diff --git a/README.md b/README.md
index dd72888..04222bb 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ The plugin is designed to keep the LLM grounded in MCP tools and server-side con
## Features
- **Author workflow**: Create CALDERA abilities and adversaries from an operator prompt while using available MCP server tools.
-- **Plan and Execute workflow**: Select or upload CTI/STIX, build an adversary from the observed techniques, run the CALDERA operation against available agents, and summarize detection coverage.
+- **Plan and Execute workflow**: Select or upload CTI/STIX, build an adversary from the observed techniques, run the CALDERA operation against available agents, and report which techniques it covered.
- **CTI ingest pipeline**: Upload raw CTI in HTML, PDF, plaintext, or Markdown and produce STIX 2.1 bundles for retrieval and planning.
- **STIX selection for planning**: Pick generated STIX bundles from the Plan and Execute workspace. Selecting STIX automatically enables CTI retrieval for that run.
- **Model and CTI/RAG profiles**: Configure the chat model, API base, API key, temperature, token budget, and tool-call budget. CTI/RAG can use the chat model by default or a saved profile when it needs a different endpoint.
@@ -68,9 +68,45 @@ The CTI ingest workflow stages raw CTI files, runs extraction, and displays gene
-### CTI Pipeline Fidelity
+### What the pipeline produces
-The CTI pipeline extracts structure from STIX and related observables, including hosts, identities, user accounts, domains, software, ATT&CK platform hints, and CVE references. These become CALDERA facts so an operation runs against values the report actually named, not placeholders.
+A threat report tells you **what** to run. Your environment tells you **where**.
+
+The pipeline extracts ATT&CK techniques, the named threat actor, and file
+hash observables, and nothing else. It does not extract hosts, accounts, domains, services or
+software, and does not turn them into CALDERA facts. Those describe the
+report's victim, not your estate; CALDERA discovers facts about your hosts
+at runtime, which is why the abilities that use them carry `has_agent_copy`
+and `no_backwards_movement` requirements.
+
+The one insertion point into core CALDERA is the adversary profile:
+
+```
+upload report(s) -> clean -> IR -> ATT&CK techniques -> STIX bundle
+ |
+ "build an adversary from this and run it" v
+ build_adversary attack-pattern -> ability.technique_id -> Adversary
+ + unmatched_techniques + platform_excluded
+ run_operation Adversary + your agents + runtime-discovered facts
+```
+
+### Known limits
+
+- **Extraction quality.** Scored against the committed measuring stick with
+ `tests/test_pipeline_score.py`: precision 0.83, F1 0.89. That fixture names
+ its technique ids explicitly, so its recall is an upper bound, not a field
+ estimate. Recall on prose-only reports is materially lower, and fusing
+ several reports on the same actor is the cheapest way to raise it.
+- **No detection scoring.** The `detections` plugin does not ship in this
+ repository, so nothing here scores an operation against SIEM rules.
+- **Platform matching is coarse.** `build_adversary` knows which platforms
+ your agents run, not whether a Windows agent is domain-joined. It reports
+ the gap in `platform_excluded` rather than closing it.
+- **Fusion does not check identity.** Fusing bundles for two different
+ actors merges them into one profile without complaint.
+- **Operations are not agent-scoped.** `run_operation` runs against the whole
+ `red` group; the `agent_paws` argument is not honoured by core's operation
+ schema.
## Installation
@@ -79,7 +115,7 @@ Install MCP like a standard CALDERA plugin.
1. Clone or copy this repository into the CALDERA plugin directory:
```bash
-git clone https://gitlab.mitre.org/caldera/caldera-mcp.git plugins/mcp
+git clone https://github.com/mitre/mcp.git plugins/mcp
```
2. Add `mcp` to your CALDERA plugin list in `conf/local.yml`. Keep local configuration in `conf/local.yml`; do not commit that file.
@@ -92,25 +128,39 @@ plugins:
- mcp
```
-3. Optional integrations can be enabled by adding their plugins as well:
+3. Install plugin requirements from the CALDERA virtual environment:
-```yaml
-plugins:
- - magma
- - sandcat
- - stockpile
- - detections
- - mcp
+```bash
+source venv/bin/activate
+pip install -r plugins/mcp/requirements.txt
```
-4. Install plugin requirements from the CALDERA virtual environment:
+4. Install the spaCy model. pip cannot do this from `requirements.txt`:
```bash
-source venv/bin/activate
-pip install -r plugins/mcp/requirements.txt
+python -m spacy download en_core_web_lg
+```
+
+ Install poppler as well, which supplies `pdftotext`. Without it the
+ pipeline still ingests TXT, MD and HTML, and PDF uploads report the
+ missing dependency rather than failing silently:
+
+```bash
+brew install poppler # macOS
+apt install poppler-utils # Debian/Ubuntu
```
-5. Copy `.env.example` to `.env` and set the LLM endpoint and credential. Both are required; nothing ships in `conf/default.yml`.
+ To run the test suite, also install the dev requirements:
+
+```bash
+pip install -r plugins/mcp/requirements-dev.txt
+```
+
+5. Copy `.env.example` to `.env` and set the LLM endpoint and credential.
+ Both are optional: with neither set, IR extraction falls back to a
+ deterministic offline extractor. That extractor trades roughly 15 to 20
+ percent of recall for sub-second processing, so configure a model when
+ extraction quality matters.
```bash
cp plugins/mcp/.env.example plugins/mcp/.env
@@ -164,12 +214,14 @@ Use Upload CTI to stage raw reports, run CTI extraction, and produce STIX 2.1 bu
Use Plan and Execute for CTI-driven operations. The workflow can:
- Read selected STIX bundles and CTI/RAG context.
-- Extract hosts, operating systems, domains, users, and software.
-- Turn those into a CALDERA fact source so operations run on values the report named.
-- Build and run the CALDERA operation.
-- Summarize operator-review gaps and detection coverage.
+- Fuse several bundles describing the same actor into one.
+- Build an adversary from the observed techniques, previewing it first.
+- Run the CALDERA operation against agents that have checked in.
+- Report which techniques had no matching ability, and which had one that
+ no live agent can run.
-The workflow should report missing evidence rather than inventing hosts, users, domains, or services.
+The CTI names techniques, not your estate. The workflow reports a gap
+rather than answering a question about your environment from a report.
## Configuration
@@ -184,28 +236,32 @@ MCP supports saved endpoint profiles in the UI. Profiles can carry:
- Maximum tool calls
- Maximum tokens
-CTI/RAG model settings can use the chat endpoint by default or a separate saved profile when CTI extraction benefits from a different model.
+CTI and RAG share the chat endpoint. Extraction differs from chat only in its generation settings, which the CTI Extraction Model panel edits.
### Local Settings
Prefer environment variables for local values, and keep `conf/default.yml` limited to safe defaults.
-To pin values on disk instead, set them in `conf/local.yml`. That file is overlaid onto `conf/default.yml` key by key, so it only needs the keys it changes.
-
-The `llm` block sits at the top level of the file:
+To pin values on disk instead, create `conf/local.yml`. That file is a **sparse overlay**, not a full config: it is deep-merged onto `conf/default.yml` key by key, so it needs only the keys it changes. A file containing one key is valid and complete.
```yaml
llm:
model: openai/gpt-oss-120b
api_base: https://api.example.com/v1
- api_base_env: MCP_LLM_API_BASE
- api_key_env: MCP_LLM_API_KEY
- temperature: 0.5
- max_tool_calls: 5
- max_tokens: 24000
+ offline: false
+
+cti:
+ timeout: 120
+ offline: false
```
-A value set here outranks the environment variable named beside it, so leave `api_base` empty to keep resolving it from `MCP_LLM_API_BASE`. The `cti` block takes the same shape and may name a different variable if CTI extraction should reach a separate endpoint.
+Three rules that are easy to trip over:
+
+- **`cti` layers over `llm`, but only for its own generation settings.** A workload profile may set `top_p`, `timeout`, `stream`, `offline` and `embed_model`. Everything else belongs to `llm`: the connection (`provider`, `model`, `api_base`, credentials, `ssl_verify`), and `temperature` and `max_tokens`, which two panels display and so are stored once. Anything else under `cti` is dropped and logged, and `set_config` rejects it outright.
+- **Precedence differs by field.** `api_key` resolves environment-first and is never read from this file. `api_base` resolves yaml-first, so a value here beats `MCP_LLM_API_BASE`; leave it empty to keep using the variable.
+- **A key with no value is `null`, and null overrides.** A bare `llm:` heading wipes the shipped block rather than falling through to it. Omit the block instead.
+
+The GUI's **Global Model Config** panel writes the connection to the `llm` profile in `conf/local.yml`, so it configures every workload including CTI extraction. Only fields you change are written, so a value still coming from `MCP_LLM_API_BASE` is left alone rather than pinned to disk. The API key is the exception: it stays in `localStorage` and rides each request, and `set_config` strips credentials before writing.
## API Surface
@@ -220,6 +276,10 @@ The plugin exposes MCP workflow APIs through CALDERA's aiohttp server. The UI us
- Run CTI pipeline steps.
- Read run history and transcripts.
+The CTI pipeline MCP server exposes five tools: `cti_pipeline_ingest_cti`,
+`cti_pipeline_fuse`, `cti_pipeline_build_adversary`,
+`cti_pipeline_run_operation` and `cti_pipeline_wait_for_agents`.
+
When adding new UI functionality, prefer extending the existing MCP API routes instead of creating separate side channels.
## Architecture
diff --git a/app/capabilities/rag.py b/app/capabilities/rag.py
index f1e3a47..f7f6ee6 100644
--- a/app/capabilities/rag.py
+++ b/app/capabilities/rag.py
@@ -34,7 +34,7 @@ def __init__(
if stix_bundle_path:
self.load_stix_bundle(stix_bundle_path)
- def load_stix_bundle(self, stix_bundle_path: str, embed_model: str = 'openai/text-embedding-3-small'):
+ def load_stix_bundle(self, stix_bundle_path: str, embed_model: str | None = None):
"""Load STIX bundle from file path and build embeddings."""
try:
with open(stix_bundle_path, 'r') as f:
@@ -45,7 +45,7 @@ def load_stix_bundle(self, stix_bundle_path: str, embed_model: str = 'openai/tex
except json.JSONDecodeError:
raise ValueError(f"Invalid JSON in STIX bundle: {stix_bundle_path}")
- def initialize_from_bundles(self, stix_bundles: List[dict], embed_model: str = 'openai/text-embedding-3-small'):
+ def initialize_from_bundles(self, stix_bundles: List[dict], embed_model: str | None = None):
"""Initialize the RAG service with multiple STIX bundles and create retriever."""
all_corpus = []
all_adv_step = {}
@@ -56,7 +56,19 @@ def initialize_from_bundles(self, stix_bundles: List[dict], embed_model: str = '
self.corpus = all_corpus
self.adv_step = all_adv_step
-
+
+ if not self.corpus:
+ # Embeddings() raises numpy AxisError on an empty corpus, and the
+ # caller swallows it and silently runs without CTI grounding.
+ # Bundles with no attack-pattern and no threat-actor are the
+ # normal way to get here. search_cti_title handles search=None.
+ self.search = None
+ self.log.warning(
+ "[RAG] No attack-pattern or threat-actor objects in the "
+ "selected STIX; CTI retrieval is unavailable for this run"
+ )
+ return
+
self.log.info("Initializing embeddings and retriever for STIX corpus")
embedder_kwargs = {"api_key": self.api_key}
if self.api_base:
@@ -77,10 +89,7 @@ def extract_text_chunks(self, stix_bundle: dict) -> tuple[List[str], Dict[str, s
adv_step = {}
for obj in stix_bundle.get("objects", []):
- if obj.get("type") in [
- "attack-pattern", "malware", "tool", "threat-actor",
- "intrusion-set", "identity", "indicator", "report"
- ]:
+ if obj.get("type") in ["attack-pattern", "threat-actor"]:
name = obj.get("name", "")
description = obj.get("description", "")
@@ -160,18 +169,7 @@ def get_context_for_task(self, task: str) -> Dict[str, any]:
}
-# Legacy functions for backward compatibility
-def search_cti_title(query: str) -> list[str]:
- """Legacy function - use RAGService instead."""
- if 'global_rag_service' in globals():
- return global_rag_service.search_cti_title(query)
- return ["RAG service not initialized"]
-def search_cti_data_by_title(name: str) -> str:
- """Legacy function - use RAGService instead."""
- if 'global_rag_service' in globals():
- return global_rag_service.search_cti_data_by_title(name)
- return "RAG service not initialized"
# ---------------------------------------------------------------------------
@@ -184,7 +182,6 @@ def search_cti_data_by_title(name: str) -> str:
# capability registry, this declaration is dormant; the legacy code path in
# mcp_svc still wires RAG into runs directly.
-import os
import asyncio
from pathlib import Path
@@ -253,7 +250,7 @@ async def _enrich(prompt: str, settings: dict) -> dict:
settings keys (all optional):
rag_files list of filenames under plugins/mcp/data/
topk int, defaults to 5
- embed_model str, defaults to openai/text-embedding-3-small
+ embed_model str, falls back to the chat model when unset
api_key str, embedding key fallback (mcp_svc fills this with
the resolved chat-LLM key when the caller does not
override it via embed_api_key)
@@ -271,7 +268,15 @@ async def _enrich(prompt: str, settings: dict) -> dict:
embed_api_key = settings.get("embed_api_key") or settings.get("api_key") or ""
embed_api_base = settings.get("embed_api_base") or settings.get("api_base") or None
ssl_verify = settings.get("ssl_verify")
- embed_model = settings.get("embed_model") or "openai/text-embedding-3-small"
+ # An undeclared embedding model falls back to the chat model. A deployment
+ # pointing at its own gateway has no reason to reach for an OpenAI model
+ # name it never chose, and that name would be sent to that gateway.
+ embed_model = settings.get("embed_model") or settings.get("model")
+ if not embed_model:
+ raise ValueError(
+ "No embedding model: set embed_model, or a model on the global "
+ "LLM profile for it to inherit."
+ )
topk = int(settings.get("topk") or 5)
base_dir = Path(__file__).resolve().parent.parent.parent / "data"
diff --git a/app/cti_ingest_svc.py b/app/cti_ingest_svc.py
index d5c1213..a3fbbc3 100644
--- a/app/cti_ingest_svc.py
+++ b/app/cti_ingest_svc.py
@@ -3,28 +3,21 @@
Logging is preserved verbatim for debug capture via:
python3 cti_ingest_svc.py --base-dir data --step all 2>&1 | tee -a debug_mitre.log
-| Step | Description |
-| ------------- | -------------------------------------- |
-| Raw → Clean | Normalize source material |
-| Clean → IR | LLM extraction of entities & behaviors |
-| NLP Layers | Improve IR quality |
-| MITRE | Map behaviors to ATT&CK |
-| Relationships | Build entity graph |
-| Validation | Ensure graph correctness |
-| Outputs | Persist IR + summary |
-| Scenario | (Optional) Narrative generation |
+| Step | Description |
+| ------------ | ---------------------------------------------- |
+| raw-to-clean | Normalize source material |
+| debug-ir | Stop after IR extraction |
+| stage2 | IR -> STIX bundle only |
+| all | Everything, in order |
'''
import argparse
-import asyncio
-import json, re
import shutil
from enum import Enum
from pathlib import Path
from plugins.mcp.app.cti_pipeline_stage1 import (
- ensure_dirs,
step_raw_to_clean,
step_parse_to_ir
)
@@ -70,20 +63,14 @@ def run_stage(self, base_dir: Path, step: str):
step_raw_to_clean(base_dir)
case "debug-ir":
- step_parse_to_ir(base_dir, stop_after="ir")
-
- case "debug-mitre":
- step_parse_to_ir(base_dir, stop_after="mitre")
-
- case "debug-relationships":
- step_parse_to_ir(base_dir, stop_after="relationships")
+ step_parse_to_ir(base_dir, stop_after="ir", only=self.selected)
case "stage2":
self.run_stage2(base_dir)
case "all":
step_raw_to_clean(base_dir)
- step_parse_to_ir(base_dir)
+ step_parse_to_ir(base_dir, only=self.selected)
# Only run Stage 2 if IR exists
ir_dir = base_dir / "outputs_ir" / "complete"
@@ -121,12 +108,25 @@ def status(self):
}
def finalize_run(self, base_dir: Path, selected: list[str]):
+ """Retire the reports this run actually processed.
+
+ This moved everything in uploads/ and never read its own argument, so
+ a report the operator did not select was retired having never been
+ cleaned or extracted. list_cti_raw stamps a literal "processed" on
+ that directory, so it then rendered green.
+
+ An empty selection still means everything, matching the convention
+ step_parse_to_ir uses for the same reason.
+ """
uploads = base_dir / "raw" / "uploads"
processed = base_dir / "raw" / "processed"
processed.mkdir(parents=True, exist_ok=True)
+ names = set(selected or [])
for f in uploads.iterdir():
+ if names and f.name not in names:
+ continue
shutil.move(str(f), processed / f.name)
@staticmethod
diff --git a/app/cti_pipeline_stage1.py b/app/cti_pipeline_stage1.py
index c5ce6dc..3e7404d 100644
--- a/app/cti_pipeline_stage1.py
+++ b/app/cti_pipeline_stage1.py
@@ -29,43 +29,23 @@
import asyncio
import time
import os
-import shutil
+import traceback
from pathlib import Path
-from concurrent.futures import ProcessPoolExecutor, as_completed
+from concurrent.futures import as_completed
# =============================================================
# Core Utilities
# =============================================================
-from plugins.mcp.app.utilities.cti_raw_cleaner import clean_raw_directory
+from plugins.mcp.app.utilities.cti_raw_cleaner import clean_raw_directory, clean_stem
from plugins.mcp.app.utilities.cti_parsing import extract_ir, render_ir_summary
from plugins.mcp.app.utilities.cti_mitre_extract import extract_mitre_techniques, convert_sets
-from plugins.mcp.app.utilities.cti_taxonomy_loader import build_normalized_attack_patterns
-from plugins.mcp.app.utilities.cti_entity_validator import validate_entities, repair_entities
-
-from plugins.mcp.app.utilities.cti_relationships import (
- normalize_and_qualify_behaviors,
- extract_all_relationships,
- REL_REJECTIONS,
+from plugins.mcp.app.utilities.cti_taxonomy_loader import (
+ build_normalized_attack_patterns,
+ load_mitre_taxonomy,
)
-from plugins.mcp.app.utilities.cti_linguistics import extract_dynamic_techniques, extract_commands, extract_hashes
-from plugins.mcp.app.utilities.cti_extract_users import extract_users
-from plugins.mcp.app.utilities.cti_extract_hosts import (
- extract_hosts,
- hosts_to_infrastructure_entries,
-)
-from plugins.mcp.app.utilities.cti_extract_domains import extract_domains
-from plugins.mcp.app.utilities.cti_extract_software import extract_software
-from plugins.mcp.app.utilities.cti_extract_services import (
- extract_services,
- services_to_infrastructure_entries,
-)
-from plugins.mcp.app.utilities.cti_ae_library_loader import (
- _extract_file_paths as extract_file_paths,
- _extract_registry as extract_registry_keys,
- _extract_subnets as extract_network_subnets,
-)
+from plugins.mcp.app.utilities.cti_linguistics import extract_hashes
from plugins.mcp.app.utilities.cti_technique_grounding import (
ground_techniques,
detect_platforms,
@@ -80,8 +60,6 @@
# =============================================================
from plugins.mcp.app.utilities.nlp.cti_nlp_enhancements import clean_ir_nlp_layer1
-from plugins.mcp.app.utilities.nlp.cti_semantic_enrichment import clean_ir_nlp_layer2
-from plugins.mcp.app.utilities.nlp.cti_behavior_expansion import recover_nominalized_behaviors
# =============================================================
# Directory Constants
@@ -95,18 +73,6 @@
OUTPUTS_IR_DIR = "outputs_ir"
IMAGES_DIR_NAME = "images"
-
-def _preload_thread_shared_nlp_resources():
- """Load lazy NLTK corpora before Stage 1 worker threads touch them."""
- try:
- from nltk.corpus import stopwords, wordnet # type: ignore
-
- wordnet.ensure_loaded()
- wordnet.synsets("network")
- stopwords.words("english")
- except Exception as e:
- print(f"[WARN] NLTK pre-load skipped: {e}")
-
# =============================================================
# Directory Setup
# =============================================================
@@ -160,9 +126,10 @@ def move_raw_to_processed(raw_path: Path, processed_dir: Path):
# Stage 1.2 — Clean → IR (PARALLEL)
# =============================================================
-def step_parse_to_ir(base_dir: Path, stop_after: str | None = None):
+def step_parse_to_ir(base_dir: Path, stop_after: str | None = None,
+ only: list[str] | None = None):
"""
- Process all cleaned TXT files into IR + relationships + MITRE.
+ Process all cleaned TXT files into IR + MITRE techniques.
Parallelism:
• One OS process per file
@@ -181,6 +148,15 @@ def step_parse_to_ir(base_dir: Path, stop_after: str | None = None):
final_dir.mkdir(parents=True, exist_ok=True)
files = list(clean_dir.glob("*.txt"))
+
+ # clean/ is never emptied, so it holds every report ever ingested. Without
+ # this, selecting one row re-ran LLM extraction over the whole corpus while
+ # the UI reported one file. An empty selection still means everything, which
+ # is what the CLI and a full re-run want.
+ if only:
+ wanted = {clean_stem(name) for name in only}
+ files = [f for f in files if f.stem in wanted]
+
if not files:
print("[!] No clean files found.")
return
@@ -188,7 +164,6 @@ def step_parse_to_ir(base_dir: Path, stop_after: str | None = None):
workers = max(1, (os.cpu_count() or 4) - 2)
else:
workers = 1
- _preload_thread_shared_nlp_resources()
# Stage1 work is LLM/IO-bound, not CPU-bound: each file makes
# remote calls to the LLM gateway, downloads embeddings, reads
@@ -218,15 +193,21 @@ def step_parse_to_ir(base_dir: Path, stop_after: str | None = None):
for path in files
}
raw_uploads, raw_processed, _, _, _ = ensure_dirs(base_dir)
+ succeeded = 0
+ failures = []
for fut in as_completed(futures):
clean_path = futures[fut]
raw_path = None
for p in raw_uploads.iterdir():
- if p.is_file() and p.stem == clean_path.stem:
+ # Matching on the bare stem paired report.md with the clean
+ # file report.txt actually produced from report.txt, so the
+ # wrong raw file was moved to processed.
+ if p.is_file() and clean_stem(p.name) == clean_path.stem:
raw_path = p
break
try:
fut.result()
+ succeeded += 1
print(f"[OK] {clean_path.name}")
# MOVE RAW INPUT ONLY AFTER SUCCESS
@@ -234,10 +215,18 @@ def step_parse_to_ir(base_dir: Path, stop_after: str | None = None):
move_raw_to_processed(raw_path, raw_processed)
except Exception as e:
+ failures.append((clean_path.name, e))
print(f"[ERR] {clean_path.name}: {e}")
+ print(traceback.format_exc())
elapsed = time.perf_counter() - start_time
- print(f"\n[STAGE1] completed in {elapsed:.2f}s")
+ print(f"\n[STAGE1] completed {succeeded}, failed {len(failures)} in {elapsed:.2f}s")
+
+ # Callers keyed off the IR directory being empty, which reported a
+ # missing-IR error rather than the exception that actually stopped the run.
+ if failures and not succeeded:
+ name, exc = failures[0]
+ raise RuntimeError(f"Stage 1 failed for all {len(failures)} files; {name}: {exc}") from exc
# =============================================================
# Per-File Pipeline
@@ -255,13 +244,9 @@ async def process_file(
Steps:
1. IR extraction / resume
2. NLP Layer 1 cleanup
- 3. Behavior normalization & qualification
- 4. Relationship extraction
- 5. Entity validation
- 6. MITRE ATT&CK mapping
- 7. Final JSON + analyst summary output
+ 3. MITRE ATT&CK mapping
+ 4. Final JSON + analyst summary output
"""
- REL_REJECTIONS.clear()
print(f"\n[*] Processing {path.name}")
text = path.read_text(errors="ignore")
@@ -279,51 +264,13 @@ async def process_file(
pre_beh = len(ir.get("behaviors", []))
ir = clean_ir_nlp_layer1(ir, text)
- recovered = recover_nominalized_behaviors(text)
- if recovered:
- seen = {(b.get("verb"), b.get("object")) for b in ir["behaviors"]}
- for b in recovered:
- key = (b.get("verb"), b.get("object"))
- if key not in seen:
- ir["behaviors"].append(b)
- seen.add(key)
-
if len(ir["behaviors"]) < pre_beh:
raise RuntimeError("NLP Layer 1 removed behaviors (forbidden)")
- # ---------------------------------------------------------
- # 3. Behavior qualification
- # ---------------------------------------------------------
- normalized, qualified = normalize_and_qualify_behaviors(ir)
- ir["behaviors"] = normalized
- ir["qualified_behaviors"] = qualified
-
- high_conf = [b for b in qualified if b.get("confidence", 0) >= 0.5]
- low_conf = [b for b in qualified if b.get("confidence", 0) < 0.5]
-
- # ---------------------------------------------------------
- # 4. Relationships
- # ---------------------------------------------------------
- raw_relationships = await extract_all_relationships(
- text, ir, high_conf
- ) or []
- ir["relationships"] = rag_safe_relationships(raw_relationships)
- ir["low_confidence_behaviors"] = low_conf
-
# ---------------------------------------------------------
# Commands Extraction (Linguistic)
# ---------------------------------------------------------
- commands = extract_commands(text)
- if commands:
- for m in ir.get("malware", []):
- if m.get("name", "").lower() in text.lower():
- _merge_commands(m, commands)
-
- for t in ir.get("tools", []):
- if t.get("name", "").lower() in text.lower():
- _merge_commands(t, commands)
-
# ---------------------------------------------------------
# Hash Extraction (File Observables)
# ---------------------------------------------------------
@@ -337,183 +284,29 @@ async def process_file(
if key not in seen:
ir["hashes"].append(h)
- # ---------------------------------------------------------
- # User-account Extraction (AE-plan tables + inline prose)
- # ---------------------------------------------------------
- ir.setdefault("user_accounts", [])
- users = extract_users(text)
- if users:
- seen_users = {(u["username"].lower(), (u.get("domain") or "").lower())
- for u in ir["user_accounts"]}
- for u in users:
- key = (u["username"].lower(), (u.get("domain") or "").lower())
- if key not in seen_users:
- ir["user_accounts"].append(u)
- seen_users.add(key)
# ---------------------------------------------------------
- # Software + Version Extraction (AE-plan tooling tables +
- # filename-with-extension hits + ATT&CK-gated bare tokens)
- #
- # Distinct from ir["tools"]: ir["tools"] stays scoped to
- # ATT&CK-known offensive software, while ir["software"] is the
- # broader observed-software list -- INCLUDING versions and
- # non-ATT&CK entries -- so consumers can match concrete binaries.
- #
- # Pure ontology-driven: ATT&CK name_index for admission, OSV.dev
- # + nvdlib for optional external validation (gated behind
- # use_external_apis=False here; CI/unit tests stay offline).
+ # 3. MITRE ATT&CK
# ---------------------------------------------------------
- ir.setdefault("software", [])
- try:
- # Load the ATT&CK taxonomy lazily so software classification can
- # tag each candidate with attack_id / software_kind. The full
- # taxonomy is loaded again below for the MITRE technique pass
- # (step 6); both calls share the same on-disk bundle but the
- # extra parse is cheap relative to the rest of Stage 1.
- try:
- from plugins.mcp.app.utilities.cti_taxonomy_loader import load_mitre_taxonomy as _ldtax
- _sw_taxonomy = _ldtax()
- except Exception as _e:
- print(f"[SOFTWARE-EXTRACT][WARN] taxonomy unavailable: {_e}")
- _sw_taxonomy = None
- sw_entries = extract_software(text, taxonomy=_sw_taxonomy,
- use_external_apis=False)
- except Exception as e:
- print(f"[SOFTWARE-EXTRACT][WARN] {e}")
- sw_entries = []
- if sw_entries:
- seen_sw = {
- (s.get("name", "").lower(), (s.get("version") or "").lower())
- for s in ir["software"]
- }
- for s in sw_entries:
- key = (s["name"].lower(), (s.get("version") or "").lower())
- if key in seen_sw:
- continue
- ir["software"].append(s)
- seen_sw.add(key)
- print(f"[SOFTWARE-EXTRACT] added {len(sw_entries)} software entries")
+ techniques, lookup = build_normalized_attack_patterns()
- # ---------------------------------------------------------
- # Named-Host + IP Extraction (AE-plan tables + freeform prose)
- #
- # Recovers structured named hosts -- hostname/IP/role/OS -- which
- # the LLM IR step routinely flattens to generic "Internet-facing
- # RDP server" infrastructure entries. Pure ontology-driven: spaCy
- # NER, IPv4 regex, RFC 1123 hostnames, STIX infra-type-ov role
- # vocab + ATT&CK technique-name hints. No hostname->role tables.
- # ---------------------------------------------------------
- ir.setdefault("infrastructure", [])
+ # Steps 3.5 and 3.6 below need the full taxonomy rather than the
+ # normalized attack patterns.
try:
- # Reuse the spaCy pipeline already loaded by cti_linguistics
- # (loaded once per worker process) for PROPN-aware hostname
- # candidate ranking. Fall back to regex-only if unavailable.
- try:
- from plugins.mcp.app.utilities.cti_linguistics import nlp as _nlp
- except Exception:
- _nlp = None
- named_hosts = extract_hosts(text, nlp=_nlp)
+ taxonomy = load_mitre_taxonomy()
except Exception as e:
- print(f"[HOST-EXTRACT][WARN] {e}")
- named_hosts = []
- if named_hosts:
- new_entries = hosts_to_infrastructure_entries(named_hosts)
- # Dedup by (hostname-lower, ip) against any existing infra entries.
- seen_infra = set()
- for inf in ir["infrastructure"]:
- if isinstance(inf, dict):
- key = (
- (inf.get("name") or "").strip().lower(),
- (inf.get("ip") or "").strip(),
- )
- seen_infra.add(key)
- for e in new_entries:
- key = (e["name"].lower(), e.get("ip", ""))
- if key in seen_infra:
- continue
- ir["infrastructure"].append(e)
- seen_infra.add(key)
- print(f"[HOST-EXTRACT] added {len(new_entries)} named hosts")
-
- # ---------------------------------------------------------
- # Service / Application Extraction (NEW: cti_extract_services)
- #
- # CTI reports name application-level services (Active Directory,
- # RDP, SMB, SQL Server, Exchange, KVM, NetBNMBackup, ...). The
- # extractor admits each candidate ONLY when one of these
- # ontology sources backs it:
- # * IANA service registry (Python stdlib socket / /etc/services)
- # * MITRE ATT&CK data-source vocabulary + technique-name
- # phrase harvesting (Server Message Block, Remote Desktop
- # Protocol, ...)
- # Each service is added to ir["services"] AND mirrored into
- # ir["infrastructure"] so stage2 emits a STIX infrastructure SDO.
- # ---------------------------------------------------------
- ir.setdefault("services", [])
- try:
- # Reuse taxonomy loaded above for the software pass.
- services = extract_services(text, taxonomy=_sw_taxonomy)
- except Exception as e:
- print(f"[SERVICE-EXTRACT][WARN] {e}")
- services = []
- if services:
- seen_services = {
- (s.get("name") or "").strip().lower()
- for s in ir["services"]
- }
- for s in services:
- key = (s.get("name") or "").strip().lower()
- if key in seen_services:
- continue
- ir["services"].append(s)
- seen_services.add(key)
- # Mirror into infrastructure[] so the stage2 builder
- # produces STIX `infrastructure` SDOs.
- svc_infra_entries = services_to_infrastructure_entries(services)
- seen_infra = {
- ((inf.get("name") or "").strip().lower(),
- (inf.get("ip") or "").strip())
- for inf in ir.get("infrastructure", [])
- if isinstance(inf, dict)
- }
- for e in svc_infra_entries:
- key = (e["name"].lower(), e.get("ip", ""))
- if key in seen_infra:
- continue
- ir["infrastructure"].append(e)
- seen_infra.add(key)
- print(f"[SERVICE-EXTRACT] added {len(services)} services "
- f"({len(svc_infra_entries)} infra entries)")
-
- # ---------------------------------------------------------
- # 5. Entity validation
- # ---------------------------------------------------------
- ir = await validate_entities(ir, destructive=False)
- ir = repair_entities(ir)
-
- # ---------------------------------------------------------
- # 6. MITRE ATT&CK
- # ---------------------------------------------------------
- techniques, lookup = build_normalized_attack_patterns()
- ir = clean_ir_nlp_layer2(ir, {"attack_patterns": techniques})
-
- ling = await extract_dynamic_techniques(
- text,
- techniques,
- ir.get("qualified_behaviors", []),
- limit=25,
- )
+ print(f"[TAXONOMY][WARN] {e}")
+ taxonomy = None
mitre = extract_mitre_techniques(
text,
- qualified,
+ ir.get("behaviors", []),
techniques,
lookup,
)
# ---------------------------------------------------------
- # 6.5 Explicit-anchor technique grounding (NEW)
+ # 3.5 Explicit-anchor technique grounding
#
# Walk a set of STRUCTURAL ANCHORS (binary names, system
# commands, narrative phrases) and resolve each to an ATT&CK
@@ -527,7 +320,7 @@ async def process_file(
# T1059.001).
# ---------------------------------------------------------
try:
- grounded = ground_techniques(text, taxonomy=_sw_taxonomy)
+ grounded = ground_techniques(text, taxonomy=taxonomy)
except Exception as e:
print(f"[TECHNIQUE-GROUND][WARN] {e}")
grounded = []
@@ -536,13 +329,17 @@ async def process_file(
seen = set()
merged = []
- for t in ir.get("attack_patterns", []) + ling + mitre + grounded:
+ # The linguistic source is deliberately absent: measured on the committed
+ # BlackCat stick it contributed 21 false positives and zero true
+ # positives, including three revoked ATT&CK ids, because it emits
+ # techniques with no platforms key that the filter then keeps.
+ for t in ir.get("attack_patterns", []) + mitre + grounded:
if isinstance(t, dict) and t.get("id") and t["id"] not in seen:
seen.add(t["id"])
merged.append(t)
# ---------------------------------------------------------
- # 6.6 Platform-attestation filter
+ # 3.6 Platform-attestation filter
#
# Drop techniques whose `x_mitre_platforms` doesn't overlap
# the platform set attested in the source text. Stops
@@ -551,7 +348,7 @@ async def process_file(
# from ATT&CK's `x_mitre_platforms` walks.
# ---------------------------------------------------------
try:
- attested = detect_platforms(text, taxonomy=_sw_taxonomy)
+ attested = detect_platforms(text, taxonomy=taxonomy)
if attested:
before = len(merged)
merged = filter_techniques_by_platform(merged, attested)
@@ -574,82 +371,15 @@ async def process_file(
ir["attack_patterns"] = merged
# ---------------------------------------------------------
- # 6b. Domain Extraction (AD signal)
- #
- # Pulls Windows AD / DNS domain names out of the cleaned prose.
- # Ontology-grounded: regex + spaCy ORG NER, gated by ATT&CK
- # technique IDs whose canonical names imply AD (T1003.006, T1558.*,
- # T1078.002, T1069.002, T1087.002, T1018, T1482, T1484, T1098.007,
- # T1207, T1556.001, T1550.002/3). No hardcoded CTI->domain map.
- # ---------------------------------------------------------
- ir.setdefault("domains", [])
- try:
- ap_ids = [
- ap.get("id") for ap in ir.get("attack_patterns", [])
- if isinstance(ap, dict) and ap.get("id")
- ]
- domains = extract_domains(text, attack_pattern_ids=ap_ids, nlp=None)
- except Exception as e:
- print(f"[DOMAIN-EXTRACT][WARN] {e}")
- domains = []
- if domains:
- seen_domains = {
- (d.get("name") or "").lower() for d in ir["domains"]
- }
- for d in domains:
- key = (d.get("name") or "").lower()
- # Allow multiple synthetic entries only if they have non-empty
- # signal sets that differ (defensive — shouldn't happen).
- if key and key in seen_domains:
- continue
- ir["domains"].append(d)
- if key:
- seen_domains.add(key)
- print(f"[DOMAIN-EXTRACT] added {len(domains)} domain entries")
-
- # ---------------------------------------------------------
- # 6c. Observable Surface Extraction
- #
- # Reuse the generic AE-library parsers for first-class observables
- # that matter as operation facts: filesystem paths,
- # and Windows registry keys/values. These helpers are structural
- # regex extractors, not scenario-specific lists; Stage 2 turns the
- # resulting IR fields into STIX SCOs.
- # ---------------------------------------------------------
- observable_extractors = (
- ("network_subnets", extract_network_subnets),
- ("file_paths", extract_file_paths),
- ("registry_keys", extract_registry_keys),
- )
- for field, extractor in observable_extractors:
- ir.setdefault(field, [])
- try:
- values = extractor(text)
- except Exception as e:
- print(f"[OBSERVABLE-EXTRACT][WARN] {field}: {e}")
- values = []
- if not values:
- continue
- seen = {str(v).strip().lower() for v in ir[field] if str(v).strip()}
- added = 0
- for value in values:
- sval = str(value).strip()
- if not sval:
- continue
- key = sval.lower()
- if key in seen:
- continue
- ir[field].append(sval)
- seen.add(key)
- added += 1
- if added:
- print(f"[OBSERVABLE-EXTRACT] added {added} {field}")
-
- # ---------------------------------------------------------
- # 7. Output
+ # 4. Output
# ---------------------------------------------------------
final = convert_sets(ir)
- final["provenance"] = ir.get("provenance")
+ provenance = dict(ir.get("provenance") or {})
+ # Which extractor actually produced the IR. The model can be configured and
+ # still return nothing, in which case the deterministic extractor ran and
+ # crediting the model would be wrong.
