Reduced memory usage of DetectInfo/EvtxRecordInfo

[fukusuket]

What Changed

• ref: Reduce usage of clone() #787
• removed following two fields to reduce memory usage.
  • EvtxRecordInfo.record_information
  • DetectInfo.record_information
• Along with the two fields deletion, changed to refer to serde_json::Value when the value is needed.

Evidence

I got the benchmark with this environment and procedure.

-P standard

Reduced memory usage about 0.3GiB(heap stats: peak/reserved)
e873adf (mainブランチ)

Elapsed time: 00:13:05.192
Saved file: 1.csv (574.8 MB)

Memory usage stats:
heap stats:    peak      total      freed    current       unit      count
  reserved:    5.6 GiB    5.6 GiB   56.0 MiB    5.5 GiB                        not all freed!
 committed:    4.9 GiB    6.6 GiB    1.8 GiB    4.8 GiB                        not all freed!

8591a97 (修正後)

Elapsed time: 00:12:43.371
Saved file: 1.csv (574.8 MB)

Memory usage stats:
heap stats:    peak      total      freed    current       unit      count
  reserved:    5.3 GiB    5.3 GiB   56.0 MiB    5.2 GiB                        not all freed!
 committed:    4.6 GiB    5.9 GiB    1.4 GiB    4.5 GiB                        not all freed!

-P super-verbose

Reduced memory usage about 0.2GiB (heap stats: peak/reserved)
e873adf (mainブランチ)

Elapsed time: 00:13:18.908
Saved file: 1.csv (2.2 GB)

Memory usage stats:
heap stats:    peak      total      freed    current       unit      count
  reserved:    9.1 GiB    9.1 GiB   56.0 MiB    9.0 GiB                        not all freed!
 committed:    8.4 GiB   11.2 GiB    2.9 GiB    8.3 GiB                        not all freed!

8591a97 (修正後)

Elapsed time: 00:13:07.431
Saved file: 1.csv (2.2 GB)

Memory usage stats:
heap stats:    peak      total      freed    current       unit      count
  reserved:    8.9 GiB    8.9 GiB   56.0 MiB    8.8 GiB                        not all freed!
 committed:    8.2 GiB   11.0 GiB    2.8 GiB    8.2 GiB                        not all freed!

Test

About the above command execution(-P standard/-P super-verbose) results, I have confirmed following points.

• Same number of detections before and after fix. (ref: results.zip)
• There is no diffs in the output.csv(after sorted)

I would appreciate it if you could review🙏

[hitenkoku]

LGTM

[YamatoSecurity]

LGTM. ありがとうございました！