Performance and accuracy: filter out functions
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
Goal: filter out more functions that slow down performance and often only provide FP matches.
Main concern: this could prevent some matches
Initial ideas:
- lightweight library ID, functions with
- many basic blocks
- surrounding functions are library code
- no/few api calls?
- only calls to/from library code (see #989)
- trim functions with too many basic blocks in general
Anecdotally, huge/complex functions are library code or obfuscated and make analysis slow.
Can we heuristically identify them and don't even extract their features, except maybe a new characteristic (complex/un-analyzed function) or just a warning in the results.
Example: https://github.com/mandiant/capa-rules/issues/435 (non public sample) and it would be good to collect more test samples on this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the function-extraction behavior described here, the related discussion in #989, and the non-public example referenced from capa-rules #435. Collect additional test samples and evaluate candidate heuristics for complex or library functions, with completion defined by documented trade-offs between performance and missed matches.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- performance, reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100