+ provenance["extractor"] = ir.get("extractor", "unknown")
+ final["provenance"] = provenance
(final_dir / f"{path.stem}.json").write_text(
json.dumps(final, indent=2),
encoding="utf-8",
@@ -674,10 +404,16 @@ def process_one_file_sync(path, ir_dir, final_dir, stop_after):
• Executes the async pipeline via asyncio.run()
"""
- # Load spaCy per worker (MANDATORY)
+ # The model is not on PyPI under its own name, so pip alone does not
+ # supply it. This check existed but its body was `pass`, so the real
+ # failure was an OSError raised from inside spacy.load, several frames
+ # deep in a worker, naming nothing the operator could act on.
import spacy
if not spacy.util.is_package("en_core_web_lg"):
- pass
+ raise RuntimeError(
+ "spaCy model en_core_web_lg is not installed. Run: "
+ "python -m spacy download en_core_web_lg"
+ )
asyncio.run(process_file(path, ir_dir, final_dir, stop_after))
@@ -720,54 +456,6 @@ async def load_or_extract_ir(path: Path, text: str, ir_dir: Path) -> dict:
print(f"[IR] Extracted {path.stem}")
return ir
-def _merge_commands(entity, commands):
- existing = {c["command"] for c in entity.get("x_cti_commands", [])}
- for c in commands:
- if c["command"] not in existing:
- entity.setdefault("x_cti_commands", []).append(c)
-
-def rag_safe_relationships(rels: list[dict], min_conf: float = 0.55) -> list[dict]:
- """
- Filter relationships for RAG suitability.
-
- Constraints:
- • confidence ≥ min_conf
- • source_context ∈ {behavior, sentence}
- """
- return [
- r for r in rels
- if r.get("confidence", 0.0) >= min_conf
- and r.get("source_context") in {"behavior", "sentence"}
- ]
-
-def prepare_raw_uploads(base_dir: Path, selected: list[dict]):
- uploads = base_dir / "raw" / "uploads"
- inbox = base_dir / "raw" / "inbox"
- processed = base_dir / "raw" / "processed"
- SUPPORTED_EXTS = {".html", ".htm", ".pdf", ".txt", ".md"}
-
-
- uploads.mkdir(parents=True, exist_ok=True)
- for item in selected:
- name = item["name"]
- location = item["location"]
- src_root = inbox if location == "inbox" else processed
- src = src_root / name
- if not src.exists():
- continue
-
- if src.is_file():
- _copy_if_needed(src, uploads / src.name)
-
- elif src.is_dir():
- for f in src.rglob("*"):
- if f.suffix.lower() in SUPPORTED_EXTS:
- _copy_if_needed(f, uploads / f.name)
-
-def _copy_if_needed(src: Path, dst: Path):
- if dst.exists():
- return
- shutil.copy2(src, dst)
diff --git a/app/cti_pipeline_stage2.py b/app/cti_pipeline_stage2.py
index dbc4e7b..3cc248c 100644
--- a/app/cti_pipeline_stage2.py
+++ b/app/cti_pipeline_stage2.py
@@ -15,52 +15,30 @@
data/outputs_stix/debug/.ir.json (IR copy)
data/outputs_stix/debug/.ir.pretty.txt (IR pretty summary)
data/outputs_stix/debug/.conversion.log (step-by-step log)
- data/outputs_stix/debug/.relationships.json (relationship debug)
data/outputs_stix/debug/.validation.txt (validation issues)
data/outputs_stix/debug/.metrics.json (quality metrics)
data/outputs_stix/debug/.audit.json (full audit trail)
"""
-import argparse
import json
from pathlib import Path
-import uuid
import datetime
-from nltk.corpus import wordnet as wn
# ----------------- Imports from utilities -----------------
-from plugins.mcp.app.utilities.cti_linguistics import normalize_behavior_text
from plugins.mcp.app.utilities.cti_stix_builders import (
make_bundle,
- make_malware,
- make_tool,
make_threat_actor,
- make_infrastructure,
make_attack_pattern,
- make_observed_data,
- make_relationship,
- make_identity,
- make_user_account,
- make_software,
- make_ipv4_addr,
- make_file_path,
- make_windows_registry_key,
)
-from plugins.mcp.app.utilities.cti_taxonomy_loader import (
- load_mitre_taxonomy,
- lookup_name,
- lookup_attack_id
-)
+from plugins.mcp.app.utilities.cti_taxonomy_loader import load_mitre_taxonomy
from plugins.mcp.app.utilities.cti_stix_validation import validate_bundle
from plugins.mcp.app.utilities.cti_stix_report_writer import render_stix_report
-from plugins.mcp.app.utilities.cti_defend_enricher import enrich_stix_bundle_with_defend
from plugins.mcp.app.utilities.cti_mitre_extract import hashes_to_stix_observed_data
-from plugins.mcp.app.utilities.llm_client import get_llm_provenance
# -----------------------------------------------------------
@@ -75,12 +53,7 @@
OUTPUTS_IR_DIR = "outputs_ir/complete"
OUTPUTS_STIX_DIR = "outputs_stix"
DEBUG_DIR = "debug"
-OUTPUTS_CAD_DIR = "outputs_cad"
-
-def get_d3fend_root(mcp_root: Path | None = None) -> Path:
- """Return the existing D3FEND CAD asset directory."""
- return (mcp_root or root_dir) / "app" / "utilities" / "D3fend_CAD"
def log(msg):
@@ -112,40 +85,22 @@ def load_ir(path: Path) -> dict:
def compute_metrics(ir: dict, bundle: dict) -> dict:
"""Generate transformation quality metrics."""
return {
- "timestamp": datetime.datetime.utcnow().isoformat() + "Z",
+ "timestamp": datetime.datetime.now(datetime.UTC).isoformat().replace("+00:00", "Z"),
"input_counts": {
- "malware": len(ir.get("malware", [])),
- "tools": len(ir.get("tools", [])),
"threat_actors": len(ir.get("threat_actors", [])),
- "infrastructure": len(ir.get("infrastructure", [])),
"attack_patterns": len(ir.get("attack_patterns", [])),
"behaviors": len(ir.get("behaviors", [])),
- "relationships": len(ir.get("relationships", [])),
- "domains": len(ir.get("domains", [])),
- "user_accounts": len(ir.get("user_accounts", [])),
- "software": len(ir.get("software", [])),
+ "hashes": len(ir.get("hashes", [])),
},
"output_counts": {
"total_stix_objects": len(bundle.get("objects", [])),
- "relationships": len([
- o for o in bundle.get("objects", [])
- if o.get("type") == "relationship"
- ]),
"attack_patterns": len([
o for o in bundle.get("objects", [])
if o.get("type") == "attack-pattern"
]),
- "identities": len([
- o for o in bundle.get("objects", [])
- if o.get("type") == "identity"
- ]),
- "user_accounts": len([
- o for o in bundle.get("objects", [])
- if o.get("type") == "user-account"
- ]),
- "software": len([
+ "threat_actors": len([
o for o in bundle.get("objects", [])
- if o.get("type") == "software"
+ if o.get("type") == "threat-actor"
]),
}
}
@@ -169,42 +124,12 @@ def convert_ir_to_stix(ir: dict, debug: dict, taxonomy: dict) -> dict:
"""
stix_objects = []
- name_to_id = {}
debug["conversion_steps"] = []
- debug["relationship_debug"] = []
# Helper for logging
def log(msg):
debug["conversion_steps"].append(msg)
- log(f"[DEBUG] Processing {len(ir.get('attack_patterns', []))} TTPs, "
- f"{len(ir.get('relationships', []))} relationships")
-
-
- # ------- Malware -------
- # Pass the loaded MITRE ATT&CK taxonomy so the builder enriches each
- # object with x_mitre_platforms, x_mitre_aliases, malware_types,
- # external_references — pure ontology lookup (no static malware->OS
- # tables). Misses degrade gracefully to IR-only output.
- for m in ir.get("malware", []):
- obj = make_malware(m, taxonomy)
- log(f"Malware → {m.get('name')} → {obj['id'] if obj else 'SKIPPED'} "
- f"platforms={obj.get('x_mitre_platforms') if obj else None}")
- if obj:
- stix_objects.append(obj)
- name_to_id[obj["name"].lower()] = obj["id"]
- for alias in obj.get("aliases", []):
- name_to_id[alias.lower()] = obj["id"]
-
- # ------- Tools -------
- for t in ir.get("tools", []):
- obj = make_tool(t, taxonomy)
- log(f"Tool → {t.get('name')} → {obj['id'] if obj else 'SKIPPED'} "
- f"platforms={obj.get('x_mitre_platforms') if obj else None}")
- if obj:
- stix_objects.append(obj)
- name_to_id[obj["name"].lower()] = obj["id"]
- for alias in obj.get("aliases", []):
- name_to_id[alias.lower()] = obj["id"]
+ log(f"[DEBUG] Processing {len(ir.get('attack_patterns', []))} TTPs")
# ------- Threat Actors -------
for ta in ir.get("threat_actors", []):
@@ -212,165 +137,6 @@ def log(msg):
log(f"Threat Actor → {ta.get('name')} → {obj['id'] if obj else 'SKIPPED'}")
if obj:
stix_objects.append(obj)
- name_to_id[obj["name"].lower()] = obj["id"]
- for alias in obj.get("aliases", []):
- name_to_id[alias.lower()] = obj["id"]
-
- # ------- Infrastructure -------
- # Pass the full attack_patterns list AND the taxonomy so
- # make_infrastructure can derive kill_chain_phases via three signals:
- # 1) IR APs with explicit 'tactic' (post-enrichment)
- # 2) IR APs with explicit kill_chain_phases
- # 3) IR APs carrying a technique id resolved against ATT&CK
- # attack_id_index (pure ontology lookup; no static T1xxx tables).
- _ir_aps = ir.get("attack_patterns", [])
- # IR relationships drive per-infra `kill_chain_phases` scoping
- # inside make_infrastructure (see gap #6 in
- # /tmp/blackcat-pipeline-vs-measuring-stick.md). Without this the
- # builder falls back to the legacy "every related AP's phases on
- # every infra" union (12 KCPs each on BlackCat) instead of the
- # measuring-stick-target 1-3 phases per infra.
- _ir_relationships = ir.get("relationships", []) or []
- # Track infrastructure objects so we can later emit located-at edges
- # to domain identities.
- infra_objs_for_locating: list[dict] = []
- for inf in ir.get("infrastructure", []):
- obj = make_infrastructure(
- inf,
- related_attack_patterns=_ir_aps,
- taxonomy=taxonomy,
- relationships=_ir_relationships,
- )
- log(f"Infrastructure → {inf.get('name')} → {obj['id'] if obj else 'SKIPPED'} "
- f"types={obj.get('infrastructure_types') if obj else None} "
- f"kcp={len(obj.get('kill_chain_phases', [])) if obj else 0} "
- f"ip={obj.get('x_cti_ip') if obj else None} "
- f"os={obj.get('x_cti_target_os') if obj else None} "
- f"role={obj.get('x_cti_role') if obj else None}")
- if obj:
- stix_objects.append(obj)
- name_to_id[obj["name"].lower()] = obj["id"]
- for alias in obj.get("aliases", []):
- name_to_id[alias.lower()] = obj["id"]
- if obj.get("x_cti_ip"):
- infra_objs_for_locating.append(obj)
-
- # ------- Domains (NEW IR field) -------
- # cti_extract_domains emits dicts shaped
- # {name, type, confidence, signals, evidence}. Each becomes a STIX
- # 2.1 identity SDO. AD-typed entries are emitted with
- # identity_class="organization" and an x_cti_signals list carrying
- # the ATT&CK technique IDs that triggered the AD classification.
- # The identity IDs are recorded in domain_name_to_id so the
- # downstream user-account / infrastructure located-at edges can
- # resolve their target_ref.
- domain_name_to_id: dict[str, str] = {} # lowercased domain name -> identity-- id
- for d in ir.get("domains", []) or []:
- if not isinstance(d, dict):
- continue
- # AD / unknown / dns-only — every one becomes an identity SDO;
- # the type slug rides as x_cti_domain_type for downstream
- # consumers.
- obj = make_identity(d, identity_class="organization")
- log(f"Identity (domain) → {d.get('name')} → "
- f"{obj['id'] if obj else 'SKIPPED'} "
- f"type={obj.get('x_cti_domain_type') if obj else None} "
- f"signals={obj.get('x_cti_signals') if obj else None}")
- if obj:
- stix_objects.append(obj)
- domain_name_to_id[obj["name"].lower()] = obj["id"]
- # Also register in name_to_id so a freeform IR relationship
- # could reference the domain by name.
- name_to_id.setdefault(obj["name"].lower(), obj["id"])
-
- # ------- User Accounts (NEW IR field) -------
- # cti_extract_users emits dicts shaped {username, domain, password,
- # privilege, account_type, evidence, confidence}. Each becomes a
- # STIX 2.1 user-account SCO. Passwords are dropped by default
- # (keep_credential=False) per the no-secrets-in-bundle rule; the
- # SCO instead carries x_cti_password_provenance ∈
- # {absent, redacted, source}.
- user_account_objs: list[dict] = []
- for u in ir.get("user_accounts", []) or []:
- if not isinstance(u, dict):
- continue
- obj = make_user_account(u, keep_credential=False)
- log(f"User-Account → {u.get('username')} → "
- f"{obj['id'] if obj else 'SKIPPED'} "
- f"acct_type={obj.get('account_type') if obj else None} "
- f"domain={obj.get('x_cti_domain') if obj else None} "
- f"pw_prov={obj.get('x_cti_password_provenance') if obj else None}")
- if obj:
- stix_objects.append(obj)
- user_account_objs.append(obj)
-
- # ------- Software (NEW IR field) -------
- # cti_extract_software emits dicts shaped {name, version, source,
- # purl, software_kind, attack_id, cve_refs, evidence, confidence}.
- # Each becomes a STIX 2.1 `software` SCO with version and PURL.
- for sw in ir.get("software", []) or []:
- if not isinstance(sw, dict):
- continue
- obj = make_software(sw, taxonomy=taxonomy)
- log(f"Software → {sw.get('name')} v={sw.get('version')} → "
- f"{obj['id'] if obj else 'SKIPPED'} "
- f"kind={obj.get('x_cti_software_kind') if obj else None} "
- f"attack_id={obj.get('x_cti_attack_id') if obj else None} "
- f"purl={obj.get('x_cti_purl') if obj else None}")
- if obj:
- stix_objects.append(obj)
- name_to_id.setdefault(obj["name"].lower(), obj["id"])
-
- # ------- located-at relationships -------
- # For each user-account whose x_cti_domain matches a domain identity
- # SDO in this bundle, emit a (user-account)->[located-at]->(identity)
- # SRO. STIX 2.1 §5.5 lists "located-at" as a spec relationship type;
- # we use it here to bind cyber-observables (the SCO) to their
- # organizational anchor (the identity SDO).
- for ua in user_account_objs:
- dom = (ua.get("x_cti_domain") or "").strip().lower()
- if not dom:
- continue
- identity_id = domain_name_to_id.get(dom)
- if not identity_id:
- continue
- rel = make_relationship("located-at", ua["id"], identity_id)
- if rel:
- rel["x_cti_confidence"] = ua.get("x_cti_confidence")
- rel["x_cti_status"] = "concrete"
- rel["x_cti_target_role"] = "identity"
- rel["x_cti_evidence"] = ua.get("x_cti_evidence")
- stix_objects.append(rel)
- log(f"Relationship → user-account {ua['user_id']} "
- f"--[located-at]--> identity {dom} → {rel['id']}")
-
- # For each infrastructure object with an IP and a domain identity
- # present in the bundle, emit a (infrastructure)->[located-at]->
- # (identity) SRO. When >1 domain is in the bundle we attempt to
- # match by FQDN suffix on the infra `name`; otherwise we link to
- # the single domain identity.
- if infra_objs_for_locating and domain_name_to_id:
- for infra in infra_objs_for_locating:
- target_identity = None
- iname_low = (infra.get("name") or "").lower()
- for dom_low, ident_id in domain_name_to_id.items():
- # Suffix-match: hostname "srv.contoso.com" -> domain "contoso.com"
- if dom_low and (
- iname_low.endswith("." + dom_low) or iname_low == dom_low
- ):
- target_identity = ident_id
- break
- if target_identity is None and len(domain_name_to_id) == 1:
- target_identity = next(iter(domain_name_to_id.values()))
- if target_identity is None:
- continue
- rel = make_relationship("located-at", infra["id"], target_identity)
- if rel:
- rel["x_cti_status"] = "inferred"
- rel["x_cti_target_role"] = "identity"
- stix_objects.append(rel)
- log(f"Relationship → infrastructure {infra.get('name')} "
- f"--[located-at]--> identity → {rel['id']}")
# ------- TTPs / ATT&CK -------
for ttp in ir.get("attack_patterns", []):
@@ -388,7 +154,6 @@ def log(msg):
log(f"TTP → {label} → {obj['id'] if obj else 'SKIPPED'}")
if obj:
stix_objects.append(obj)
- name_to_id[obj["name"].lower()] = obj["id"]
# ------- Hashes (Observed Data) -------
if ir.get("hashes"):
@@ -396,180 +161,6 @@ def log(msg):
stix_objects.extend(hash_objects)
log(f"Observed-Data → {len(hash_objects)} file hash observables created")
- # ------- Observable SCOs -------
- observable_builders = (
- ("network_subnets", make_ipv4_addr, "IPv4/CIDR observable"),
- ("file_paths", make_file_path, "file path observable"),
- ("registry_keys", make_windows_registry_key, "registry key observable"),
- )
- for field, builder, label in observable_builders:
- seen_values = set()
- emitted = 0
- for raw_value in ir.get(field, []) or []:
- value = str(raw_value).strip()
- if not value:
- continue
- key = value.lower()
- if key in seen_values:
- continue
- seen_values.add(key)
- obj = builder(value)
- if not obj:
- continue
- obj["x_cti_source_field"] = field
- stix_objects.append(obj)
- emitted += 1
- if emitted:
- log(f"Observable SCO → {emitted} {label}(s) from {field}")
-
- # ------- Observed Data -------
- for obs in ir.get("qualified_behaviors", ir.get("behaviors", [])):
- if isinstance(obs, dict):
- behavior_text = obs.get("normalized") or obs.get("description") or ""
- else:
- behavior_text = obs
-
- if not behavior_text.strip():
- log("Observed-Data → SKIPPED (empty after IR normalization)")
- continue
-
- norm_text = normalize_behavior_text(behavior_text)
-
- # obj = make_observed_data(norm_text)
- # if not obj:
- # continue
-
- # if isinstance(obs, dict):
- # if "confidence" in obs:
- # obj["x_cti_confidence"] = obs["confidence"]
- # if "evidence" in obs:
- # obj["x_cti_evidence"] = obs["evidence"]
- # # Preserve execution-ready metadata for MCP RAG / AE / IaC
- # if "x_cti_configuration" in obs:
- # obj["x_cti_configuration"] = obs["x_cti_configuration"]
- # if "x_cti_sequence" in obs:
- # obj["x_cti_sequence"] = obs["x_cti_sequence"]
-
- # stix_objects.append(obj)
-
- # -------------------------------------------------------
- # Build relationships
- # -------------------------------------------------------
- for rel in ir.get("relationships", []):
- # New Stage-1 schema (primary):
- # { "source": "...", "relationship": "...", "target": "..." }
- # Backwards-compatible fallbacks for legacy runs.
-
- src_name = (
- rel.get("source")
- or rel.get("src")
- or rel.get("entity1")
- or ""
- ).lower().strip()
-
- dst_name = (
- rel.get("target")
- or rel.get("dst")
- or rel.get("entity2")
- or ""
- ).lower().strip()
-
- raw_rel = (
- rel.get("relationship")
- or rel.get("rel")
- or rel.get("relation")
- or ""
- )
-
- entry = {"src": src_name, "dst": dst_name, "raw_rel": raw_rel}
- if not raw_rel:
- entry["status"] = "SKIPPED (empty verb)"
- debug["relationship_debug"].append(entry)
- continue
-
-
- if not src_name or not dst_name or not raw_rel:
- entry["status"] = "SKIPPED (missing fields)"
- debug["relationship_debug"].append(entry)
- continue
-
- # -------------------------------------------------------
- # Relationship resolution (lossless, uncertainty-aware)
- # -------------------------------------------------------
-
- status = rel.get("status", "concrete")
- target_role = rel.get("target_role", "unknown")
- confidence = rel.get("confidence", 0.5)
- evidence = rel.get("evidence", [])
- # ---------------------------------------------------------------------------
-
- src_id = name_to_id.get(src_name)
- dst_id = name_to_id.get(dst_name)
-
- # --- Handle unresolved TARGET without dropping ---
- if not dst_id:
- placeholder_name = f"abstract-{target_role}-{dst_name or 'target'}"
-
- if placeholder_name.lower() not in name_to_id:
- placeholder_obj = (
- make_infrastructure({
- "name": placeholder_name,
- "description": "Abstract relationship target derived from CTI text",
- "confidence": confidence,
- "x_cti_status": status,
- "x_cti_evidence": evidence,
- "x_cti_target_role": target_role,
- })
- if target_role == "infrastructure"
- else {
- "type": "x-cti-artifact",
- "spec_version": "2.1",
- "id": new_stix_id("x-cti-artifact"),
- "name": placeholder_name,
- "confidence": confidence,
- "x_cti_status": status,
- "x_cti_evidence": evidence,
- "x_cti_target_role": target_role,
- "x_cti_artifact_kind": "configuration-object",
- }
- )
-
- stix_objects.append(placeholder_obj)
- name_to_id[placeholder_name.lower()] = placeholder_obj["id"]
-
- dst_id = name_to_id[placeholder_name.lower()]
-
-
- # --- Handle unresolved SOURCE (cannot recover safely) ---
- if not src_id:
- entry["status"] = "SKIPPED (unresolved source)"
- debug["relationship_debug"].append(entry)
- continue
-
- # -------------------------------------------------------
- # Relationship creation (Stage-1 semantics preserved)
- # -------------------------------------------------------
-
- stix_rel = raw_rel.strip().lower().replace(" ", "-")
-
- rel_obj = make_relationship(stix_rel, src_id, dst_id)
-
- if rel_obj:
- # Preserve Stage-1 semantics explicitly
- rel_obj["x_cti_confidence"] = rel.get("confidence")
- rel_obj["x_cti_status"] = rel.get("status", "concrete")
- rel_obj["x_cti_target_role"] = rel.get("target_role")
- rel_obj["x_cti_evidence"] = rel.get("evidence")
-
- stix_objects.append(rel_obj)
- entry["status"] = f"CREATED ({rel_obj['x_cti_status']})"
- else:
- entry["status"] = "SKIPPED (failed creation)"
-
-
-
- debug["relationship_debug"].append(entry)
-
# -------------------------------------------------------
# Final STIX Bundle
# -------------------------------------------------------
@@ -577,14 +168,20 @@ def log(msg):
if not provenance:
raise ValueError("Missing provenance in IR (rerun Stage-1 to regenerate IR with provenance)")
- model = provenance.get("model")
- provider = provenance.get("provider")
+ # provenance is built from config whether or not the model was reached, so
+ # crediting it unconditionally stamped the configured model onto bundles
+ # that spaCy produced end to end. Stage 1 records which extractor actually
+ # ran; only the LLM path earns the attribution.
+ extractor = ir.get("extractor")
+ used_llm = extractor == "llm"
+ model = provenance.get("model") if used_llm else None
+ provider = provenance.get("provider") if used_llm else None
bundle = make_bundle(
stix_objects,
model=model,
provider=provider,
- config=provenance,
+ config={**provenance, "extractor": extractor} if extractor else provenance,
)
debug["bundle_id"] = bundle["id"]
@@ -597,11 +194,9 @@ def log(msg):
def run_phase2(base_dir: Path):
outputs_ir = base_dir / OUTPUTS_IR_DIR
outputs_stix = base_dir / OUTPUTS_STIX_DIR
- outputs_cad = base_dir / OUTPUTS_CAD_DIR
debug_dir = outputs_stix / DEBUG_DIR
outputs_stix.mkdir(parents=True, exist_ok=True)
- outputs_cad.mkdir(parents=True, exist_ok=True)
# Load MITRE taxonomy once
taxonomy = load_mitre_taxonomy()
@@ -651,8 +246,6 @@ def run_phase2(base_dir: Path):
write_debug_file(debug_dir / f"{stem}.metrics.json", metrics)
# Write relationship debug
- write_debug_file(debug_dir / f"{stem}.relationships.json",
- debug.get("relationship_debug", []))
# Write conversion log
write_debug_file(debug_dir / f"{stem}.conversion.log",
@@ -665,16 +258,8 @@ def run_phase2(base_dir: Path):
"metrics": metrics,
"validation_errors": errors,
"conversion_log": debug.get("conversion_steps", []),
- "relationship_debug": debug.get("relationship_debug", []),
}
- audit["unresolved_entities"] = [
- r for r in debug.get("relationship_debug", [])
- if "unresolved" in r.get("status", "")
- ]
-
- audit["object_count_before_bundle"] = len(bundle.get("objects", []))
- audit["object_count_after_bundle"] = len(bundle.get("objects", []))
-
+ audit["object_count"] = len(bundle.get("objects", []))
write_debug_file(debug_dir / f"{stem}.audit.json", audit)
@@ -690,92 +275,6 @@ def run_phase2(base_dir: Path):
log(f" → wrote {stem}.stix.txt")
- # -------------------------------------------------------
- # Write CAD Graph Preview for Visualizer Testing
- # -------------------------------------------------------
- defense_root = get_d3fend_root()
- try:
- enriched_bundle, ontology_info = enrich_stix_bundle_with_defend(bundle, defense_root)
- except FileNotFoundError as e:
- log(f"[D3FEND] Skipping enrichment (missing assets): {e}")
- ontology_info = {}
- log(" → performed D3FEND enrichment")
- log("ontology_info keys:")
- log(", ".join(ontology_info.keys()))
- if "cad_graph" in ontology_info:
- cad_out = outputs_cad / f"{stem}.cad.json"
- with cad_out.open("w", encoding="utf-8") as f:
- json.dump(ontology_info["cad_graph"], f, indent=2)
-
- log(f" → wrote {cad_out.name} (CAD Graph Preview)")
- else:
- log(" [!] No CAD graph returned from enrichment.")
-
- # -------------------------------------------------------
- # STDOUT log: ontology modules + mappings + schema used
- # -------------------------------------------------------
- log("\n===== D3FEND ENRICHMENT DEBUG =====")
- if ontology_info:
- modules = ontology_info.get("ontology_modules", [])
- log(f"[Ontology] Loaded {len(modules)} ontology_modules:")
- for m in modules:
- log(f" - {m}")
- log(f"\n[CAD Schema] {ontology_info.get('cad_schema')}")
-
- log("\n[Dynamic D3FEND Class Mappings]:")
- for k, v in ontology_info.get("mappings_used", {}).items():
- log(f" {k:20s} → {v}")
- else:
- log("[D3FEND] Enrichment skipped — ontology assets not available")
- log("===== END D3FEND ENRICHMENT DEBUG =====\n")
-
-
-# -----------------------------------------------------------
-# STIX → CAD Enrichment Only Runner
-# -----------------------------------------------------------
-def run_stix_to_cad_only(base_dir: Path):
- outputs_stix = base_dir / OUTPUTS_STIX_DIR
- outputs_cad = base_dir / OUTPUTS_CAD_DIR
-
- outputs_stix.mkdir(parents=True, exist_ok=True)
- outputs_cad.mkdir(parents=True, exist_ok=True)
-
- log("[+] Running STIX → CAD enrichment only")
-
- # Only process raw STIX bundles, not CAD output
- stix_files = sorted(outputs_stix.glob("*.stix.json"))
- if not stix_files:
- log("[!] No .stix.json files found in outputs_stix/.")
- return
-
- defense_root = get_d3fend_root()
-
- for stix_file in stix_files:
- log(f" [*] Enriching {stix_file.name}")
-
- with stix_file.open("r", encoding="utf-8") as f:
- bundle = json.load(f)
- enriched_bundle, ontology_info = enrich_stix_bundle_with_defend(bundle, defense_root)
-
- stem = stix_file.name.replace(".stix.json", "")
- # Write CAD graph
- if "cad_graph" in ontology_info:
- cad_out = outputs_cad / f"{stem}.cad.json"
- with cad_out.open("w", encoding="utf-8") as f:
- json.dump(ontology_info["cad_graph"], f, indent=2)
- log(f" → wrote {cad_out.name} (CAD Graph)")
- else:
- log(" [!] No CAD graph returned.")
-
-def is_physical_or_protocol(noun: str) -> bool:
- synsets = wn.synsets(noun, pos=wn.NOUN)
- return any(s.lexname() in {"noun.artifact", "noun.communication"} for s in synsets)
-
-def new_stix_id(stix_type: str) -> str:
- """
- Generate a valid STIX 2.1 ID using UUIDv4.
- """
- return f"{stix_type}--{uuid.uuid4()}"
diff --git a/app/discovery/servers.py b/app/discovery/servers.py
index f70d0ea..2b4aebe 100644
--- a/app/discovery/servers.py
+++ b/app/discovery/servers.py
@@ -55,13 +55,14 @@ def discover_mcp_servers(plugins_root: Path) -> dict:
# the defaults baked in below.
cti_pipeline_path = plugins_root / "mcp" / "mcp_server.py"
if cti_pipeline_path.exists():
+ # Only reached when the server's own MCP_METADATA could not be read.
+ # Restating its description here is how this copy came to advertise a
+ # deploy step that no longer exists, so say only what is still true
+ # when the metadata is unavailable.
cti_metadata = _safe_load_metadata(cti_pipeline_path) or {
"display_name": "CTI Pipeline",
"default_enabled": False,
- "description": (
- "CTI ingest -> STIX -> adversary -> "
- "-> operation -> detection-validation tools."
- ),
+ "description": "CTI pipeline tools. Server metadata unavailable.",
}
registry["cti_pipeline"] = {
"path": cti_pipeline_path,
diff --git a/app/dspy_env.py b/app/dspy_env.py
index f9bfc15..fa7ae1a 100644
--- a/app/dspy_env.py
+++ b/app/dspy_env.py
@@ -20,6 +20,14 @@
import os
import dspy
+# dspy parks a lazy proxy at sys.modules["numpy"], and thinc's Cython
+# _import_array() cannot see through it, so spaCy fails to import. A bare
+# `import numpy` only rebinds the proxy; the attribute access is what forces
+# the real module. Every path that reaches spaCy imports dspy_env first.
+import numpy as _numpy
+
+_ = _numpy.ndarray
+
ENV_MODEL = "DSPY_MODEL"
ENV_API_KEY = "DSPY_API_KEY"
@@ -30,10 +38,13 @@
ENV_TIMEOUT = "DSPY_TIMEOUT"
ENV_SSL_VERIFY = "DSPY_SSL_VERIFY"
+# Last-resort fallbacks when a setting reaches here unset. Kept equal to
+# conf/default.yml so the subprocess cannot run on different numbers from the
+# ones the UI displays.
_DEFAULTS = {
"model": "gpt-4o",
- "temperature": 0.5,
- "max_tokens": 10000,
+ "temperature": 0.0,
+ "max_tokens": 24000,
}
_LM_CONFIGURED = False
@@ -181,7 +192,16 @@ def __init__(self):
self.create_full_command = dspy.ChainOfThought(CreateFullCommand)
def forward(self, description: str, platform: str):
- identified_technologies = self.identify_technologies(description=description, platform=platform)
- ranked_approaches = self.rank_approaches(description=description, technologies=identified_technologies)
- full_command = self.create_full_command(technologies=identified_technologies, approaches=ranked_approaches)
- return full_command.command
+ # Each step returns a Prediction, not the field. Passing the whole
+ # object into a list[str] input made DSPy stringify the prediction,
+ # reasoning included, into the next prompt: the ranker saw a paragraph
+ # of prose where it declared a list, and warned on every call.
+ technologies = self.identify_technologies(
+ description=description, platform=platform
+ ).technologies
+ approaches = self.rank_approaches(
+ description=description, technologies=technologies
+ ).approaches
+ return self.create_full_command(
+ technologies=technologies, approaches=approaches
+ ).command
diff --git a/app/mcp_api.py b/app/mcp_api.py
index 424b1b7..cbb087a 100644
--- a/app/mcp_api.py
+++ b/app/mcp_api.py
@@ -7,12 +7,24 @@
import yaml
import shutil
import asyncio
-import subprocess
from pathlib import Path
-from datetime import datetime
+from datetime import datetime, timezone
+
+from app.service.auth_svc import for_all_public_methods, check_authorization
from plugins.mcp.app.config import llm_defaults
-from plugins.mcp.app.utilities.llm_client import load_config, reload_config
+from plugins.mcp.app.utilities.llm_client import (
+ LLM_OVERRIDABLE,
+ LLM_PROFILES,
+ WORKLOAD_OVERRIDABLE,
+ deep_merge,
+ layered_profile,
+ load_config,
+ reload_config,
+ resolve_env_indirection,
+ unwrap_config_envelope,
+)
+from plugins.mcp.app.utilities.cti_raw_cleaner import clean_stem
from plugins.mcp.app.utilities.paths import get_mcp_data_dir, get_mcp_root
from plugins.mcp.app.cti_ingest_svc import CTIIngestService
@@ -20,8 +32,11 @@
# come back from llm_defaults() which already applies its own fallbacks;
# the RAG-specific defaults stay here because they belong to the capability
# rather than the LLM provider.
+#
+# rag_embed_model has no literal default: an undeclared embedding model falls
+# back to the configured chat model, since a deployment pointing at its own
+# gateway has no reason to reach for an OpenAI model name it never chose.
_RAG_DEFAULTS = {
- "rag_embed_model": "openai/text-embedding-3-small",
"rag_topk": 5,
}
@@ -30,7 +45,36 @@
# Matched by name rather than listed: the UI keeps growing key fields
# (embed_api_key, plan_api_key, cti_rag_api_key) and a list keeps missing them.
# api_key_env names a variable, not a value, so it is kept.
-_SECRET_KEY_NAME = re.compile(r"api_?key", re.IGNORECASE)
+# Widened past api_key: a gateway credential also arrives as an Authorization
+# or x-api-key header, and the llm section used to accept any key at all, so
+# all three reached the file in plaintext.
+# max_tokens contains "token" and is a generation setting, not a credential,
+# so the token alternative excludes it explicitly. Dropping it silently is
+# worse than not matching a credential, because the operator sees a saved
+# value vanish with no error.
+_SECRET_KEY_NAME = re.compile(
+ r"(api[-_]?key|authorization|bearer|(? bool:
@@ -45,10 +89,23 @@ def _without_secrets(value):
return [_without_secrets(v) for v in value]
return value
+# Caldera gates plugin routes per handler, not with a middleware: auth_svc.apply
+# only installs the session and security machinery, and check_authorization is
+# what calls check_permissions. Without this every route here was reachable
+# unauthenticated, including the ones that delete files and rewrite local.yml.
+# McpGUI in this same plugin already carries it, as do access, gameboard and
+# human. Every public method on this class is a registered route.
+@for_all_public_methods(check_authorization)
class McpAPI:
def __init__(self, services):
self.services = services
+ # check_authorization reaches for self.auth_svc on the instance.
+ self.auth_svc = services.get("auth_svc")
+ # Outcome of the most recent CTI run. cti_run returns as soon as the
+ # work is scheduled, so this is the only thing the browser can poll to
+ # learn that a run failed.
+ self._cti_run = {"state": "idle", "step": None, "files": [], "error": None}
self.mcp_svc = services.get("mcp_svc")
self.log = logging.getLogger("plugins.mcp")
self.log.info("[MCP] Initialized McpAPI")
@@ -222,10 +279,12 @@ async def defaults(self, request):
"fields_locked": cfg.get("fields_locked") or {},
}
for key, fallback in _RAG_DEFAULTS.items():
- if key == "rag_embed_model":
- payload[key] = cfg.get(key) or cfg.get("embed_model") or fallback
- else:
- payload[key] = cfg.get(key, fallback)
+ payload[key] = cfg.get(key, fallback)
+ payload["rag_embed_model"] = (
+ cfg.get("rag_embed_model")
+ or cfg.get("embed_model")
+ or cfg.get("model")
+ )
return web.json_response(payload)
except Exception as e:
self.log.error(f"[MCP] Error fetching defaults: {e}")
@@ -328,7 +387,7 @@ async def upload_rag(self, request):
target_path = base_dir / filename
if target_path.exists():
- ts = datetime.utcnow().strftime("%Y%m%d_%H%M%S")
+ ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
stem = Path(filename).stem
suffix = Path(filename).suffix
filename = f"{stem}_{ts}{suffix}"
@@ -366,7 +425,7 @@ async def list_rag(self, request):
files.append({
"filename": p.name,
"size": stat.st_size,
- "modified": datetime.utcfromtimestamp(stat.st_mtime).isoformat() + "Z"
+ "modified": datetime.fromtimestamp(stat.st_mtime, timezone.utc).isoformat().replace("+00:00", "Z")
})
except Exception:
continue
@@ -486,7 +545,17 @@ async def get_run_detail(self, request):
# CTI vue
async def cti_run(self, request):
try:
- data = await request.json()
+ try:
+ data = await request.json()
+ except Exception:
+ return web.json_response(
+ {"error": "Body must be JSON"}, status=400
+ )
+ if not isinstance(data, dict):
+ return web.json_response(
+ {"error": "Body must be a JSON object"}, status=400
+ )
+
files = data.get("files")
step = data.get("step", "all")
@@ -495,6 +564,20 @@ async def cti_run(self, request):
{"error": "Missing files list"},
status=400
)
+ # Every name is joined onto a Path below, so a non-string element
+ # raises TypeError and surfaces as a 500. The upload handlers pass
+ # their filenames through basename; this one never did, so a name
+ # with a separator escaped the uploads directory.
+ if not all(isinstance(f, str) and f.strip() for f in files):
+ return web.json_response(
+ {"error": "files must be a list of non-empty strings"},
+ status=400
+ )
+ if any(f != os.path.basename(f) for f in files):
+ return web.json_response(
+ {"error": "files must be bare filenames"},
+ status=400
+ )
uploads = self.base_dir / "raw" / "uploads"
processed = self.base_dir / "raw" / "processed"
@@ -503,7 +586,10 @@ async def cti_run(self, request):
processed.mkdir(parents=True, exist_ok=True)
# 1️⃣ Rehydrate selected items (for re-runs)
- svc = CTIIngestService()
+ # The selection has to reach the service: clean/ accumulates, so
+ # without it Stage 1 re-extracts every report ever ingested while
+ # the browser reports the count the operator picked.
