Malware Visualization

In addition to capturing the output of one or more malware analyses, a MAEC Package or MAEC Bundle can also be used as a standard format to create visualizations of malware behavior. Such visualizations permit clear assessment of the low-level Actions, mid-level Behaviors, and high-level Capabilities performed by malware and facilitate comparison between two or more malware instances.

While no visualization tools currently exist to display MAEC content, we expect that future tools will provide much needed insight to analysts for quickly identifying similarities between malware instances and between analysis outputs from different tools.