Classification thoughts

I know I am late with the minutes again but the notes are in the office, =
I took a long weekend in NYC (it was the 150th anniversary of central =
park) and the dog ate my homework.....

I think all of us that were on the phone last week would agree that =
whilst on the face of it, creating a classification scheme is an easy =
task, in practice it is fraught with semantical and contextual issues.

We all discussed the merits of hierarchical schemes but all seemed to =
agree that the hierarchies can be meaningless to one person whilst =
communicating a valuable message to another.

In a sense (and remembering why OWASP arrived at the ASAC after the =
call) I personally think we may wish to consider creating atoms of =
attacks and a mechanism for allowing people to piece them together to =
create useful meaningful pieces of information. Kinda like OOP.=20

By taking this approach any scheme is both extensible (users could =
create their own object type) and flexible. You could define classes of =
objects that have a natural hierarchy or share similar properties =
(buffer over flow, format string etc) and also use polymorphism to =
create unique attack objects such as Code Red that inherit from =
different base classes.

Is there any merit to this ?

Any better ideas ?

was message