+ svc = CTIIngestService(selected=files)
uploads_dir = self.base_dir / "raw" / "uploads"
processed_dir = self.base_dir / "raw" / "processed"
@@ -520,13 +606,44 @@ async def cti_run(self, request):
# 2️⃣ Run pipeline (NON-BLOCKING)
loop = asyncio.get_running_loop()
- loop.run_in_executor(
+ future = loop.run_in_executor(
None,
svc.run_stage,
self.base_dir,
step
)
+ self._cti_run = {
+ "state": "running", "step": step, "files": files, "error": None,
+ }
+
+ # run_stage re-raises after marking FAILED. Without retrieving the
+ # result the exception dies with the future, so a run that failed
+ # immediately looked identical to one still working: no log line,
+ # and the file stuck on "pending" forever. The outcome is recorded
+ # here too, because the service instance is local to this request
+ # and the browser has nothing else to poll.
+ def _report(fut):
+ exc = fut.exception()
+ if exc is None:
+ self._cti_run = {
+ "state": "complete", "step": step, "files": files,
+ "error": None,
+ }
+ self.log.info(f"[MCP] CTI pipeline finished: step={step}")
+ else:
+ self._cti_run = {
+ "state": "failed", "step": step, "files": files,
+ "error": f"{type(exc).__name__}: {exc}",
+ }
+ self.log.error(
+ f"[MCP] CTI pipeline failed: step={step} files={files}",
+ exc_info=exc,
+ )
+
+ future.add_done_callback(_report)
+ self.log.info(f"[MCP] CTI pipeline started: step={step} files={files}")
+
return web.json_response({
"status": "started",
"files": files,
@@ -552,11 +669,14 @@ async def upload_stix_cti(self, request):
self.base_dir.mkdir(parents=True, exist_ok=True)
- rag_dir = self.base_dir / "stix_cti"
+ # Same directory the four read handlers and the pipeline use.
+ # Uploading to stix_cti made every bundle invisible to list,
+ # get, download and delete.
+ rag_dir = self.base_dir / "outputs_stix"
rag_dir.mkdir(parents=True, exist_ok=True)
target_path = rag_dir / filename
if target_path.exists():
- ts = datetime.utcnow().strftime("%Y%m%d_%H%M%S")
+ ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
target_path = rag_dir / f"{target_path.stem}_{ts}.json"
data = await part.read()
@@ -585,15 +705,16 @@ async def list_stix_cti(self, request):
for p in stix_dir.glob("*.json"):
stat = p.stat()
- # ⬇️ READ BUNDLE METADATA SAFELY
model = None
provider = None
+ extractor = None
try:
with p.open("r", encoding="utf-8") as f:
bundle = json.load(f)
model = bundle.get("x_cti_model")
provider = bundle.get("x_cti_provider")
+ extractor = (bundle.get("x_cti_config") or {}).get("extractor")
except Exception:
# Do NOT fail listing if one file is malformed
pass
@@ -601,9 +722,11 @@ async def list_stix_cti(self, request):
files.append({
"filename": p.name,
"size": stat.st_size,
- "modified": datetime.utcfromtimestamp(stat.st_mtime).isoformat() + "Z",
+ "modified": datetime.fromtimestamp(stat.st_mtime, timezone.utc).isoformat().replace("+00:00", "Z"),
+ # Absent on an offline bundle, which credits no model.
"model": model,
"provider": provider,
+ "extractor": extractor,
})
self.log.info(f"[MCP] listing stix cti files: {files}")
@@ -615,20 +738,49 @@ async def list_stix_cti(self, request):
return web.json_response({"error": str(e)}, status=500)
async def delete_stix_cti(self, request):
- data = await request.json()
- files = data.get("files", [])
- stix_dir = self.base_dir /"outputs_stix"
+ try:
+ data = await request.json()
+ except Exception:
+ return web.json_response({"error": "Body must be JSON"}, status=400)
+
+ files = (data or {}).get("files", [])
+ if not isinstance(files, list) or not all(isinstance(f, str) for f in files):
+ return web.json_response(
+ {"error": "files must be a list of strings"}, status=400
+ )
+
+ stix_dir = self.base_dir / "outputs_stix"
+ stix_root = stix_dir.resolve()
+ deleted = []
for fname in files:
- p = stix_dir / fname
- if p.exists() and p.is_file():
- p.unlink()
+ # This used to join the name and unlink whatever existed, so any
+ # path resolving to a file was deletable. download_stix_cti twelve
+ # lines below already had the right guard.
+ target = (stix_dir / fname).resolve()
+ if stix_root not in target.parents:
+ continue
+ try:
+ if target.is_file():
+ target.unlink()
+ deleted.append(fname)
+ except OSError as e:
+ self.log.error(f"[MCP] could not delete {fname}: {e}")
- return web.json_response({"deleted": files})
+ # Report what actually went, not what was asked for.
+ return web.json_response({"deleted": deleted})
async def upload_cti_raw(self, request):
try:
- reader = await request.multipart()
+ # multipart() raises KeyError('Content-Type') rather than a 4xx
+ # when the header is absent, which reached the client as a 500.
+ try:
+ reader = await request.multipart()
+ except Exception:
+ return web.json_response(
+ {"error": "Expected a multipart/form-data upload"},
+ status=400
+ )
file_part = None
async for part in reader:
if part.name == "file":
@@ -652,16 +804,10 @@ async def upload_cti_raw(self, request):
self.log.info(f"[MCP] Uploaded CTI input: {input_path}")
- # 2️⃣ Kick off pipeline (Stage 1 + 2)
- # subprocess.Popen(
- # ["python", "app/cti_ingest_svc.py", "--base-dir", "data"],
- # stdout=subprocess.DEVNULL,
- # stderr=subprocess.DEVNULL,
- # )
- print(" starting cti ingest subprocess ")
-
+ # Staging only. Extraction runs from the Run Pipeline button,
+ # which posts to /plugin/mcp/cti/run.
return web.json_response({
- "status": "CTI ingest started",
+ "status": "staged",
"file": filename
})
@@ -679,7 +825,13 @@ async def list_cti_raw(self, request):
seen = set()
def file_status(p: Path) -> str:
- ir_path = ir_complete / f"{p.stem}.json"
+ """Processed means an IR exists and is no older than the file.
+
+ The listing used to stamp a literal "processed" on everything
+ in that directory, so a report that was never selected, never
+ cleaned and never extracted still rendered green.
+ """
+ ir_path = ir_complete / f"{clean_stem(p.name)}.json"
if not ir_path.exists():
return "pending"
return (
@@ -688,7 +840,7 @@ def file_status(p: Path) -> str:
else "pending"
)
- def collect(dir_path: Path, status_for_files: str | None):
+ def collect(dir_path: Path):
out = []
if not dir_path.exists():
return out
@@ -706,7 +858,7 @@ def collect(dir_path: Path, status_for_files: str | None):
"name": c.name,
"size": c.stat().st_size,
"type": "file",
- "status": status_for_files,
+ "status": file_status(c),
})
out.append({
"name": p.name,
@@ -719,18 +871,22 @@ def collect(dir_path: Path, status_for_files: str | None):
# -------------------------
# FILE
# -------------------------
+ if p.name in seen:
+ continue
+ seen.add(p.name)
out.append({
"name": p.name,
"type": "file",
"size": p.stat().st_size,
- "status": status_for_files,
+ # Computed, not assumed from which directory it sits in.
+ "status": file_status(p),
})
return out
# uploads first, processed second (UI expectation)
- items.extend(collect(uploads_dir, "pending"))
- items.extend(collect(processed_dir, "processed"))
+ items.extend(collect(uploads_dir))
+ items.extend(collect(processed_dir))
return web.json_response({"items": items})
@@ -752,11 +908,16 @@ async def delete_cti_raw(self, request):
deleted = []
def try_delete(base: Path, name: str) -> bool:
+ if not isinstance(name, str) or not name.strip():
+ return False
+
target = (base / name).resolve()
base_resolved = base.resolve()
- # hard safety: no traversal
- if base_resolved not in target.parents and target != base_resolved:
+ # Containment. The base directory itself was previously
+ # admitted, so an empty name resolved to it and the rmtree
+ # below removed the whole uploads or processed directory.
+ if base_resolved not in target.parents:
return False
if target.exists():
@@ -806,11 +967,111 @@ async def get_stix_cti(self, request):
except Exception as e:
return web.json_response({"error": str(e)}, status=500)
+ async def cti_status(self, request):
+ """Outcome of the most recent CTI run.
+
+ cti_run schedules the work and returns immediately, so without this
+ a failure only ever reached the server log and the row in the UI
+ stayed on 'pending' indefinitely.
+ """
+ return web.json_response(self._cti_run)
+
+ async def view_cti_raw(self, request):
+ """Return an uploaded report as text for the preview modal.
+
+ A PDF is not readable as-is, so the extracted text from data/clean is
+ preferred when the pipeline has already produced it, and pdftotext runs
+ on demand otherwise. That keeps a pending PDF viewable without making
+ the operator run the pipeline just to see what they uploaded.
+ """
+ try:
+ try:
+ data = await request.json()
+ except Exception:
+ return web.json_response({"error": "Body must be JSON"}, status=400)
+
+ filename = (data or {}).get("filename")
+ if not filename or not isinstance(filename, str):
+ return web.json_response({"error": "Missing filename"}, status=400)
+
+ # A nested upload is addressed as "/", so basename is
+ # too strict here. resolve() collapses any .. before the parents
+ # check, which is what actually contains the read to the root.
+ uploads = self.base_dir / "raw" / "uploads"
+ processed = self.base_dir / "raw" / "processed"
+ target = None
+ for root in (uploads, processed):
+ candidate = (root / filename).resolve()
+ if root.resolve() in candidate.parents and candidate.is_file():
+ target = candidate
+ break
+ if target is None:
+ return web.json_response({"error": "File not found"}, status=404)
+
+ suffix = target.suffix.lower()
+ if suffix == ".pdf":
+ clean = self.base_dir / "clean" / f"{clean_stem(target.name)}.txt"
+ if clean.is_file():
+ text = clean.read_text(encoding="utf-8", errors="replace")
+ else:
+ # Same missing-poppler case the cleaner handles: name the
+ # dependency rather than letting FileNotFoundError read as
+ # the report being absent.
+ try:
+ proc = await asyncio.create_subprocess_exec(
+ "pdftotext", "-layout", str(target), "-",
+ stdout=asyncio.subprocess.PIPE,
+ stderr=asyncio.subprocess.PIPE,
+ )
+ except FileNotFoundError:
+ return web.json_response(
+ {"error": "pdftotext not found. Install poppler to "
+ "preview PDF reports."},
+ status=501,
+ )
+ out, err = await proc.communicate()
+ if proc.returncode != 0:
+ return web.json_response(
+ {"error": f"Could not read PDF: {err.decode()[:200]}"},
+ status=500,
+ )
+ text = out.decode("utf-8", errors="replace")
+ else:
+ text = target.read_text(encoding="utf-8", errors="replace")
+
+ return web.json_response({
+ "filename": filename,
+ "kind": suffix.lstrip("."),
+ "size": target.stat().st_size,
+ "text": text,
+ })
+
+ except Exception as e:
+ self.log.error(f"[MCP] view_cti_raw failed: {e}")
+ return web.json_response({"error": str(e)}, status=500)
+
async def get_config(self, request):
try:
cfg = load_config()
+
+ # The panel used to layer the profiles itself, in JavaScript, over
+ # this raw yaml. It duplicated the allowlist and skipped env
+ # resolution, so it displayed "not set" for an endpoint that came
+ # from MCP_LLM_API_BASE while extraction dialled it correctly.
+ # Resolve it here, where the rule already lives.
+ resolved = {}
+ # Every LLM profile, declared or not: an absent workload profile
+ # inherits the connection, and the panel has to show that.
+ for profile in sorted(LLM_PROFILES):
+ resolved[profile] = _without_secrets(
+ resolve_env_indirection(layered_profile(cfg, profile))
+ )
+
self.log.info("[MCP] get_config returning effective config")
- return web.json_response({"config": cfg})
+ return web.json_response({
+ "config": _without_secrets(cfg),
+ "resolved": resolved,
+ })
except Exception as e:
self.log.error(f"[MCP] get_config failed: {e}")
return web.json_response({"error": str(e)}, status=500)
@@ -828,6 +1089,98 @@ async def set_config(self, request):
status=400
)
+ payload = unwrap_config_envelope(data)
+
+ # llm_client dispatches on an exact provider string and raises
+ # "Unsupported model provider" otherwise. Catching it here names
+ # the field while the operator is still looking at it, rather
+ # than failing on every document at extraction time.
+ invalid = [
+ f"{section}.provider={cfg['provider']!r}"
+ for section, cfg in payload.items()
+ if isinstance(cfg, dict) and cfg.get("provider")
+ and cfg["provider"] not in _VALID_PROVIDERS
+ ]
+ if invalid:
+ return web.json_response({
+ "error": f"unsupported provider: {', '.join(invalid)}. "
+ f"Valid: {', '.join(sorted(_VALID_PROVIDERS))}"
+ }, status=400)
+
+ unknown = sorted(set(payload) - _KNOWN_SECTIONS)
+ if unknown:
+ return web.json_response({
+ "error": f"unknown config section: {', '.join(unknown)}. "
+ f"Valid: {', '.join(sorted(_KNOWN_SECTIONS))}."
+ }, status=400)
+
+ # The reader drops any connection key on a workload profile, so
+ # accepting one here and answering "saved" persists a setting that
+ # will never be read. Refuse it while the operator is still looking
+ # at the field, and name the profile that does own it. The llm
+ # profile has its own allowlist: it used to take any key, so an
+ # Authorization header or an mlflow host landed in the file.
+ def _allowed(section):
+ if section in _SECTION_OVERRIDABLE:
+ return _SECTION_OVERRIDABLE[section]
+ return LLM_OVERRIDABLE if section == "llm" else WORKLOAD_OVERRIDABLE
+
+ # A credential-named key is stripped by _without_secrets below
+ # rather than refused, so an older cached bundle that still posts
+ # api_key can save the rest of its payload instead of failing
+ # outright. Everything else outside the allowlist is a structural
+ # mistake worth naming.
+ misplaced = [
+ f"{section}.{key}"
+ for section, cfg in payload.items()
+ if isinstance(cfg, dict)
+ for key in sorted(cfg)
+ if key not in _allowed(section) and not _is_secret(key)
+ ]
+ if misplaced:
+ return web.json_response({
+ "error": f"not settable here: {', '.join(misplaced)}. "
+ f"The connection belongs to 'llm'; a workload "
+ f"profile may set "
+ f"{', '.join(sorted(WORKLOAD_OVERRIDABLE))}. "
+ f"Credentials belong in plugins/mcp/.env."
+ }, status=400)
+
+ bind = (payload.get("mlflow") or {}).get("host")
+ if bind is not None and str(bind) not in _LOOPBACK_HOSTS:
+ return web.json_response({
+ "error": f"mlflow.host {bind!r} would expose the tracking "
+ f"server, which holds every logged prompt and "
+ f"response, on a non-loopback interface. Edit "
+ f"conf/local.yml directly if that is intended."
+ }, status=400)
+
+ # fields_locked is the lock itself. Writable, it unlocks itself,
+ # so it is editable only by hand in conf/local.yml.
+ locked_write = [
+ section for section, cfg in payload.items()
+ if isinstance(cfg, dict) and "fields_locked" in cfg
+ ]
+ if locked_write:
+ return web.json_response({
+ "error": "fields_locked cannot be set over the API; "
+ "edit conf/local.yml directly."
+ }, status=400)
+
+ # Honour the lock this endpoint used to ignore entirely.
+ effective = load_config()
+ blocked = [
+ f"{section}.{key}"
+ for section, cfg in payload.items()
+ if isinstance(cfg, dict)
+ for key in sorted(cfg)
+ if ((effective.get(section) or {}).get("fields_locked") or {}).get(key)
+ ]
+ if blocked:
+ return web.json_response({
+ "error": f"locked by conf/local.yml: {', '.join(blocked)}"
+ }, status=400)
+
conf_dir = self.root_dir / "conf"
conf_dir.mkdir(exist_ok=True)
@@ -836,15 +1189,26 @@ async def set_config(self, request):
# 1️⃣ Load existing local.yml if present
if local_path.exists():
with local_path.open("r", encoding="utf-8") as f:
- existing = yaml.safe_load(f) or {}
+ existing = unwrap_config_envelope(yaml.safe_load(f) or {})
else:
existing = {}
- # 2️⃣ Update only provided top-level keys
+ # 2️⃣ Merge the provided keys into each section.
# Example payload: { "cti": {...} } or { "llm": {...} }
- for section, cfg in data.items():
+ # get_config hands back {"config": cfg}, so a client that edits
+ # what it read posts that envelope straight back.
+ #
+ # This assigned the section outright, so a partial payload erased
+ # every key it did not mention. The CTI panel posts four keys, so
+ # one Save deleted a hand-pinned model, api_base or ssl_verify.
+ # Removing a key is still a file edit; a POST only ever adds or
+ # updates.
+ for section, cfg in payload.items():
if isinstance(cfg, dict):
- existing[section] = cfg
+ current = existing.get(section)
+ existing[section] = (
+ deep_merge(current, cfg) if isinstance(current, dict) else cfg
+ )
# 3️⃣ Scrub secrets from the whole file, not just the posted
# sections, so a save also clears a key an earlier build wrote.
@@ -866,59 +1230,6 @@ async def set_config(self, request):
self.log.error(f"[MCP] Failed to save config: {e}")
return web.json_response({"error": str(e)}, status=500)
- # ===== AE end-to-end workflow runner =====
-
- async def run_ae_end_to_end(self, request):
- """POST /plugin/mcp/workflows/run-ae-end-to-end.
-
- Invokes the in-process ``ae-e2e`` workflow directly (bypassing the
- DSPy / LM pipeline used by /plugin/mcp/execute). Runs every stage to
- completion in the request handler and returns the final state dict so
- callers can show stage statuses without polling /status.
-
- Request body (all optional except cti_source for fresh runs):
- {
- "cti_source": "raw/uploads/report.pdf",
- "dry_run": false,
- "start_stage": "cti",
- "only_stage": null,
- "checkpoint_path": "/tmp/e2e_full_vision_state.json",
- "elk_url": "http://192.168.66.1:9200",
- "kibana_url": "http://192.168.66.1:5601",
- "adversary_slug": "alphv_blackcat",
- "agents_timeout": 600,
- "operation_timeout": 1800,
- "cti_timeout": 900
- }
- """
- try:
- data = await request.json() if request.body_exists else {}
- except Exception as e:
- return web.json_response(
- {"error": f"invalid JSON body: {e}"}, status=400,
- )
- if not isinstance(data, dict):
- return web.json_response(
- {"error": "request body must be a JSON object"}, status=400,
- )
-
- # ae-e2e is intentionally not registered in the workflow registry —
- # it duplicates plan_execute's card in the UI. The endpoint bypasses
- # the registry and instantiates AEEndToEndWorkflow directly with our
- # services dict (workflow.run requires it).
- try:
- from plugins.mcp.app.workflows.ae_e2e import AEEndToEndWorkflow
- workflow = AEEndToEndWorkflow(self.services)
- result = await workflow.run(**data)
- return web.json_response(result)
- except TypeError as e:
- return web.json_response(
- {"error": f"bad workflow arguments: {e}"}, status=400,
- )
- except Exception as e:
- self.log.exception("[MCP] ae-e2e workflow failed")
- return web.json_response({"error": str(e)}, status=500)
-
async def download_stix_cti(self, request):
try:
data = await request.json()
diff --git a/app/mcp_server.py b/app/mcp_server.py
index d25cd98..c26acf1 100644
--- a/app/mcp_server.py
+++ b/app/mcp_server.py
@@ -1,21 +1,24 @@
import os
from mcp.server.fastmcp import FastMCP
-from pydantic import BaseModel
+from typing import Optional
+
import requests
from datetime import datetime
-import time
import collections
import uuid
import sys
from pathlib import Path
-from dspy_env import CreateCommand
-
_REPO_ROOT = Path(__file__).resolve().parents[3]
if str(_REPO_ROOT) not in sys.path:
sys.path.insert(0, str(_REPO_ROOT))
-from plugins.mcp.app.config import caldera_connection, _normalise_api_url
+# Both of these have to come after the path insert above. The first was a bare
+# "from dspy_env import" sitting before it, which resolved only when sys.path[0]
+# happened to be this directory, so importing this module any other way failed
+# with ModuleNotFoundError.
+from plugins.mcp.app.dspy_env import CreateCommand # noqa: E402
+from plugins.mcp.app.config import caldera_connection, _normalise_api_url # noqa: E402
MCP_METADATA = {
"display_name": "CALDERA Core",
@@ -169,7 +172,7 @@ def get_adversaries():
@mcp.tool(name="core_get_adversary_by_ability_id")
-def get_adversary_by_ability_id(ability_id: str, ability_name: str = None):
+def get_adversary_by_ability_id(ability_id: str, ability_name: Optional[str] = None):
"""
Filters all Caldera adversaries by the specifies ability id or ability name.
"""
@@ -329,7 +332,7 @@ def create_adversary(name: str, description: str, atomic_ordering: list):
adversary_id = str(uuid.uuid4())
return caldera_request.make_post_request(
- f"adversaries",
+ "adversaries",
{
"adversary_id": adversary_id,
"name": name,
@@ -346,16 +349,22 @@ def create_operation(operation_name: str, adversary_name: str):
Args:
operation_name: Name for the operation
- adversary_id: ID of the adversary to use for this operation
+ adversary_name: Name of the adversary to use for this operation
Returns:
- The response from the Caldera API or None if adversary details cannot be fetched
+ The response from the Caldera API, or an error dict when the
+ adversary cannot be found.
"""
req = caldera_request.make_get_request("adversaries")
- found_adversaries = []
- for adversary in req:
- if adversary["name"] == adversary_name:
- found_adversaries.append(adversary)
+ if not isinstance(req, list):
+ return {"error": "could not list adversaries", "response": req}
+
+ found_adversaries = [
+ a for a in req
+ if isinstance(a, dict) and a.get("name") == adversary_name
+ ]
+ if not found_adversaries:
+ return {"error": f"no adversary named {adversary_name!r}"}
adversary_details = found_adversaries[0]
@@ -375,9 +384,12 @@ def create_operation(operation_name: str, adversary_name: str):
},
"objective": "495a9828-cab1-44dd-a0ca-66e58177d8cc",
},
- "planner_id": "aaa7c857-37a0-4c4a-85f7-4e9f7f30e31a",
- "source_id": "ed32b9c3-9593-4c33-b0db-e2007315096b",
- "objective_id": "495a9828-cab1-44dd-a0ca-66e58177d8cc",
+ # setup_operation pops 'planner' and 'source' as nested dicts and
+ # OperationSchema discards every other key, so the *_id spellings
+ # this used to send were dropped and Caldera silently fell back to
+ # its own defaults.
+ "planner": {"id": "atomic"},
+ "source": {"id": "basic"},
"state": "paused",
"autonomous": 1,
"auto_close": False,
@@ -407,8 +419,8 @@ def create_windows_ability(
command_description: str,
tactic: str,
technique_name: str,
- technique_id: str = None,
- payloads: list = None,
+ technique_id: Optional[str] = None,
+ payloads: Optional[list] = None,
):
"""
Create a new windows ability with the specified parameters.
@@ -473,8 +485,8 @@ def create_linux_ability(
command_description: str,
tactic: str,
technique_name: str,
- technique_id: str = None,
- payloads: list = None,
+ technique_id: Optional[str] = None,
+ payloads: Optional[list] = None,
):
"""
Create a new linux ability with the specified parameters.
diff --git a/app/mcp_svc.py b/app/mcp_svc.py
index 039fa3c..24bd70a 100644
--- a/app/mcp_svc.py
+++ b/app/mcp_svc.py
@@ -12,6 +12,7 @@
from plugins.mcp.app.mlflow_run import (
RunTracker,
reconcile_orphaned_runs as _reconcile_orphaned_runs,
+ summarize_exception,
)
@@ -45,32 +46,6 @@ def _scrub_secrets(text: str) -> str:
return _SECRET_RE.sub("sk-***", str(text or ""))
-def _leaf_exceptions(exc: BaseException) -> list[BaseException]:
- if isinstance(exc, BaseExceptionGroup):
- leaves = []
- for child in exc.exceptions:
- leaves.extend(_leaf_exceptions(child))
- return leaves
- return [exc]
-
-
-def _summarize_exception(exc: BaseException) -> str:
- leaves = _leaf_exceptions(exc)
- if not leaves:
- return _scrub_secrets(str(exc))
- primary = leaves[-1]
- summary = _scrub_secrets(str(primary)).strip() or primary.__class__.__name__
- if "failure to get a peer from the ring-balancer" in summary:
- return (
- "LLM provider unavailable: the AI Platform model gateway returned "
- "'failure to get a peer from the ring-balancer' after retries."
- )
- if "Incorrect API key provided" in summary:
- return (
- "LLM authentication failed: the configured API key was rejected by "
- "the selected provider."
- )
- return summary
_LEGACY_TYPE_MAP = {
@@ -395,8 +370,12 @@ async def execute(self, focus: str = None, prompt: str = "", model_config: dict
if not rag_cfg.get("api_base"):
rag_cfg["api_base"] = resolved_lm.get("api_base", "")
if not rag_cfg.get("embed_model"):
+ # Last rung is the chat model: one endpoint, one model, unless
+ # a deployment explicitly names a separate embedding model.
rag_cfg["embed_model"] = (
- resolved_lm.get("embed_model") or resolved_lm.get("rag_embed_model")
+ resolved_lm.get("embed_model")
+ or resolved_lm.get("rag_embed_model")
+ or resolved_lm.get("model")
)
if rag_cfg.get("ssl_verify") is None:
rag_cfg["ssl_verify"] = resolved_lm.get("ssl_verify")
@@ -589,7 +568,7 @@ async def _run_execution(self, workflow, prompt, run_id, lm_obj,
)
except Exception as e:
- error_summary = _summarize_exception(e)
+ error_summary = summarize_exception(e)
self.log.error(f"[MCP] Execution failed: {error_summary}")
tracker.set_tag("stage", "error")
tracker.set_tag("status", "error")
diff --git a/app/mlflow_run.py b/app/mlflow_run.py
index bc3929f..ccf1edb 100644
--- a/app/mlflow_run.py
+++ b/app/mlflow_run.py
@@ -13,11 +13,73 @@
"""
import logging
+import re
from mlflow.tracking import MlflowClient
log = logging.getLogger("plugins.mcp")
+_SECRET_RE = re.compile(r"\bsk-[A-Za-z0-9_-]{8,}\b")
+
+
+def _scrub_secrets(text: str) -> str:
+ return _SECRET_RE.sub("sk-***", str(text or ""))
+
+
+def _leaf_exceptions(exc: BaseException) -> list[BaseException]:
+ if isinstance(exc, BaseExceptionGroup):
+ leaves = []
+ for child in exc.exceptions:
+ leaves.extend(_leaf_exceptions(child))
+ return leaves
+ return [exc]
+
+
+def summarize_exception(exc: BaseException) -> str:
+ """The innermost cause, scrubbed, rather than the group that wraps it.
+
+ An MCP stdio session fails inside nested anyio task groups, so the
+ exception that reaches a caller stringifies as "unhandled errors in a
+ TaskGroup (1 sub-exception)". MLflow params are immutable, so whichever
+ handler logged first won, and that string is what History displayed
+ instead of the provider error that actually stopped the run.
+ """
+ leaves = _leaf_exceptions(exc)
+ if not leaves:
+ return _scrub_secrets(str(exc))
+ primary = leaves[-1]
+ summary = _scrub_secrets(str(primary)).strip() or primary.__class__.__name__
+ if "failure to get a peer from the ring-balancer" in summary:
+ return (
+ "LLM provider unavailable: the AI Platform model gateway returned "
+ "'failure to get a peer from the ring-balancer' after retries."
+ )
+ # Providers word this three ways for the same cause, and none of them say
+ # where the name is set.
+ bad_model = re.search(
+ r"[Tt]he model [`'\"]?([\w./:-]+)[`'\"]? (?:does not exist|is not available)",
+ summary,
+ )
+ if bad_model:
+ return (
+ f"Model not available: the provider has no {bad_model.group(1)}. "
+ f"Set a model it serves in Global Model Config, or in llm.model "
+ f"in conf/local.yml."
+ )
+ busy = re.search(r"[`'\"]?([\w./:-]+)[`'\"]? is temporarily at capacity", summary)
+ if busy:
+ return (
+ f"Model busy: the provider has no free slot for {busy.group(1)}. "
+ f"Retry, or pick another model."
+ )
+
+ if "Incorrect API key provided" in summary:
+ return (
+ "LLM authentication failed: the configured API key was rejected by "
+ "the selected provider."
+ )
+ return summary
+
# mlflow rejects an oversized value outright. Truncating keeps a completed
# run from being recorded as failed just because its reasoning was long.
_MAX_TAG_CHARS = 5000
diff --git a/app/utilities/D3fend_CAD/D3fend_CAD_Graph_Schema.json b/app/utilities/D3fend_CAD/D3fend_CAD_Graph_Schema.json
deleted file mode 100644
index ca0a897..0000000
--- a/app/utilities/D3fend_CAD/D3fend_CAD_Graph_Schema.json
+++ /dev/null
@@ -1,259 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "D3FEND CAD Graph Schema",
- "type": "object",
- "properties": {
- "meta": {
- "type": "object",
- "title": "Meta",
- "properties": {
- "title": {
- "type": "string"
- },
- "authors": {
- "type": "array",
- "items": {
- "type": "string"
- }
- },
- "orgs": {
- "type": "array",
- "items": {
- "type": "string"
- }
- },
- "description": {
- "type": "string"
- },
- "article": {
- "type": "string"
- },
- "d3fend_version": {
- "type": "string"
- },
- "cad_schema_version": {
- "type": "number"
- },
- "published_date": {
- "type": "string",
- "format": "date-time"
- },
- "references": {
- "type": "array",
- "items": {
- "type": "string"
- }
- },
- "settings": {
- "type": "object",
- "properties": {},
- "required": []
- }
- },
- "required": [
- "title",
- "authors",
- "description",
- "article",
- "d3fend_version",
- "cad_schema_version",
- "published_date"
- ],
- "additionalProperties": false
- },
- "nodes": {
- "type": "array",
- "items": {
- "type": "object",
- "title": "CADNode",
- "properties": {
- "id": {
- "type": "string"
- },
- "type": {
- "type": "string",
- "enum": [
- "event-node",
- "attack-node",
- "countermeasure-node",
- "artifact-node",
- "agent-node",
- "vulnerability-node",
- "condition-node",
- "note-node",
- "thing-node"
- ]
- },
- "position": {
- "type": "object",
- "title": "Position",
- "properties": {
- "x": {
- "type": "number"
- },
- "y": {
- "type": "number"
- }
- },
- "required": [
- "x",
- "y"
- ],
- "additionalProperties": false
- },
- "data": {
- "type": "object",
- "title": "NodeData",
- "properties": {
- "label": {
- "type": "string"
- },
- "sequence": {
- "type": "string"
- },
- "d3f_class": {
- "type": "string"
- },
- "user_properties": {
- "type": "array",
- "items": {
- "type": "array",
- "title": "UserProperty",
- "items": {
- "type": "string",
- "default": ""
- }
- }
- }
- },
- "required": [
- "label",
- "sequence",
- "user_properties"
- ],
- "additionalProperties": false
- },
- "origin": {
- "type": "array",
- "items": {
- "type": "number"
- }
- },
- "measured": {
- "type": "object",
- "title": "Measured",
- "properties": {
- "width": {
- "type": "number"
- },
- "height": {
- "type": "number"
- }
- },
- "required": [
- "width",
- "height"
- ],
- "additionalProperties": false
- },
- "selected": {
- "type": "boolean"
- },
- "dragging": {
- "type": "boolean"
- },
- "width": {
- "type": "number"
- },
- "height": {
- "type": "number"
- }
- },
- "required": [
- "id",
- "type",
- "position",
- "data",
- "origin",
- "measured",
- "selected",
- "dragging"
- ]
- }
- },
- "edges": {
- "type": "array",
- "items": {
- "type": "object",
- "title": "Edge",
- "properties": {
- "type": {
- "type": "string"
- },
- "data": {
- "type": "object",
- "title": "EdgeData",
- "properties": {
- "label": {
- "type": "string"
- },
- "d3f_property": {
- "type": "string"
- }
- },
- "required": [
- "label"
- ],
- "additionalProperties": false
- },
- "markerEnd": {
- "type": "object",
- "title": "MarkerEnd",
- "properties": {
- "type": {
- "type": "string"
- }
- },
- "required": [
- "type"
- ],
- "additionalProperties": false
- },
- "source": {
- "type": "string"
- },
- "sourceHandle": {
- "type": "string"
- },
- "target": {
- "type": "string"
- },
- "targetHandle": {
- "type": "string"
- },
- "id": {
- "type": "string"
- },
- "selected": {
- "type": "boolean"
- }
- },
- "required": [
- "source",
- "sourceHandle",
- "target",
- "targetHandle",
- "id",
- "selected"
- ],
- "additionalProperties": false
- }
- }
- },
- "required": [
- "meta",
- "nodes",
- "edges"
- ],
- "additionalProperties": false
-}
\ No newline at end of file
diff --git a/app/utilities/D3fend_CAD/ensure_CAD_ontology_files.py b/app/utilities/D3fend_CAD/ensure_CAD_ontology_files.py
deleted file mode 100644
index 47e7547..0000000
--- a/app/utilities/D3fend_CAD/ensure_CAD_ontology_files.py
+++ /dev/null
@@ -1,95 +0,0 @@
-#!/usr/bin/env python3
-"""
-Standalone D3FEND ontology fetch/update utility.
-
-Automatically:
- - Clones or updates the d3fend GitHub repository
- - Locates ontology .ttl files regardless of folder layout
- - Locates mappings directory
- - Locates CAD schema
-"""
-
-import argparse
-import subprocess
-from pathlib import Path
-
-D3FEND_GIT_URL = "https://github.com/d3fend/d3fend-ontology.git"
-
-
-def find_file(root: Path, patterns):
- """Return first file matching any pattern below a directory."""
- if isinstance(patterns, str):
- patterns = [patterns]
-
- for pattern in patterns:
- matches = list(root.rglob(pattern))
- if matches:
- return matches[0]
- return None
-
-
-def ensure_ontology_files(ontology_root: Path):
- """
- Ensures the d3fend ontology is cloned and returns paths to:
- - ALL TTL ontology modules under src/ontology/
- - mappings directory
- - CAD schema
- """
-
- repo_dir = ontology_root / "d3fend-ontology"
-
- if repo_dir.exists():
- print("[D3FEND] Updating existing repository...")
- subprocess.run(["git", "-C", str(repo_dir), "pull"], check=False)
- else:
- print("[D3FEND] Cloning ontology repository...")
- subprocess.run(["git", "clone", D3FEND_GIT_URL, str(repo_dir)], check=True)
-
- # Correct modern repo structure
- src_ontology_dir = repo_dir / "src" / "ontology"
- mappings_dir = src_ontology_dir / "mappings"
- cad_schema = repo_dir / "cad" / "schema" / "cad.schema.json"
-
- # Collect ALL TTL ontology files
- ttl_files = list(src_ontology_dir.rglob("*.ttl"))
-
- if not ttl_files:
- raise FileNotFoundError(
- f"No TTL ontology files found under {src_ontology_dir}"
- )
-
- if not cad_schema.exists():
- raise FileNotFoundError(f"Missing CAD schema: {cad_schema}")
-
- if not mappings_dir.exists():
- raise FileNotFoundError(f"Missing mappings directory: {mappings_dir}")
-
- print(f"[D3FEND] Loaded {len(ttl_files)} ontology TTL modules.")
-
- return {
- "ontology_modules": ttl_files,
- "mappings": mappings_dir,
- "cad_schema": cad_schema,
- }
-
-def main():
- parser = argparse.ArgumentParser(description="Fetch and validate the D3FEND ontology + CAD schema")
- parser.add_argument(
- "--ontology-root",
- type=Path,
- default=Path("./ontology"),
- help="Directory where the D3FEND ontology repo will be stored."
- )
-
- args = parser.parse_args()
- args.ontology_root.mkdir(parents=True, exist_ok=True)
-
- result = ensure_ontology_files(args.ontology_root)
-
- print("\n[D3FEND] Ontology and CAD schema ready.")
- for k, v in result.items():
- print(f" {k}: {v}")
-
-
-if __name__ == "__main__":
- main()
diff --git a/app/utilities/D3fend_CAD/ontology/LICENSE.md b/app/utilities/D3fend_CAD/ontology/LICENSE.md
deleted file mode 100644
index c895315..0000000
--- a/app/utilities/D3fend_CAD/ontology/LICENSE.md
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2022 The MITRE Corporation
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/app/utilities/D3fend_CAD/ontology/README.md b/app/utilities/D3fend_CAD/ontology/README.md
deleted file mode 100644
index b30e4f8..0000000
--- a/app/utilities/D3fend_CAD/ontology/README.md
+++ /dev/null
@@ -1,104 +0,0 @@
-# D3FEND Ontology
-
-This repository holds the necessary content to produce the D3FEND ontology distribution.
-
-- > If you are looking for the latest release of the ontology, please find it [here](https://d3fend.mitre.org/resources/ontology/).
-
-- > If you are interested in contributing to this project, please see our [contribution guidelines](CONTRIBUTING.md).
-
-## Overview
-
-> **Note:** if you are looking for the latest D3FEND ontology release please find it [here](https://d3fend.mitre.org/resources/ontology/).
