Reading on YARA Performance

It is difficult to benchmark or optimize “performance” of single YARA rules or rulesets in a scientific way because the application of YARA in different technology systems varies so widely. As you compose rules you should heed the compiler errors as signs that your rule is not optimized for performance.


There are some general guidelines, tips and tricks for composing rules that will work well in YARA applications. Check out some of the reading below for ideas on how to think about and test rule performance.


On YARA Performance Guidelines and Testing


These Github pages and projects includes a number of best practices and explanations how rules work. This is initially authored by Florian Roth but was reviewed and fact checked by several YARA developers (including its creator!)
- https://github.com/Neo23x0/YARA-Performance-Guidelines
- https://github.com/Neo23x0/panopticon


On YARA Rule Optimization


These blogs demonstrate some matching experimentation, pitfalls and adjustments made to optimize performance.
- https://inquest.net/blog/2018/09/30/stringless-yara-rules
- https://inquest.net/blog/2018/12/19/short-circuiting-boolean-operators-yara
