--- title: "YARA-X just got faster" url: https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr source_url: https://virustotal.github.io/yara-x/blog/yara-x-just-got-faster type: article source: "YARA-X" published: 2026-08-23T12:23:27.934Z updated: 2026-08-23T12:56:09.421Z tags: ["security", "performance", "rust"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # YARA-X just got faster **[YARA-X](https://daily.dev/sources/yara-x)** · 4 min read · 0 upvotes · 0 comments ## Summary YARA-X, the Rust reimplementation of the YARA malware scanning engine, has received two major performance optimizations. First, it switched its Aho-Corasick pattern matching implementation from the aho_corasick crate to daachorse, achieving a 2.20x speedup over the previous implementation and making YARA-X faster than legacy YARA in almost all cases (available since YARA-X v1.16.0). Second, an upcoming compiler optimization (v1.17.0) groups multiple regex checks against the same field into a single RegexSet, cutting VirusTotal Livehunt's 99th percentile scan time for domain-related rules from over 6 seconds to under 3 seconds, while also halving CPU costs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did YARA-X switch from the aho_corasick crate to daachorse? YARA-X switched to daachorse for faster Aho-Corasick pattern matching because its byte-by-byte NFA traversal requires fewer memory indirections and its double-array automaton layout is more cache-efficient, reducing CPU cache misses on large files. Benchmarks on 500 VirusTotal files (~24GB) showed daachorse scanning in 26.152s versus 57.584s with aho_corasick, a 2.20x speedup, available starting in YARA-X v1.16.0. _daily.dev helps security engineers track scanning engine upgrades like this before rolling them into production._ ### How does grouping regex patterns into a RegexSet speed up YARA rule evaluation? Grouping identical match targets in an or condition into a single RegexSet lets the scanning engine make one pass over the target string instead of one pass per regex pattern. This shifts complexity from scaling linearly with pattern count to a single efficient scan, and this optimization ships in YARA-X v1.17.0, reducing redundant re-initialization and full-string rescans for rules with dozens or hundreds of matches checks. _Engineers optimizing complex rule sets can follow performance changes like this via daily.dev._ ### What performance impact did YARA-X's RegexSet optimization have on VirusTotal Livehunt? After deploying the RegexSet optimization to VirusTotal Livehunt, the 99th percentile execution time for domain-related rules dropped from over 6 seconds to under 3 seconds, and CPU costs for that workload were also cut in half. This came from grouping multiple regex checks against the same field into a single unified scan pass rather than evaluating each expression sequentially. _daily.dev keeps malware analysts current on scanning engine performance gains that affect production workloads._ --- Tags: [#security](https://daily.dev/tags/security), [#performance](https://daily.dev/tags/performance), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/yara-x-just-got-faster-88jjhmfvr)