-
-The basic workflow is to edit the `d3fend-protege.ttl` file, save your changes, then simply
-run `make all` in this directory. This is designed to accommodate both plain text editing
-and Protege Ontology IDE modifications.
-
-When making changes with a text editor please avoid introducing unsubstantial changes
-to many lines in the file. This enables efficient code reviews.
-
-> **Note**: before sending a merge request changes to `src/ontology/d3fend-protege.ttl` please always run `make pre-commit` **before** you commit changes or will will not be able to accept the request. :eyes: You can run this automatically (and only against staged files) every commit with `make pre-commit-install`.
-
-## System Dependencies
-
-Building the D3FEND ontology distribution must be done in a posix-like environment, e.g. Redhat Linux or macOS.
-The following packages must be installed:
-
-- make
-- java 15.0.1, other versions may work however
-- python 3.9
-- python pipenv package with `pipenv` in your PATH
-
-## Building
-
-The Makefile has all the necessary targets (commands) needed to build the D3FEND ontology.
-Once your system dependencies are installed, run `make install-deps`, then you can run
-`make all` to build the ontology.
-
-> In order to run `make build/d3fend.csv`, you need to be
-running a d3fend-backend server, this is not yet released.
-
-## Directories
-
-|Directory |Purpose |
-|-------------------|-------------------------------------------------|
-|dist/ |Holds distributable ontology files resulting from a build (`make all`).|
-|build/ |Holds intermediate files used in build workflow.|
-|reports/ |Holds reports generated by report and test targets.|
-|src/queries/ |Holds queries and report profiles necessary to update ontology and generate reports.|
-|src/ontology/ |Holds the base ontology which is used during the build process to create the distribution.|
-
-## Files
-
-These files are located in the src, build, or dist directories.
-
-> Note: some files are created when `make all` is executed.
-
-|File |Purpose |
-|---------------------------|-------------------------------------------------|
-|d3fend-protege.ttl |Downloaded D3FEND ontology from webprotege.owl (renamed to match this name).|
-|d3fend.{ttl,owl,json} |D3FEND ontology distribution files.|
-|d3fend-public.owl |Temp merge of original web protege ontology and restrictions as object property assertions.|
-|d3fend-res-as-prop.owl |Temp file containing *just* restrictions as object property assertions between class puns.|
-|d3fend-full.owl |Final inference-enhanced copy with KBs for use in SPARQL end point. This is what is loaded into production Blazegraph.|
-|d3fend-architecture.owl |File of architectural elements extracted by a filter-architecture-* target.|
-|d3fend.csv |Tabular form of defensive tactics and techniques trees.|
-|d3fend-prefixes.json |D3FEND ontology context information / namespace prefixes in JSON-LD format; usable by ROBOT and RDFLib.|
-|annotations.ttl |Not currently used; stub of alternative file-based means to add ontology header (see ROBOT documentation).|
-
-## Developer Notes
-
-- Ontology version is specified in `Makefile` as `D3FEND_VERSION`
-- Ontology style guide/conventions [here](./CONVENTIONS.md) (work in progress).
-
-## Build with docker
-
-If you have docker and docker-compose, you can build a distribution
-in the dist/ folder running
-
-```bash
-docker-compose up d3fend-ontology
-```
-
-### SSL Certificates in Docker
-
-If you have custom SSL certificates needed to fetch packages and dependencies from the internet, make a directory `.local` in this project root and place your certificates in `.local/` as `.pem` or `.crt`. The docker build will install the certificates if it finds them there.
-
-
-## NOTICE
-
-Use of the MITRE D3FEND™ Knowledge Graph and website is subject to the Terms of Use. Use of the MITRE D3FEND website is subject to the MITRE D3FEND Privacy Policy. MITRE D3FEND is funded by the National Security Agency (NSA) Cybersecurity Directorate and managed by the National Security Engineering Center (NSEC), which is operated by The MITRE Corporation. MITRE D3FEND; and the MITRE D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. MITRE ATT&CK content is subject to the MITRE ATT&CK terms of use.
-
-## NOTICE
-
-This software was produced for the U. S. Government under Basic Contract No. W56KGU-18-D-0004, and is subject to the Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation Clause 252.227-7014 (FEB 2012) © 2022 The MITRE Corporation.
-
-## NOTICE
-
-MITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.
-
-## NOTICE
-
-© The MITRE Corporation
-
-Approved for Public Release; Distribution Unlimited #21-3978 and #23-1207.
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/cci/CCI_Mapping.xlsx b/app/utilities/D3fend_CAD/ontology/extensions/cci/CCI_Mapping.xlsx
deleted file mode 100644
index a1c1ef6..0000000
Binary files a/app/utilities/D3fend_CAD/ontology/extensions/cci/CCI_Mapping.xlsx and /dev/null differ
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/cci/README.md b/app/utilities/D3fend_CAD/ontology/extensions/cci/README.md
deleted file mode 100644
index a6e0c2a..0000000
--- a/app/utilities/D3fend_CAD/ontology/extensions/cci/README.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# Correlation Control Indicator (CCI) mappings to D3FEND
-
-Generates a set of facts for the CCIs, mapping them to D3FEND
-techniques as part of building the extensions. To correct or customize
-these, modify the accompanying spreadsheet. The repeating reference
-columns are related to NIST mappings and provide more context, but
-these should not be modified or relied on; instead, reference the CCI
-List .xml data.
-
-See [CCI Downloads](https://public.cyber.mil/stigs/cci/)
-
-Future Potential Work: Process the U_CCI_List.xml available at DoD
-Cyber Exchange to also include CCI->NIST mappings. Currently out of
-scope.
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/cci/create_cci_mappings.py b/app/utilities/D3fend_CAD/ontology/extensions/cci/create_cci_mappings.py
deleted file mode 100644
index 5c3ce8e..0000000
--- a/app/utilities/D3fend_CAD/ontology/extensions/cci/create_cci_mappings.py
+++ /dev/null
@@ -1,153 +0,0 @@
-import numpy as np
-import pandas # requires openpyxl in environment to do read_excel
-from owlready2 import default_world
-
-""" This Python script reads the public ontology file and a mapping
-file and writes out .ttl file with mappings that may be
-appended to the public ontology. """
-
-default_world.get_ontology(
- "build/d3fend-public.owl"
-).load() # Only needed for defensive technique lookups
-d3fend_world = default_world
-
-relation_map = {
- "broader": "d3f:broader",
- "narrower": "d3f:narrower",
- "exactly": "d3f:exactly",
- "same": "d3f:exactly", # off-label usage of same; treat as exactly
- np.nan: "d3f:related", # If undefined in spreadsheet, use most general match :related
- "": "d3f:related",
-} # If undefined in spreadsheet, use most general match :related
-
-d3fend_technique_query = """
-prefix :
-
-SELECT ?x
-WHERE {{ ?x :d3fend-id '{}' . }}
-"""
-
-
-# > get_d3fend_technique_name('D3-AL')
-# d3fend.AccountLocking
-def get_d3fend_technique_name(d3fend_id):
- query = d3fend_technique_query.format(d3fend_id)
- raw_result = d3fend_world.sparql(query)
- # print(raw_result)
- result = list(raw_result) # owlready2 sparql query to lookup technique name; could cache
- if result and result[0] and result[0][0]:
- # print("{} -> {}\n".format(d3fend_id, result))
- return result[0][0].name # .namespace, .iri
- else:
- # print("{} -> found nothing!\n".format(d3fend_id))
- return None
-
-
-def get_cci_iri(cci_id):
- return cci_id # pass through for now
-
-
-# Use when adding CCI mappings to NIST controls, but if doing that,
-# remember to use XML data for those NIST reference mappings, tying to
-# CCI XML data from DoD Cyber Exchange, as the spreadsheet isn't
-# faithful table mapping of that XML:/e
-# https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CCI_List.zip)
-def get_sp800_53_control_iri_name(version, control_id):
- """Formats IRI for a NIST SP800-53 control by removing spaces and brackets and embedding the release version"""
- control_iri_name = control_id.replace(" ", "")
- control_iri_name = control_iri_name.replace(")", "")
- control_iri_name = control_iri_name.replace("(", "_")
- control_iri_name = "NIST_SP800-53_R{}_{}".format(str(version), control_iri_name)
- return control_iri_name
-
-
-def write_cci_mappings(
- f,
- publishdate,
- control_id,
- contributor,
- status,
- definition,
- relation,
- techniques_string,
- cci_catalog_prefix="CCICatalog",
- cci_catalog_version_date="2022-04-05",
-):
- """Writes mappings for one row in frame (spreadsheet.) to .ttl"""
- if status != "deprecated":
- # Comes in as pandas.Timestamp, which is fine for d3f:published, which is xsd:dateTime
- # publishdate = publishdate.date() # If using as xsd:date
- publishdate = str(publishdate).replace(
- " ", "T"
- ) # default not quite ISO; not quite xsd:dateTime worthy
- if contributor == "DISA FSO":
- contributor_iri_name = (
- "DISA_FSO" # Fix the typos in original data with double spaces
- )
- else:
- contributor_iri_name = contributor.replace(" ", "_")
- # print('<{}>, <{}>, <{}>, <{}>, <{}>, <{}>, <{}>, <{}>\n'.
- # format(type(publishdate), publishdate, control_id, contributor, status,
- # definition, relation, techniques_string))
- control_iri_name = get_cci_iri(control_id) + "_v" + cci_catalog_version_date
- cci_catalog_iri = cci_catalog_prefix + "_v" + cci_catalog_version_date
- # Write individual representing NIST control and provide annotation and data properties
- f.write("d3f:{} a d3f:CCIControl ;\n".format(control_iri_name))
- f.write(" d3f:member-of d3f:{} ;\n".format(cci_catalog_iri))
- f.write(' rdfs:label "{}" ;\n'.format(control_id))
- f.write(' d3f:published "{}"^^xsd:dateTime ;\n'.format(publishdate))
- f.write(" d3f:contributor d3f:{} ;\n".format(contributor_iri_name))
- f.write(' d3f:definition "{}" .\n'.format(definition))
- f.write(
- "d3f:{} d3f:has-member d3f:{} .\n".format(cci_catalog_iri, control_iri_name)
- )
- # Write relations of this control to D3FEND countermeasures mapped in mapping file.
- if isinstance(relation, str):
- relation = (
- relation.lower()
- ) # make lower for robust matching, but not if nan
- if relation: # np.nan or non-empty string
- d3fend_relation = relation_map[relation]
- if d3fend_relation: # If we can understand relation, do mappings
- for technique in techniques_string.split(
- "|"
- ): # Get multiple defensive techniques
- technique = technique.strip() # Trim it
- if technique: # if non-empty
- technique_iri_name = get_d3fend_technique_name(technique)
- if technique_iri_name: # if we got a good lookup, do it.
- f.write(
- "d3f:{} {} d3f:{} .\n".format(
- control_iri_name,
- d3fend_relation,
- technique_iri_name,
- )
- )
- f.write("\n")
-
-
-df = pandas.read_excel(io="extensions/cci/CCI_Mapping.xlsx", sheet_name="U_CCI_List")
-
-df = df[~df["D3FEND"].isnull()]
-# dataframe as read treats str 'NA' and np.nan the same; but if that
-# changes, pull NA string fields explicitly
-df = df[~df["D3FEND"].str.contains("NA")]
-df = df[~df["D3FEND"].str.contains("TBD")]
-df = df[~df["D3FEND"].str.contains("Duplicate")]
-df = df[~df["D3FEND"].str.contains("Review")]
-
-with open("build/cci-to-d3fend-mapping.ttl", "w") as f:
- df.apply(
- lambda x: write_cci_mappings(
- f,
- # no versioning on CCI data; pub date instead; versions are on NIST pubs
- x["publishdate"], # Just the date, no time
- x["_id"], # this is the CCI-nnnnnn formated id
- x["contributor"], # DISA-FSO or DISA-FSP
- x["status"], # deprecated or draft (dump deprecated)
- x["definition"],
- x["Relation"],
- x["D3FEND"],
- ),
- axis=1,
- )
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/cwe/README.md b/app/utilities/D3fend_CAD/ontology/extensions/cwe/README.md
deleted file mode 100644
index a9fba21..0000000
--- a/app/utilities/D3fend_CAD/ontology/extensions/cwe/README.md
+++ /dev/null
@@ -1,71 +0,0 @@
-
-# CWE -> D3FEND Converter
-
-This directory holds a Makefile and documents the steps necessary to all CWE to Original add of Top-25 CWEs to d3fend-protege.ttl.
-
-- This only converts the Research Concepts View (aka Graph) of CWE into a D3FEND taxonomy for CWE Weaknesses.
-
-- Future work will be required to extend this capability for ongoing CWE updates
-
-## How to use
-
-To accomplish add in of CWE tree structure for the Research Concepts View (aka View 1000, Research Concepts Graph), here are the manual steps:
-
-1. `cd extensions/cwe/`
-
- (i.e., go to the directory in which this README.md is located.)
-
-2. `make install-deps`
-
- This will install the # Add all CWE to Original add of Top-25 CWEs to d3fend-protege.ttl
-
-To accomplish add in of CWE tree structure for CWE-1000 / Research
-Concepts View (aka Graph), here are the manual steps.
-
-3. `make all`
-
-4. Review diffs to d3fend-protege.ttl manually. _Example: First time use, the Top 25 classes already present were direct subclasses of Weakness but this was no longer wanted given entire taxonomy with intermediate clases were available; statements were already there and deletions may be required_.
-
-## Notes on RML and YARRRML technology
-
-### RML and YARRML Introduction
-
-RML is a declarative language for converting non-linked data formats into linked data. RML is encoded in Turtle. It allows extraction and tranformation steps that includes inputs from relational databases, csv, json, and xml files. It is an extension of R2RML, which had a focus on relational data.
-
-YARRRML is an effort to provide a more concise, and easier-to-use language for the same kinds of data transformation, where YARRRML is converted into RML and then used with RML engines.
-
-The introduction of YARRRML as an implementation appears to be by the [RML.io](https://rml.io/) group. The [YARRRML Parser](https://github.com/RMLio/yarrrml-parser) and [YARRRML Mapper](https://github.com/RMLio/rmlmapper-java) were developed by the group and ultimately were used for translating the CWE XML catalog file into the CWE Research Concept taxonomy of D3FEND classes representing CWE weaknesses.
-
-### Alternative Implementations
-
-Depending on the needs, YARRRML and RML alternatives exist. Capabilities vary and cross-compatibility is not assured.
-
-The Python-based [Morph KGC](https://github.com/morph-kgc/morph-kgc) (and [kglab](https://github.com/DerwenAI/kglab/), which embeds it) can use YARRRML directly to directly perform knowledge graph construction. They also support .ttl as an output serialization format. However, the Morph KGC team has categorized the ability to use parent references in XPath as [an enhancement rather than a bug](https://github.com/morph-kgc/morph-kgc/issues/98), which is unfortunate since RML.io's implementation and the [CARML](https://github.com/carml/carml-jar) implementation do handle parent path references in Xpath and the [RML spec](https://rml.io/specs/rml/) _[not sure what specification is considered canonical other than one on RML.io cite]_ seems to indicate this should be possible. Intermediate RML can be generated directly in the Morph KGC with the code block:
-
-```
-rml_mapping = morph_kgc.mapping.load_yarrrml()
-rml_mapping.serialize(destination="morph-kgc.rml.ttl`)
-```
-
-However, the resulting RML file did not work with other RML mapping engines.
-
-CARML does not offer pre-built jars though appeared to be compatible with YARRRML Parser code.
-
-Yatter did not work for RML examples tried. But minimal use, so may work out well later.
-
-### Learning Resources
-
-The [RML spec](https://rml.io/specs/rml/) has many examples.
-
-The recommendations for YARRRRML users suggested in Section 9.1 of the paper ["Path-based and triplication approaches to mapping data into RDF:
-usability analysis and recommendations"](https://www.semantic-web-journal.net/system/files/swj3348.pdf) are very helpful in debugging YARRRML.
-
-[Matey](https://rml.io/yarrrml/matey/) is live page is available for experimentning with YARRRML, but error messages are suppressed for some operations.
-
-The many pitfalls for new users of YARRRML are noted by the ShEXML creators in their paper ["ShExML: improving the usability of heterogeneous data mapping languages for first-time users"](https://pubmed.ncbi.nlm.nih.gov/33816968/)
-
-
-### Non-RML approaches
-
-- [ShExML](https://github.com/herminiogg/ShExML)
-- Python code with other RDF libraries
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/cwe/cwe-yarrrml.yaml b/app/utilities/D3fend_CAD/ontology/extensions/cwe/cwe-yarrrml.yaml
deleted file mode 100644
index 646070e..0000000
--- a/app/utilities/D3fend_CAD/ontology/extensions/cwe/cwe-yarrrml.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-prefixes:
- d3f: http://d3fend.mitre.org/ontologies/d3fend.owl#
- xsd: http://www.w3.org/2001/XMLSchema#
- rdf: http://www.w3.org/1999/02/22-rdf-syntax-ns#
- rdfs: http://www.w3.org/2000/01/rdf-schema#
- owl: http://www.w3.org/2002/07/owl#
- grel: http://users.ugent.be/~bjdmeest/function/grel.ttl#
-
-sources:
- cwe-pillar-source:
- access: "cwec_latest.xml"
- referenceFormulation: xpath
- iterator: "/Weakness_Catalog/Weaknesses/Weakness[@Abstraction = 'Pillar']"
- cwe-source:
- access: "cwec_latest.xml"
- referenceFormulation: xpath
- iterator: "/Weakness_Catalog/Weaknesses/Weakness[@Status != 'Deprecated']"
- cwe-rel-source:
- access: "./cwec_latest.xml"
- referenceFormulation: xpath
- iterator: "/Weakness_Catalog/Weaknesses/Weakness/Related_Weaknesses/Related_Weakness[@Nature = 'ChildOf' and @View_ID='1000']"
-
-mappings:
- Pillar:
- sources: cwe-pillar-source
- s: d3f:CWE-$(./@ID)
- po:
- - [rdfs:subClassOf, d3f:Weakness~iri]
-
- Weakness:
- sources: cwe-source
- s: d3f:CWE-$(./@ID)
- po:
- - [d3f:cwe-id, "CWE-$(./@ID)"]
- - [rdfs:label, "$(./@Name)"]
- - p: d3f:definition
- o:
- function: grel:string_replace
- parameters:
- - [grel:valueParameter, $(Description)]
- - [grel:p_string_find, "/\\s+/"]
- - [grel:p_string_replace, " "]
- - [d3f:synonym, "$(./Alternate_Terms/Alternate_Term/Term)"]
-
- RelatedWeakness:
- sources: cwe-rel-source
- s: d3f:CWE-$(./../../@ID)
- po:
- - [rdfs:subClassOf, d3f:CWE-$(./@CWE_ID)~iri]
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/nist/README.md b/app/utilities/D3fend_CAD/ontology/extensions/nist/README.md
deleted file mode 100644
index 38f97e5..0000000
--- a/app/utilities/D3fend_CAD/ontology/extensions/nist/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# NIST Control mappings to D3FEND
-
-Generates a set of facts for NIST 800-53 r5 controls, mapping them to
-D3FEND techniques as part of building the extensions. To correct or
-customize these, modify the accompanying spreadsheet.
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/nist/create_nist_mappings.py b/app/utilities/D3fend_CAD/ontology/extensions/nist/create_nist_mappings.py
deleted file mode 100644
index 68564a7..0000000
--- a/app/utilities/D3fend_CAD/ontology/extensions/nist/create_nist_mappings.py
+++ /dev/null
@@ -1,123 +0,0 @@
-import numpy as np
-import pandas # requires openpyxl to do read_excel
-from owlready2 import default_world
-
-""" This Python script reads the public ontology file and a mapping
-file and writes out .ttl file with mappings that may be
-appended to the public ontology. """
-
-default_world.get_ontology(
- "build/d3fend-public.owl"
-).load() # Only needed for defensive technique lookups
-d3fend_world = default_world
-
-relation_map = {
- "broader": "d3f:broader",
- "narrower": "d3f:narrower",
- "exactly": "d3f:exactly",
- "same": "d3f:exactly", # off-label usage of same; treat as exactly
- np.nan: "d3f:related", # If undefined in spreadsheet, use most general match :related
- "": "d3f:related",
-} # If undefined in spreadsheet, use most general match :related
-
-d3fend_technique_query = """
-prefix :
-
-SELECT ?x
-WHERE {{ ?x :d3fend-id '{}' . }}
-"""
-
-
-# > get_d3fend_technique_name('D3-AL')
-# d3fend.AccountLocking
-def get_d3fend_technique_name(d3fend_id):
- query = d3fend_technique_query.format(d3fend_id)
- result = list(
- d3fend_world.sparql(query)
- ) # owlready2 sparql query to lookup technique name; could cache
- # print("{} -> {}\n".format(d3fend_id, result))
- if result and result[0] and result[0][0]:
- return result[0][0].name # .namespace, .iri
- else:
- return None
-
-
-def get_cci_iri(cci_id):
- return cci_id
-
-
-def get_sp800_53_control_iri_name(version, control_id):
- """Formats IRI for a NIST SP 800-53 control by removing spaces and brackets and embedding the release version"""
- control_iri_name = control_id.replace(" ", "")
- control_iri_name = control_iri_name.replace(")", "")
- control_iri_name = control_iri_name.replace("(", "_")
- control_iri_name = "NIST_SP_800-53_R{}_{}".format(str(version), control_iri_name)
- return control_iri_name
-
-
-def write_nist_control_mappings(
- f,
- version,
- control_id,
- control_name,
- relation,
- techniques_string,
- nist_catalog_iri="NIST_SP_800-53_R5",
-):
- """Writes mappings for one row in frame (spreadsheet.) to .ttl"""
- version = str(version)
- # print('<{}>, <{}>, <{}>\n'.format(control_id, relation, techniques_string))
- control_iri_name = get_sp800_53_control_iri_name(version, control_id)
- # Write individual representing NIST control and provide annotation and data properties
- f.write("d3f:{} a d3f:NISTControl ;\n".format(control_iri_name))
- f.write(" d3f:member-of d3f:{} ;\n".format(nist_catalog_iri))
- f.write(' rdfs:label "{}" ;\n'.format(control_id))
- f.write(' d3f:control-name "{}" .\n'.format(control_name))
- f.write(
- "d3f:{} d3f:has-member d3f:{} .\n".format(nist_catalog_iri, control_iri_name)
- )
- # Write relations of this control to D3FEND countermeasures mapped in mapping file.
- if isinstance(relation, str):
- relation = relation.lower() # make lower for robust matching, but not if nan
- if relation: # np.nan or non-empty string
- d3fend_relation = relation_map[relation]
- if d3fend_relation: # If we can understand relation, do mappings
- for technique in techniques_string.split(
- "|"
- ): # Get multiple defensive techniques
- technique = technique.strip() # Trim it
- if technique: # if non-empty
- technique_iri_name = get_d3fend_technique_name(technique)
- if technique_iri_name: # if we got a good lookup, do it.
- f.write(
- "d3f:{} {} d3f:{} .\n".format(
- control_iri_name, d3fend_relation, technique_iri_name
- )
- )
- f.write("\n")
-
-
-# Corrected D3-LIC to D3-DLIC
-df = pandas.read_excel(
- io="extensions/nist/sp800-53r5-control-catalog-d3fend-mapping.xlsx",
- sheet_name="SP 800-53 Revision 5--d3fend",
-)
-techniques_column = "D3FEND Techniques" # Corrected typo 'qes'->'ques' on column name original in spreadsheet
-
-df = df[~df[techniques_column].isnull()]
-# dataframe as read treats str 'NA' and np.nan the same; but if that
-# changes, pull NA string fields explicitly
-df = df[~df[techniques_column].str.contains("NA")]
-
-with open("build/sp800-53r5-control-to-d3fend-mapping.ttl", "w") as f:
- df.apply(
- lambda x: write_nist_control_mappings(
- f,
- "5",
- x["Control Identifier"],
- x["Control (or Control Enhancement) Name"],
- x["Relation"],
- x[techniques_column],
- ),
- axis=1,
- )
diff --git a/app/utilities/D3fend_CAD/ontology/extensions/nist/sp800-53r5-control-catalog-d3fend-mapping.xlsx b/app/utilities/D3fend_CAD/ontology/extensions/nist/sp800-53r5-control-catalog-d3fend-mapping.xlsx
deleted file mode 100644
index 055b5d9..0000000
Binary files a/app/utilities/D3fend_CAD/ontology/extensions/nist/sp800-53r5-control-catalog-d3fend-mapping.xlsx and /dev/null differ
diff --git a/app/utilities/D3fend_CAD/ontology/src/ontology/d3fend-protege.ttl b/app/utilities/D3fend_CAD/ontology/src/ontology/d3fend-protege.ttl
deleted file mode 100644
index 72f4cb7..0000000
--- a/app/utilities/D3fend_CAD/ontology/src/ontology/d3fend-protege.ttl
+++ /dev/null
@@ -1,41615 +0,0 @@
-@prefix : .
-@prefix dcterms: .
-@prefix owl: .
-@prefix rdf: .
-@prefix rdfs: .
-@prefix skos: .
-@prefix xsd: .
-
- a owl:Ontology ;
- rdfs:comment "Use of the D3FEND Knowledge Graph, and the associated references from this ontology are subject to the Terms of Use. D3FEND is funded by the National Security Agency (NSA) Cybersecurity Directorate and managed by the National Security Engineering Center (NSEC) which is operated by The MITRE Corporation. D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. This software was produced for the U.S. Government under Basic Contract No. W56KGU-18-D0004, and is subject to the Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation Clause 252.227-7014 (FEB 2012) Copyright 2022 The MITRE Corporation." ;
- dcterms:description "D3FEND is a framework which encodes a countermeasure knowledge base as a knowledge graph. The graph contains the types and relations that define key concepts in the cybersecurity countermeasure domain and the relations necessary to link those concepts to each other. Each of these concepts and relations are linked to references in the cybersecurity literature." ;
- dcterms:license "MIT" ;
- dcterms:title "D3FEND™ - A knowledge graph of cybersecurity countermeasures" .
-
-### Object Properties
-
-:abuses a owl:ObjectProperty ;
- rdfs:label "abuses" ;
- skos:altLabel "misapplies",
- "misuses" ;
- rdfs:subPropertyOf :uses ;
- rdfs:isDefinedBy ;
- :definition "x abuses y: The entity x applies an artifact y to a wrong thing or person; x applies y badly or incorrectly." .
-
-:access-mediated-by a owl:ObjectProperty ;
- rdfs:label "access-mediated-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :mediates-access-to ;
- :definition "x access-mediated-by y: The entity or resource x has its access regulated, controlled, or facilitated by entity y, which acts as an intermediary or gatekeeper to enforce access control policies." .
-
-:accessed-by a owl:ObjectProperty ;
- rdfs:label "accessed-by" ;
- rdfs:subPropertyOf :associated-with,
- :may-be-accessed-by ;
- owl:inverseOf :accesses ;
- :definition "x accessed-by y: The entity or resource x is accessed by entity y." .
-
-:accesses a owl:ObjectProperty ;
- rdfs:label "accesses" ;
- rdfs:subPropertyOf :associated-with,
- :may-access ;
- rdfs:isDefinedBy ;
- :definition "x accesses y: An subject x takes the action of reading from, writing into, or executing the stored information in the object y. Reads, writes, and executes are specific cases of accesses." .
-
-:addressed-by a owl:ObjectProperty ;
- rdfs:label "addressed-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :addresses ;
- :definition "x addressed-by y: Relates a resource x (e.g., network host, peripheral device, disk sector, a memory cell or other logical or physical entity) to a discrete address y in an address space that points to it." .
-
-:addresses a owl:ObjectProperty ;
- rdfs:label "addresses" ;
- skos:altLabel "points-to" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x addresses y: Relates a pointer x to a digital artifact y located in the address space to which x points. The address space is part of some digital store, whether it be in memory, an image, or a persistent storage device." ;
- rdfs:seeAlso ,
- ;
- :todo "For inference, If an object has a pointer (but is not a pointer itself), does it point to the target object of the pointer? i.e., an image might hold a pointer pointing to some global address space, does the image itself point-to the address space? Would we assert that directly ever or only infer it?" .
-
-:adds a owl:ObjectProperty ;
- rdfs:label "adds" ;
- rdfs:subPropertyOf :associated-with,
- :may-add ;
- :definition "x adds y: The subject x adds a data object y, such as a file, to some other digital artifact, such as a directory. Examples include an agent or technique adding a record to a database. or a domain entry to a DNS server." .
-
-:analyzes a owl:ObjectProperty ;
- rdfs:label "analyzes" ;
- rdfs:subPropertyOf :associated-with,
- :detects ;
- rdfs:isDefinedBy ;
- :definition "x analyzes y: The subject x break down object y into components or essential features, assessing y by quantitative methods, qualitative methods, or both. Usually the analysis is done in terms of some model or framework." .
-
-:associated-with a owl:ObjectProperty ;
- rdfs:label "associated-with" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x associated-with y: The subject x and object y are associated in some way. This is the most general definite relationship in d3fend (i.e., most general relationship that is not prefixed by 'may-'.)" ;
- rdfs:seeAlso .
-
-:attached-to a owl:ObjectProperty ;
- rdfs:label "attached-to" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x attached-to y: A subject x is joined in close association to an object y." ;
- rdfs:seeAlso :connects .
-
-:attack-may-be-countered-by a owl:ObjectProperty ;
- rdfs:label "attack-may-be-countered-by" ;
- rdfs:subPropertyOf :may-be-tactically-associated-with .
-
-:authenticates a owl:ObjectProperty ;
- rdfs:label "authenticates" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- rdfs:isDefinedBy ;
- :definition "x authenticates y: The subject x establishes the authenticity of some y. This relation indicates an authentication event has occurred." .
-
-:authorizes a owl:ObjectProperty ;
- rdfs:label "authorizes" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- rdfs:isDefinedBy ;
- :comment "Consider adding certificates (verb sense) specialization of authorizes for authorizations by certificate." ;
- :definition "x authorizes y: A subject x grants authorization or clearance for an agent y to use an object. This relation indicates an authorization event has occurred." ;
- rdfs:seeAlso .
-
-:blocks a owl:ObjectProperty ;
- rdfs:label "blocks" ;
- rdfs:subPropertyOf :counters,
- :filters ;
- rdfs:isDefinedBy ;
- :definition "x blocks y: The entity x blocks off the use of digital artifact y by reference to a block or allow list (or both.)" .
-
-:broader a owl:ObjectProperty ;
- rdfs:label "broader" ;
- rdfs:subPropertyOf :semantic-relation ;
- :definition "x broader y: The entity x represents a more general or inclusive concept than entity y." .
-
-:broader-transitive a owl:ObjectProperty ;
- rdfs:label "broader-transitive" ;
- rdfs:subPropertyOf :semantic-relation ;
- :definition "x broader-transitive y: The entity x represents a more general concept than entity y, including indirect or hierarchical relationships where x encompasses y through intermediate entities." .
-
-:carried-by a owl:ObjectProperty ;
- rdfs:label "carried-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :carries ;
- :definition "x carried-by y: The information entity x is dependent upon the entity y for its storage, transport, or communication. Entity y serves as the necessary bearer or link from which x can be recovered or interpreted." .
-
-:carries a owl:ObjectProperty ;
- rdfs:label "carries" ;
- rdfs:subPropertyOf :associated-with ;
- :comment "Related to BFO_0000101" ;
- :definition "x carries y: The entity x serves as the bearer or link for information y, enabling y to be stored, transported, or communicated such that y can be recovered or interpreted from x" .
-
-:caused-by a owl:ObjectProperty ;
- rdfs:label "caused-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :causes ;
- rdfs:isDefinedBy ;
- :definition "x caused-by y: The event or action x occurs as a consequence of event or action y." .
-
-:causes a owl:ObjectProperty ;
- rdfs:label "causes" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x causes y: The event or action x brings about event or action y as a consequence." .
-
-:communicates-with a owl:ObjectProperty,
- owl:SymmetricProperty ;
- rdfs:label "communicates-with" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x communicates-with y: x and y exchange signals or data bidirectionally, enabling mutual awareness, coordination, or interaction." .
-
-:configures a owl:ObjectProperty ;
- rdfs:label "configures" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- :definition "x configures y: The entity x sets the operational parameters of entity y, determining how y will operate." .
-
-:connected-to a owl:ObjectProperty ;
- rdfs:label "connected-to" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x connected-to y: The subject x shares a direct physical or logical link with object y such that communication is possible between them without intermediate routing." .
-
-:connects a owl:ObjectProperty ;
- rdfs:label "connects" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x connects y: The subject x joins system y by means of communication equipment (to some other system, typically the adversary-targeted host)." ;
- :todo "x connects y to z is a complete capture of the action, but requires and event to reify that. y connected-to z could be relation for the state after the event \"x connects y to z\". But there is also the likely need to model the sense of x connects y to z, where x is the communications equipment (might be a simple cable) and y and z are the systems being connected." .
-
-:contained-by a owl:ObjectProperty,
- owl:TransitiveProperty ;
- rdfs:label "contained-by" ;
- rdfs:subPropertyOf :associated-with,
- :may-be-contained-by ;
- owl:inverseOf :contains ;
- :definition "x contained-by y: The entity x exists within or is physically or logically enclosed by entity y." .
-
-:contains a owl:ObjectProperty,
- owl:TransitiveProperty ;
- rdfs:label "contains" ;
- rdfs:subPropertyOf :associated-with,
- :may-contain ;
- rdfs:isDefinedBy ;
- :comment """d3fend uses 'contains' for the more ontologically traditional term 'has-part' and thus is transitive. The concept of containment in other ontologies (e.g., SUMO and OBO's RO) may refer the containment of an object within a space or object defining a space, or may express the containment of subintervals or subsequences of intervals or sequences, respectively.
-
-Moving forward different distinctions of kinds of has-part (contains) relationships may prove useful or even necessary. Deferred for future releases""" ;
- :definition "x contains y: A core relation that holds between a whole x and its part y. Equivalent to relational concept 'has part' and thus transitive." .
-
-:controlled-by a owl:ObjectProperty ;
- rdfs:label "controlled-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :controls ;
- :definition "x controlled-by y: x's operation or behavior is directed or regulated by y." .
-
-:controls a owl:ObjectProperty ;
- rdfs:label "controls" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x controls y: x directs or regulates y's operational state, behavior, or function." .
-
-:copies a owl:ObjectProperty ;
- rdfs:label "copies" ;
- rdfs:subPropertyOf :creates ;
- rdfs:isDefinedBy ;
- :definition "x copies y: An technique or agent x reproduces or makes and exact copy of some digital artifact y." .
-
-:copy-of a owl:ObjectProperty ;
- rdfs:label "copy-of" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x copy-of y: The subject x is a duplicate of the object y." .
-
-:counters a owl:ObjectProperty ;
- rdfs:label "counters" ;
- rdfs:subPropertyOf :may-counter .
-
-:created-by a owl:ObjectProperty ;
- rdfs:label "created-by" ;
- rdfs:subPropertyOf :associated-with,
- :may-be-created-by ;
- owl:inverseOf :creates ;
- :definition "x created-by y: The entity x is brought into existence, developed, or generated by entity y." .
-
-:creates a owl:ObjectProperty ;
- rdfs:label "creates" ;
- rdfs:subPropertyOf :associated-with,
- :may-create ;
- rdfs:isDefinedBy ;
- :definition "x creates y: The subject x bring into existence an object y. Some technique or agent x creates a persistent digital artifact y (as opposed to production of a consumable or transient object.); i.e., bring forth or generate" ;
- rdfs:seeAlso :produces .
-
-:d3fend-general-object-property a owl:ObjectProperty ;
- rdfs:label "d3fend-general-object-property" ;
- rdfs:subPropertyOf :d3fend-object-property .
-
-:d3fend-kb-object-property a owl:ObjectProperty ;
- rdfs:label "d3fend-kb-object-property" ;
- rdfs:subPropertyOf :d3fend-object-property ;
- :definition "x d3fend-kb-object-property y: The object y is a d3fend knowledge base object property. These properties allow the linkage of knowledge and information supporting and illustrating the d3fend model." .
-
-:d3fend-object-property a owl:ObjectProperty ;
- rdfs:label "d3fend-object-property" .
-
-:d3fend-process-object-property a owl:ObjectProperty ;
- rdfs:label "d3fend-process-object-property" ;
- rdfs:subPropertyOf :d3fend-object-property .
-
-:d3fend-tactical-verb-property a owl:ObjectProperty ;
- rdfs:label "d3fend-tactical-verb-property" ;
- rdfs:subPropertyOf :d3fend-object-property .
-
-:d3fend-use-case-object-property a owl:ObjectProperty ;
- rdfs:subPropertyOf :d3fend-object-property .
-
-:deceives a owl:ObjectProperty ;
- rdfs:label "deceives" ;
- rdfs:subPropertyOf :counters .
-
-:deceives-with a owl:ObjectProperty ;
- rdfs:label "deceives-with" ;
- rdfs:subPropertyOf :d3fend-tactical-verb-property ;
- :definition "x deceives-with y: The entity x misleads or manipulates another entity using y as a tool, method, or mechanism to create false perceptions or understanding." .
-
-:decodes a owl:ObjectProperty ;
- rdfs:label "decodes" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x decodes y: Entity x transforms data y to a different form, usually through decompression." .
-
-:deletes a owl:ObjectProperty ;
- rdfs:label "deletes" ;
- rdfs:subPropertyOf :evicts,
- :modifies ;
- rdfs:isDefinedBy ;
- :definition "x deletes y: A technique or agent x wipes out the digitally or magnetically recorded information of digital object y." .
-
-:dependent a owl:ObjectProperty ;
- rdfs:label "dependent" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x dependent y: A dependent y is an entity that requires the fulfillment of the requirements specified in dependency x." .
-
-:depends-on a owl:ObjectProperty ;
- rdfs:label "depends-on" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :has-dependent ;
- rdfs:isDefinedBy ;
- :definition "x depends-on y: The entity x is contingent on y being available; x relies on y." ;
- rdfs:seeAlso .
-
-:detects a owl:ObjectProperty ;
- rdfs:label "detects" ;
- rdfs:subPropertyOf :counters,
- :d3fend-tactical-verb-property ;
- :definition "x detects y: The entity x discovers the presence, occurrence, or state of entity y through observation or measurement." .
