BehaviorType is intended to serve as a method for the characterization
of malicious behaviors found or observed in malware. Behaviors can be
thought of as representing the purpose behind groups of MAEC actions, and
are therefore representative of distinct portions of higher-level malware
functionality. Thus, while a malware instance may perform some thousands
of actions, it is likely that these actions represent only a few dozen
distinct behaviors. Some examples include vulnerability exploitation,
email address harvesting, and the disabling of a security service.The
ordinal_position attribute is intended to reference the ordinal position
of the behavior with respect to the execution of the malware.The
successful attribute is used to describe whether the behavior was
successful or not.The duration attribute represents the duration of the
behavior. Such a value may be derived by calculating the difference
between the timestamps of the first and last actions that compose the
behavior.
|
__init__(self,
successful=None,
duration=None,
ordinal_position=None,
id=None,
Purpose=None,
Description=None,
Discovery_Method=None,
Actions=None,
Objects=None,
Effects=None,
Related_Behaviors=None)
x.__init__(...) initializes x; see help(type(x)) for signature |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
set_Discovery_Method(self,
Discovery_Method) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
set_Related_Behaviors(self,
Related_Behaviors) |
source code
|
|
|
|
|
|
|
|
|
|
|
|
|
set_ordinal_position(self,
ordinal_position) |
source code
|
|
|
|
|
|
|
export(self,
outfile,
level,
namespace_=' maec: ' ,
name_=' BehaviorType ' ,
namespacedef_='
' ) |
source code
|
|
|
exportAttributes(self,
outfile,
level,
already_processed,
namespace_=' maec: ' ,
name_=' BehaviorType ' ) |
source code
|
|
|
exportChildren(self,
outfile,
level,
namespace_=' maec: ' ,
name_=' BehaviorType ' ,
fromsubclass_=False) |
source code
|
|
|
|
|
exportLiteral(self,
outfile,
level,
name_=' BehaviorType ' ) |
source code
|
|
|
exportLiteralAttributes(self,
outfile,
level,
already_processed,
name_) |
source code
|
|
|
exportLiteralChildren(self,
outfile,
level,
name_) |
source code
|
|
|
|
|
buildAttributes(self,
node,
attrs,
already_processed) |
source code
|
|
|
buildChildren(self,
child_,
node,
nodeName_,
fromsubclass_=False) |
source code
|
|
Inherited from GeneratedsSuper :
gds_build_any ,
gds_format_boolean ,
gds_format_boolean_list ,
gds_format_double ,
gds_format_double_list ,
gds_format_float ,
gds_format_float_list ,
gds_format_integer ,
gds_format_integer_list ,
gds_format_string ,
gds_str_lower ,
gds_validate_boolean ,
gds_validate_boolean_list ,
gds_validate_double ,
gds_validate_double_list ,
gds_validate_float ,
gds_validate_float_list ,
gds_validate_integer ,
gds_validate_integer_list ,
gds_validate_string ,
get_class_obj_ ,
get_path_ ,
get_path_list_
Inherited from object :
__delattr__ ,
__format__ ,
__getattribute__ ,
__hash__ ,
__new__ ,
__reduce__ ,
__reduce_ex__ ,
__repr__ ,
__setattr__ ,
__sizeof__ ,
__str__ ,
__subclasshook__
|