2

I was looking at some MITRE projects and was wondering what you thought about, and if anyone was using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project: https://maec.mitre.org/. Do you see the potential for widespread adoption?

To me, it looks interesting from the description:

International in scope and free for public use, MAEC is a standardized language for encoding and communicating high-fidelity information about malware based upon attributes such as behaviors, artifacts, and attack patterns.

By eliminating the ambiguity and inaccuracy that currently exists in malware descriptions and by reducing reliance on signatures, MAEC aims to improve human-to-human, human-to-tool, tool-to-tool, and tool-to-human communication about malware; reduce potential duplication of malware analysis efforts by researchers; and allow for the faster development of countermeasures by enabling the ability to leverage responses to previously observed malware instances.

But it also looks fairly complicated, which might limit widespread adoption.

4
  • 3
    "Do you see the potential for widespread adoption?" is the only question you have buried in there. It would probably be best if you thought more about the topic and asked more specific questions that are not as subjective. Keep in mind when writing questions that despite your interesting topic, opinion is not the goal of the site; answers are!
    – cb88
    May 10 '13 at 15:43
  • Thank you for the comment. To clarify, I meant the 'question' to be mostly 'Is anyone using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project?' It looks interesting to me, but I have gotten involved in other such projects that have gone nowhere due to lack of interest. My intent was to see the level of interest among malware analysts to help me determine if I should invest time and effort to understand, adopt, and possibly contribute to the project. While interesting, and on version 4, I have not heard of anyone actually using it.
    – Marc
    May 11 '13 at 1:00
  • Hi! Welcome to Reverse Engineering. RE Stack Exchange is suited towards more specific questions that may deal with issues you are facing while RE-ing. It is not suited to opinion based questions and answers. This site is different from a forum. See tour for more.
    – asheeshr
    May 11 '13 at 9:32
  • Maybe a way to turn this into a question would be to ask "What are some examples of real-life scenarios where using MAEC and its related projects are useful and make financial sense?" I would certainly be interested in reading about those. May 15 '13 at 16:10

Browse other questions tagged or ask your own question.