ClusterEdgeNodePairTypeMAEC Package Schema

The ClusterEdgeNodePairType captures a single edge-node pair in a malware cluster, which is composed of the two Malware Subjects that correspond to the nodes connected to the edge (via references), and represents the similarity index between the two Malware Subjects.


Field Name Type Description
@similarity_indexoptional decimal

The similarity_index field specifies the similarity index between the two Malware Subjects being referenced (indicating how similar they are), as a decimal value. This value should be equivalent to 1 minus the similarity distance value (if included).

@similarity_distanceoptional decimal

The similarity_index field specifies the similarity distance between the two Malware Subjects being referenced (indicating how dissimilar they are), as a decimal value. This value should be equivalent to 1 minus the similarity index value (if included).

Malware_Subject_Node_A1..1 MalwareSubjectReferenceType

The Malware_Subject_Node_A field represents a node connected to the edge via a reference to a Malware Subject that is part of a malware cluster.

Malware_Subject_Node_B1..1 MalwareSubjectReferenceType

The Malware_Subject_Node_B field represents a node connected to the edge via a reference to a Malware Subject that is part of a malware cluster.