-
-:disables a owl:ObjectProperty ;
- rdfs:label "disables" ;
- rdfs:subPropertyOf :evicts,
- :may-disable,
- :modifies ;
- rdfs:isDefinedBy ;
- :definition "x disables y: The technique or agent x makes an entity y unable to perform its actions or capabilities." .
-
-:drives a owl:ObjectProperty ;
- rdfs:label "drives" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x drives y: The device driver x causes a system component y to function by controlling it." ;
- rdfs:seeAlso .
-
-:employed-by a owl:ObjectProperty ;
- rdfs:label "employed-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :employs ;
- rdfs:isDefinedBy ;
- :definition "x employed-by y: An entity x is put into service by a technique or agent y. Inverse of y employs x." .
-
-:employs a owl:ObjectProperty ;
- rdfs:label "employs" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x employs y: The entity x makes purposeful use of entity y to perform a function." .
-
-:enabled-by a owl:ObjectProperty ;
- rdfs:label "enabled-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :enables ;
- rdfs:isDefinedBy ;
- :definition "x enabled-by y: A top level technique y enables a tactic x, that is, the property indicates that a technique y is used to put a particular tactic x into action. In other words, y renders x capable or able for some task. Inverse of enables." .
-
-:enables a owl:ObjectProperty ;
- rdfs:label "enables" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x enables y: A top level technique x enables a tactic y, that is, the property indicates that a technique x is used to put a particular tactic y into action. In other words, x renders y capable or able for some task." .
-
-:encodes a owl:ObjectProperty ;
- rdfs:label "encodes" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x encodes y: Entity x transforms data y to a different form, usually through compression." .
-
-:encrypts a owl:ObjectProperty ;
- rdfs:label "encrypts" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- rdfs:isDefinedBy ;
- :definition "x encrypts y: The entity x converts the ordinary representation of a digital artifact y into a secret code." .
-
-:end a owl:ObjectProperty ;
- rdfs:label "end" ;
- rdfs:subPropertyOf :d3fend-process-object-property .
-
-:enforces a owl:ObjectProperty ;
- rdfs:label "enforces" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x enforces y: Technique x forces entity y to be compliant with a law, rule, or obligation." .
-
-:enumerates a owl:ObjectProperty ;
- rdfs:label "enumerates" ;
- rdfs:subPropertyOf :reads ;
- :definition "x enumerates y: The subject x takes the action of reading from a digital source y to acquire data and create a list of its contents." .
-
-:erases a owl:ObjectProperty ;
- rdfs:label "erases" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x erases y: A technique x removes recorded data from storage device y creating space for new data." .
-
-:evaluated-by a owl:ObjectProperty ;
- rdfs:label "evaluated-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :evaluates ;
- :definition "x evaluated-by y: The entity x is assessed and analyzed by entity y." .
-
-:evaluates a owl:ObjectProperty ;
- rdfs:label "evaluates" ;
- rdfs:subPropertyOf :associated-with,
- :may-evaluate ;
- :definition "x evaluates y: The entity x systematically assesses entity y to judge its state, quality, or risk." .
-
-:evicts a owl:ObjectProperty ;
- rdfs:label "evicts" ;
- rdfs:subPropertyOf :counters,
- :d3fend-tactical-verb-property,
- :may-evict ;
- :definition "x evicts y: The entity x forcibly removes entity y from the environment or resource where y was residing." .
-
-:exactly a owl:ObjectProperty ;
- rdfs:label "exactly" ;
- rdfs:subPropertyOf :semantic-relation ;
- :definition "x exactly y: The entity x is identical to or fully corresponds to entity y." .
-
-:excises a owl:ObjectProperty ;
- rdfs:label "excises" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x excises y: Technique x removes a section of entity y." .
-
-:executed-by a owl:ObjectProperty ;
- rdfs:label "executed-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :executes ;
- :definition "x executed-by y: The entity or function x is carried out, performed, or run by entity y." .
-
-:executes a owl:ObjectProperty ;
- rdfs:label "executes" ;
- rdfs:subPropertyOf :accesses,
- :may-execute,
- :runs ;
- rdfs:isDefinedBy ;
- :definition "x executes y: The subject x takes the action of carrying out (executing) y, which is a single software module, function, or instruction." .
-
-:extends a owl:ObjectProperty ;
- rdfs:label "extends" ;
- rdfs:subPropertyOf :modifies ;
- rdfs:isDefinedBy ;
- :definition "x extends y: The entity x extend the scope or range or area of entity y, especially in the sense of widen the range of applications." .
-
-:filters a owl:ObjectProperty ;
- rdfs:label "filters" ;
- rdfs:subPropertyOf :associated-with,
- :isolates ;
- rdfs:isDefinedBy ;
- :definition "x filters y: An technique or agent x removes some specified set of of entities from the content of a digital artifact y, by passing an artifact's content through a filter. A filter is a device that removes something from whatever passes through it." ;
- rdfs:seeAlso ,
- .
-
-:forges a owl:ObjectProperty ;
- rdfs:label "forges" ;
- rdfs:subPropertyOf :creates ;
- :definition "x forges y: An technique or agent x counterfeits a digital artifact y, such as a fake credential, with the intent to deceive." ;
- rdfs:seeAlso .
-
-:fork a owl:ObjectProperty ;
- rdfs:label "fork" ;
- rdfs:subPropertyOf :d3fend-process-object-property .
-
-:hardens a owl:ObjectProperty ;
- rdfs:label "hardens" ;
- rdfs:subPropertyOf :counters,
- :d3fend-tactical-verb-property ;
- :definition "x hardens y: The entity x fortifies entity y to reduce its weaknesses so y can better withstand attack or failure." .
-
-:has-account a owl:ObjectProperty ;
- rdfs:label "has-account" ;
- rdfs:subPropertyOf :owns ;
- :definition "x has-account y: The subject x has ownership or possession of some account y." ;
- rdfs:seeAlso .
-
-:has-agent a owl:ObjectProperty ;
- rdfs:label "has-agent" ;
- rdfs:subPropertyOf :has-participant ;
- :definition "x has-agent y: The event x occurs because agent y actively carries it out." .
-
-:has-audience a owl:ObjectProperty ;
- rdfs:label "has-audience" ;
- rdfs:subPropertyOf :d3fend-use-case-object-property .
-
-:has-contribution a owl:ObjectProperty ;
- rdfs:label "has-contribution" ;
- rdfs:subPropertyOf :d3fend-kb-object-property .
-
-:has-contributor a owl:ObjectProperty ;
- rdfs:label "has-contributor" ;
- rdfs:subPropertyOf :d3fend-kb-object-property .
-
-:has-dependent a owl:ObjectProperty ;
- rdfs:label "has-dependent" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x has-dependent y: The entity x is relied upon or required by entity y." .
-
-:has-goal a owl:ObjectProperty ;
- rdfs:label "has-goal" ;
- rdfs:subPropertyOf :d3fend-use-case-object-property .
-
-:has-input a owl:ObjectProperty ;
- rdfs:label "has-input" ;
- rdfs:subPropertyOf :has-participant ;
- rdfs:domain :Event ;
- rdfs:range :Artifact ;
- owl:inverseOf :input-of ;
- :definition "x has-input y: An event x has input y iff y is an artifact that is present at the start of x, provides material or information required for x to begin, and during x either y's state is altered or the information content it bears is realized." ;
- rdfs:seeAlso ,
- .
-
-:has-location a owl:ObjectProperty ;
- rdfs:label "has-location" ;
- skos:altLabel "located_in" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x has-location y: The entity x is situated in a particular spot or position y." ;
- rdfs:seeAlso .
-
-:has-mediator a owl:ObjectProperty ;
- rdfs:label "has-mediator" ;
- rdfs:subPropertyOf :has-participant ;
- :definition "x has-mediator y: The entity x relies on or is facilitated by entity y." .
-
-:has-member a owl:ObjectProperty ;
- rdfs:label "has-member" ;
- rdfs:subPropertyOf :d3fend-kb-object-property ;
- owl:inverseOf :member-of .
-
-:has-output a owl:ObjectProperty ;
- rdfs:label "has-output" ;
- rdfs:subPropertyOf :has-participant ;
- rdfs:domain :Event ;
- rdfs:range :Artifact ;
- owl:inverseOf :output-of ;
- :definition "x has-output y: An event x has output y iff y is an artifact that is present at the end of x, was not present in the same state at the start of x, and whose presence at the end is required for x to be considered complete; the change in state may arise either from a transformation of y itself or from the realization of the information content y bears." ;
- rdfs:seeAlso ,
- .
-
-:has-participant a owl:ObjectProperty ;
- rdfs:label "has-participant" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :participates-in ;
- rdfs:isDefinedBy ;
- :definition "x has-participant y: The event x involves an object y as a participant, indicating that y plays some role in the event, whether actively, passively, or otherwise." .
-
-:has-prerequisite a owl:ObjectProperty ;
- rdfs:label "has-prerequisite" ;
- rdfs:subPropertyOf :d3fend-use-case-object-property .
-
-:has-procedure a owl:ObjectProperty ;
- rdfs:label "has-procedure" ;
- rdfs:subPropertyOf :d3fend-general-object-property .
-
-:has-recipient a owl:ObjectProperty ;
- rdfs:label "has-recipient" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x has_recipient y: An agent y is the intended recipient and decoder of the information contained in communication x." ;
- rdfs:seeAlso ,
- .
-
-:has-sender a owl:ObjectProperty ;
- rdfs:label "has-sender" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x has_sender y: An agent y is the sender and encoder of the information contained in communication x." ;
- rdfs:seeAlso .
-
-:has-weakness a owl:ObjectProperty ;
- rdfs:label "has-weakness" ;
- rdfs:subPropertyOf :may-have-weakness ;
- owl:inverseOf :weakness-of ;
- :definition "x has-weakness y: The entity x exhibits a condition y that could, in some circumstances, lead to a vulnerability." .
-
-:hides a owl:ObjectProperty ;
- rdfs:label "hides" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:range :DigitalArtifact ;
- :definition "x hides y: A technique or operation x conceals the digital artifact y." .
-
-:identified-by a owl:ObjectProperty ;
- rdfs:label "identified-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :identifies ;
- :definition "x identified-by y: The entity x is recognized or described by entity y." .
-
-:identifies a owl:ObjectProperty ;
- rdfs:label "identifies" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x identifies y: The entity x recognizes or brings attention to entity y, making it distinct or clear through naming, description, or discovery." .
-
-:impairs a owl:ObjectProperty ;
- rdfs:label "impairs" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x impairs y: The entity or action x hinders entity y by reducing its normal function, capacity, or availability." .
-
-:implemented-by a owl:ObjectProperty ;
- rdfs:label "implemented-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :implements ;
- :definition "x implemented-by y: The entity x is realized or brought into operation by entity y." .
-
-:implements a owl:ObjectProperty ;
- rdfs:label "implements" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x implements y: The entity x realize entity y by putting its design or specification into effect." .
-
-:initiates a owl:ObjectProperty ;
- rdfs:label "initiates" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x initiates y: The entity or action x starts or triggers entity or function y, bringing it into action." .
-
-:injects a owl:ObjectProperty ;
- rdfs:label "injects" ;
- rdfs:subPropertyOf :executes ;
- :definition "x injects y: The subject x takes the action of exploiting a security flaw by introducing (injecting) y, which is code or data that will change the course of execution or state of a computing process to an alternate course or state. Typically code injection is associated with adversaries intending the alternate course to facilitate a malevolent purpose; however, code injection can be unintentional or the intentions behind it may be good or benign." ;
- rdfs:seeAlso ,
- ;
- :todo "We use injects for IPC as well as more ordinary injection attacks, hence \"execution or state\" phrasing. Might distinguish after discussion and investigation." .
-
-:input-of a owl:ObjectProperty ;
- rdfs:label "input-of" ;
- rdfs:subPropertyOf :participates-in ;
- rdfs:domain :Artifact ;
- rdfs:range :Event ;
- :definition "x input-of y: An artifact x is input of an event y iff x participates at the start of y, provides the material or information required for y to begin, and during y either x's state is altered or the information content it bears is realized." ;
- rdfs:seeAlso .
-
-:installs a owl:ObjectProperty ;
- rdfs:label "installs" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x installs y: An entity x sets up a digital artifact y for subsequent use. For example, an installation program can install application software." .
-
-:instructed-by a owl:ObjectProperty ;
- rdfs:label "instructed-by" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x instructed-by y: A subject x takes machine instructions from object y." .
-
-:instructs a owl:ObjectProperty ;
- rdfs:label "instructs" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x instructs y: A subject x delivers machine instructions to object y." .
-
-:interprets a owl:ObjectProperty ;
- rdfs:label "interprets" ;
- rdfs:subPropertyOf :executes,
- :may-interpret ;
- :definition "x interprets y: The subject x interprets the executable script y. The sense of interprets is here 'Parse the source code and perform its behavior directly.'" ;
- rdfs:seeAlso .
-
-:inventoried-by a owl:ObjectProperty ;
- rdfs:label "inventoried-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :inventories ;
- :definition "x inventoried-by y: The entity x is cataloged, recorded, or tracked by entity y." .
-
-:inventories a owl:ObjectProperty ;
- rdfs:label "inventories" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x inventories y: The entity x systematically discovers entity y and records its presence and key details for tracking." .
-
-:invoked-by a owl:ObjectProperty ;
- rdfs:label "invoked-by" ;
- rdfs:subPropertyOf :associated-with,
- :may-be-invoked-by ;
- owl:inverseOf :invokes ;
- :definition "x invoked-by y: The entity x is called, triggered, or activated by entity y." .
-
-:invokes a owl:ObjectProperty ;
- rdfs:label "invokes" ;
- skos:altLabel "calls" ;
- rdfs:subPropertyOf :executes,
- :may-invoke ;
- rdfs:isDefinedBy ;
- :definition "x invokes y: The subject x invokes a system service y by use of an instruction object y that interrupts the program being executed and passes control to the operating system to perform that operation." ;
- rdfs:seeAlso ;
- :todo "Calls in Wordnet can be function call or system / supervisor call; we may want to make this distinction in future. So far, we have always used this in the second sense (system call.)" .
-
-:isolates a owl:ObjectProperty ;
- rdfs:label "isolates" ;
- rdfs:subPropertyOf :associated-with,
- :d3fend-tactical-verb-property ;
- rdfs:isDefinedBy ;
- :definition "x isolates y: The technique or agent x sets digital artifact y apart from other digital artifacts, sequestering y." .
-
-:kb-reference a owl:ObjectProperty ;
- rdfs:label "kb-reference" ;
- skos:altLabel "has-technique-reference" ;
- rdfs:subPropertyOf :d3fend-kb-object-property ;
- owl:inverseOf :kb-reference-of .
-
-:kb-reference-of a owl:ObjectProperty ;
- rdfs:label "kb-reference-of" ;
- skos:altLabel "kb-is-example-of" ;
- rdfs:subPropertyOf :d3fend-kb-object-property ;
- rdfs:range :CyberTechnique ;
- :definition "x kb-is-example-of y: The reference x is an example of technique y." .
-
-:limits a owl:ObjectProperty ;
- rdfs:label "limits" ;
- skos:altLabel "cutoff" ;
- rdfs:subPropertyOf :restricts ;
- rdfs:isDefinedBy ;
- :definition "x limits y: An entity x specifies a designated limit beyond which some entity y cannot function or must be terminated." ;
- rdfs:seeAlso .
-
-:loaded-by a owl:ObjectProperty ;
- rdfs:label "loaded-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :loads ;
- :definition "x loaded-by y: The entity x is brought into memory by entity y." .
-
-:loads a owl:ObjectProperty ;
- rdfs:label "loads" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x loads y: The technique or process x transfers a software from a storage y to a computer's memory for subsequent execution." .
-
-:manages a owl:ObjectProperty ;
- rdfs:label "manages" ;
- skos:altLabel "oversees",
- "supervises" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x manages y: The technique or agent x watches and directs the use of a digital artifact y." .
-
-:mapped-by a owl:ObjectProperty ;
- rdfs:label "mapped-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :maps ;
- :definition "x mapped-by y: The entity x is linked to another entity by entity y." .
-
-:maps a owl:ObjectProperty ;
- rdfs:label "maps" ;
- rdfs:subPropertyOf :may-map ;
- :definition "x maps y: The entity x discovers and records how entity y is arranged and interconnected." .
-
-:may-access a owl:ObjectProperty ;
- rdfs:label "may-access" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- owl:inverseOf :may-be-accessed-by ;
- :definition "x may-access y: They entity x may access the thing y; that is, 'x accesses y' may be true." .
-
-:may-add a owl:ObjectProperty ;
- rdfs:label "may-add" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-add y: They entity x may add the thing y; that is, 'x adds y' may be true." .
-
-:may-be-accessed-by a owl:ObjectProperty ;
- rdfs:label "may-be-accessed-by" ;
- rdfs:subPropertyOf :may-be-associated-with .
-
-:may-be-associated-with a owl:ObjectProperty ;
- rdfs:label "may-be-associated-with" ;
- rdfs:subPropertyOf :d3fend-object-property ;
- :comment "Any relationship intended to relate subjects to d3f:DigitalArtifacts is expected to be a subproperty of this object property." ;
- :definition "x may-be-associated-with y: The subject x and object y may be associated in some way." ;
- rdfs:seeAlso .
-
-:may-be-contained-by a owl:ObjectProperty,
- owl:TransitiveProperty ;
- rdfs:label "may-be-contained-by" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- owl:inverseOf :may-contain .
-
-:may-be-created-by a owl:ObjectProperty ;
- rdfs:label "may-be-created-by" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- owl:inverseOf :may-create .
-
-:may-be-deceived-by a owl:ObjectProperty ;
- rdfs:label "may-be-deceived-by" ;
- rdfs:subPropertyOf :attack-may-be-countered-by ;
- owl:inverseOf :may-deceive ;
- :pref-label "may be deceived by" .
-
-:may-be-detected-by a owl:ObjectProperty ;
- rdfs:label "may-be-detected-by" ;
- rdfs:subPropertyOf :attack-may-be-countered-by ;
- owl:inverseOf :may-detect ;
- :pref-label "may be detected by" .
-
-:may-be-evicted-by a owl:ObjectProperty ;
- rdfs:label "may-be-evicted-by" ;
- rdfs:subPropertyOf :attack-may-be-countered-by ;
- owl:inverseOf :may-evict ;
- :pref-label "may be evicted by" .
-
-:may-be-hardened-against-by a owl:ObjectProperty ;
- rdfs:label "may-be-hardened-against-by" ;
- rdfs:subPropertyOf :attack-may-be-countered-by ;
- owl:inverseOf :may-harden ;
- :pref-label "may be hardened against by" .
-
-:may-be-invoked-by a owl:ObjectProperty ;
- rdfs:label "may-be-invoked-by" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- owl:inverseOf :may-invoke .
-
-:may-be-isolated-by a owl:ObjectProperty ;
- rdfs:label "may-be-isolated-by" ;
- rdfs:subPropertyOf :attack-may-be-countered-by ;
- owl:inverseOf :may-isolate ;
- :pref-label "may be isolated by" .
-
-:may-be-modified-by a owl:ObjectProperty ;
- rdfs:label "may-be-modified-by" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- owl:inverseOf :may-modify .
-
-:may-be-tactically-associated-with a owl:ObjectProperty ;
- rdfs:label "may-be-tactically-associated-with" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :comment "Most/all of these properties are (will be) realized via inference over chain property path axioms and atomic assertions. Promote this to regular comment once definitions no longer in comments." ;
- :definition "x may-be-tactically-associated-with y: the defensive action x may be a tactic that counters offensive action y." ;
- :todo "Needs name change... With the right name change to better capture definition can keep this definition" .
-
-:may-be-weakness-of a owl:ObjectProperty ;
- rdfs:label "may-be-weakness-of" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- rdfs:domain :Weakness ;
- rdfs:range :Artifact ;
- owl:inverseOf :may-have-weakness .
-
-:may-contain a owl:ObjectProperty,
- owl:TransitiveProperty ;
- rdfs:label "may-contain" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "to potentially have as contents or constituent parts; comprise; include." .
-
-:may-counter a owl:ObjectProperty ;
- rdfs:label "may-counter" ;
- rdfs:subPropertyOf :may-be-associated-with .
-
-:may-counter-attack a owl:ObjectProperty ;
- rdfs:label "may-counter-attack" ;
- rdfs:subPropertyOf :may-be-tactically-associated-with .
-
-:may-create a owl:ObjectProperty ;
- rdfs:label "may-create" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-create y: They entity x may create the entity y; that is, 'x creates y' may be true." .
-
-:may-deceive a owl:ObjectProperty ;
- rdfs:label "may-deceive" ;
- rdfs:subPropertyOf :may-counter-attack ;
- :pref-label "may deceive" .
-
-:may-detect a owl:ObjectProperty ;
- rdfs:label "may-detect" ;
- rdfs:subPropertyOf :may-counter-attack ;
- :pref-label "may detect" .
-
-:may-disable a owl:ObjectProperty ;
- rdfs:label "may-disable" ;
- rdfs:subPropertyOf :may-evict .
-
-:may-evaluate a owl:ObjectProperty ;
- rdfs:label "may-evaluate" ;
- rdfs:subPropertyOf :may-be-associated-with .
-
-:may-evict a owl:ObjectProperty ;
- rdfs:label "may-evict" ;
- rdfs:subPropertyOf :may-counter,
- :may-counter-attack ;
- :pref-label "may evict" .
-
-:may-execute a owl:ObjectProperty ;
- rdfs:label "may-execute" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may execute y: The subject x might take the action of carrying out (executing) y, which is a single software module, function, or instruction." .
-
-:may-harden a owl:ObjectProperty ;
- rdfs:label "may-harden" ;
- rdfs:subPropertyOf :may-counter-attack ;
- :pref-label "may harden" ;
- :todo "Need to identify verbs for hardening, don't want modifies o modified-by patterns as these are evictions." .
-
-:may-have-weakness a owl:ObjectProperty ;
- rdfs:label "may-have-weakness" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- rdfs:domain :Artifact ;
- rdfs:range :Weakness .
-
-:may-interpret a owl:ObjectProperty ;
- rdfs:label "may-interpret" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-interpret y: They entity x may interpret the thing y; that is, 'x interprets y' may be true." .
-
-:may-invoke a owl:ObjectProperty ;
- rdfs:label "may-invoke" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-invoke y: They entity x may invoke the thing y; that is, 'x invokes y' may be true." .
-
-:may-isolate a owl:ObjectProperty ;
- rdfs:label "may-isolate" ;
- rdfs:subPropertyOf :may-counter-attack ;
- :pref-label "may isolate" ;
- :todo "There are some d3f isolation techniques H b P I and E T and M A C that use isolates directly which is different sense that this tactial isolates/may-isolates." .
-
-:may-map a owl:ObjectProperty ;
- rdfs:label "may-map" ;
- rdfs:subPropertyOf :may-be-associated-with .
-
-:may-modify a owl:ObjectProperty ;
- rdfs:label "may-modify" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-modify y: They entity x may modify the thing y; that is, 'x modifies y' may be true." .
-
-:may-produce a owl:ObjectProperty ;
- rdfs:label "may-produce" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-produce y: They entity x may produce the thing y; that is, 'x produces y' may be true." .
-
-:may-query a owl:ObjectProperty ;
- rdfs:label "may-query" ;
- rdfs:subPropertyOf :may-be-associated-with .
-
-:may-run a owl:ObjectProperty ;
- rdfs:label "may-run" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-run y: They entity x may run the thing y; that is, 'x runs y' may be true." .
-
-:may-transfer a owl:ObjectProperty ;
- rdfs:label "may-transfer" ;
- rdfs:subPropertyOf :may-be-associated-with ;
- :definition "x may-transfer y: They entity x might send the thing y; that is, 'x transfers y' may be true." .
-
-:mediates-access-to a owl:ObjectProperty ;
- rdfs:label "mediates-access-to" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x mediates-access-to y: The entity x controls and brokers requests to reach entity y, enforcing the access rules that allow or deny it." .
-
-:member-of a owl:ObjectProperty ;
- rdfs:label "member-of" ;
- rdfs:subPropertyOf :d3fend-kb-object-property .
-
-:modified-by a owl:ObjectProperty ;
- rdfs:label "modified-by" ;
- rdfs:subPropertyOf :associated-with,
- :may-be-modified-by ;
- owl:inverseOf :modifies ;
- :definition "x modified-by y: The entity x is changed by entity y." .
-
-:modifies a owl:ObjectProperty ;
- rdfs:label "modifies" ;
- skos:altLabel "alters" ;
- rdfs:subPropertyOf :accesses,
- :associated-with,
- :may-modify ;
- rdfs:isDefinedBy ;
- :definition "x modifies y: A technique or agent x causes a digital object y to change; become different; or undertake a transformation. Afterwards, the data or state held by a digital object is changed." .
-
-:modifies-part a owl:ObjectProperty ;
- rdfs:label "modifies-part" ;
- rdfs:subPropertyOf :may-modify ;
- owl:propertyChainAxiom (
- :modifies
- :contains ) ;
- :definition "x modifies-part y: The entity x modifies a part of y. [Note: This is a rolification property for the rule 'if one modifies a part of a whole, they modify the whole.' Reasoning for this and similar semantics to come are under evaluation and not part of current d3fend inferences.]" .
-
-:monitors a owl:ObjectProperty ;
- rdfs:label "monitors" ;
- rdfs:subPropertyOf :associated-with,
- :detects ;
- rdfs:isDefinedBy ;
- :definition "x monitors y: The technique or agent x keep tabs on; keeps an eye on; or keep the digital artifact y under surveillance." .
-
-:narrower a owl:ObjectProperty ;
- rdfs:label "narrower" ;
- rdfs:subPropertyOf :semantic-relation ;
- :definition "x narrower y: The entity x represents a more specific or focused concept than entity y." .
-
-:narrower-transitive a owl:ObjectProperty ;
- rdfs:label "narrower-transitive" ;
- rdfs:subPropertyOf :semantic-relation ;
- :definition "x narrower-transitive y: The entity x represents a more specific concept than entity y, including indirect or hierarchical relationships where x is a subset of y through intermediate entities." .
-
-:neutralizes a owl:ObjectProperty ;
- rdfs:label "neutralizes" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- rdfs:isDefinedBy ;
- :definition "x neutralizes y: The technique x makes the execution of actions of y ineffective by preventing or counterbalancing the effect of y." .
-
-:next a owl:ObjectProperty ;
- rdfs:label "next" ;
- rdfs:subPropertyOf :d3fend-process-object-property .
-
-:obfuscates a owl:ObjectProperty ;
- rdfs:label "obfuscates" ;
- rdfs:subPropertyOf :evicts,
- :modifies ;
- rdfs:isDefinedBy ;
- :definition "x obfuscates y: The technique x makes the digital artifact y unclear or obscure. Typically obfuscation is a way to hide a digital artifact from discovery, use, or both." ;
- rdfs:seeAlso .
-
-:operates a owl:ObjectProperty ;
- rdfs:label "operates" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy "oewn-01513459-v" ;
- :definition "x operates y: The entity x enables, activates, or controls the functioning or behavior of object y (operated entity), typically in accordance with the design or intended use of the operated entity." .
-
-:originates-from a owl:ObjectProperty ;
- rdfs:label "originates-from" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x originates-from y: The digital event or artifact x began its network transit from a physical location y." .
-
-:output-of a owl:ObjectProperty ;
- rdfs:label "output-of" ;
- rdfs:subPropertyOf :participates-in ;
- rdfs:domain :Artifact ;
- rdfs:range :Event ;
- :definition "x output-of y: An artifact x is output of an event y iff x must be present when y concludes, was absent in the same state when x began, and y counts as complete only when x is available at its end." ;
- rdfs:seeAlso .
-
-:owns a owl:ObjectProperty ;
- rdfs:label "owns" ;
- skos:altLabel "possesses" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x owns y: The subject x has ownership or possession of some object y." ;
- rdfs:seeAlso .
-
-:participates-in a owl:ObjectProperty ;
- rdfs:label "participates-in" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x participates-in y: The object x takes part in the event y, signifying that x contributes to or is affected by the event’s occurrence in some way." .
-
-:powered-by a owl:ObjectProperty ;
- rdfs:label "powered-by" ;
- rdfs:subPropertyOf :depends-on ;
- owl:inverseOf :powers ;
- :definition "x powered-by y: x obtains its essential energy or force from y to perform its function or remain active." .
-
-:powers a owl:ObjectProperty ;
- rdfs:label "powers" ;
- rdfs:subPropertyOf :has-dependent ;
- :definition "x powers y: x furnishes y with the energy or force required for y's functionality or operation." .
-
-:preceded-by a owl:ObjectProperty ;
- rdfs:label "preceded-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :precedes ;
- rdfs:isDefinedBy ;
- :definition "x preceded-by y: The event or action x occurs after event or action y in time." .
-
-:precedes a owl:ObjectProperty ;
- rdfs:label "precedes" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x precedes y: The event or action x occurs before event or action y in time." .
-
-:process-ancestor a owl:ObjectProperty,
- owl:TransitiveProperty ;
- rdfs:label "process-ancestor" ;
- rdfs:subPropertyOf :process-property ;
- :definition "x process-ancestor y: The process y is a process ancestor of process x, indicating one or more process creation events were conducted were started at process y and subsequently created process x." .
-
-:process-image-path a owl:ObjectProperty ;
- rdfs:label "process-image-path" ;
- skos:altLabel "processImagePath" ;
- rdfs:subPropertyOf :process-property ;
- :definition "x process-image-path y: The filepath y is the process image path for the process x, indicating the path to the resource from which the process's image was loaded." .
-
-:process-parent a owl:ObjectProperty ;
- rdfs:label "process-parent" ;
- skos:altLabel "processParent" ;
- rdfs:subPropertyOf :process-ancestor ;
- :definition "x process-parent y: The process y created the process x (directly) with a create process event." .
-
-:process-property a owl:ObjectProperty ;
- rdfs:label "process-property" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x process-property y: Process x has the a process-property y. This is generalization for specific process object properties." .
-
-:process-user a owl:ObjectProperty ;
- rdfs:label "process-user" ;
- skos:altLabel "processUser" ;
- rdfs:subPropertyOf :process-property ;
- :definition "x process-user y: The process x has been executed by the user y." .
-
-:produced-by a owl:ObjectProperty ;
- rdfs:label "produced-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :produces ;
- :definition "x produced-by y: The entity x is created by entity y." .
-
-:produces a owl:ObjectProperty ;
- rdfs:label "produces" ;
- skos:altLabel "outputs" ;
- rdfs:subPropertyOf :associated-with,
- :may-produce ;
- rdfs:isDefinedBy ;
- :definition "x produces y: The subject entity x or process produces a data object y, which may be discrete digital object or a stream (e.g., a stream such as network traffic.)" ;
- rdfs:seeAlso :creates ;
- :todo "Make definition of produces more generic to match sense of Product Developer produces Product (so generalize to any object really, not just computery digital stuff.)" .
-
-:provider a owl:ObjectProperty ;
- rdfs:label "provider" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x provider y: A provider y is an entity that supplies a service, system, or data resources to a dependent entity x." ;
- rdfs:seeAlso .
-
-:quarantines a owl:ObjectProperty ;
- rdfs:label "quarantines" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x quarantines y: Technique x moves entity y to a place of isolation." .
-
-:queries a owl:ObjectProperty ;
- rdfs:label "queries" ;
- rdfs:subPropertyOf :associated-with,
- :may-query ;
- :definition "x queries y: The entity x requests information or data from entity y." .
-
-:reads a owl:ObjectProperty ;
- rdfs:label "reads" ;
- rdfs:subPropertyOf :accesses ;
- :definition "x reads y: The subject x takes the action of reading from a digital source y to acquire data and placing it into volatile memory for processing." ;
- rdfs:seeAlso ,
- .
-
-:receives a owl:ObjectProperty ;
- rdfs:label "receives" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x receives y: The subject x acquires object y from a communication medium and transfers y into its local context for storage or processing." .
-
-:recorded-in a owl:ObjectProperty ;
- rdfs:label "recorded-in" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :records ;
- :definition "x recorded-in y: The event x is documented, logged, or otherwise preserved within the digital artifact y, which stores or encodes relevant data about the event." .
-
-:records a owl:ObjectProperty ;
- rdfs:label "records" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x records y: The digital artifact x makes a record of events y; set down in permanent form." ;
- rdfs:seeAlso ;
- :todo "a log doesn't summarize an event, it records it; it logs it in the sense of holding the records; it contains it in sense of a record in a historical list of records, maybe---but if we model loggers we might want to reserve 'log' to say they 'log' the event. The chronological order of the log events (log event records to be exact) would suggest 'chronicles' but that verb might be too twee for first D3FEND release." .
-
-:regenerates a owl:ObjectProperty ;
- rdfs:label "regenerates" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- rdfs:isDefinedBy ;
- :definition "x regenerates y: The entity x discards the current digital artifact y and creates a new version that serves the same function." .
-
-:related a owl:ObjectProperty ;
- rdfs:label "related" ;
- rdfs:subPropertyOf :semantic-relation ;
- rdfs:isDefinedBy skos:related ;
- :definition "x related y: x has a symmetric associative relation to y." .
-
-:restores a owl:ObjectProperty ;
- rdfs:label "restores" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x restores y: The entity x returns entity y to its known-good or previous state." .
-
-:restricted-by a owl:ObjectProperty ;
- rdfs:label "restricted-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :restricts ;
- :definition "x restricted-by y: The entity x is limited, constrained, or regulated by entity y." .
-
-:restricts a owl:ObjectProperty ;
- rdfs:label "restricts" ;
- rdfs:subPropertyOf :associated-with,
- :isolates ;
- rdfs:isDefinedBy ;
- :definition "x restricts y: An entity x bounds the use of entity y." .
-
-:resume a owl:ObjectProperty ;
- rdfs:label "resume" ;
- rdfs:subPropertyOf :d3fend-process-object-property ;
- rdfs:isDefinedBy ;
- :definition "The agent or technique x continues a previous action on entity y. Usually occurs after suspension on y." .
-
-:resumes a owl:ObjectProperty ;
- rdfs:label "resumes" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "The agent or technique x continues a previous action on entity y. Usually occurs after suspension on y." .
-
-:runs a owl:ObjectProperty ;
- rdfs:label "runs" ;
- rdfs:subPropertyOf :associated-with,
- :may-run ;
- :definition "x runs y: To carry out a process or program y, as on a computer or a machine x; where y may be a large software assembly or a specific module or instruction. Examples: \"run a new program on the Mac\"; \"the computer runs the application software\"." ;
- rdfs:seeAlso .
-
-:semantic-relation a owl:ObjectProperty ;
- rdfs:label "semantic-relation" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x semantic-relation y: The entity x is conceptually or meaningfully connected to entity y." .
-
-:signed-by a owl:ObjectProperty ;
- rdfs:label "signed-by" ;
- rdfs:subPropertyOf :validated-by ;
- owl:inverseOf :signs ;
- :definition "x signed-by y: The digital artifact x includes a signature generated by the entity y, certifying the authenticity and integrity of x. This relationship indicates that x has undergone a validation process by y, using cryptographic measures to ensure that x is trustworthy and unaltered since the signing by y." .
-
-:signs a owl:ObjectProperty ;
- rdfs:label "signs" ;
- rdfs:subPropertyOf :validates ;
- :definition "x signs y: The entity x applies a digital signature to the digital artifact y, thereby asserting its validity, integrity, and authenticity. Typically, this involves cryptographic techniques to securely bind the signature to y, ensuring that y's contents have not been altered and are authentic as endorsed by x." .
-
-:spoofs a owl:ObjectProperty ;
- rdfs:label "spoofs" ;
- rdfs:subPropertyOf :associated-with,
- :deceives-with ;
- :definition "x spoofs y: The technique x creates a fake instance of a digital artifact y; that is, y is a decoy, fake, or counterfeit." ;
- rdfs:seeAlso ,
- .
-
-:start a owl:ObjectProperty ;
- rdfs:label "start" ;
- rdfs:subPropertyOf :d3fend-process-object-property .
-
-:strengthens a owl:ObjectProperty ;
- rdfs:label "strengthens" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- rdfs:isDefinedBy ;
- :definition "x strengthens y: The technique x make digital artifact y resistant (to harm or misuse.)" .
-
-:summarizes a owl:ObjectProperty ;
- rdfs:label "summarizes" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x summarizes y: The sensor x summarizes a set y of events concerning digital artifacts over time." .
-
-:suspends a owl:ObjectProperty ;
- rdfs:label "suspends" ;
- rdfs:subPropertyOf :evicts ;
- rdfs:isDefinedBy ;
- :definition "x suspends y: The agent or technique x pauses entity y." .
-
-:terminates a owl:ObjectProperty ;
- rdfs:label "terminates" ;
- rdfs:subPropertyOf :associated-with,
- :evicts ;
- rdfs:isDefinedBy ;
- :definition "x terminates y: The technique x brings to an end or halt to some activity y." ;
- rdfs:seeAlso ;
- :synonym "aborts" .
-
-:transmits a owl:ObjectProperty ;
- rdfs:label "transmits" ;
- skos:altLabel "sends" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x transmits y: The subject x actively emits object y onto a communication medium, rendering y observable and available for reception on that medium." .
-
-:unloads a owl:ObjectProperty ;
- rdfs:label "unloads" ;
- rdfs:subPropertyOf :evicts ;
- :definition "x unloads y: The technique or artifact performs the action of unloading some artifact (applications, kernel modules, or hardware drivers, etc.) from a computer's memory." .
-
-:unmounts a owl:ObjectProperty ;
- rdfs:label "unmounts" ;
- rdfs:subPropertyOf :associated-with ;
- :definition "x unmounts y: An operation x removes the access via computer system's file system the availability of files and directories on a storage artifact y. Unmounts reverse or undo prior mount operations." ;
- rdfs:seeAlso .
-
-:updates a owl:ObjectProperty ;
- rdfs:label "updates" ;
- rdfs:subPropertyOf :hardens,
- :modifies ;
- :definition "x updates y: The technique x updates the software for component y." .
