CybOX Datatype Refactoring/Deprecation

["Kirillov, Ivan A." <ikirillov@mitre.org>]

Sending this to the broader CTI since it’s part of the STIX/CybOX Indicator tranche. 

Given that we’ll be splitting out embedded patterning from CybOX, there are changes that we need to make to the base datatypes used currently for specifying properties in CybOX Objects. At a high level, this involves the following:

• Deprecating any types/enums associated with patterning
• Refactoring the base BaseObjectPropertyType (the base type for ALL Object properties) to remove patterning and permit more accurate datatype based field specification in Objects (e.g., an integer is represented as an integer and not a string). Accordingly, this would entail creating a new BaseStringObjectPropertyType and BaseNumberObjectPropertyType that extend from the refactored BaseObjectPropertyType.
• Updating the existing ObjectPropertyTypes (e.g., StringObjectPropertyType, DoubleObjectPropertyType, etc.) to extend from the new BaseString/Number ObjectPropertyTypes

More details on these proposed changes can be found here: https://github.com/CybOXProject/schemas/issues/416#issuecomment-181916815

Accordingly, this would result in CybOX instance content that looks like the following; each property is an Object (so that it can specify metadata about refanging/defanging/etc) and thus the “value” field MUST be included in every property to capture its actual value.

{
   "size": {"value": 23134},
   "file-system-properties" : {"file_name": {"value":"test.dll",
                                             "observed_encoding":"utf-8"}}
}

Some open questions:

• Does this approach seem reasonable?
• Do we need all of the properties defined on the BaseObjectPropertyType (see below), or are there other properties that we should consider adding?
  • appears_random (boolean): whether the property appears random in nature
  • is_obfuscated (boolean): whether the property has been obfuscated
  • obfuscation_algorithm_ref (string): a reference to a description of the algorithm used to obfuscate the object property
  • is_defanged (boolean): whether the property has been defanged
  • defanging_algorithm_ref (string): a reference to a description of the algorithm used to defang the object property
  • refanging_transform_type (string): the type of refanging transform specified in the refanging_transform property
  • refanging_transform (string): an automated transform that can be applied to the object property in order to refang it to its original format
  • observed_encoding (string): the encoding of the string as observed
• For the extensions of the BaseStringObjectPropertyType and BaseNumberObjectPropertyType, such as PositiveIntegerPropertyType, should we define additional patterns (i.e. regular expressions) for field-level validation of these types? E.g., in this example, to make sure that the number is a valid positive integer?

Regards,

Ivan