YARA Rule Coverage Calculator
Assess YARA coverage across malware families and check whether your scan throughput can keep up with daily file volume.
About YARA Rule Coverage Calculator
Family coverage counts families, not rules, because ten rules for one family is depth rather than breadth. Throughput is the constraint that decides whether the rule set is deployable at all: YARA cost scales with rule count and condition complexity, so a large unoptimised set can easily fail to finish a day's files in a day. YARA is the workhorse for hunting in file collections and memory, but an untested rule set produces false positives on legitimate software, and a set too slow to complete a daily pass silently stops covering the newest files.
Formulas
YARA Rule Coverage
Family coverage = families with at least one rule ÷ families in scope. Scan time = files × average size ÷ (throughput per core × cores).
- families in scope
- Malware families credible for your sector and platforms
- throughput
- MB/s per core, 20–60 for a large rule set
- cores
- Cores dedicated to scanning
Noise from signatures
False positives per day = files scanned ÷ 100,000 × false positives per 100,000 files.
- FP per 100k
- Measured false-positive density of the rule set
Worked example
With the default values below, YARA Rule Coverage Calculator returns Malware Family Coverage of 65.0%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Malware families relevant to your threat modelaccepts 1–10,000 families
- 120 families
- Families with at least one YARA ruleaccepts 0–10,000 families
- 78 families
- YARA rules in the deployed setaccepts 1–100,000 rules
- 340 rules
- Rules tested against known samplesaccepts 0–100,000 rules
- 210 rules
- Files scanned per dayaccepts 0–1,000,000,000 files/day
- 250,000 files/day
- Average file sizeaccepts 0.01–5,000 MB
- 1.2 MB
- Scan throughput per coreaccepts 1–5,000 MB/s
- 45 MB/s
- Cores dedicated to scanningaccepts 1–1,024 cores
- 8 cores
- False positives per 100,000 filesaccepts 0–10,000 FP/100k
- 3 FP/100k
Results
- Malware Family Coverage
- 65.0%
- Rules Validated Against Samples
- 61.8%
- Rules per Covered Family
- 4.36 rules
- Scan Time Required per Day
- 0.23 hours
- Data Scanned per Day
- 0.300 TB
- False Positives per Day
- 7.5 alerts/day
- Throughput Verdict
- Comfortable — capacity available for retro-hunts across the archive
Step by step
- 1Values used
- 2YARA Rule Coverage
- 3Noise from signatures
- 4Malware Family Coverage= 65.0
- 5Rules Validated Against Samples= 61.8
- 6Rules per Covered Family= 4.36 rules
- 7Scan Time Required per Day= 0.23 hours
- 8Data Scanned per Day= 0.300 TB
- 9False Positives per Day= 7.5 alerts/day
Assumptions and limits
- The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is YARA Rule Coverage calculated?
Family coverage = families with at least one rule ÷ families in scope. Scan time = files × average size ÷ (throughput per core × cores). Family coverage counts families, not rules, because ten rules for one family is depth rather than breadth. Throughput is the constraint that decides whether the rule set is deployable at all: YARA cost scales with rule count and condition complexity, so a large unoptimised set can easily fail to finish a day's files in a day.
Why does YARA Rule Coverage matter?
YARA is the workhorse for hunting in file collections and memory, but an untested rule set produces false positives on legitimate software, and a set too slow to complete a daily pass silently stops covering the newest files.
What values do I need to enter?
This calculator takes 9 inputs: Malware families relevant to your threat model, Families with at least one YARA rule, YARA rules in the deployed set, Rules tested against known samples, Files scanned per day, Average file size, Scan throughput per core, Cores dedicated to scanning, False positives per 100,000 files. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I make a large rule set faster?
Anchor rules with cheap conditions first — file magic, size ranges, a rare string — so expensive regular expressions only run on candidates. Ordering conditions cheapest-first routinely buys an order of magnitude.
Should I deploy every public rule I can find?
No. Public rule sets carry unmaintained rules with generic strings that fire on packers, installers and legitimate developer tooling. Test each rule against a clean corpus before it reaches production, and measure the false-positive density you are accepting.