-
Notifications
You must be signed in to change notification settings - Fork 566
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
perf: short circuit logic nodes when appropriate #827
Conversation
fixes circular import error in capa.features.freeze
fixes circular import error in capa.features.freeze
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased)
section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed
CHANGELOG updated or no update needed, thanks! 😄
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
closes #824
review and merge #828 first
Adds logic to
and
,or
, andsome
statements andsubstring
andregex
features to detect when the nodes are minimally satisfied (or not) and to complete evaluation early. For example, if one child of anand
statement fails, then theand
statement will never be satisfied, and the remaining children don't actually have to be evaluated.However, in some cases "thorough" evaluation may still be desirable, such as with
or
statements that have multiple children that may be satisfied. In a verbose output mode, users may want to see all the evidence related to a rule match, not just the minimal set of evidence.Therefore, this PR includes logic to invoke the (fast) short circuiting mode first, and only if there's a match (uncommon), go back and collect the thorough results for display.
(via: PMA01-01, 30 iterations)
In the above table, we see that the PR here matches about 30% faster in this test case. When always short circuiting (at the expense of non-thorough results) then we can go a bit faster.
As expected, there are more node evaluations in the "hybrid" mode, as the engine goes back and collects thorough results once a match has been found.
Checklist