-
-:use-limits a owl:ObjectProperty ;
- rdfs:label "use-limits" ;
- rdfs:subPropertyOf :limits ;
- :definition "x use-limits y: An entity x specifies a designated number of uses beyond which some entity y cannot function or must be terminated." ;
- rdfs:seeAlso .
-
-:used-by a owl:ObjectProperty ;
- rdfs:label "used-by" ;
- rdfs:subPropertyOf :associated-with ;
- owl:inverseOf :uses ;
- :definition "x used-by y: is inverse of y uses x." .
-
-:uses a owl:ObjectProperty ;
- rdfs:label "uses" ;
- rdfs:subPropertyOf :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x uses y: An entity x puts into service a resource or implement y; makes y work or employ for a particular purpose or for its inherent or natural purpose." .
-
-:validated-by a owl:ObjectProperty ;
- rdfs:label "validated-by" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- :definition "x validated-by y: The digital artifact x has its authenticity and correctness confirmed or verified by the technique, operation, or agent y." .
-
-:validates a owl:ObjectProperty ;
- rdfs:label "validates" ;
- rdfs:subPropertyOf :associated-with,
- :hardens ;
- rdfs:isDefinedBy ;
- :definition "x validates y: The technique x proves the digital artifact y is valid; that is, x shows or confirms the validity of y." .
-
-:verifies a owl:ObjectProperty ;
- rdfs:label "verifies" ;
- rdfs:subPropertyOf :analyzes,
- :associated-with ;
- rdfs:isDefinedBy ;
- :definition "x verifies y: A technique x confirms the truth of a digital artifact y." ;
- rdfs:seeAlso ,
- ,
- ;
- :todo "verifies and validates both share common parent confirms ala Wordnet (they are siblings). Might be useful parent, but leave out until it is clear it is helpful. Wordnet 'checks' might also be in play here, though in our world spec of verifies as in http://wordnet-rdf.princeton.edu/id/00665271-v, or is that checks more like validates? Eschewing altLabel 'checks' for either for now." .
-
-:weakness-of a owl:ObjectProperty ;
- rdfs:label "weakness-of" ;
- rdfs:subPropertyOf :may-be-weakness-of .
-
-:writes a owl:ObjectProperty ;
- rdfs:label "writes" ;
- rdfs:subPropertyOf :accesses ;
- :definition "x writes y: The subject x takes the action of writing to a digital artifact y to store data and placing it into persistent memory for later reference." ;
- rdfs:seeAlso .
-
-### Annotation Properties
-
-:attack-id a owl:AnnotationProperty ;
- rdfs:label "attack-id" ;
- rdfs:subPropertyOf :attack-kb-annotation ;
- rdfs:domain :OffensiveTechnique ;
- rdfs:range xsd:string ;
- :definition "x attack-id y: The offensive technique x has the att&ck unique id of y." ;
- :todo "Drop as annotation and merge any as attack-technique-id data property. Reason: The unique id of a technique may be needed even for OWL 2 DL reasoning as it is the surrogate identity key (and the primary key) for all ATT&CK techniques." .
-
-:attack-kb-annotation a owl:AnnotationProperty ;
- rdfs:label "attack-kb-annotation" ;
- rdfs:subPropertyOf :d3fend-annotation ;
- rdfs:domain :OffensiveTechnique ;
- :definition "x attack-kb-annotation y: The offensive technique x has the kb annotation of y." .
-
-:comment a owl:AnnotationProperty ;
- rdfs:label "comment" ;
- rdfs:subPropertyOf :d3fend-private-annotation ;
- :definition "x comment y: The d3fend object x a d3fend team specific comment y. Not for use external to the MITRE development team." .
-
-:cwe-id a owl:AnnotationProperty ;
- rdfs:label "cwe-id" ;
- rdfs:subPropertyOf :cwe-kb-annotation .
-
-:cwe-kb-annotation a owl:AnnotationProperty ;
- rdfs:label "cwe-kb-annotation" ;
- rdfs:subPropertyOf :d3fend-annotation .
-
-:d3fend-annotation a owl:AnnotationProperty ;
- rdfs:label "d3fend-annotation" ;
- :definition "x d3fend-annotation y: The d3fend object x has the annotation y." .
-
-:d3fend-catalog-annotation-property a owl:AnnotationProperty ;
- rdfs:label "d3fend-catalog-annotation-property" ;
- skos:altLabel "d3fend-vendor-registry-annotation-property" ;
- rdfs:subPropertyOf :d3fend-annotation .
-
-:d3fend-display-annotation a owl:AnnotationProperty ;
- rdfs:label "d3fend-display-annotation" ;
- rdfs:subPropertyOf :d3fend-annotation .
-
-:d3fend-kb-annotation-property a owl:AnnotationProperty ;
- rdfs:label "d3fend-kb-annotation-property" ;
- rdfs:subPropertyOf :d3fend-annotation ;
- :definition "x d3fend-kb-annotation-property y: The entity x had the d3fend kb annotation y." ;
- :todo "Move all subproperties under d3fend-kb-data-property and drop this (d3fend-kb-annotation-property) property definition." .
-
-:d3fend-kb-reference-annotation a owl:AnnotationProperty ;
- rdfs:label "d3fend-kb-reference-annotation" ;
- rdfs:subPropertyOf :d3fend-kb-annotation-property ;
- rdfs:domain :TechniqueReference ;
- rdfs:range xsd:string ;
- :definition "x d3fend-kb-data-property y: The reference x has the data property y." ;
- :todo "Move subproperties under d3fend-kb-data-property and rename this d3fend-kb-reference-property definition." .
-
-:d3fend-private-annotation a owl:AnnotationProperty ;
- rdfs:label "d3fend-private-annotation" ;
- rdfs:subPropertyOf :d3fend-annotation ;
- :definition "x d3fend-private-annotation: The d3fend object x has the internal comment or tracking property y. Not for use external to the MITRE development team." .
-
-dcterms:description a owl:AnnotationProperty .
-
-dcterms:license a owl:AnnotationProperty .
-
-dcterms:title a owl:AnnotationProperty .
-
-:definition a owl:AnnotationProperty ;
- rdfs:label "definition" ;
- rdfs:subPropertyOf :d3fend-annotation ;
- rdfs:isDefinedBy ;
- :comment "Intended d3fend equivalent to http://purl.obolibrary.org/obo/IAO_0000115; will take over from use of rdfs:comment to hold definition." ;
- :definition "x definition y: The d3fend object x has the definition y." ;
- :todo "Will port rdfs:comment entries that have been definitions to d3f:definition to free up comments for non-definitional expansions and commentary." .
-
-:description a owl:AnnotationProperty ;
- rdfs:label "description"@en ;
- rdfs:subPropertyOf :d3fend-catalog-annotation-property ;
- rdfs:isDefinedBy ;
- :definition "A statement that represents something in words." .
-
-:display-baseurl a owl:AnnotationProperty ;
- rdfs:label "display-baseurl" ;
- rdfs:subPropertyOf :d3fend-display-annotation ;
- :definition "A base string to use as prefix to create a full URL for an entity. The baseurl must end in a forward slash: /" .
-
-:display-order a owl:AnnotationProperty ;
- rdfs:label "display-order" ;
- rdfs:subPropertyOf :d3fend-display-annotation ;
- :definition "x display-order y: An object x should be displayed in ordinal position y when placed or listed in a d3fend display with other objects of its kind." ;
- :todo "This should be an annotation property." .
-
-:display-priority a owl:AnnotationProperty ;
- rdfs:label "display-priority" ;
- rdfs:subPropertyOf :d3fend-display-annotation .
-
-:draft a owl:AnnotationProperty ;
- rdfs:label "draft" ;
- rdfs:subPropertyOf :d3fend-private-annotation .
-
-:kb-abstract a owl:AnnotationProperty ;
- rdfs:label "kb-abstract" ;
- rdfs:subPropertyOf :d3fend-kb-reference-annotation ;
- rdfs:domain :TechniqueReference ;
- rdfs:range xsd:string ;
- :definition "x kb-abstract y: The reference x has the abstract y." .
-
-:kb-article a owl:AnnotationProperty ;
- rdfs:label "kb-article" ;
- rdfs:subPropertyOf :d3fend-kb-reference-annotation ;
- rdfs:domain :Technique ;
- rdfs:range xsd:string ;
- :definition "The technique x has the kb-article y, where y is written in Markdown." ;
- :todo "make a d3fend-kb-data-property" .
-
-:kb-author a owl:AnnotationProperty ;
- rdfs:label "kb-author" ;
- rdfs:subPropertyOf :d3fend-kb-reference-annotation ;
- rdfs:domain :TechniqueReference ;
- rdfs:range xsd:string ;
- :definition "x kb-author y: The reference x has some author y." ;
- :todo "Eventually would be best to resolve these to Person instances in KB. This might be kept as kb-author-string. Also, we might choose to drop kb- prefix on many of these.",
- "make a d3fend-kb-data-property" .
-
-:kb-mitre-analysis a owl:AnnotationProperty ;
- rdfs:label "kb-mitre-analysis" ;
- rdfs:subPropertyOf :d3fend-kb-annotation-property ;
- rdfs:domain :TechniqueReference ;
- rdfs:range xsd:string ;
- :definition "x kb-mitre-analysis y: The reference x has the mitre d3fend analysis y." ;
- :todo "make a d3fend-kb-data-property" .
-
-:kb-organization a owl:AnnotationProperty ;
- rdfs:label "kb-organization" ;
- rdfs:subPropertyOf :d3fend-kb-annotation-property ;
- :definition "x kb-organization y: The reference x was created or owned by the organization y." ;
- :todo "Eventually would be best to resolve these to Organization instances in KB. This might be kept as kb-organization-string. Also, we might choose to drop kb- prefix on many of these.",
- "make a d3fend-kb-data-property" .
-
-:label a owl:AnnotationProperty ;
- rdfs:label "label"@en ;
- rdfs:subPropertyOf rdfs:label .
-
-:pref-label a owl:AnnotationProperty ;
- rdfs:label "pref-label" ;
- rdfs:subPropertyOf :d3fend-annotation ;
- :definition "x pref-label y: The preferred display value for x is y in d3fend tools." .
-
-rdfs:isDefinedBy a owl:AnnotationProperty ;
- rdfs:label "isDefinedBy" .
-
-rdfs:label a owl:AnnotationProperty .
-
-rdfs:seeAlso a owl:AnnotationProperty .
-
-:release-date a owl:AnnotationProperty ;
- rdfs:label "release-date" ;
- rdfs:subPropertyOf :d3fend-annotation,
- owl:versionInfo ;
- :definition "x release-date y: The object x has the release-date y." ;
- :todo "remove and place info in versionInfo on ontology annotations header" .
-
-skos:altLabel a owl:AnnotationProperty .
-
-skos:example a owl:AnnotationProperty .
-
-skos:prefLabel a owl:AnnotationProperty .
-
-:synonym a owl:AnnotationProperty ;
- rdfs:label "synonym" ;
- rdfs:subPropertyOf :d3fend-annotation ;
- :definition "an equivalent term." .
-
-:todo a owl:AnnotationProperty ;
- rdfs:label "todo" ;
- rdfs:subPropertyOf :d3fend-private-annotation ;
- :definition "x todo y: The d3fend object x has a todo annotation y specific to the d3fend team. These may serve as a guide to implementing a low-level change; before work commences should be reflected in the tasks/issues. Not for use external to the MITRE development team." .
-
-### Data Properties
-
-:archived-at a owl:DatatypeProperty ;
- rdfs:label "archived-at"@en ;
- rdfs:subPropertyOf :d3fend-catalog-data-property ;
- rdfs:range xsd:anyURI ;
- :comment "schema.org's archivedAt vice schema.org notion of url, previously has-link" .
-
-:attack-kb-data-property a owl:DatatypeProperty ;
- rdfs:label "attack-kb-data-property" ;
- skos:altLabel "attack-kb-property" .
-
-:available a owl:DatatypeProperty ;
- rdfs:label "date available"@en ;
- rdfs:subPropertyOf :date ;
- rdfs:range xsd:dateTime ;
- :comment "d3f:available casts the dcterms:available rdf Property as a DatatypeProperty." ;
- :definition "Date that the resource became or will become available." .
-
-:capec-id a owl:DatatypeProperty ;
- rdfs:label "capec-id" ;
- rdfs:subPropertyOf :d3fend-kb-data-property ;
- :definition "Unique identifier for a CAPEC technique, i.e. a common attack pattern identified by the pattern CAPEC-[number]." .
-
-:comments a owl:DatatypeProperty,
- owl:FunctionalProperty ;
- rdfs:label "comments" ;
- rdfs:subPropertyOf :d3fend-catalog-data-property ;
- rdfs:range xsd:string ;
- :definition "x comments y: x claim has provider comments y." .
-
-:confidence a owl:DatatypeProperty ;
- rdfs:label "confidence" ;
- rdfs:subPropertyOf :d3fend-catalog-data-property .
-
-:control-name a owl:DatatypeProperty ;
- rdfs:label "control-name" ;
- rdfs:subPropertyOf :d3fend-external-control-data-property ;
- :definition "The control (or control enhancement) name." .
-
-:created a owl:DatatypeProperty ;
- rdfs:label "date created"@en ;
- rdfs:subPropertyOf :date ;
- rdfs:range xsd:dateTime ;
- :comment "d3f:created casts dcterms:created rdf Property as a DatatypeProperty." ;
- :definition "Date of creation of the resource." .
-
-:d3fend-artifact-data-property a owl:DatatypeProperty ;
- rdfs:label "d3fend-artifact-data-property" ;
- rdfs:subPropertyOf :d3fend-data-property ;
- rdfs:domain :DigitalArtifact ;
- :definition "x d3fend-artifact-data-property y: The artifact x has the data property y." .
-
-:d3fend-catalog-data-property a owl:DatatypeProperty ;
- rdfs:label "d3fend-catalog-data-property" ;
- skos:altLabel "d3fend-vendor-registry-data-property"@en ;
- rdfs:subPropertyOf :d3fend-data-property .
-
-:d3fend-comment a owl:DatatypeProperty ;
- rdfs:label "d3fend-comment" ;
- rdfs:subPropertyOf :d3fend-kb-data-property ;
- :definition "x d3fend-comment y: The entity x has an D3FEND team written a public note about entity y." .
-
-:d3fend-data-property a owl:DatatypeProperty ;
- rdfs:label "d3fend-data-property" .
-
-:d3fend-display-property a owl:DatatypeProperty ;
- rdfs:label "d3fend-display-property" ;
- rdfs:subPropertyOf :d3fend-data-property ;
- :definition "x d3fend-display-property y: An object x should be displayed using the display property y, when it applies." ;
- :todo "This should be an annotation property." .
-
-:d3fend-external-control-data-property a owl:DatatypeProperty ;
- rdfs:label "d3fend-external-control-data-property" ;
- rdfs:subPropertyOf :d3fend-data-property .
-
-:d3fend-id a owl:DatatypeProperty ;
- rdfs:label "d3fend-id" ;
- rdfs:subPropertyOf :d3fend-kb-data-property ;
- :definition "Unique identifier for a D3FEND technique. D3-[Acronym]." .
-
-:d3fend-kb-data-property a owl:DatatypeProperty ;
- rdfs:label "d3fend-kb-data-property" ;
- rdfs:subPropertyOf :d3fend-data-property ;
- :definition "x d3fend-kb-data-property y: The d3fend knowledge base object x has a data property y; e.g., a string capturing a particular aspect or section of a knowledge base article." .
-
-:date a owl:DatatypeProperty ;
- rdfs:label "date"@en ;
- rdfs:subPropertyOf :d3fend-data-property ;
- rdfs:range xsd:dateTime ;
- :comment "d3f:date casts the dcterms:date rdf Property as a DatatypeProperty." ;
- :definition "A point or period of time associated with an event in the lifecycle of the resource." ;
- rdfs:seeAlso .
-
-:expectation-rating a owl:DatatypeProperty ;
- rdfs:label "expectation-rating" ;
- rdfs:subPropertyOf :d3fend-catalog-data-property .
-
-:has-link a owl:DatatypeProperty ;
- rdfs:label "has-link" ;
- rdfs:subPropertyOf :d3fend-kb-data-property ;
- rdfs:range xsd:anyURI ;
- :definition "x has-link y: The d3fend analysis x has the link y." .
-
-:identifier a owl:DatatypeProperty ;
- rdfs:label "identifier"@en ;
- rdfs:subPropertyOf :d3fend-catalog-data-property ;
- rdfs:range xsd:string .
-
-:issued a owl:DatatypeProperty ;
- rdfs:label "date issued"@en ;
- rdfs:subPropertyOf :date ;
- rdfs:range xsd:dateTime ;
- :comment "d3f:issued casts the dcterms:issued rdf Property as a DatatypeProperty." ;
- :definition "Date of formal issuance of the resource." .
-
-:kb-reference-title a owl:DatatypeProperty ;
- rdfs:label "kb-reference-title" ;
- rdfs:subPropertyOf :d3fend-kb-data-property ;
- rdfs:range xsd:string ;
- :definition "x kb-reference-title y: The d3fend knowledge base reference x has the reference title string y." .
-
-:modified a owl:DatatypeProperty ;
- rdfs:label "date modified"@en ;
- rdfs:subPropertyOf :date ;
- rdfs:range xsd:dateTime ;
- :comment "d3f:modified casts the dcterms:modified rdf Property as a DatatypeProperty." ;
- :definition "Date on which the resource was changed." .
-
-:name a owl:DatatypeProperty ;
- rdfs:label "name"@en ;
- rdfs:subPropertyOf :d3fend-catalog-data-property .
-
-:operating-system a owl:DatatypeProperty ;
- rdfs:label "operating-system"@en ;
- rdfs:subPropertyOf :d3fend-catalog-data-property ;
- rdfs:range xsd:string ;
- :definition "x operating-system y: The product x is supported on operating system y." .
-
-:process-command-line-arguments a owl:DatatypeProperty ;
- rdfs:label "process-command-line-arguments" ;
- rdfs:subPropertyOf :process-data-property ;
- :definition "x process-command-line-arguments y: The process x has the process command line arguments data y." .
-
-:process-data-property a owl:DatatypeProperty ;
- rdfs:label "process-data-property" ;
- rdfs:subPropertyOf :d3fend-artifact-data-property ;
- :definition "x process-data-property y: The process x has the data property y." .
-
-:process-environmental-variables a owl:DatatypeProperty ;
- rdfs:label "process-environmental-variables" ;
- skos:altLabel "process-environmental-variable" ;
- rdfs:subPropertyOf :process-data-property ;
- :definition "x process-environment-variables y: The process x has the process environmental variables data y." .
-
-:process-identifier a owl:DatatypeProperty ;
- rdfs:label "process-identifier" ;
- rdfs:subPropertyOf :process-data-property ;
- :definition "x process-identifier y: The process x has the process identifier y." .
-
-:process-security-context a owl:DatatypeProperty ;
- rdfs:label "process-security-context" ;
- rdfs:subPropertyOf :process-data-property ;
- rdfs:domain :Process ;
- :definition "x process-security-context y: The process x has the process security context data y." .
-
-:published a owl:DatatypeProperty ;
- rdfs:label "date published"@en ;
- rdfs:subPropertyOf :date ;
- rdfs:range xsd:dateTime ;
- :definition "Date of publication of the resource." .
-
-:rating a owl:DatatypeProperty,
- owl:FunctionalProperty ;
- rdfs:label "rating" ;
- rdfs:subPropertyOf :d3fend-catalog-data-property .
-
-:risk-impact a owl:DatatypeProperty ;
- rdfs:label "risk-impact" ;
- rdfs:subPropertyOf :d3fend-data-property ;
- rdfs:range [ a rdfs:Datatype ;
- owl:onDatatype xsd:integer ;
- owl:withRestrictions (
- [ xsd:maxInclusive 5 ]
- [ xsd:minInclusive 1 ] ) ] ;
- rdfs:isDefinedBy ;
- :definition "Risk impact rating, expressed on a numeric scale from 1 (lowest impact) to 5 (highest impact) in the context of a 5x5 risk matrix. Impact is used here as a synonym for consequence, another popular term used in risk analysis." .
-
-:risk-likelihood a owl:DatatypeProperty ;
- rdfs:label "risk-likelihood" ;
- rdfs:subPropertyOf :d3fend-data-property ;
- rdfs:range [ a rdfs:Datatype ;
- owl:onDatatype xsd:integer ;
- owl:withRestrictions (
- [ xsd:maxInclusive 5 ]
- [ xsd:minInclusive 1 ] ) ] ;
- rdfs:isDefinedBy ;
- :definition "Risk likelihood rating, expressed on a numeric scale from 1 (lowest likelihood) to 5 (highest likelihood) in the context of a 5x5 risk matrix." .
-
-:stage a owl:DatatypeProperty,
- owl:FunctionalProperty ;
- rdfs:label "stage" ;
- rdfs:subPropertyOf :d3fend-catalog-data-property .
-
-:text a owl:DatatypeProperty ;
- rdfs:label "text"@en ;
- rdfs:subPropertyOf :d3fend-catalog-data-property ;
- :definition "The text of the document (i.e., terms of license.)" .
-
-:title a owl:DatatypeProperty ;
- rdfs:label "title"@en ;
- rdfs:subPropertyOf :d3fend-catalog-data-property ;
- rdfs:range xsd:string ;
- :comment "d3f:title casts dcterms:title rdf Property as a DatatypeProperty." ;
- :definition "A name given to the resource." .
-
-:valid a owl:DatatypeProperty ;
- rdfs:label "date valid"@en ;
- rdfs:subPropertyOf :date ;
- rdfs:range xsd:dateTime ;
- :comment "d3f:valid casts dcterms:valid rdf Property as a DatatypeProperty." ;
- :definition "Date (often a range) of validity of a resource." .
-
-:version a owl:DatatypeProperty,
- owl:FunctionalProperty ;
- rdfs:label "version"@en ;
- rdfs:subPropertyOf :d3fend-catalog-data-property,
- :d3fend-external-control-data-property ;
- rdfs:range [ a rdfs:Datatype ;
- owl:unionOf (
- xsd:integer
- xsd:string ) ] ;
- :definition "x version y: The product or service x has the version y." .
-
-:windows-registry-data-property a owl:DatatypeProperty ;
- rdfs:label "windows-registry-data-property" ;
- rdfs:subPropertyOf :d3fend-artifact-data-property ;
- :definition "x windows-registry-data-property y: The windows registry entry x has the property y." .
-
-:windows-registry-key a owl:DatatypeProperty ;
- rdfs:label "windows-registry-key" ;
- skos:altLabel "key" ;
- rdfs:subPropertyOf :windows-registry-data-property ;
- :definition "x value y: The key-value pair x has the key y." .
-
-:windows-registry-value a owl:DatatypeProperty ;
- rdfs:label "windows-registry-value" ;
- skos:altLabel "value" ;
- rdfs:subPropertyOf :windows-registry-data-property ;
- :definition "x value y: The key-value pair x has the data value y." .
-
-### Classes
-
-:AcademicPaperReference a owl:Class ;
- rdfs:label "Academic Paper Reference" ;
- rdfs:subClassOf :TechniqueReference ;
- :pref-label "Academic Paper" .
-
-:Access a owl:Class ;
- rdfs:label "Access" ;
- rdfs:subClassOf :Event,
- [ a owl:Restriction ;
- owl:onProperty :accesses ;
- owl:someValuesFrom :Resource ],
- [ a owl:Restriction ;
- owl:onProperty :has-mediator ;
- owl:someValuesFrom :AccessMediator ] .
-
-:AccessControlAdministrationEvent a owl:Class ;
- rdfs:label "Access Control Administration Event" ;
- skos:altLabel "Permission Administration Event",
- "Permission Provisioning Event" ;
- rdfs:subClassOf :AccessControlEvent ;
- :definition "An event concerning the administrative actions of setting, modifying, or abolishing permissions, configuring access control settings, and managing user access rights to ensure alignment with access control policies." .
-
-:AccessControlConfiguration a owl:Class ;
- rdfs:label "Access Control Configuration" ;
- rdfs:subClassOf :ConfigurationResource ;
- :definition "Information about what access permissions are granted to particular users for particular objects." ;
- rdfs:seeAlso .
-
-:AccessControlEvent a owl:Class ;
- rdfs:label "Access Control Event" ;
- rdfs:subClassOf :AuthorizationEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :AccessControlConfiguration ] ;
- :definition "An event that captures the implementation or evaluation of access control measures, including the application of rules and policies to govern the accessibility of resources by agents within a digital system." .
-
-:AccessControlGroup a owl:Class ;
- rdfs:label "Access Control Group" ;
- rdfs:subClassOf :AccessControlConfiguration,
- [ a owl:Restriction ;
- owl:onProperty :restricted-by ;
- owl:someValuesFrom :AccessControlList ] ;
- :definition "A collection of objects that can have access controls placed on them." ;
- rdfs:seeAlso .
-
-:AccessControlList a owl:Class ;
- rdfs:label "Access Control List" ;
- rdfs:subClassOf :AccessControlConfiguration,
- [ a owl:Restriction ;
- owl:onProperty :restricts ;
- owl:someValuesFrom :UserGroup ] ;
- rdfs:isDefinedBy ;
- :definition "A list of permissions attached to an object." .
-
-:AccessDeniedEvent a owl:Class ;
- rdfs:label "Access Denied Event" ;
- rdfs:subClassOf :AccessMediationEvent ;
- :definition "An event indicating the refusal of access to a resource, where an access request has been evaluated and denied based on current authorization policies, preventing operations by the requesting agent." .
-
-:AccessGrantedEvent a owl:Class ;
- rdfs:label "Access Granted Event" ;
- rdfs:subClassOf :AccessMediationEvent ;
- :definition "An event signifying that access to a resource has been authorized and successfully enforced, allowing the requesting agent to perform specified operations based on the access control policies." .
-
-:AccessMediation a :AccessMediation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Access Mediation" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Isolate ] ;
- :d3fend-id "D3-AMED" ;
- :definition "Access mediation is the process of granting or denying specific requests to: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities (e.g., Federal buildings, military establishments, border crossing entrances). Access mediation decisions should enforce least privilege by granting access for scoped durations to prevent privilege creep and, where applicable, implement just-in-time (JIT) access. Denial decisions may prevent initial access or terminate access that has already been granted, ensuring continuous enforcement of security policies." ;
- :kb-reference :Reference-CNNSI-4009 ;
- rdfs:seeAlso ,
- ,
- ,
- ,
- ;
- :synonym "Access Control" .
-
-:AccessMediationEvent a owl:Class ;
- rdfs:label "Access Mediation Event" ;
- skos:altLabel "Access Enforcement Event" ;
- rdfs:subClassOf :AccessControlEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :AccessMediator ] ;
- :definition "An event involving the intermediary control mechanism that evaluates access requests and enforces access control decisions, ensuring that subjects' resource interactions comply with the established access policies." .
-
-:AccessMediator a owl:Class ;
- rdfs:label "Access Mediator" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :implements ;
- owl:someValuesFrom :AccessControlConfiguration ],
- [ a owl:Restriction ;
- owl:onProperty :mediates-access-to ;
- owl:someValuesFrom :Resource ],
- [ a owl:Restriction ;
- owl:onProperty :used-by ;
- owl:someValuesFrom :Agent ] ;
- :definition "An Access Mediator enforces access control policies to regulate interactions with a resource." .
-
-:AccessModeling a :AccessModeling,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Access Modeling" ;
- rdfs:subClassOf :OperationalActivityMapping,
- [ a owl:Restriction ;
- owl:onProperty :maps ;
- owl:someValuesFrom :AccessControlConfiguration ],
- [ a owl:Restriction ;
- owl:onProperty :maps ;
- owl:someValuesFrom :DigitalIdentity ],
- [ a owl:Restriction ;
- owl:onProperty :maps ;
- owl:someValuesFrom :UserAccount ] ;
- :d3fend-id "D3-AM" ;
- :definition "Access modeling captures and records the access permissions granted to identities (e.g., administrators, users, groups, systems) and optionally includes details on how these identities are stored, managed, and shared across systems." ;
- :kb-reference :Reference-RFC7642SystemForCrossDomainIdentityManagementDefinitionsOverviewConceptsAndRequirements .
-
-:AccessPolicyAdministration a :AccessPolicyAdministration,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Access Policy Administration" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Isolate ] ;
- :d3fend-id "D3-APA" ;
- :definition "Access policy administration is the systematic process of defining, implementing, and managing access control policies that dictate user permissions to resources." ;
- :synonym "Access Control Administration" .
-
-:AccessProcess a owl:Class ;
- rdfs:label "Access Process" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :accesses ;
- owl:someValuesFrom :Process ] .
-
-:AccessToken a owl:Class ;
- rdfs:label "Access Token" ;
- skos:altLabel "Ticket",
- "Token" ;
- rdfs:subClassOf :Credential ;
- :definition "In computer systems, an access token contains the security credentials for a login session and identifies the user, the user's groups, the user's privileges, and, in some cases, a particular application. Typically one may be asked to enter the access token (e.g. 40 random characters) rather than the usual password (it therefore should be kept secret just like a password)." ;
- rdfs:seeAlso .
-
-:AccountLocking a :AccountLocking,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Account Locking" ;
- rdfs:subClassOf :CredentialEviction,
- [ a owl:Restriction ;
- owl:onProperty :disables ;
- owl:someValuesFrom :UserAccount ] ;
- :created "2020-08-05T00:00:00"^^xsd:dateTime ;
- :d3fend-id "D3-AL" ;
- :definition "The process of temporarily disabling user accounts on a system or domain." ;
- :kb-article """## How it works
-Management servers with enterprise policies for account management provide the ability to enable and disable account for given rules. The rules may include specific periods of time (eg. weekend, plant shutdown, leave periods), specific user types or groups, or individual users.
-
-## Considerations
-* Local accounts caches vs centralized account management
-* Single Sign-on
-* Role based vs Attribute based systems
-
-## Examples of account configuration stores
-* Directory Services
-* Active Directory
-* RADIUS
-* LDAP
-* Oracle User Account Management
-* JumpCloud""" ;
- :kb-reference :Reference-AccountMonitoring_ForescoutTechnologies,
- :Reference-FrameworkForNotifyingADirectoryServiceOfAuthenticationEventsProcessedOutsideTheDirectoryService_OracleInternationalCorp .
-
-:Action a owl:Class ;
- rdfs:label "Action" ;
- rdfs:subClassOf :Event,
- [ a owl:Restriction ;
- owl:onProperty :has-agent ;
- owl:someValuesFrom :Agent ] ;
- :definition "An Action is a deliberate operation or activity performed by an entity." .
-
-:ActiveCertificateAnalysis a :ActiveCertificateAnalysis,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Active Certificate Analysis" ;
- rdfs:subClassOf :CertificateAnalysis ;
- :created "2020-08-05T00:00:00"^^xsd:dateTime ;
- :d3fend-id "D3-ACA" ;
- :definition "Actively collecting PKI certificates by connecting to the server and downloading its server certificates for analysis." ;
- :kb-article """## How it works
-Analysis of server certificates using active methods to detect if certificates have been misconfigured or spoofed by using elements of the certificate, certificate authorities and signatures.
-
-### Certificate validity analysis
-This can be accomplished by verifying the digital signature on certificate.
-
-### Certificate path analysis
-The client's browser can perform path verification to ensure that the server's certificate contains a valid trust anchor.
-
-### Certificate configuration analysis
-Some browsers can be configured to implement the key-usage extensions contained certificates. This can help to prevent a certificate from being misused.
-
-### Certificate revocation status analysis
-Using either Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) to determine the revocation status. OCSP Stapling, binding the status with the certificate, helps to mitigate potential delay in status verifications.
-
-## Considerations
-* Management of the PKI across the enterprise typically requires automation to maintain scalability and flexibility
-* If the certificate authority, issuing the certificate, is compromised then all of the certificates issued by the CA are suspect
-* There may be delays associated with updates to certificates
-* Revoked certificates give the appearance of valid certificates until they are published to a trusted revocation service (OCSP or CRL)
-* The revocation service (OCSP or CRL) may be down during our connection and a browser will need to make a decision will need to be made about trusting the connection""" ;
- :kb-reference :Reference-SecuringWebTransactions .
-
-:ActiveLearning a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Active Learning" ;
- rdfs:subClassOf :MachineLearning ;
- :d3fend-id "D3A-AL" ;
- :definition "Active learning aims to improve learning efficiency by allowing the learning algorithm to select which data to learn from." ;
- :kb-article """## How it works
-Traditional supervised learning often requires a large number of labeled instances, which can be costly or time-consuming to obtain. Active learning addresses this labeling bottleneck by asking an oracle (e.g., a human annotator) to label selected unlabeled instances. The goal is to achieve high accuracy with minimal labeling effort.
-
-## Considerations
-Active learning is particularly useful in scenarios where data is abundant but labeled instances are scarce or expensive. Examples include speech recognition, information extraction, and document classification.
-
-## References
-- Wikipedia article on Active Learning (machine learning) [Link](https://en.wikipedia.org/wiki/Active_learning_(machine_learning))
-- Settles, B. (2009). Active Learning Literature Survey. [Link](https://burrsettles.com/pub/settles.activelearning.pdf)""" .
-
-:ActiveLogicalLinkMapping a :ActiveLogicalLinkMapping,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Active Logical Link Mapping" ;
- rdfs:subClassOf :LogicalLinkMapping,
- [ a owl:Restriction ;
- owl:onProperty :may-query ;
- owl:someValuesFrom :NetworkAgent ] ;
- :d3fend-id "D3-ALLM" ;
- :definition "Active logical link mapping sends and receives network traffic as a means to map the whole data link layer, where the links represent logical data flows rather than physical connection" ;
- :kb-article """## How it works
-
-Active logical link mapping establishes awareness of logical links in the network by sending data over the network to gather information about logical connections in the network.
-
-Typically this will be achieved through network telemetry coordinated for network management and monitoring and will use a link layer discovery protocol such as LLDP and the information gathered and aggregated a higher levels using an application protocol such as SNMP. The information may be polled by network management softare or configured once and then pushed from network sensors (or agents.)
-
-Another means of establishing network connectivity is by means of sendingn traffic through the use of a tool such as traceroute, to determine the logical paths through the network architecture.
-
-## Considerations
-
-* Best practice is to encrypte network monitoring data and require authentication for queries or admin/management functions.
-* Push notifications reduce bandwidth necessary to capture and maintain information if reliable transport is used.
-* Special consideration should be made before using of active scanning in OT networks and OT-safe options chosen where available.""" ;
- :kb-reference :Reference-IdentificationOfTracerouteNodesAndAssociatedDevices,
- :Reference-SNMPNetworkAutoDiscovery .
-
-:ActivePhysicalLinkMapping a :ActivePhysicalLinkMapping,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Active Physical Link Mapping" ;
- rdfs:subClassOf :PhysicalLinkMapping,
- [ a owl:Restriction ;
- owl:onProperty :may-query ;
- owl:someValuesFrom :NetworkAgent ] ;
- owl:disjointWith :DirectPhysicalLinkMapping ;
- :d3fend-id "D3-APLM" ;
- :definition "Active physical link mapping sends and receives network traffic as a means to map the physical layer." ;
- :kb-reference :Reference-IdentificationOfTracerouteNodesAndAssociatedDevices,
- :Reference-UsingSpanningTreeProtocolSTPToEnhanceLayer2NetworkTopologyMaps ;
- :synonym "Active Physical Layer Mapping" .
-
-:ActivityDependency a owl:Class ;
- rdfs:label "Activity Dependency" ;
- rdfs:subClassOf :Dependency ;
- :definition "An activity dependency is a dependency that indicates an activity has an activity or agent which relies on it in order to be functional." .
-
-:Actor-Critic a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Actor-Critic" ;
- rdfs:subClassOf :PolicyGradient,
- :TemporalDifferenceLearning ;
- :d3fend-id "D3A-AC" ;
- :definition "Actor-Critic is a Temporal Difference(TD) version of Policy gradient. It has two networks: Actor and Critic. The actor decided which action should be taken and critic inform the actor how good was the action and how it should adjust. The learning of the actor is based on policy gradient approach. In comparison, critics evaluate the action produced by the actor by computing the value function." ;
- :kb-article """## References
-The Actor-Critic Reinforcement Learning Algorithm. Medium. [Link](https://medium.com/intro-to-artificial-intelligence/the-actor-critic-reinforcement-learning-algorithm-c8095a655c14).""" ;
- :todo "The citation suggest (at a very brief glance) this may belong under temporal difference learning" .
-
-:Actuator a owl:Class ;
- rdfs:label "Actuator" ;
- rdfs:subClassOf :OutputDevice ;
- :definition "An actuator is a mechanical or electromechanical device that, upon receiving a relatively low-energy control signal (e.g., electrical voltage, fluid pressure, or human force), translates its primary energy source (electric, hydraulic, or pneumatic) into targeted mechanical motion or adjustment. It typically works in conjunction with a control device (like a valve or logic driver) and is central to automation, enabling machines or systems to move, open, close, or otherwise manipulate their components or environment. By amplifying or redirecting energy from one form to another, the actuator executes control commands, thereby automating processes in industrial, automotive, aerospace, and other domains where precise mechanical action is essential." ;
- rdfs:seeAlso .
-
-:AdaptiveResonanceTheoryClustering a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Adaptive Resonance Theory Clustering" ;
- rdfs:subClassOf :ANN-basedClustering ;
- :d3fend-id "D3A-ARTC" ;
- :definition "Adaptive Resonance Theory (ART) Clustering is a neural network algorithm used for clustering data and is open to new learning(i.e. adaptive) without discarding the previous or the old information(i.e. resonance)." ;
- :kb-article """## References
-GeeksforGeeks. (n.d.). Adaptive Resonance Theory (ART). [Link](https://www.geeksforgeeks.org/adaptive-resonance-theory-art/)""" .
-
-:AddressSpace a owl:Class ;
- rdfs:label "Address Space" ;
- rdfs:subClassOf :DigitalInformationBearer ;
- rdfs:isDefinedBy ;
- :definition "An address space defines a range of discrete addresses, each of which may correspond to a network host, peripheral device, disk sector, a memory cell or other logical or physical entity. For software programs to save and retrieve stored data, each unit of data must have an address where it can be located. The number of address spaces available depends on the underlying address structure, which is usually limited by the computer architecture being used." .
