Skip to content

Use YARA for batched word matching#903

Open
liquidsec wants to merge 2 commits into
devfrom
yara-word-matcher
Open

Use YARA for batched word matching#903
liquidsec wants to merge 2 commits into
devfrom
yara-word-matcher

Conversation

@liquidsec

@liquidsec liquidsec commented Jun 18, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Adds baddns/lib/yara_helper.py — standalone YARA helper for compiling and matching rules
  • Adds WordMatcher class to matcher.py that compiles all 98 word matchers across signatures into a single YARA ruleset at load time
  • One YARA match() call per HTTP response replaces 98 separate word in text substring scans
  • Matcher.is_match() accepts pre-computed YARA results via word_results/sig_idx params, falls back to original behavior when not provided (backward compatible)
  • BadDNS_base accepts optional word_matcher kwarg; CLI builds it once after load_signatures()
  • Adds yara-python>=4.5.0 dependency
  • Corresponding bbot-side change (build WordMatcher in setup(), pass to modules) will be in a separate bbot PR

Benchmarked at ~1.7x end-to-end speedup.

@liquidsec
liquidsec force-pushed the yara-word-matcher branch from dc24a91 to 1ce1c99 Compare June 18, 2026 14:40
@codecov-commenter

codecov-commenter commented Jun 18, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 77.06422% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.75%. Comparing base (2a62b5d) to head (221a71a).

Files with missing lines Patch % Lines
baddns/lib/yara_helper.py 23.07% 20 Missing ⚠️
baddns/lib/matcher.py 92.30% 5 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##              dev     #903      +/-   ##
==========================================
- Coverage   99.94%   98.75%   -1.20%     
==========================================
  Files          27       28       +1     
  Lines        1977     2082     +105     
==========================================
+ Hits         1976     2056      +80     
- Misses          1       26      +25     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants