Skipfish uses fast_pattern to run multiple rules instead of a single regular expression. Using fast pattern matcher the rule for the default User-Agent string has an average/Check of 92.5 microseconds. This rule had an average of 2.3 microseconds; none of the other three rules written this way were over 3.5microseconds. The VRT is constantly monitoring for new tools being used in the field, we happily accept tool submissions from the field for creating new Snort rules.”]
Source: https://blog.talosintelligence.com/2012/07/fastpattern-is-fast.html