Consider Malware Family Object

[ikiril01]

Right now we have the Malware_Subject, which is really a characterization of a malware instance. Perhaps we should consider adding a Malware_Family Object, which can serve as a meta class that can reference the Malware_Subjects that are part of a malware family?

[ikiril01]

Notionally, the structure could be something like:

• Malware Family
  • Names
  • Malware Subjects
  • Common Actions
  • Common Behaviors
  • Common Capabilities
  • etc.

[ikiril01]

A few open questions:

• How should Malware Instances/Subjects be associated with a Malware Family object?
  • Referenced directly from the Malware Family?
  • Using a top-level Relationship object?
• How should common Actions/Behaviors/etc. be captured?
  • What if certain Actions/etc. are common to a subset of a malware family, but not the entire family?

[dzbeck]

• In MalwareFamilyType, should the field capture Malware Subjects (maecPackage:MalwareSubjectReferenceType) or Objects (maecCore:ObjectReferenceType)?
  • For now, we’ve chosen Malware Subjects.
  • There may be some objects, which are not malware subjects, which we would want to associate with a particular malware family.
• So that there is only one way to associate Malware Subjects with a Malware Family, we have NOT defined a Malware_Family field in MalwareSubjectType.
  • This prevents defining relationships in two directions, which we’re trying to get away from in 5.0.
  • With Relationships being pairwise, it would be cumbersome to link multiple Malware Subjects (or Objects) to a Malware Family because multiple Relationships would need to be defined (i.e., capturing through the Malware Family is more efficient).
  • We could remove the Malware_Subject field from MalwareFamilyType and associate malware subjects (and/or objects) and malware families using a Collection.
  • We shouldn’t use both the Malware Subject field in MalwareFamilyType and Collections (there shouldn't be two ways to specify family members).
  • If we don’t use Collections, we should remove “same malware family” from maecPackage:CollectionAssociateTypeEnum.