That's depend on the implementation of both Aho-Corasick and the regexp engine. It's true that Aho-Corasick is designed to search for multiple patterns at once, so the more patterns you are looking for, the faster it will be when compared with a solution based in searching one pattern at a time, either with a regexp, or a simple call to strstr. However, it doesn't means that searching for a single pattern is going to be faster if you use a regexp, that depends on the specific implementation of the regexp engine and the regexp you are searching for.
But regarding your question, yes, YARA uses Aho Corasick regardless of the number of patterns you are looking for. On Mon, Jul 29, 2019 at 4:21 AM Andrew <[email protected]> wrote: > In full-text search, Aho Coarsick is fast when we use more than hundreds > of keywords, but as I am aware, Aho Coarsick seems to be slower than Regex > when there are one or two keywords. > ( > https://www.freecodecamp.org/news/regex-was-taking-5-days-flashtext-does-it-in-15-minutes-55f04411025f/ > ) > > Does Yara always use Aho Coarsick regardless of the number of keywords? > > > > > > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/yara-project/92ee6c7c-646e-4b02-b2d1-23825d3e573a%40googlegroups.com > <https://groups.google.com/d/msgid/yara-project/92ee6c7c-646e-4b02-b2d1-23825d3e573a%40googlegroups.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/yara-project/CAD7Y4L4g3u4EcRvUMLpH75FKd5rv9igRPLBS1M1F%2BUZfQQswkw%40mail.gmail.com.
