rsigma-parser 0.7.0

Parser for Sigma detection rules, correlations, and filters
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

//! Parser benchmarks for rsigma-parser.
//!
//! Measures parsing throughput at various rule counts and condition complexity.

mod datagen;

use criterion::{BenchmarkId, Criterion, black_box, criterion_group, criterion_main};
use rsigma_parser::parse_sigma_yaml;

// ---------------------------------------------------------------------------
// Benchmark: parse single rule
// ---------------------------------------------------------------------------

fn bench_parse_single_rule(c: &mut Criterion) {
    let yaml = datagen::gen_n_rules(1);

    c.bench_function("parse_single_rule", |b| {
        b.iter(|| {
            let result = parse_sigma_yaml(black_box(&yaml)).unwrap();
            black_box(result);
        });
    });
}

// ---------------------------------------------------------------------------
// Benchmark: parse N rules (scaling)
// ---------------------------------------------------------------------------

fn bench_parse_scaling(c: &mut Criterion) {
    let mut group = c.benchmark_group("parse_rules");

    for n in [10, 100, 500, 1000] {
        let yaml = datagen::gen_n_rules(n);
        let yaml_len = yaml.len();

        group.bench_with_input(BenchmarkId::new("count", n), &yaml, |b, yaml| {
            b.iter(|| {
                let result = parse_sigma_yaml(black_box(yaml)).unwrap();
                black_box(result);
            });
        });

        // Also report throughput in bytes
        group.throughput(criterion::Throughput::Bytes(yaml_len as u64));
    }

    group.finish();
}

// ---------------------------------------------------------------------------
// Benchmark: parse complex condition expression
// ---------------------------------------------------------------------------

fn bench_parse_complex_condition(c: &mut Criterion) {
    let yaml = datagen::gen_complex_condition_rule();

    c.bench_function("parse_complex_condition", |b| {
        b.iter(|| {
            let result = parse_sigma_yaml(black_box(&yaml)).unwrap();
            black_box(result);
        });
    });
}

// ---------------------------------------------------------------------------
// Benchmark: parse wildcard-heavy rules
// ---------------------------------------------------------------------------

fn bench_parse_wildcard_rules(c: &mut Criterion) {
    let mut group = c.benchmark_group("parse_wildcard_rules");

    for n in [100, 500, 1000] {
        let yaml = datagen::gen_n_wildcard_rules(n);

        group.bench_with_input(BenchmarkId::new("count", n), &yaml, |b, yaml| {
            b.iter(|| {
                let result = parse_sigma_yaml(black_box(yaml)).unwrap();
                black_box(result);
            });
        });
    }

    group.finish();
}

// ---------------------------------------------------------------------------
// Benchmark: parse regex-heavy rules
// ---------------------------------------------------------------------------

fn bench_parse_regex_rules(c: &mut Criterion) {
    let mut group = c.benchmark_group("parse_regex_rules");

    for n in [100, 500, 1000] {
        let yaml = datagen::gen_n_regex_rules(n);

        group.bench_with_input(BenchmarkId::new("count", n), &yaml, |b, yaml| {
            b.iter(|| {
                let result = parse_sigma_yaml(black_box(yaml)).unwrap();
                black_box(result);
            });
        });
    }

    group.finish();
}

// ---------------------------------------------------------------------------
// Criterion harness
// ---------------------------------------------------------------------------

criterion_group!(
    benches,
    bench_parse_single_rule,
    bench_parse_scaling,
    bench_parse_complex_condition,
    bench_parse_wildcard_rules,
    bench_parse_regex_rules,
);
criterion_main!(benches);