CTI CybOX SC Meeting November 19, 2015

Agenda Recent discussions recap Maturity spectrum/cti-stats discussion CybOX 3.0 roadmap update File object refactoring OASIS work product status & discussion

Recent Discussions Address object refactoring Splitting up the existing Address object into more “atomic” entities HashType refactoring Making it easier to capture common (e.g., MD5) hash values Observable revocation

Maturity Spectrum Three-tiered model for capturing the relative maturity of CybOX components Semantic consensus Semantic completeness Existing use Informed by cti-stats Used to inform our CybOX 3.0+ decisions What should we focus on refactoring and improving now? What should we leave for later versions?

cti-stats I Up-to-date statistics around usage of STIX and CybOX components STIX entities CybOX objects STIX ObjectsCountsPercentages Campaign % Course of Action100.00% Exploit Target180.00% Incident30.00% Indicator % Report00.00% TTP % Threat Actor %

cti-stats II CybOX ObjectsCountsPercentages Address % Artifact480.01% DomainName % Message % File % Hostname130.00% HTTPSession % Link % Memory400.01% Mutex % NetworkConnection300.00% PDFFile60.00% Port % URI % Whois % WinExecutableFile % WinRegistryKey %

cti-stats III

CybOX 3.0 Roadmap Update We’re considering merging CybOX Core and Common, in addition to performing any streamlining around them They serve similar purposes “Common” is only truly common to CybOX We want to avoid basing our refactoring on reductionist reasoning based on just the simple constructs in use today Therefore, in addition to the simpler Object types that we see in use in the wild today, we’ll select 3-5 additional, more complex Objects for refactoring

File Object Refactoring I Refactoring There are a number of existing issues with the File object and its subclasses: Conflation of generic file properties with those related to file systems and disk-level representation There are certain fields that may be specific to Windows and no other platforms There currently are LOTS of subclasses of the File object: File Archive File Image File PDF File Unix File Windows File Windows Executable File

File Object Refactoring II

File Object Refactoring III { "hashes" : [{"type":"md5", "hash_value":"3773a88f65a5e780c8dff9cdc3a056f3"}], "size" : 25537, "file_system_properties":{"file_name":{"delimiter":"/", "components":["usr","tmp","foo.exe"]}}, "extensions": [{"type":"EXT3FileExtension", "inode":" "}, {"type":"PEBinaryFileExtension", "exports":[{"name":"foo_app"}]}] }

OASIS Work Product Update CybOX specifications out of 94 reviewed and edited ETA: Late November/Early December

Next meeting December 10 th -20 th ?