Pattern sets for hyperscan performance evaluation

[ShaofengWu123]

Hi, I am testing hyperscan and comparing it with hardware regex accelerators recently. I checked the performance of hs in both here and here. However, I can not find the pattern sets, i.e. snort_pcre, snort_literals and teakettle 2500, on the internet. I tried installing snort3 and view the example rule set, but end up being confused about how snort_literals is obtained from its example rule set since it mentions nothing about the key word "literal". I wonder will these pattern sets be open-source ? Thanks.

[ShaofengWu123]

OK, after some efforts, I found the ruleset here . I found this link among all the issues and I think these ruleset and corpora should be put in a more obvious place so that people can get them with ease.

[hongyang7]

Hi, I am testing hyperscan and comparing it with hardware regex accelerators recently. I checked the performance of hs in both here and here. However, I can not find the pattern sets, i.e. snort_pcre, snort_literals and teakettle 2500, on the internet. I tried installing snort3 and view the example rule set, but end up being confused about how snort_literals is obtained from its example rule set since it mentions nothing about the key word "literal". I wonder will these pattern sets be open-source ? Thanks.

The snort_literals are literal rules extracted from common snort rules years before, which comes from the "content" field of snort rule. This field is for multi-string matching in Snort.

[hongyang7]

OK, after some efforts, I found the ruleset here . I found this link among all the issues and I think these ruleset and corpora should be put in a more obvious place so that people can get them with ease.

Yes it's under our consideration, and perhaps with more rulesets to expose.