Subject: Re: [mile] MAEC in SCI

From: "Chase, Melissa P." <[email-masked]>
Date: Wed, 1 Feb 2012 15:22:16 +0000

I think this make sense from the MAEC perspective. MAEC behaviors are probably at the right level to express the what falls under the IODEF method (and other attributes could be abstracted to the campaign level) and MAEC bundles capture all the details of individual malware samples.

Penny Chase
MAEC Project Lead

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, January 27, 2012 12:49 PM
To: [email-masked]
Subject: [mile] MAEC in SCI

I suggest we look at including MAEC in SCI. I believe the appropriate place for most of what MAEC is intended to express falls under the IODEF Method class at the top level, but individual instances of malicious code expressed using MAEC with full details of network/file observables and such are better reserved for EventData child classes.

Would there be a way to explain how MAEC (or other malware languages) can be used in either location depending on the nature of what is being expressed? MAEC at the top level Method class would be concerned with common attributes of malware being used in a campaign, perhaps - MAEC in children of EventData would be concerned with individual malware samples captured and analyzed.

Making any sense?

 - Tom Millar, US-CERT

[email-masked]
BB: [email-masked] / 202-631-1915
24x7: [email-masked] / 888-282-0870 

_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile

---

From: "Takeshi Takahashi" <[email-masked]>
Date: Thu, 2 Feb 2012 02:10:13 +0900

Thank you for the kind comments, all.
I agree, and the latest version submitted in this morning already includes
the MAEC.
(See Section 4.1.12)

I hope it is ok now.

Kind Regards,
Take

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Chase, Melissa P.
> Sent: Thursday, February 02, 2012 12:22 AM
> To: [email-masked]; [email-masked]
> Subject: Re: [mile] MAEC in SCI
> 
> I think this make sense from the MAEC perspective. MAEC behaviors are
> probably at the right level to express the what falls under the IODEF
> method (and other attributes could be abstracted to the campaign level)
> and MAEC bundles capture all the details of individual malware samples.
> 
> Penny Chase
> MAEC Project Lead
> 
> I suggest we look at including MAEC in SCI. I believe the appropriate
> place for most of what MAEC is intended to express falls under the IODEF
> Method class at the top level, but individual instances of malicious code
> expressed using MAEC with full details of network/file observables and
> such are better reserved for EventData child classes.
> 
> Would there be a way to explain how MAEC (or other malware languages)
> can be used in either location depending on the nature of what is being
> expressed? MAEC at the top level Method class would be concerned with
> common attributes of malware being used in a campaign, perhaps - MAEC
> in children of EventData would be concerned with individual malware
> samples captured and analyzed.
> 
> Making any sense?
> 
>  - Tom Millar, US-CERT
>