-
-:AddUserToGroupEvent a owl:Class ;
- rdfs:label "Add User to Group Event" ;
- rdfs:subClassOf :GroupManagementEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :UserAccount ],
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :GroupCreationEvent ],
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :UserAccountCreationEvent ] ;
- :definition "An event where a user is added to a group, granting the user the permissions and privileges associated with the group." .
-
-:AdministrativeNetworkActivityAnalysis a :AdministrativeNetworkActivityAnalysis,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Administrative Network Activity Analysis" ;
- rdfs:subClassOf :NetworkTrafficAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :IntranetAdministrativeNetworkTraffic ] ;
- :created "2020-08-05T00:00:00"^^xsd:dateTime ;
- :d3fend-id "D3-ANAA" ;
- :definition "Detection of unauthorized use of administrative network protocols by analyzing network activity against a baseline." ;
- :kb-article """## How it works
-Network protocols such as RDP, IPMI, SSH, SNMP, VNC, MOSH, NX, TeamViewer, SPICE, PCoIP, and others are used by system administrators to remotely manage servers. Defenders monitor administrative network activity to determine if the use of remote protocols is malicious. Attackers can abuse administrative protocols and leverage them for initial access to various endpoints. For example, an attacker with valid credentials will remotely SSH or RDP into a server and attempt to blend in with existing traffic from system administrators. By monitoring the traffic activity, it is possible to detect when the protocols are behaving differently from a known baseline of system administration activity.
-
-## Considerations
-* Administrative traffic can be encrypted, making network protocol analysis a challenge
-* False alarms can be mitigated by integration with inventory management systems""" ;
- :kb-reference :Reference-MethodAndSystemForDetectingSuspiciousAdministrativeActivity_VectraNetworksInc,
- :Reference-RemoteRegistry_MITRE,
- :Reference-WindowsRemoteManagement_WinRM_MITRE .
-
-:AdministrativeNetworkTraffic a owl:Class ;
- rdfs:label "Administrative Network Traffic" ;
- rdfs:subClassOf :NetworkTraffic ;
- :definition "Administrative network traffic is network traffic related to the remote administration or control of hosts or devices through a standard remote administrative protocol. Remote shells, terminals, RDP, and VNC are examples of these protocols, which are typically only used by administrators." ;
- rdfs:seeAlso .
-
-:Agent a owl:Class ;
- rdfs:label "Agent" ;
- rdfs:subClassOf :D3FENDCore ;
- :definition "An entity capable of performing intentional actions." .
-
-:AgentAuthentication a :AgentAuthentication,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Agent Authentication" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :Agent ],
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Harden ],
- [ a owl:Restriction ;
- owl:onProperty :strengthens ;
- owl:someValuesFrom :UserAccount ] ;
- :d3fend-id "D3-AA" ;
- :definition "Agent authentication is the process of verifying the identities of agents to ensure they are authorized and trustworthy participants within a system." ;
- :kb-reference :Reference-NIST-Special-Publication-800-53-Revision-5 .
-
-:AgentGroup a owl:Class ;
- rdfs:label "Agent Group" ;
- rdfs:subClassOf :Group,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :Agent ] .
-
-:AgglomerativeClustering a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Agglomerative Clustering" ;
- rdfs:subClassOf :HierarchicalClustering ;
- :d3fend-id "D3A-AC" ;
- :definition "Agglomerative Clustering is a type of hierarchical clustering method where data points are grouped together based on similarity. Initially, each data point is treated as an individual cluster, and then in successive iterations, the closest clusters are merged until only one large cluster remains or until a specified stopping criterion is met." ;
- :kb-article """## How it works
-
-Agglomerative clustering starts with each data point as its own cluster. The algorithm then iterates, identifying the two clusters that are closest to each other based on a defined distance metric (e.g., Euclidean, Manhattan). These two clusters are then merged into a single cluster. This process continues iteratively, merging the closest pairs of clusters in each step until all data points are merged into a single cluster or until other stopping criteria are achieved. A dendrogram, which is a tree-like diagram, can be used to represent the sequence of merges, providing a visual representation of the hierarchical structure of data.
-
-## Considerations
-
-- **Choice of Distance Metric**: The outcome can vary significantly depending on the chosen distance metric (e.g., Euclidean, Manhattan).
-
-- **Scalability**: Agglomerative clustering can be computationally intensive for large datasets.
-
-- **Sensitivity**: The method can be sensitive to outliers, which might affect the quality of the clusters formed.
-
-## Key Test Considerations
-
-- **Unsupervised Learning**:
-
- - **Number of Clusters**: Determine an optimal number of clusters using the dendrogram and techniques like the elbow method.
-
-- **Cluster Analysis**:
-
- - **Silhouette Score**: Evaluates how similar an object is to its own cluster compared to other clusters. A higher silhouette score indicates that the object is well matched to its own cluster and poorly matched to neighboring clusters.
-
- - **Dunn Index**: Measures the ratio between the smallest distance between observations not in the same cluster to the largest intra-cluster distance.
-
-- **Hierarchical Clustering**:
-
- - **Cophenetic Correlation Coefficient**: Measures the correlation between the distances of points in feature space and their distances on the dendrogram. Helps assess the fidelity of the dendrogram in preserving pairwise distances between samples.
-
-- **Agglomerative Clustering**:
-
- - **Linkage Criteria**: Test different linkage criteria (e.g., single, complete, average) to determine which produces the most cohesive clusters for the data at hand.
-
- ## Platforms, Tools, or Libraries
-
-- **scikit-learn**:
-
- - A versatile machine learning library in Python.
-
- - The `AgglomerativeClustering` class in scikit-learn provides this functionality.
-
-- **SciPy**:
-
- - A Python library used for scientific and technical computing.
-
- - The `scipy.cluster.hierarchy` module provides functions for hierarchical and
- agglomerative clustering, including the `linkage` and `dendrogram` functions.
-
-- **R**:
-
- - The `hclust` function in the stats package provides agglomerative clustering.
-
- - The `agnes` function in the `cluster` package offers a more extensive implementation.
-
-- **MATLAB**:
-
- - Offers the `linkage` function for hierarchical agglomerative clustering and `dendrogram` for visualization.
-
-- **Weka**:
-
- - A collection of machine learning algorithms for data mining tasks.
-
- - The `HierarchicalClusterer` class provides an implementation of agglomerative clustering.
-
-## References
-
-1. Jain, A. K., & Dubes, R. C. (1988). *Algorithms for clustering data*. Prentice-Hall, Inc.
-
-2. Murtagh, F., & Legendre, P. (2014). Ward’s hierarchical agglomerative clustering method: which algorithms implement Ward’s criterion?. *Journal of Classification*, 31(3), 274-295. [Link](https://link.springer.com/article/10.1007/s00357-014-9161-z).
-
-3. Scikit-learn. (30 Jun 2023). Scikit-learn Documentation: Agglomerative Clustering.
-[Link](https://scikit-learn.org/stable/modules/generated/sklearn.cluster.AgglomerativeClustering.html).""" .
-
-:AlethicLogic a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Alethic Logic" ;
- rdfs:subClassOf :ModalLogic ;
- :d3fend-id "D3A-AL" ;
- :definition "Alethic logic is a modal logic that addresses the modalities of necessity and possibility." ;
- :kb-article """## References
-1. Alethic logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Alethic_logic)""" .
-
-:Alias a owl:Class ;
- rdfs:label "Alias" ;
- rdfs:subClassOf :SlowSymbolicLink ;
- rdfs:isDefinedBy ;
- :definition "In macOS, an alias is a small file that represents another object in a local, remote, or removable[1] file system and provides a dynamic link to it; the target object may be moved or renamed, and the alias will still link to it (unless the original file is recreated; such an alias is ambiguous and how it is resolved depends on the version of macOS)." .
-
-:AllocateMemory a owl:Class ;
- rdfs:label "Allocate Memory" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :creates ;
- owl:someValuesFrom :MemoryBlock ] .
-
-:AnalyticalPurpose a owl:Class ;
- rdfs:label "Analytical Purpose" ;
- rdfs:subClassOf :Goal .
-
-:AnalyticTechnique a owl:Class ;
- rdfs:label "Analytic Technique" ;
- rdfs:subClassOf :Technique ;
- rdfs:isDefinedBy ;
- :definition "A process in which a computer examines information using mathematical methods in order to find useful patterns." .
-
-:ANN-basedClustering a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "ANN-based Clustering" ;
- rdfs:subClassOf :ClusterAnalysis ;
- :d3fend-id "D3A-ABC" ;
- :definition "Combines the principles of Artificial Neural Networks (ANN) and clustering methods." ;
- :kb-article """## References
-Wikipedia. (n.d.). Artificial neural network. [Link](https://en.wikipedia.org/wiki/Artificial_neural_network)""" ;
- :todo """have a gander at this paper for more clustering techniques ?
-https://www.sciencedirect.com/science/article/pii/S089360800900207X?viewFullText=true#sec19""" .
-
-:AnonymousPipe a owl:Class ;
- rdfs:label "Anonymous Pipe" ;
- rdfs:subClassOf :Pipe ;
- rdfs:isDefinedBy ;
- :definition "In computer science, an anonymous pipe is a simplex FIFO communication channel that may be used for one-way interprocess communication (IPC). An implementation is often integrated into the operating system's file IO subsystem. Typically a parent program opens anonymous pipes, and creates a new process that inherits the other ends of the pipes, or creates several new processes and arranges them in a pipeline." .
-
-:AnswerSetProgramming a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Answer Set Programming" ;
- rdfs:subClassOf :LogicProgramming ;
- :d3fend-id "D3A-ASP" ;
- :definition "Answer set programming is a form of declarative programming based on the stable model (answer set) semantics of logic programming." ;
- :kb-article """## How it works
-Answer set programming (ASP) is oriented towards difficult (primarily NP-hard) search problems. The computational process employed in the design of many answer set solvers is an enhancement of the DPLL algorithm and, in principle, it always terminates (unlike Prolog query evaluation, which may lead to an infinite loop).
-
-In a more general sense, ASP includes all applications of answer sets to knowledge representation and the use of Prolog-style query evaluation for solving problems arising in these applications.
-
-## References
-1. Answer set programming. (2023, April 27). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Answer_set_programming)""" ;
- :synonym "ASP" .
-
-:Application a owl:Class ;
- rdfs:label "Application" ;
- rdfs:subClassOf :Software,
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :ApplicationConfiguration ] ;
- :definition "A program that gives a computer instructions that provide the user with tools to accomplish a task; \"he has tried several different word processing applications\". Distinct from system software that is intrinsically part of the operating system. An application can be made up of executable files, configuration files, shared libraries, etc." ;
- rdfs:seeAlso ,
- .
-
-:Application-basedProcessIsolation a :Application-basedProcessIsolation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Application-based Process Isolation" ;
- rdfs:subClassOf :ExecutionIsolation,
- [ a owl:Restriction ;
- owl:onProperty :isolates ;
- owl:someValuesFrom :Process ],
- [ a owl:Restriction ;
- owl:onProperty :restricts ;
- owl:someValuesFrom :Subroutine ] ;
- :d3fend-id "D3-ABPI" ;
- :definition "Application code which prevents its own subroutines from accessing intra-process / internal memory space." ;
- :kb-article """## How it works
-Some applications implement logic to permit or deny a particular subroutine access to other data within the same applicaition process. This is intended to prevent critical application process data from being tampered with.
-
-### Application-based Process Isolation in web browsers.
-
-Isolation in browsers usually is designed with the following architectural mindset:
-* Sandboxes and web resources should not be allowed to access each other because compromise of one should not effect the other.
-* The principle of least-privilege should be followed when browsing.
-The following aspects help make browser-based process isolation possible:
-* Same Origin Policy
-* Separate tabs and iframes use their own DOMs (cross-site document object models always run as a different process)
-* CORS ensures cross-site data is not delivered to a process unless the server allows it
-* Cookie and local data storage is separated by domain/site
-* Separate execution environments (threads)
-
-## Considerations
-- Using isolation in browsers does mitigate and protect by default some types of attacks (e.g. renderer attacks and access to the filesystem) but it depends on correct configuration of CORS, use of valid/appropriate certificates.
-- Application-based Process Isolation may increase memory footprint.
-- Application-based Process Isolation may decrease application performance.""" ;
- :kb-reference :Reference-PrivateApplicationAccessWithBrowserIsolation,
- :Reference-ProtectingWebApplicationsFromUntrustedEndpointsUsingRemoteBrowserIsolation,
- :Reference-SiteIsolationDesignDocument ;
- :synonym "Browser-based Process Isolation",
- "Remote Browser Isolation",
- "Sandbox" .
-
-:ApplicationConfiguration a owl:Class ;
- rdfs:label "Application Configuration" ;
- rdfs:subClassOf :ConfigurationResource ;
- :definition "Information used to configure the parameters and initial settings for an application." ;
- rdfs:seeAlso .
-
-:ApplicationConfigurationDatabase a owl:Class ;
- rdfs:label "Application Configuration Database" ;
- rdfs:subClassOf :ConfigurationDatabase,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :ApplicationConfigurationDatabaseRecord ] ;
- :definition "A database used to hold application configuration data." .
-
-:ApplicationConfigurationDatabaseRecord a owl:Class ;
- rdfs:label "Application Configuration Database Record" ;
- rdfs:subClassOf :ApplicationConfiguration,
- :ConfigurationDatabaseRecord ;
- :definition "A database record holding information used to configure the parameters and initial settings for an application." .
-
-:ApplicationConfigurationFile a owl:Class ;
- rdfs:label "Application Configuration File" ;
- rdfs:subClassOf :ConfigurationFile,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :ApplicationConfiguration ] ;
- :definition "A file containing Information used to configure the parameters and initial settings for an application.. A plist file is an example of this type of file for macOS. Usually text-based." .
-
-:ApplicationConfigurationHardening a :ApplicationConfigurationHardening,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Application Configuration Hardening" ;
- rdfs:subClassOf :ApplicationHardening,
- [ a owl:Restriction ;
- owl:onProperty :hardens ;
- owl:someValuesFrom :ApplicationConfiguration ] ;
- :d3fend-id "D3-ACH" ;
- :definition "Modifying an application's configuration to reduce its attack surface." ;
- :kb-article """## How it works
-Application configuration settings can be configured to limit the permissions on an application or disable certain vulnerable application features.
-
-Hardening an application's configuration involves analyzing not only the application but also the environment in which the application is run in for potential vulnerabilities.""" ;
- :kb-reference :Reference-RedHatEnterpriseLinux8SecurityTechnicalImplementationGuide,
- :Reference-Windows10STIG .
-
-:ApplicationConfigurationModificationEvent a owl:Class ;
- rdfs:label "Application Configuration Modification Event" ;
- rdfs:subClassOf :ConfigurationModificationEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :ApplicationConfiguration ],
- [ a owl:Restriction ;
- owl:onProperty :precedes ;
- owl:someValuesFrom :ApplicationUpdateEvent ] ;
- :definition "An event in which the configuration of a specific software application is changed, affecting how that application executes, interacts with other components, or exposes functionality to users or services." .
-
-:ApplicationDeletionEvent a owl:Class ;
- rdfs:label "Application Deletion Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :ApplicationInstallationEvent ] ;
- :definition "An event capturing the removal of an application from a system, ensuring its binaries, configuration files, and registry entries are deleted or deactivated." .
-
-:ApplicationDisableEvent a owl:Class ;
- rdfs:label "Application Disable Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :ApplicationEnableEvent ] ;
- :definition "An event capturing the disabling of an application, preventing it from being operational or accessed until re-enabled." .
-
-:ApplicationEnableEvent a owl:Class ;
- rdfs:label "Application Enable Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :ApplicationInstallationEvent ] ;
- :definition "An event representing the enabling of an application, allowing it to be started or accessed when required." .
-
-:ApplicationEvent a owl:Class ;
- rdfs:label "Application Event" ;
- rdfs:subClassOf :DigitalEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :Application ] ;
- :definition "An event that captures the behavior, state, or interactions of software applications or services operating within a system. Application events encompass lifecycle changes, configuration updates, and operational anomalies, providing insight into the health and performance of software components." ;
- rdfs:seeAlso .
-
-:ApplicationExceptionMonitoring a :ApplicationExceptionMonitoring,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Application Exception Monitoring" ;
- rdfs:subClassOf :ApplicationPerformanceMonitoring,
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :ApplicationFailureCountVariable ],
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :Log ] ;
- :d3fend-id "D3-AEM" ;
- :definition "Monitoring the failures of system counters and timers." ;
- :kb-article """## How it works
-Monitoring timer and counter failures or exceedances can reveal issues with the program or platform, and is important for both safety and security. It may also help identify tampering or malicious activity affecting the device or the processes it controls.""" ;
- :kb-reference :Reference-SecurePLCCodingPracticesTop20List ;
- :synonym "Application Failure Monitoring" .
-
-:ApplicationFailureCountVariable a owl:Class ;
- rdfs:label "Application Failure Count Variable" ;
- rdfs:subClassOf :RuntimeVariable ;
- rdfs:comment "Differenct controller brands have different system tags to monitor various aspects, for example in Allen-Bradley you might use S:ERR, T4:0.DN, C5:0.OV; respectively System error, timer/counter status bits" ;
- :definition "Variables that keep count of various failures and errors." .
-
-:ApplicationHardening a :ApplicationHardening,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Application Hardening" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Harden ] ;
- :d3fend-id "D3-AH" ;
- :definition "Application Hardening makes an executable application more resilient to a class of exploits which either introduce new code or execute unwanted existing code. These techniques may be applied at compile-time or on an application binary." ;
- :enables :Harden ;
- :kb-article """## Technique Overview
-
-Exploits may, for example, rely on knowledge of addresses in a process's memory, they may alter memory contents, and they may cause a program to use instructions in a way that they were not intended. By, for example, including code that dynamically changes the memory address of data or code on each run, introducing logic to validating the memory contents before certain potentially dangerous flows are executed, or monitoring a program for unusual sequence of instructions, this makes it harder for an attacker to craft a working exploit.""" ;
- :synonym "Process Hardening" .
-
-:ApplicationInstallationEvent a owl:Class ;
- rdfs:label "Application Installation Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :SoftwareDeploymentTool ] ;
- :definition "An event representing the installation of an application onto a system, making it available for use and interaction." .
-
-:ApplicationInstaller a owl:Class ;
- rdfs:label "Application Installer" ;
- rdfs:subClassOf :UserApplication ;
- :definition "An application installer is a user application designed to install, configure, and deploy another application." .
-
-:ApplicationInventorySensor a owl:Class ;
- rdfs:label "Application Inventory Sensor" ;
- rdfs:subClassOf :EndpointSensor,
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :Application ] ;
- :definition "Collects information on applications on an endpoint." .
-
-:ApplicationLayerEvent a owl:Class ;
- rdfs:label "Application Layer Event" ;
- rdfs:subClassOf :NetworkEvent ;
- :definition "An event occurring at the application layer, involving protocols that support application-specific communication." .
-
-:ApplicationLayerFirewall a owl:Class ;
- rdfs:label "Application Layer Firewall" ;
- skos:altLabel "Application Firewall" ;
- rdfs:subClassOf :Firewall ;
- rdfs:isDefinedBy ;
- :definition "An application firewall is a form of firewall that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. The application firewall is typically built to control all network traffic on any OSI layer up to the application layer. It is able to control applications or services specifically, unlike a stateful network firewall, which is - without additional software - unable to control network traffic regarding a specific application. There are two primary categories of application firewalls, network-based application firewalls and host-based application firewalls." .
-
-:ApplicationLayerLink a owl:Class ;
- rdfs:label "Application Layer Link" ;
- rdfs:subClassOf :LogicalLink ;
- :definition "An Application Layer Link is a type of logical link that exists at the application layer of a network or system architecture." .
-
-:ApplicationPerformanceMonitoring a :ApplicationPerformanceMonitoring,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Application Performance Monitoring" ;
- rdfs:subClassOf :PlatformMonitoring,
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :ApplicationScanTime ],
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :SystemApplicationCycleCount ] ;
- :d3fend-id "D3-APM" ;
- :definition "Monitoring the count and duration of the application or program cycle." ;
- :kb-article """## How it works
-Keeping track of the controller cycle time by logging it, setting alarms, and correlating with other events. Changes to cycle time can be indicative of injecting new logic, deleting logic, or system failures.""" ;
- :kb-reference :Reference-SecurePLCCodingPracticesTop20List .
-
-:ApplicationProcess a owl:Class ;
- rdfs:label "Application Process" ;
- rdfs:subClassOf :UserProcess,
- [ a owl:Restriction ;
- owl:onProperty :runs ;
- owl:someValuesFrom :Application ] ;
- :definition "An application process is an instance of an application computer program that is being executed." ;
- rdfs:seeAlso .
-
-:ApplicationProcessConfiguration a owl:Class ;
- rdfs:label "Application Process Configuration" ;
- rdfs:subClassOf :ApplicationConfiguration ;
- :definition "The current configuration of an application process, stored in memory. It may have been sourced from other types of application configurations, e.g. Application Configuration Files or Application Configuration Database Records." .
-
-:ApplicationProtocolCommandAnalysis a :ApplicationProtocolCommandAnalysis,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Application Protocol Command Analysis" ;
- rdfs:subClassOf :NetworkTrafficAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :NetworkTraffic ] ;
- :d3fend-id " D3-APCA" ;
- :definition "Analyzing application protocol level remote commands to detect unauthorized activity." ;
- :kb-article """## How it works
-This technique requires the ability to parse application layer protocols to understand the commands being sent to a remote service. Signature-based or statistical analysis may be employed to identify unauthorized commands being sent. These commands can be observed by monitoring network traffic or application logs.""" ;
- :kb-reference :Reference-MethodAndApparatusForDetectingAnomaliesOfAnInfrastructureInANetwork,
- :Reference-ProtocolBasedDetectionOfSuspiciousNetworkTraffic .
-
-:ApplicationRestartEvent a owl:Class ;
- rdfs:label "Application Restart Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :ApplicationStopEvent ],
- [ a owl:Restriction ;
- owl:onProperty :precedes ;
- owl:someValuesFrom :ApplicationStartEvent ] ;
- :definition "An event where an application is sequentially stopped and started, typically to refresh its state, apply updates, or resolve issues while preserving its availability." .
-
-:ApplicationRule a owl:Class ;
- rdfs:label "Application Rule" ;
- rdfs:subClassOf :ApplicationConfiguration ;
- :definition "A configuration of an application which is used to apply logical or data processing functions to data processed by the application." .
-
-:ApplicationRuntimeVariable a owl:Class ;
- rdfs:label "Application Runtime Variable " ;
- rdfs:subClassOf :RuntimeVariable ;
- :definition "A system variable that tracks aspects of runtime of a system." .
-
-:ApplicationScanTime a owl:Class ;
- rdfs:label "Application Scan Time" ;
- rdfs:subClassOf :ApplicationRuntimeVariable ;
- :definition "A variable that tracks the measured time it takes to begin, run, and complete a select portion of an application's logic." .
-
-:ApplicationShim a owl:Class ;
- rdfs:label "Application Shim" ;
- rdfs:subClassOf :Shim ;
- :definition "An application shim adapts an application program to run on a version of a platform for which they were not originally created. Most commonly \"Application Shimming\" refers to use of The Windows Application Compatibility Toolkit (ACT) provides backward compatibility by simulating the behavior of older version of Windows." ;
- rdfs:seeAlso ,
- :Shim .
-
-:ApplicationStartEvent a owl:Class ;
- rdfs:label "Application Start Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :ApplicationInstallationEvent ] ;
- :definition "An event where an application transitions from an inactive state to an active state, initializing its resources and becoming operational for user interaction or automated processes." .
-
-:ApplicationStopEvent a owl:Class ;
- rdfs:label "Application Stop Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :ApplicationStartEvent ] ;
- :definition "An event capturing the cessation of an application’s operations, transitioning it to an inactive state and releasing any allocated resources." .
-
-:ApplicationUpdateEvent a owl:Class ;
- rdfs:label "Application Update Event" ;
- rdfs:subClassOf :ApplicationEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :ApplicationInstallationEvent ] ;
- :definition "An event describing changes made to an application, such as updates, reconfigurations, or patch installations, while maintaining its presence on the system." .
-
-:ApproximateStringMatching a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Approximate String Matching" ;
- rdfs:subClassOf :PartialMatching ;
- :d3fend-id "D3A-ASM" ;
- :definition "Approximate string matching is a form of string matching that allows errrors." ;
- :kb-article """## References
-1. Navarro, G. (2001). A guided tour to approximate string matching. _ACM Computing Surveys_, 33(1), 31-88. [Link](https://doi.org/10.1145/375360.375365)""" .
-
-:ArchiveFile a owl:Class ;
- rdfs:label "Archive File" ;
- rdfs:subClassOf :File ;
- rdfs:isDefinedBy ;
- :definition "An archive file is a file that is composed of one or more computer files along with metadata. Archive files are used to collect multiple data files together into a single file for easier portability and storage, or simply to compress files to use less storage space. Archive files often store directory structures, error detection and correction information, arbitrary comments, and sometimes use built-in encryption." .
-
-:ARIMAModel a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "ARIMA Model" ;
- rdfs:subClassOf :TimeSeriesAnalysis ;
- :d3fend-id "D3A-AM" ;
- :definition "An autoregressive integrated moving average (ARIMA) model is a generalization of an autoregressive moving average (ARMA) model." ;
- :kb-article """## References
-Wikipedia. (n.d.). Autoregressive integrated moving average. [Link](https://en.wikipedia.org/wiki/Autoregressive_integrated_moving_average)""" ;
- :synonym "Autoregressive Integrated Moving Average Model" .
-
-:ARMA_Model a owl:Class,
- owl:NamedIndividual,
- :TimeSeriesAnalysis ;
- rdfs:label "ARMA Model" ;
- rdfs:subClassOf :TimeSeriesAnalysis ;
- :d3fend-id "D3-ARMA" ;
- :definition "Autoregressive-moving-average (ARMA) models provide a parsimonious description of a (weakly) stationary stochastic process in terms of two polynomials, one for the autoregression (AR) and the second for the moving average (MA)." ;
- :kb-article """## References
-Wikipedia. (n.d.). Autoregressive-moving-average model. [Link](https://en.wikipedia.org/wiki/Autoregressive%E2%80%93moving-average_model)""" ;
- :synonym "Autoregressive moving average model" .
-
-:Artifact a owl:Class ;
- rdfs:label "Artifact" ;
- rdfs:subClassOf :D3FENDCore ;
- :definition "A man-made object taken as a whole." ;
- rdfs:seeAlso ,
- .
-
-:ArtifactServer a owl:Class ;
- rdfs:label "Artifact Server" ;
- rdfs:subClassOf :WebServer ;
- :definition "A digital artifact server provides access services to digital artifacts in a repository. It provides an associated set of data management, search and access methods allowing application-independent access to the content." ;
- rdfs:seeAlso ,
- .
-
-:ArtificialNeuralNetClassification a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Artificial Neural Network Classification" ;
- rdfs:subClassOf :Classification ;
- :d3fend-annotation "Classification ANNs seek to classify an observation as belonging to some discrete class as a function of the inputs. The input features (independent variables) can be categorical or numeric types, however, we require a categorical feature as the dependent variable." ;
- :d3fend-id "D3A-ANNC" ;
- :kb-article """## References
-ANN Classification. [Link](http://uc-r.github.io/ann_classification).""" .
-
-:AssetInventory a :AssetInventory,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Asset Inventory" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Model ] ;
- :d3fend-id "D3-AI" ;
- :definition "Asset inventorying identifies and records the organization's assets and enriches each inventory item with knowledge about their vulnerabilities." ;
- :display-order 1 ;
- :synonym "Asset Discovery",
- "Asset Inventorying" .
-
-:AssetInventoryAgent a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Asset Inventory Agent" ;
- rdfs:subClassOf :NetworkAgent ;
- :definition "An asset inventory agent is a software tool which captures and transmits information about the devices on a network, including their hostnames, MAC addresses, software they may be running, etc." ;
- rdfs:seeAlso .
-
-:AssetVulnerabilityEnumeration a :AssetVulnerabilityEnumeration,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Asset Vulnerability Enumeration" ;
- rdfs:subClassOf :AssetInventory,
- [ a owl:Restriction ;
- owl:onProperty :evaluates ;
- owl:someValuesFrom :PhysicalArtifact ],
- [ a owl:Restriction ;
- owl:onProperty :evaluates ;
- owl:someValuesFrom :Software ],
- [ a owl:Restriction ;
- owl:onProperty :identifies ;
- owl:someValuesFrom :Vulnerability ] ;
- :d3fend-id "D3-AVE" ;
- :definition "Asset vulnerability enumeration enriches inventory items with knowledge identifying their vulnerabilities." ;
- :kb-reference :Reference-AutomatedComputerVulnerabilityResolutionSystem,
- :Reference-SecurityVulnerabilityInformationAggregation,
- :Reference-SystemAndMethodForVulnerabilityRiskAssessment .
-
-:AssignPrivilegesToGroupEvent a owl:Class ;
- rdfs:label "Assign Privileges to Group Event" ;
- rdfs:subClassOf :GroupManagementEvent,
- :PermissionGrantingEvent,
- [ a owl:Restriction ;
- owl:onProperty :preceded-by ;
- owl:someValuesFrom :GroupCreationEvent ] ;
- :definition "An event where specific privileges or rights are granted to a group, enabling its members to perform actions or access resources as defined by the privileges." .
-
-:AssociationRuleLearning a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Association Rule Learning" ;
- rdfs:subClassOf :UnsupervisedLearning ;
- :d3fend-id "D3A-ARL" ;
- :definition "Association rule learning is a rule-based machine learning method for discovering interesting relations between variables in large databases." ;
- :kb-article """## References
-Association rule learning. (n.d.). Wikipedia. [Link](https://en.wikipedia.org/wiki/Association_rule_learning)""" .
-
-:AsymmetricFeature-basedTransferLearning a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Asymmetric Feature-based Transfer Learning" ;
- rdfs:subClassOf :HomogenousTransferLearning ;
- :d3fend-id "D3A-AFTL" ;
- :definition "Homogeneous (where the metrics are the same for both source and target) asymmetric transformation mapping transforms the source feature space to align with that of the target or the target to that of the source. This, in effect, bridges the feature space gap and reduces the problem into a homogeneous transfer problem when further distribution differences need to be corrected." ;
- :kb-article """## References
-Day, O., & Khoshgoftaar, T.M. (2017). A survey on heterogeneous transfer learning. Journal of Big Data, 4(1), 29. [Link](https://doi.org/10.1186/s40537-017-0089-0).""" ;
- :todo "Could use a better definition as this is a slightly modified version of the heterogeneous definition" .
-
-:AsymmetricKey a owl:Class ;
- rdfs:label "Asymmetric Key" ;
- rdfs:subClassOf :CryptographicKey ;
- :definition "Asymmetric keys are public and private keys, paired such that asymmetric (public-key) cryptography algorithms can be implemented using them. Public-key cryptography, or asymmetric cryptography, is any cryptographic system that uses pairs of keys: public keys that may be disseminated widely paired with private keys which are known only to the owner. There are two functions that can be achieved: using a public key to authenticate that a message originated with a holder of the paired private key; or encrypting a message with a public key to ensure that only the holder of the paired private key can decrypt it." ;
- rdfs:seeAlso .
-
-:ATTACKEnterpriseDataSource a owl:Class ;
- rdfs:label "ATTACK Enterprise Data Source" ;
- rdfs:subClassOf :ATTACKEnterpriseThing .
-
-:ATTACKEnterpriseMitigation a owl:Class ;
- rdfs:label "ATTACK Enterprise Mitigation" ;
- rdfs:subClassOf :ATTACKEnterpriseThing,
- [ a owl:Restriction ;
- owl:onProperty :d3fend-comment ;
- owl:someValuesFrom xsd:string ],
- [ a owl:Restriction ;
- owl:onProperty :semantic-relation ;
- owl:someValuesFrom :DefensiveTechnique ] .
-
-:ATTACKEnterpriseTactic a owl:Class ;
- rdfs:label "ATTACK Enterprise Tactic" ;
- rdfs:subClassOf :ATTACKEnterpriseThing .
-
-:ATTACKEnterpriseTechnique a owl:Class ;
- rdfs:label "ATTACK Enterprise Technique" ;
- rdfs:subClassOf :ATTACKEnterpriseThing .
-
-:ATTACKEnterpriseThing a owl:Class ;
- rdfs:label "ATTACK Enterprise Thing" ;
- rdfs:subClassOf :ATTACKThing .
-
-:Attacker a owl:Class ;
- rdfs:label "Attacker" ;
- rdfs:subClassOf :Agent ;
- :definition "An agent that attempts to exploit vulnerabilities to gain unauthorized access to data or systems." .
-
-:ATTACKICSCollectionTechnique a owl:Class ;
- rdfs:label "Collection Technique - ATTACK ICS" ;
- skos:prefLabel "Collection Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0100 ] .
-
-:ATTACKICSCommandAndControlTechnique a owl:Class ;
- rdfs:label "Command and Control Technique - ATTACK ICS" ;
- skos:prefLabel "Command and Control Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0101 ] .
-
-:ATTACKICSDiscoveryTechnique a owl:Class ;
- rdfs:label "Discovery Technique - ATTACK ICS" ;
- skos:prefLabel "Discovery Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0102 ] .
-
-:ATTACKICSEvasionTechnique a owl:Class ;
- rdfs:label "Evasion Technique - ATTACK ICS" ;
- skos:prefLabel "Evasion Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0103 ] .
-
-:ATTACKICSExecutionTechnique a owl:Class ;
- rdfs:label "Execution Technique - ATTACK ICS" ;
- skos:prefLabel "Execution Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0104 ] .
-
-:ATTACKICSImpactTechnique a owl:Class ;
- rdfs:label "Impact Technique - ATTACK ICS" ;
- skos:prefLabel "Impact Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0105 ] .
-
-:ATTACKICSImpairProcessControlTechnique a owl:Class ;
- rdfs:label "Impair Process Control Technique - ATTACK ICS" ;
- skos:prefLabel "Impair Process Control Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0106 ] ;
- :definition "The adversary is trying to manipulate, disable, or damage physical control processes." .
-
-:ATTACKICSInhibitResponseFunctionTechnique a owl:Class ;
- rdfs:label "Inhibit Response Function Technique - ATTACK ICS" ;
- skos:prefLabel "Inhibit Response Function Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0107 ] ;
- :definition "The adversary is trying to prevent your safety, protection, quality assurance, and operator intervention functions from responding to a failure, hazard, or unsafe state." .
-
-:ATTACKICSInitialAccessTechnique a owl:Class ;
- rdfs:label "Initial Access Technique - ATTACK ICS" ;
- skos:prefLabel "Initial Access Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0108 ] .
-
-:ATTACKICSLateralMovementTechnique a owl:Class ;
- rdfs:label "Lateral Movement Technique - ATTACK ICS" ;
- skos:prefLabel "Lateral Movement Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0109 ] .
-
-:ATTACKICSPersistenceTechnique a owl:Class ;
- rdfs:label "Persistence Technique - ATTACK ICS" ;
- skos:prefLabel "Persistence Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0110 ] .
-
-:ATTACKICSPrivilegeEscalationTechnique a owl:Class ;
- rdfs:label "Privilege Escalation Technique - ATTACK ICS" ;
- skos:prefLabel "Privilege Escalation Technique" ;
- rdfs:subClassOf :ATTACKICSTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0111 ] .
-
-:ATTACKICSTactic a owl:Class ;
- rdfs:label "ATTACK ICS Tactic" ;
- rdfs:subClassOf :ATTACKICSThing .
-
-:ATTACKICSTechnique a owl:Class ;
- rdfs:label "ATTACK ICS Technique" ;
- rdfs:subClassOf :ATTACKICSThing .
-
-:ATTACKICSThing a owl:Class ;
- rdfs:label "ATTACK ICS Thing" ;
- rdfs:subClassOf :ATTACKThing .
-
-:ATTACKMergedThing a owl:Class ;
- rdfs:label "ATTACK Merged Thing" ;
- rdfs:subClassOf :ATTACKThing .
-
-:ATTACKMobileCollectionTechnique a owl:Class ;
- rdfs:label "Collection Technique - ATTACK Mobile" ;
- skos:prefLabel "Collection Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0035 ] .
-
-:ATTACKMobileCommandAndControlTechnique a owl:Class ;
- rdfs:label "Command and Control Technique - ATTACK Mobile" ;
- skos:prefLabel "Command and Control Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0037 ] .
-
-:ATTACKMobileCredentialAccessTechnique a owl:Class ;
- rdfs:label "Credential Access Technique - ATTACK Mobile" ;
- skos:prefLabel "Credential Access Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0031 ] .
-
-:ATTACKMobileDefenseEvasionTechnique a owl:Class ;
- rdfs:label "Defense Evasion Technique - ATTACK Mobile" ;
- skos:prefLabel "Defense Evasion Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0030 ] .
-
-:ATTACKMobileDiscoveryTechnique a owl:Class ;
- rdfs:label "Discovery Technique - ATTACK Mobile" ;
- skos:prefLabel "Discovery Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0032 ] .
-
-:ATTACKMobileExecutionTechnique a owl:Class ;
- rdfs:label "Execution Technique - ATTACK Mobile" ;
- skos:prefLabel "Execution Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0041 ] .
-
-:ATTACKMobileExfiltrationTechnique a owl:Class ;
- rdfs:label "Exfiltration Technique - ATTACK Mobile" ;
- skos:prefLabel "Exfiltration Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0036 ] .
-
-:ATTACKMobileImpactTechnique a owl:Class ;
- rdfs:label "Impact Technique - ATTACK Mobile" ;
- skos:prefLabel "Impact Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0034 ] .
-
-:ATTACKMobileInitialAccessTechnique a owl:Class ;
- rdfs:label "Initial Access Technique - ATTACK Mobile" ;
- skos:prefLabel "Initial Access Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0027 ] .
