Faster Scanning with Vectorscan

The malware scan currently has 2 separate scan signature engines, libpcre and Vectorscan. While both of these scan engines are highly performant, Vectorscan is software designed to address the specific use-case we have with malware scanning, where we need to run a large number of regular expressions against a stream of data.

Benchmarks for Performance Increase using Vectorscan

Benchmarking has indicated that Vectorscan can be more than 30 times as fast as the exact same scan on the exact same hardware using PCRE.

(The above benchmarks were conducted using a free Wordfence CLI license)

Configuring CLI to use Vectorscan

By default, CLI will use libprce for scanning. To configure CLI to use Vectorscan, you can use the following command-line argument:

wordfence malware-scan --match-engine=vectorscan

This can also be set in the INI file:

[MALWARE_SCAN]
match_engine=vectorscan

Installing Vectorscan/Hyperscan

On Debian-based distros, Vectorscan can be installed with apt:

$ sudo apt install libvectorscan5

Vectorscan is a fork of Hyperscan and maintains a compatible API, so installing Hyperscan on Intel-based systems will work as well.

$ sudo apt install libhyperscan5

We do currently support both technologies, but this may change over time if Vectorscan's API diverges from Hyperscan's. We will officially support Vectorscan going forward.

Additional installation instructions can be found in the Vectorscan Wiki.

Downloading/Compiling Vectorscan signatures

When running a supported version of vectorscan on a supported platform, a pre-compiled Vectorscan signature database will be downloaded from the Wordfence servers automatically. This is currently rate limited to 1 request every 12 hours. Ensure that caching is enabled to avoid hitting this rate limit (the database is cached for 24 hours by default).

Alternatively, you may use the --compile-local option to pull the standard signatures from the Wordfence API and compile them to a platform-specific Vectorscan database locally. This will avoid the above rate limit but will take a significant amount of time during the scan.

Known issues

Segfaults on Ubuntu versions 22.04 and 24.04

The Vectorscan package provided by Ubuntu versions 22.04 and 24.04 will produce segfaults when performing malware scanning against certain files on some ARM systems. We've identified that this is an issue specifically with the packaged version. Compiling Vectorscan from scratch does not produce the same segfaults. We've created a ticket on LaunchPad for this issue.

Negligible Performance Improvement over NFS

CLI will oftentimes have to scan large filesystems of relatively small files. NFS is not setup particularly well to serve many small files. Vectorscan can scan these small files fast enough where there can be not much of discernible difference between using libprce and Vectorscan since the scanning processes are largely I/O bound while waiting on NFS to provide the file contents.

We've observed in our own benchmarks that there is not a significant performance increase using Vectorscan over libpcre for filesystems over NFS shares.