The BehaviorType is one of the foundational MAEC types, and serves as a method for the characterization of malicious behaviors found or observed in malware. Behaviors can be thought of as representing the purpose behind groups of MAEC Actions, and are therefore representative of distinct portions of higher-level malware functionality. Thus, while a malware instance may perform some multitude of Actions, it is likely that these Actions represent only a few distinct behaviors. Some examples include vulnerability exploitation, email address harvesting, the disabling of a security service, etc.
| Field Name | Type | Description |
|---|---|---|
| @idrequired | QName |
The required id field specifies a unique ID for this Behavior. |
| @ordinal_positionoptional | positiveInteger |
The ordinal_position field specifies the ordinal position of the Behavior with respect to the execution of the malware. |
| @statusoptional | ActionStatusTypeEnum |
The status field specifies the execution status of the Behavior being characterized. |
| @durationoptional | duration |
The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior. |
| Purpose0..1 | BehaviorPurposeType |
The Purpose field specifies the intended purpose of the Behavior. Since a Behavior is not always successful, and may not be fully observed, this is meant as way to state the nature of the Behavior apart from its constituent actions. |
| Description0..1 | string |
The Description field specifies a prose textual description of the Behavior. |
| Discovery_Method0..1 | MeasureSourceType |
The Discovery_Method field specifies the method used to discover the Behavior. |
| Action_Composition0..1 | BehavioralActionsType |
The Action_Composition field captures the Actions that compose the Behavior. |
| Associated_Code0..1 | AssociatedCodeType |
The Associated_Code field specifies any code snippets that may be associated with the Behavior. |
| Relationships0..1 | BehaviorRelationshipListType |
The Relationships field specifies any relationships between this Behavior and any other Behaviors. |
