Subject: [mile] cybox+ maec and IEEE MMDEF WG - paris wg meeting follow

From: "Baker, Jon" <[email-masked]>
Date: Tue, 3 Apr 2012 16:41:34 +0000

At the Paris WG meeting I was asked about any plans for CybOX and MAEC and the IEEE. During the meeting I was able to give a short description of the activities with the Malware Metadata Exchange Format Working Group (MMDEF) and committed to providing a bit more information about the activity as a follow up on this list.  More information about this group is available here: http://standards.ieee.org/develop/indconn/icsg/mmdef.html

I talked Penny Chase, who leads the MAEC effort about their involvement with the MMDEF WG. Here is what she had to say:

--------------------------------------
When we started to develop MAEC in 2010 we became aware of the first version of the IEEE Industry Connections Security Group (ICSG) Malware Metadata Exchange Format schema. The IEEE ICSG working group that developed schema consisted of several anti-virus vendor and their goal was to share a minimal amount of malware metadata when exchanging samples. MAEC 1.0 (released in June 2010) imported elements of the MMDEF schema.

Over a year ago we were approached by the IEEE ICSG. After working on some other projects, they decided that they wanted to expand MMDEF schema to characterize malware behavior. At that time the resources who had worked on the schema were no longer available. In addition and having looked at MAEC, which focused on characterizing results from dynamic analysis, they thought that it made sense to integrate MAEC into the new IEEE ICSG schema. IEEE ICSG launched a new working group to developed MMDEF v 2.0, with Ivan Kirillov, MAEC's lead architect, as co-chair. 

Before agreeing to participate, we had discussions about the relationship between MAEC and the MMDEF schema. We were assured that IEEE ICSG was willing to have MAEC as an independent schema that the MMDEF schema could refer to. The MMDEF working group's goal  is to import selected portions of MAEC/CybOX into the IEEE ICSG MMDEF v 2.0 schema.

It is not clear if MMDEF v 2.0 will become an IEEE standard. MMDEF v 1.0 is available for people to use, but isn't an official IEEE standard (ICSG products do not necessarily become IEEE standards). Some people in the working group have brought it up, but it hasn't been discussed in-depth.
--------------------------------------

I hope this additional information about MAEC and the IEEE MMDEF WG addresses your questions. Let me know if there is anything else I can help with.

Regards,

Jon

============================================
Jonathan O. Baker
G022 - IA Industry Collaboration
The MITRE Corporation
Email: [email-masked]

---

From: <[email-masked]>
Date: Thu, 5 Apr 2012 10:50:16 -0400

Thank you for the update, Jon!

I have a few follow up questions to help determine the path forward and options for MILE.  From the message below, you may not have the answers yet, so if you can keep MILE posted as this evolves, it would be appreciated!

Will the work stay in IEEE?  If so, is there a chance that a normative reference will be possible?  
MAEC impacts the SCI draft and possibly the forensics draft as a (possible) referenced specification.  It sounds like the only reference that may emerge from the WG is for MMDEF and that is not certain.  Is that correct?

Since part of CybOX is included in your IEEE effort, can you explain what that means for any possible standardization efforts around CybOX?  Will CybOX show up in multiple standards efforts or just the IEEE (where it may not become a normative reference and it appears to be part of MMDEF)?  Is there a chance it would be proposed to MILE for the integration possibilities with IODEF?

I just to make sure we are clear on options, it sounds like we won't have a normative reference through the IEEE effort, is that right?  Does this just apply to MAEC or are other specifications as well (CybOX, CAPEC, etc.)?  As mentioned at the MILE meeting, it sounds like we need to move forward on the forensics document to cover the MILE charter item and WG needs.  If a standard that can be referenced emerges we can consider it later, but need to work towards meeting the charter items until that happens.  

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Baker, Jon
Sent: Tuesday, April 03, 2012 12:42 PM
To: [email-masked]
Subject: [mile] cybox+ maec and IEEE MMDEF WG - paris wg meeting follow

Regards,

Jon

_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile