YARA Rule Coverage Calculator
Assess YARA coverage across malware families and check whether your scan throughput can keep up with daily file volume.
Inputs
A large rule set with many regex conditions typically runs 20–60 MB/s per core.
Malware Family Coverage
65.0%
Rules Validated Against Samples
61.8%
Rules per Covered Family
4.36rules
Scan Time Required per Day
0.23hours
Data Scanned per Day
0.300TB
False Positives per Day
7.5alerts/day
Throughput Verdict
Comfortable — capacity available for retro-hunts across the archive
Step by step
Values used
Malware families relevant to your threat model = 120 families; Families with at least one YARA rule = 78 families; YARA rules in the deployed set = 340 rules; Rules tested against known samples = 210 rules; Files scanned per day = 250,000 files/day; Average file size = 1.20 MB; Scan throughput per core = 45 MB/s; Cores dedicated to scanning = 8 cores; False positives per 100,000 files = 3 FP/100k
YARA Rule Coverage
Family coverage = families with at least one rule ÷ families in scope. Scan time = files × average size ÷ (throughput per core × cores).
Noise from signatures
False positives per day = files scanned ÷ 100,000 × false positives per 100,000 files.
Malware Family Coverage
= 65.0
Rules Validated Against Samples
= 61.8
Rules per Covered Family
= 4.36 rules
Scan Time Required per Day
= 0.23 hours
Data Scanned per Day
= 0.300 TB
False Positives per Day
= 7.5 alerts/day
How it works
Family coverage counts families, not rules, because ten rules for one family is depth rather than breadth. Throughput is the constraint that decides whether the rule set is deployable at all: YARA cost scales with rule count and condition complexity, so a large unoptimised set can easily fail to finish a day's files in a day. YARA is the workhorse for hunting in file collections and memory, but an untested rule set produces false positives on legitimate software, and a set too slow to complete a daily pass silently stops covering the newest files.
Formulas
YARA Rule Coverage
Family coverage = families with at least one rule ÷ families in scope. Scan time = files × average size ÷ (throughput per core × cores).
- families in scope
- Malware families credible for your sector and platforms
- throughput
- MB/s per core, 20–60 for a large rule set
- cores
- Cores dedicated to scanning
Noise from signatures
False positives per day = files scanned ÷ 100,000 × false positives per 100,000 files.
- FP per 100k
- Measured false-positive density of the rule set
Frequently Asked Questions
How is YARA Rule Coverage calculated?
Family coverage = families with at least one rule ÷ families in scope. Scan time = files × average size ÷ (throughput per core × cores). Family coverage counts families, not rules, because ten rules for one family is depth rather than breadth. Throughput is the constraint that decides whether the rule set is deployable at all: YARA cost scales with rule count and condition complexity, so a large unoptimised set can easily fail to finish a day's files in a day.
Why does YARA Rule Coverage matter?
YARA is the workhorse for hunting in file collections and memory, but an untested rule set produces false positives on legitimate software, and a set too slow to complete a daily pass silently stops covering the newest files.
What values do I need to enter?
This calculator takes 9 inputs: Malware families relevant to your threat model, Families with at least one YARA rule, YARA rules in the deployed set, Rules tested against known samples, Files scanned per day, Average file size, Scan throughput per core, Cores dedicated to scanning, False positives per 100,000 files. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I make a large rule set faster?
Anchor rules with cheap conditions first — file magic, size ranges, a rare string — so expensive regular expressions only run on candidates. Ordering conditions cheapest-first routinely buys an order of magnitude.
Should I deploy every public rule I can find?
No. Public rule sets carry unmaintained rules with generic strings that fire on packers, installers and legitimate developer tooling. Test each rule against a clean corpus before it reaches production, and measure the false-positive density you are accepting.