Package lib :: Package maec :: Module maec11 :: Class BehaviorType
[hide private]
[frames] | no frames]

Class BehaviorType

source code

     object --+    
              |    
GeneratedsSuper --+
                  |
                 BehaviorType

BehaviorType is intended to serve as a method for the characterization of malicious behaviors found or observed in malware. Behaviors can be thought of as representing the purpose behind groups of MAEC actions, and are therefore representative of distinct portions of higher-level malware functionality. Thus, while a malware instance may perform some thousands of actions, it is likely that these actions represent only a few dozen distinct behaviors. Some examples include vulnerability exploitation, email address harvesting, and the disabling of a security service.The ordinal_position attribute is intended to reference the ordinal position of the behavior with respect to the execution of the malware.The successful attribute is used to describe whether the behavior was successful or not.The duration attribute represents the duration of the behavior. Such a value may be derived by calculating the difference between the timestamps of the first and last actions that compose the behavior.

Instance Methods [hide private]
 
__init__(self, successful=None, duration=None, ordinal_position=None, id=None, Purpose=None, Description=None, Discovery_Method=None, Actions=None, Objects=None, Effects=None, Related_Behaviors=None)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
get_Purpose(self) source code
 
set_Purpose(self, Purpose) source code
 
get_Description(self) source code
 
set_Description(self, Description) source code
 
get_Discovery_Method(self) source code
 
set_Discovery_Method(self, Discovery_Method) source code
 
get_Actions(self) source code
 
set_Actions(self, Actions) source code
 
get_Objects(self) source code
 
set_Objects(self, Objects) source code
 
get_Effects(self) source code
 
set_Effects(self, Effects) source code
 
get_Related_Behaviors(self) source code
 
set_Related_Behaviors(self, Related_Behaviors) source code
 
get_successful(self) source code
 
set_successful(self, successful) source code
 
get_duration(self) source code
 
set_duration(self, duration) source code
 
get_ordinal_position(self) source code
 
set_ordinal_position(self, ordinal_position) source code
 
get_id(self) source code
 
set_id(self, id) source code
 
export(self, outfile, level, namespace_='maec:', name_='BehaviorType', namespacedef_='') source code
 
exportAttributes(self, outfile, level, already_processed, namespace_='maec:', name_='BehaviorType') source code
 
exportChildren(self, outfile, level, namespace_='maec:', name_='BehaviorType', fromsubclass_=False) source code
 
hasContent_(self) source code
 
exportLiteral(self, outfile, level, name_='BehaviorType') source code
 
exportLiteralAttributes(self, outfile, level, already_processed, name_) source code
 
exportLiteralChildren(self, outfile, level, name_) source code
 
build(self, node) source code
 
buildAttributes(self, node, attrs, already_processed) source code
 
buildChildren(self, child_, node, nodeName_, fromsubclass_=False) source code

Inherited from GeneratedsSuper: gds_build_any, gds_format_boolean, gds_format_boolean_list, gds_format_double, gds_format_double_list, gds_format_float, gds_format_float_list, gds_format_integer, gds_format_integer_list, gds_format_string, gds_str_lower, gds_validate_boolean, gds_validate_boolean_list, gds_validate_double, gds_validate_double_list, gds_validate_float, gds_validate_float_list, gds_validate_integer, gds_validate_integer_list, gds_validate_string, get_class_obj_, get_path_, get_path_list_

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Static Methods [hide private]
 
factory(*args_, **kwargs_) source code
Class Variables [hide private]
  subclass = None
hash(x)
  superclass = None
hash(x)

Inherited from GeneratedsSuper: Tag_strip_pattern_

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, successful=None, duration=None, ordinal_position=None, id=None, Purpose=None, Description=None, Discovery_Method=None, Actions=None, Objects=None, Effects=None, Related_Behaviors=None)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__
(inherited documentation)