Open ikiril01 opened 8 years ago
More concretely, this change would involve the following:
BaseObjectPropertyType
in CybOX Common to remove patterning and to serve as an abstract datatype that captures metadata about defanging/observed encoding/randomness (as defined in the existing BaseObjectPropertyGroup):
appears_random
(boolean): whether the property appears random in natureis_obfuscated
(boolean): whether the property has been obfuscatedobfuscation_algorithm_ref
(string): a reference to a description of the algorithm used to obfuscate the object propertyis_defanged
(boolean): whether the property has been defangeddefanging_algorithm_ref
(string): a reference to a description of the algorithm used to defang the object propertyrefanging_transform_type
(string): the type of refanging transform specified in the refanging_transform propertyrefanging_transform
(string): an automated transform that can be applied to the object property in order to refang it to its original formatobserved_encoding
(string): the encoding of the string as observedBaseObjectPropertyType
, for the capture of datatype-specific values:
BaseObjectPropertyType
with a value
field of type string
BaseObjectPropertyType
with a value
field of type number
BaseStringObjectPropertyType
or BaseNumberObjectPropertyType
Accordingly, this would result in instance content that looks like the following (a file in this example):
{
"size": {"value": 23134},
"file-system-properties" : {"file_name": {"value":"test.dll",
"observed_encoding":"utf-8"}}
}
Given that we'll likely be splitting out patterning and instances in Observables, we'll need to significantly refactor (or even deprecate) the existing DataTypes in CybOX Common, such as the
StringObjectPropertyType
. The biggest issue is that these types are oriented around patterning, which we'll no longer need to support in instances; this will also require making the corresponding changes to the CybOX Objects that use these types.