stoq-plugins-public
stoq-plugins-public copied to clipboard
Less blocking for basic functions
For large files, the entropy, hashing , and base64 decoding would block. By adding an asyncio sleep after every 16MB, this blocking should be reduced.
Thanks, @malvidin. Do you have any stats on the performance improvements for these changes? Theoretically I can see them being more performant, but I'd much rather know for sure before adding additional complexity.
They are not more performant when compared directly to the non-blocking version when nothing else is running. I will try to get some tests done against multiple samples, instead of just testing the single functions.
I have been trying to get a single stoq run
command to use all the cores, but so far I have not been successful.
Base64 Changes
- Non-blocking
- Takes twice as long (1.6 vs 0.7 seconds for 10 rounds in timeit)
- Removes non-alphabet characters
- Handles padding issues
- The use of re.sub to clean the input appears to be the primary cause of slower response
Entropy Changes
- Non-blocking
- Not much difference (8.30 vs. 8.04 seconds for 5 rounds in timeit)
Hash Changes
- Non-blocking
- Not much difference (2.05 vs. 1.94 seconds for 10 rounds in timeit)
- Easier to add/remove hash functions
- Potential to use options to specify which hashes to return
ssdeep Changes
- Non-blocking
- Significantly slower (4.63 vs. 3.15 seconds for 10 rounds in timeit)
- Mirrors the hash plugin
We have not forgotten about this pull request. Our apologies for the delay, but we are reviewing this as time permits.
Close/reopen to force rebuild