-
-:ATTACKMobileLateralMovementTechnique a owl:Class ;
- rdfs:label "Lateral Movement Technique - ATTACK Mobile" ;
- skos:prefLabel "Lateral Movement Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0033 ] .
-
-:ATTACKMobilePersistenceTechnique a owl:Class ;
- rdfs:label "Persistence Technique - ATTACK Mobile" ;
- skos:prefLabel "Persistence Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0028 ] .
-
-:ATTACKMobilePrivilegeEscalationTechnique a owl:Class ;
- rdfs:label "Privilege Escalation Technique - ATTACK Mobile" ;
- skos:prefLabel "Privilege Escalation Technique" ;
- rdfs:subClassOf :ATTACKMobileTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0029 ] .
-
-:ATTACKMobileTactic a owl:Class ;
- rdfs:label "ATTACK Mobile Tactic" ;
- rdfs:subClassOf :ATTACKMobileThing .
-
-:ATTACKMobileTechnique a owl:Class ;
- rdfs:label "ATTACK Mobile Technique" ;
- rdfs:subClassOf :ATTACKMobileThing .
-
-:ATTACKMobileThing a owl:Class ;
- rdfs:label "ATTACK Mobile Thing" ;
- rdfs:subClassOf :ATTACKThing .
-
-:ATTACKThing a owl:Class ;
- rdfs:label "ATTACK Thing" ;
- rdfs:subClassOf :ExternalThreatModelThing ;
- :definition "ATTACK things are concepts defined in the ATT&CK Framework." .
-
-:AudioInputDevice a owl:Class ;
- rdfs:label "Audio Input Device" ;
- rdfs:subClassOf :InputDevice ;
- rdfs:isDefinedBy ;
- :definition "Audio input devices allow a user to send audio info to a computer for processing, recording, or carrying out commands. Devices such as microphones allow users to speak to the computer in order to record a voice message or navigate software. Aside from recording, audio input devices are also used with speech recognition software." .
-
-:AuthenticateUser a owl:Class ;
- rdfs:label "Authenticate User" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :UserAccount ] .
-
-:Authentication a owl:Class ;
- rdfs:label "Authentication" ;
- rdfs:subClassOf :DefensiveAction,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :User ],
- [ a owl:Restriction ;
- owl:onProperty :may-create ;
- owl:someValuesFrom :IntranetNetworkTraffic ],
- [ a owl:Restriction ;
- owl:onProperty :originates-from ;
- owl:someValuesFrom :PhysicalLocation ] ;
- :definition "A request-response comprising a user credential presentation to a system and a verification response." ;
- rdfs:seeAlso ,
- .
-
-:AuthenticationCacheInvalidation a :AuthenticationCacheInvalidation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Authentication Cache Invalidation" ;
- rdfs:subClassOf :CredentialEviction,
- [ a owl:Restriction ;
- owl:onProperty :deletes ;
- owl:someValuesFrom :Credential ] ;
- :d3fend-id "D3-ANCI" ;
- :definition "Removing tokens or credentials from an authentication cache to prevent further user associated account accesses." ;
- :kb-article """## How it works
-Applications can locally cache user authentication credentials for certain server connections. An application may attempt to use the cached credential for a connection. If the cached credentials exist then the user will not be typically prompted for new credentials.
-
-
-## Considerations
-Are these cached credentials only on the local host? Can they be persisted to the remote server?
-
-## Examples
-Windows Credential Management API""" ;
- :kb-reference :Reference-SecureCachingOfServerCredentials_DellProductsLP,
- :Reference-SystemAndMethodForProvidingAnActivelyInvalidatedClient-sideNetworkResourceCache_IMVU .
-
-:AuthenticationEvent a owl:Class ;
- rdfs:label "Authentication Event" ;
- skos:altLabel "Agent Authentication Event" ;
- rdfs:subClassOf :DigitalEvent,
- [ a owl:Restriction ;
- owl:onProperty :caused-by ;
- owl:someValuesFrom :Authentication ],
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :Agent ],
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :Credential ] ;
- :definition "An event capturing the systematic process of verifying an agent's identity within a system, involving credential validation and identity confirmation." ;
- rdfs:seeAlso .
-
-:AuthenticationEventThresholding a :AuthenticationEventThresholding,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Authentication Event Thresholding" ;
- rdfs:subClassOf :UserBehaviorAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :Authentication ] ;
- :created "2020-08-05T00:00:00"^^xsd:dateTime ;
- :d3fend-id "D3-ANET" ;
- :definition "Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile." ;
- :kb-article """## How it works
-Authentication event data is collected (logon information such as device id, time of day, day of week, geo-location, etc.) to create an activity baseline. Then, a threshold is determined either through a manually specified configuration, or a statistical analysis of deviations in historical data. New authentication events are evaluated to determine if a threshold is exceeded. Thresholds can be static or dynamic.
-
-### Actions
-As a result of the analysis, actions taken could include:
-
-* [Account Locking](/technique/d3f:AccountLocking)
-* Raising an alert
-
-### Example data sources
- * Directory server logs
- * VPN Server logs
- * IDAM Capability logs
- * NAC logs
- * Authentication client logs
- * Kerberos network traffic
- * LDAP network traffic
-
-## Considerations
-
-This technique covers statistical outliers. Though depending on the complexity or dimensionality of the data considered, outliers may not be obvious to a human analyst reviewing events in simplistic analytic views. If the malicious activity is not statistically different from benign activity, an alert threshold will not be met.""" ;
- :kb-reference ,
- :Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics_IdaptiveLLC,
- :Reference-SimultaneousLoginsOnAHost_MITRE,
- :Reference-UserLoggedInToMultipleHosts_MITRE,
- :Reference-UserLoginActivityMonitoring_MITRE .
-
-:AuthenticationFunction a owl:Class ;
- rdfs:label "Authentication Function" ;
- rdfs:subClassOf :Subroutine,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :UserAccount ] ;
- :definition "Authenticates a user account by verifying a presented credential." .
-
-:AuthenticationLog a owl:Class ;
- rdfs:label "Authentication Log" ;
- rdfs:subClassOf :EventLog,
- [ a owl:Restriction ;
- owl:onProperty :records ;
- owl:someValuesFrom :Authentication ] ;
- :definition "A log of authentication events." ;
- rdfs:seeAlso ,
- .
-
-:AuthenticationServer a owl:Class ;
- rdfs:label "Authentication Server" ;
- rdfs:subClassOf :Server,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :AuthenticationServiceApplication ],
- [ a owl:Restriction ;
- owl:onProperty :manages ;
- owl:someValuesFrom :AuthenticationService ] ;
- rdfs:isDefinedBy ;
- :definition "An authentication server provides a network service that applications use to authenticate the credentials, usually account names and passwords, of their users. When a client submits a valid set of credentials, it receives a cryptographic ticket that it can subsequently use to access various services. Major authentication algorithms include passwords, Kerberos, and public key encryption." .
-
-:AuthenticationService a owl:Class ;
- rdfs:label "Authentication Service" ;
- rdfs:subClassOf :ServiceApplicationProcess,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :Host ] ;
- rdfs:isDefinedBy ;
- :definition "An authentication service is a mechanism, analogous to the use of passwords on time-sharing systems, for the secure authentication of the identity of network clients by servers and vice versa, without presuming the operating system integrity of either (e.g., Kerberos)." ;
- rdfs:seeAlso .
-
-:AuthenticationServiceApplication a owl:Class ;
- rdfs:label "Authentication Service Application" ;
- rdfs:subClassOf :ServiceApplication,
- [ a owl:Restriction ;
- owl:onProperty :instructs ;
- owl:someValuesFrom :AuthenticationService ] ;
- :definition "A software application designed to verify the identity of users or devices." .
-
-:Authorization a owl:Class ;
- rdfs:label "Authorization" ;
- rdfs:subClassOf :DefensiveAction,
- [ a owl:Restriction ;
- owl:onProperty :authorizes ;
- owl:someValuesFrom :Access ] ;
- rdfs:isDefinedBy ;
- :definition "Authorization is the function of specifying access rights to resources related to information security and computer security in general and to access control in particular. More formally, \"to authorize\" is to define an access policy. For example, human resources staff is normally authorized to access employee records and this policy is usually formalized as access control rules in a computer system. During operation, the system uses the access control rules to decide whether access requests from (authenticated) consumers shall be approved (granted) or disapproved (rejected). Resources include individual files or an item's data, computer programs, computer devices and functionality provided by computer applications. Examples of consumers are computer users, computer program" .
-
-:AuthorizationEvent a owl:Class ;
- rdfs:label "Authorization Event" ;
- rdfs:subClassOf :DigitalEvent,
- [ a owl:Restriction ;
- owl:onProperty :caused-by ;
- owl:someValuesFrom :Authorization ],
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :Agent ] ;
- :definition "An event reflecting the decision-making process and actions concerning access control, recording whether agents are permitted or denied access to resources based on pre-defined access control policies." .
-
-:AuthorizationEventThresholding a :AuthorizationEventThresholding,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Authorization Event Thresholding" ;
- rdfs:subClassOf :UserBehaviorAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :Authorization ] ;
- :created "2020-08-05T00:00:00"^^xsd:dateTime ;
- :d3fend-id "D3-AZET" ;
- :definition "Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile." ;
- :kb-article """## How it works
-
-Authorization event data is collected to create a baseline user profile. Authorization events that deviate from the baseline and exceed a static or dynamic threshold are identified for further action. Authorization events can include successful and failed authorization attempts as well as events related to permissions including viewing, editing, deleting, creating files, databases etc.
-
-## Considerations
-
-Depending on the complexity of the data considered, outliers may not be obvious to a human analyst reviewing events in simplistic analytic views. If malicious activity is not statistically different from benign activity, an alert threshold will not be met.""" ;
- :kb-reference ,
- :Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics_IdaptiveLLC,
- :Reference-SMBSessionSetups_MITRE,
- :Reference-UserLoggedInToMultipleHosts_MITRE .
-
-:AuthorizationLog a owl:Class ;
- rdfs:label "Authorization Log" ;
- rdfs:subClassOf :EventLog,
- [ a owl:Restriction ;
- owl:onProperty :records ;
- owl:someValuesFrom :NetworkResourceAccess ] ;
- :definition "A log of authorization events." ;
- rdfs:seeAlso ,
- .
-
-:AuthorizationService a owl:Class ;
- rdfs:label "Authorization Service" ;
- rdfs:subClassOf :NetworkService,
- :ServiceApplicationProcess ;
- rdfs:isDefinedBy ;
- :definition "An authorization service ensures that the user is authorized to have access to a particular resource. Authorization can be done through role-based access control (RBAC) or list-based access control (LBAC)." ;
- rdfs:seeAlso .
-
-:Autoencoding a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Autoencoding" ;
- rdfs:subClassOf :DimensionReduction ;
- :d3fend-id "D3A-AUT" ;
- :definition "Autoencoders are specific type of deep learning architecture used for learning representation of data, typically for the purpose of dimensionality reduction. This is achieved by designing deep learning architecture that aims that copying input layer at its output layer." ;
- :kb-article """## References
-SOCR. (n.d.). ABIDE Autoencoder. [Link](https://socr.umich.edu/HTML5/ABIDE_Autoencoder/#:~:text=In%20simple%20words%2C%20autoencoders%20are,layer%20at%20its%20output%20layer.)""" .
-
-:AutoregressiveModel a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Autoregressive Model" ;
- rdfs:subClassOf :TimeSeriesAnalysis ;
- :d3fend-id "D3A-AM" ;
- :definition "An autoregressive (AR) model is a representation of a type of random process; as such, it is used to describe certain time-varying processes in nature, economics, behavior, etc." ;
- :kb-article """## References
-Wikipedia. (n.d.). Autoregressive model. [Link](https://en.wikipedia.org/wiki/Autoregressive_model)""" ;
- :synonym "AR Model" .
-
-:AverageAbsoluteDeviation a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Average Absolute Deviation" ;
- rdfs:subClassOf :Variability ;
- :d3fend-id "D3A-AAD" ;
- :definition "The average absolute deviation (AAD) of a data set is the average of the absolute deviations from a central point." ;
- :kb-article """## References
-Wikipedia. (n.d.). Average absolute deviation. [Link](https://en.wikipedia.org/wiki/Average_absolute_deviation)""" .
-
-:BarcodeScannerInputDevice a owl:Class ;
- rdfs:label "Barcode Scanner Input Device" ;
- skos:altLabel "Barcode Reader" ;
- rdfs:subClassOf :ImageScannerInputDevice ;
- rdfs:isDefinedBy ;
- :definition "A barcode reader (or barcode scanner) is an optical scanner that can read printed barcodes, decode the data contained in the barcode and send the data to a computer. Like a flatbed scanner, it consists of a light source, a lens and a light sensor translating for optical impulses into electrical signals. Additionally, nearly all barcode readers contain decoder circuitry that can analyze the barcode's image data provided by the sensor and sending the barcode's content to the scanner's output port." .
-
-:BayesianEstimation a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayesian Estimation" ;
- rdfs:subClassOf :BayesianMethod ;
- :d3fend-id "D3A-BE" ;
- :definition "A Bayes estimator or a Bayes action is an estimator or decision rule that minimizes the posterior expected value of a loss function (i.e., the posterior expected loss)." ;
- :kb-article """## References
-Wikipedia. (n.d.). Bayes estimator. [Link](https://en.wikipedia.org/wiki/Bayes_estimator)""" .
-
-:BayesianHypothesisTesting a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayesian Hypothesis Testing" ;
- rdfs:subClassOf :BayesianMethod ;
- :d3fend-id "D3A-BHT" ;
- :definition "Bayesian hypothesis testing can be framed as a special case of model comparison where a model refers to a likelihood function and a prior distribution." ;
- :kb-article """## How it works
-Given two competing hypotheses and some relevant data, Bayesian hypothesis testing begins by specifying separate prior distributions to quantitatively describe each hypothesis. The combination of the likelihood function for the observed data with each of the prior distributions yields hypothesis-specific models. For each of the hypothesis-specific models, averaging (ie, integrating) the likelihood with respect to the prior distribution across the entire parameter space yields the probability of the data under the model and, therefore, the corresponding hypothesis. This quantity is more commonly referred to as the marginal likelihood and represents the average fit of the model to the data. The ratio of the marginal likelihoods for both hypothesis-specific models is known as the Bayes factor.
-
-## References
-Baig, S. A., PhD. (2020). Bayesian Inference: An Introduction to Hypothesis Testing Using Bayes Factors. Nicotine & Tobacco Research, 22(7), 1244-1246. [Link](https://academic.oup.com/ntr/article/22/7/1244/5613971)""" .
-
-:BayesianLinearRegression a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayesian Linear Regression" ;
- rdfs:subClassOf :RegressionAnalysis ;
- :d3fend-id "D3A-BLR" ;
- :definition "Bayesian linear regression is a type of conditional modeling in which the mean of one variable is described by a linear combination of other variables, with the goal of obtaining the posterior probability of the regression coefficients." ;
- :kb-article """## References
-Wikipedia. (n.d.). Bayesian linear regression. [Link](https://en.wikipedia.org/wiki/Bayesian_linear_regression)""" .
-
-:BayesianLinearRegressionLearning a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayesian Linear Regression Learning" ;
- rdfs:subClassOf :RegressionAnalysisLearning ;
- :d3fend-id "D3A-BLRL" ;
- :definition "A supervised learning method that builds a Bayesian linear regression model using training data." ;
- :kb-article """## References
-Wikipedia. (n.d.). Bayesian linear regression. [Link](https://en.wikipedia.org/wiki/Bayesian_linear_regression)""" ;
- rdfs:seeAlso :BayesianLinearRegression .
-
-:BayesianMethod a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayesian Method" ;
- rdfs:subClassOf :StatisticalMethod ;
- :d3fend-id "D3A-BM" ;
- :definition "Bayesian analysis is a statistical procedure which endeavors to estimate parameters of an underlying distribution based on the observed distribution." ;
- :kb-article """## References
-Wolfram MathWorld. (n.d.). Bayesian Analysis. [Link](https://mathworld.wolfram.com/BayesianAnalysis.html)""" .
-
-:BayesianModelAveraging a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayesian Model Averaging" ;
- rdfs:subClassOf :EnsembleLearning ;
- :d3fend-id "D3A-BMA" ;
- :definition "A parameter estimate (or a prediction of new observations) obtained by averaging the estimates (or predictions) of the different models under consideration, each weighted by its model probability." ;
- :kb-article """## References
-Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
-
-Bayesian model average: A parameter estimation approach to model agnostic ensemble learning. (2019). Journal of Machine Learning for Modeling and Computing, 1(2), 61-70. [Link](https://journals.sagepub.com/doi/full/10.1177/2515245919898657#:~:text=Bayesian%20model%20average%3A%20A%20parameter,weighted%20by%20its%20model%20probability).""" .
-
-:BayesianModelCombination a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayesian Model Combination" ;
- rdfs:subClassOf :EnsembleLearning ;
- :d3fend-id "D3A-BMC" ;
- :definition "Bayesian model combination (BMC) is an algorithmic correction to Bayesian model averaging (BMA). Instead of sampling each model in the ensemble individually, it samples from the space of possible ensembles (with model weights drawn randomly from a Dirichlet distribution having uniform parameters)" ;
- :kb-article """## References
-Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
-
-Shultz, K. M., & Peterson, L. E. (2011). Model-averaged confidence intervals for ensemble learning. In *International Joint Conference on Neural Networks* (pp. 2677-2684). [Link](https://axon.cs.byu.edu/papers/Kristine.ijcnn2011.pdf).""" .
-
-:BayesOptimalClassifier a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bayes Optimal Classifier" ;
- rdfs:subClassOf :EnsembleLearning ;
- :d3fend-id "D3A-BOC" ;
- :definition "A probabilistic model that makes the most probable prediction for a new example." ;
- :kb-article """## References
-Bayes Optimal Classifier. Machine Learning Mastery. [Link](https://machinelearningmastery.com/bayes-optimal-classifier/).
-Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).""" .
-
-:BERT a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "BERT" ;
- rdfs:subClassOf :Transformer-basedLearning ;
- :d3fend-id "D3A-BER" ;
- :definition "Bidirectional Encoder Representations from Transformers (BERT) is based on a deep learning model in which every output element is connected to every input element, and the weightings between them are dynamically calculated based upon their connection." ;
- :kb-article """## References
-BERT (language model). (n.d.). In TechTarget. [Link](https://www.techtarget.com/searchenterpriseai/definition/BERT-language-model)
-BERT (language model). (n.d.). In Wikipedia. [Link](https://en.wikipedia.org/wiki/BERT_(language_model))""" ;
- :synonym "Bidirectional Encoder Representations from Transformers" .
-
-:BinaryClassification a owl:Class ;
- rdfs:label "Binary Classification" ;
- rdfs:subClassOf :Classifying .
-
-:BinaryLargeObject a owl:Class ;
- rdfs:label "Binary Large Object" ;
- skos:altLabel "BLOB",
- "Blob" ;
- rdfs:subClassOf :DigitalInformationBearer ;
- rdfs:isDefinedBy ;
- :definition "A binary large object (BLOB) is a collection of binary data stored as a single entity. Blobs are typically images, audio or other multimedia objects, though sometimes binary executable code is stored as a blob." ;
- :todo "sometimes a record, but not always. always Binary Data (but we don't have Data and Binary Data tax). Also do we need to distinguish between information and data? Don't think so. IBO that is encoded as binary is Binary Data. The notion of \"object\" is distinct as it may be part of file, part of DB, or file (part of file system). Binary padding would relate, though is padding information if just used to pad (e.g., all zeroes?)" .
-
-:BinarySegment a owl:Class ;
- rdfs:label "Binary Segment" ;
- rdfs:subClassOf :DigitalInformationBearer ;
- :definition "A binary segment is a partition of binary information within a larger binary object, which arranges a set of binary objects for its purpose. For example, code, data, heap, and stack segments are segments of the binary information used by a process. Code and data segments are also found in object files." .
-
-:BiometricAuthentication a :BiometricAuthentication,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Biometric Authentication" ;
- rdfs:subClassOf :AgentAuthentication,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :Person ] ;
- :d3fend-id "D3-BAN" ;
- :definition "Using biological measures in order to authenticate a user." ;
- :kb-reference :Reference-TokenlessBiometricTransactionAuthorizationMethodAndSystem,
- :Reference-www.biometric-solutions.com_keystroke-dynamics .
-
-:BitmapImage a owl:Class ;
- rdfs:label "Bitmap Image" ;
- rdfs:subClassOf :DigitalImage ;
- :definition "A graphical image whose data is stored in a grid format." .
-
-:BitmapImageFile a owl:Class ;
- rdfs:label "Bitmap Image File" ;
- rdfs:subClassOf :ImageFile,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :BitmapImage ] ;
- :definition "A file that contains graphics data represented in a bitmap." .
-
-:BlockDevice a owl:Class ;
- rdfs:label "Block Device" ;
- skos:altLabel "Block Special File" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :BootSector ],
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :Partition ],
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :PartitionTable ],
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :Volume ] ;
- rdfs:isDefinedBy ;
- :definition """A block device (or block special file) provides buffered access to hardware devices, and provides some abstraction from their specifics.
-
-IEEE Std 1003.1-2017: A file that refers to a device. A block special file is normally distinguished from a character special file by providing access to the device in a manner such that the hardware characteristics of the device are not visible.""" ;
- rdfs:seeAlso .
-
-:BookReference a owl:Class ;
- rdfs:label "Book Reference" ;
- rdfs:subClassOf :TechniqueReference ;
- :pref-label "Book" .
-
-:BooleanExpressionMatching a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Boolean Expression Matching" ;
- rdfs:subClassOf :LogicalRules ;
- :d3fend-id "D3A-BEM" ;
- :definition "Boolean expression matching produces a Boolean truth value for a given boolean expression and assignment of values to variables in the expression." ;
- :kb-article """## How it works
-A Boolean expression is an expression used in programming languages that produces a Boolean value when evaluated. A Boolean value is either true or false. A Boolean expression may be composed of a combination of the Boolean constants true or false, Boolean-typed variables, Boolean-valued operators, and Boolean-valued functions.
-
-Boolean expressions correspond to propositional formulas in logic and are a special case of Boolean circuits.
-
-## References
-1. Boolean expression. (2022, April 25). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Boolean_expression)
-2. Boolean algebra. (2022, May 19). In _Wikipedia_.
-[Link](https://en.wikipedia.org/wiki/Boolean_expression)""" .
-
-:Boosting a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Boosting" ;
- rdfs:subClassOf :EnsembleLearning ;
- :d3fend-id "D3A-BOO" ;
- :definition "Boosting is a sequential process where each subsequent model attempts to correct the errors of the previous model" ;
- :kb-article """## How it works
-Boosting consists of using sequentially weak learners where each iteration’s training focuses on previously misclassified instances in order to improve on the previous iteration. This process is continued iteratively until the final prediction is made by aggregating the previous predictions.
-
-## Considerations
-Boosting can be computationally expensive, prone to overfitting, and slower to train compared to other ensemble methods.
-
-There are three main types of Boosting algorithms
- - Adaptive Boosting
-Adaptive Boosting (sometimes called AdaBoost) works by adding equal importance to each piece of a dataset and running it through the base learning algorithms. Every algorithm that errors, the boosting algorithm assigns a higher importance to. This continues until an acceptable level of confidence is reached.
- - Gradient Boosting
-Gradient Boosting starts by training multiple models simultaneously to gather a strong estimate of strength to build new base learning algorithms.
- - XGBoosting
-XGBoosting is a scalable tree boosting model. Using decision trees, weight is assigned to each variable and put into a decision tree. Outputs that are classified by the algorithm as wrong or weak are put into a second decision tree and the results form a stronger model.
-
-## References
-Sciencedirect. (n.d.). Semi-supervised learning: An overview. [Link](https://www.sciencedirect.com/science/article/pii/S1319157823000228)""" .
-
-:BootLoader a owl:Class ;
- rdfs:label "Boot Loader" ;
- skos:altLabel "Bootloader" ;
- rdfs:subClassOf :Software ;
- rdfs:isDefinedBy ;
- :definition "A bootloader is software that is responsible for booting a computer. When a computer is turned off, its software-including operating systems, application code, and data-remains stored on non-volatile memory. When the computer is powered on, it typically does not have an operating system or its loader in random-access memory (RAM). The computer first executes a relatively small program stored in read-only memory (ROM, and later EEPROM, NOR flash) along with some needed data, to initialize RAM (especially on x86 systems) to access the nonvolatile device (usually block device, eg NAND flash) or devices from which the operating system programs and data can be loaded into RAM." .
-
-:BootloaderAuthentication a :BootloaderAuthentication,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bootloader Authentication" ;
- rdfs:subClassOf :PlatformHardening,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :BootLoader ] ;
- :d3fend-id "D3-BA" ;
- :definition "Cryptographically authenticating the bootloader software before system boot." ;
- :kb-reference :Reference-UEFIPlatformInitialization-Specification ;
- :synonym "Secure Boot" .
-
-:BootRecord a owl:Class ;
- rdfs:label "Boot Record" ;
- rdfs:subClassOf :Record ;
- :definition "A d3f:Record which is an essential component of the early boot (system initialization) process." .
-
-:BootSector a owl:Class ;
- rdfs:label "Boot Sector" ;
- rdfs:subClassOf :BootRecord ;
- :definition "A boot record [boot sector] is the sector of a persistent data storage device (e.g., hard disk, floppy disk, optical disc, etc.) which contains machine code to be loaded into random-access memory (RAM) and then executed by a computer system's built-in firmware (e.g., the BIOS, Das U-Boot, etc.)." ;
- rdfs:seeAlso .
-
-:BootstrapAggregating a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bootstrap Aggregating" ;
- rdfs:subClassOf :ResamplingEnsemble ;
- :d3fend-id "D3A-BA" ;
- :definition "Bootstrap aggregating, also called bagging (from bootstrap aggregating), is a machine learning ensemble meta-algorithm designed to improve the stability and accuracy of machine learning algorithms used in statistical classification and regression. It also reduces variance and helps to avoid overfitting. Although it is usually applied to decision tree methods, it can be used with any type of method. Bagging is a special case of the model averaging approach." ;
- :kb-article """## References
-Bootstrap aggregating. Wikipedia. [Link](https://en.wikipedia.org/wiki/Bootstrap_aggregating).""" .
-
-:BroadcastDomainIsolation a :BroadcastDomainIsolation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Broadcast Domain Isolation" ;
- rdfs:subClassOf :NetworkIsolation,
- [ a owl:Restriction ;
- owl:onProperty :filters ;
- owl:someValuesFrom :LocalAreaNetworkTraffic ] ;
- :d3fend-id "D3-BDI" ;
- :definition "Broadcast isolation restricts the number of computers a host can contact on their LAN." ;
- :kb-article """## How it works
-Software Defined Networking, or other network encapsulation technologies intercept host broadcast traffic then route it to a specified destination per a configured policy.
-
-This can be implemented within hypervisors, networking hardware (WAPs, switches, routers), or virutal hardware.
-
-## Considerations
-This technique is highly dependent on network infrastructure and networking requirements.""" ;
- :kb-reference :Reference-BroadcastIsolationAndLevel3NetworkSwitch_HewlettPackardEnterpriseDevelopmentLP,
- :Reference-PrivateVirtualLocalAreaNetworkIsolation_CiscoTechnologyInc ;
- :synonym "Network Segmentation" .
-
-:Browser a owl:Class ;
- rdfs:label "Browser" ;
- rdfs:subClassOf :UserApplication,
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :BrowserExtension ] ;
- rdfs:isDefinedBy ;
- :definition "A web browser (commonly referred to as a browser) is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier (URI/URL) and may be a web page, image, video or other piece of content. Hyperlinks present in resources enable users easily to navigate their browsers to related resources. Although browsers are primarily intended to use the World Wide Web, they can also be used to access information provided by web servers in private networks or files in file systems." ;
- rdfs:seeAlso .
-
-:BrowserExtension a owl:Class ;
- rdfs:label "Browser Extension" ;
- rdfs:subClassOf :UserApplication,
- [ a owl:Restriction ;
- owl:onProperty :extends ;
- owl:someValuesFrom :Browser ] ;
- rdfs:isDefinedBy ;
- :definition "A browser extension is a plug-in that extends the functionality of a web browser in some way. Some extensions are authored using web technologies such as HTML, JavaScript, and CSS. Browser extensions can change the user interface of the web browser without directly affecting viewable content of a web page; for example, by adding a \"toolbar.\"" .
-
-:BucketOfModels a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Bucket of Models" ;
- rdfs:subClassOf :EnsembleLearning ;
- :d3fend-id "D3A-BOM" ;
- :definition "A \"bucket of models\" is an ensemble technique in which a model selection algorithm is used to choose the best model for each problem. When tested with only one problem, a bucket of models can produce no better results than the best model in the set, but when evaluated across many problems, it will typically produce much better results, on average, than any model in the set." ;
- :kb-article """## References
-Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).""" .
-
-:BuildTool a owl:Class ;
- rdfs:label "Build Tool" ;
- skos:altLabel "Build Automation Tool" ;
- rdfs:subClassOf :DeveloperApplication ;
- :definition "A tool that automates the process of creating a software build and the associated processes including: compiling computer source code into binary code, packaging binary code, and running automated tests." ;
- rdfs:seeAlso .
-
-:BusinessCommunicationPlatformClient a owl:Class ;
- rdfs:label "Business Communication Platform Client" ;
- rdfs:subClassOf :CollaborativeSoftware ;
- rdfs:isDefinedBy ;
- :definition "Client software to enable the process of sharing information between employees within and outside a company. Business communication encompasses topics such as marketing, brand management, customer relations, consumer behavior, advertising, public relations, corporate communication, community engagement, reputation management, interpersonal communication, employee engagement, and event management. It is closely related to the fields of professional communication and technical communication." .
-
-:BusMessage a owl:Class ;
- rdfs:label "Bus Message" ;
- rdfs:subClassOf :DigitalMessage ;
- :definition "A digital message potentially containing commands, telemetry, or status signals, encoded in a bus protocol and conveyed over a bus within one or more frames." .
-
-:BusNetwork a owl:Class ;
- rdfs:label "Bus Network" ;
- skos:altLabel "Bus",
- "Data Highway" ;
- rdfs:subClassOf :Network ;
- rdfs:isDefinedBy ;
- :definition "An electronic communication system that links multiple components through one shared transmission medium, together with the interface hardware and link-layer signalling that govern access to that medium." .
-
-:BusNetworkFrame a owl:Class ;
- rdfs:label "Bus Network Frame" ;
- skos:altLabel "Bus Frame" ;
- rdfs:subClassOf :NetworkFrame,
- [ a owl:Restriction ;
- owl:onProperty :contained-by ;
- owl:someValuesFrom :BusNetworkTraffic ],
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :BusMessage ] ;
- :definition "A network frame whose layout and timing follow a bus protocol, allowing data to be exchanged across the shared bus medium." .
-
-:BusNetworkNode a owl:Class ;
- rdfs:label "Bus Network Node" ;
- rdfs:subClassOf :Host,
- [ a owl:Restriction ;
- owl:onProperty :connected-to ;
- owl:someValuesFrom :BusNetwork ],
- [ a owl:Restriction ;
- owl:onProperty :transmits ;
- owl:someValuesFrom :BusNetworkTraffic ] ;
- :definition "A device or logical endpoint whose interface is directly connected to a bus and exchanges data over the shared medium using the protocol implemented on that interface." .
-
-:BusNetworkTraffic a owl:Class ;
- rdfs:label "Bus Network Traffic" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :BusNetworkFrame ] ;
- :definition "The ordered flow of frames, structured by a bus protocol, that traverses the shared bus medium during operation." .
-
-:ByteSequenceEmulation a :ByteSequenceEmulation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Byte Sequence Emulation" ;
- rdfs:subClassOf :NetworkTrafficAnalysis ;
- :d3fend-id "D3-BSE" ;
- :definition "Analyzing sequences of bytes and determining if they likely represent malicious shellcode." ;
- :kb-article """## How it works
-
-Bytes are analyzed as if they are machine code instructions, and such instructions that are a common component of known shellcode are noted, such as stack pivots, reads from a Memory Address Table, and system calls for functions that disable protections or execute code. For example, the x86 instruction `b0 0b: mov $11, %ax`, with no further alterations to the `%ax` register, followed by `cd 80: syscall` executes the system call `execve()` in the Linux kernel, which replaces the current process with another one specified -- this is a common action in shellcode, so this sequence would be flagged.
-
-This technique detects shellcode despite whether or not it would cause a buffer overflow in the target binary.
-
-If the sequence of bytes contains a sequence similar to that used in malicious shellcode, the entire byte sequence is flagged and a follow-on technique may be invoked.
-
-## Considerations
-
-### False Negatives
-If the shellcode instructions are far apart, simple implementations might not detect the shellcode.
-
-Due to the nature of assembly instructions not having a defined start or end, implementations which do not process all start sequences (for example, when they a find byte sequence of interest, continue scanning forwards from the end of it) might not detect the shellcode.
-
-This technique might not detect more complex or obfuscated instructions. For that purpose, Dynamic Analysis or Emulated File Analysis could assist by analyzing the actual instruction function.
-
-This technique may not detect self-modifying code. To make it harder for a process to modify itself, Process Segment Execution Prevention should be used, while noting its considerations.
-
-This technique might not detect malicious shellcode which reuses instructions in the target binary for malicious effect, as memory references in the presumed assembly code are not dereferenced. Dynamic Analysis and Emulated File Analysis, when set up properly to fork from the running target binary, might detect this. Process Segment Execution Prevention combined with Segment Address Offset Randomization frequently makes introduction of shellcode through overwriting a saved return pointer more difficult. Call stack depth analysis might detect excessive reuse of instructions in the target binary. Shadow Stack Frames might detect that a stack frame's return address has changed and Stack Frame Canary Verification might detect that the stack frame's return address was overwritten. Other heuristic methods might detect jump-oriented programming shellcode.
-
-With inserting code directly, that it is not a buffer overflow, and just some place where code is executed either to a file or a write-what-where, the buffer overflow mitigations do not help. Behavioral analysis could detect this, or proper access control could mitigate this.
-
-### False Positives
-
-Byte sequences containing code that is never used as machine code are still analyzed and flagged for anomalies, and [eventually](http://mathforum.org/library/drmath/view/55871.html), it is likely that an attack sequence will arise from the sheer volume of bytes transmitted.""" ;
- :kb-reference :Reference-Network-BasedBufferOverflowDetectionByExploitCodeAnalysis_InformationSecurityResearchCentre,
- :Reference-Network-levelPolymorphicShellcodeDetectionUsingEmulation ;
- :synonym "Shellcode Transmission Detection" .
-
-:C4.5 a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "C4.5" ;
- rdfs:subClassOf :DecisionTree ;
- :d3fend-id "D3A-C4." ;
- :definition "C4.5 is an algorithm that is strongly based off ID3. It creates decision trees the same way as ID3. C4.5 improves on several aspects of ID3, including handling discreet variables, handling training data with missing values, and has the ability to automatically prune the decision trees it creates." ;
- :kb-article """## References
-C4.5 algorithm. Wikipedia. [Link](https://en.wikipedia.org/wiki/C4.5_algorithm).""" ;
- :todo "Review: Definition" .
-
-:C5.0 a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "C5.0" ;
- rdfs:subClassOf :DecisionTree ;
- :d3fend-id "D3A-C5." ;
- :definition "C5.0 is the next version of C4.5, which in turn is the upgrade from ID3. The only difference between C5.0 and C4.5 is some improvements made to C5.0." ;
- :kb-article """## References
-C4.5 algorithm. Wikipedia. [Link](https://en.wikipedia.org/wiki/C4.5_algorithm).""" .
-
-:CACertificateFile a owl:Class ;
- rdfs:label "CA Certificate File" ;
- rdfs:subClassOf :CertificateFile ;
- :definition "A file containing a digital certificate issued by a certificate authority (CA). Certificate authorities store, issue, and sign digital certificates used as part of the public key infrastructure." ;
- rdfs:seeAlso ,
- .
-
-:CacheMemory a owl:Class ;
- rdfs:label "Processor Cache Memory" ;
- rdfs:subClassOf :PrimaryStorage,
- [ a owl:Restriction ;
- owl:onProperty :accessed-by ;
- owl:someValuesFrom :CentralProcessingUnit ],
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :ProcessSegment ],
- [ a owl:Restriction ;
- owl:onProperty :modifies ;
- owl:someValuesFrom :CacheMemory ] ;
- rdfs:isDefinedBy ;
- :definition "Cache memory is temporary storage that is more readily available to the processor than the computer's main memory source, located between the main memory and the processor. It is typically either integrated directly into the CPU chip (level 1 cache) or placed on a separate chip with a bus interconnect with the CPU (level 2 cache)." ;
- rdfs:seeAlso .
-
-:CallStack a owl:Class ;
- rdfs:label "Call Stack" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :StackFrame ] ;
- rdfs:isDefinedBy ;
- :definition "In computer science, a call stack is a stack data structure that stores information about the active subroutines of a computer program. This kind of stack is also known as an execution stack, program stack, control stack, run-time stack, or machine stack, and is often shortened to just \"the stack\". Although maintenance of the call stack is important for the proper functioning of most software, the details are normally hidden and automatic in high-level programming languages. Many computer instruction sets provide special instructions for manipulating stacks." .
-
-:CanopyClustering a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Canopy Clustering" ;
- rdfs:subClassOf :ClusterAnalysis ;
- :d3fend-id "D3A-CC" ;
- :definition "The canopy clustering algorithm is an unsupervised pre-clustering algorithm often used as preprocessing step for the K-means algorithm or the Hierarchical clustering algorithm. It is intended to speed up clustering operations on large data sets." ;
- :kb-article """## References
-Wikipedia. (n.d.). Canopy clustering algorithm. [Link](https://en.wikipedia.org/wiki/Canopy_clustering_algorithm)""" .
-
-:Capability a owl:Class ;
- rdfs:label "Capability" ;
- rdfs:subClassOf :ExternalThing ;
- rdfs:isDefinedBy ;
- :comment """Source Definitions for DoDAF-DM2 Term: "(JCIDS): The ability to achieve a desired effect under specified standards and conditions through combinations of means and ways to perform a set of tasks.
-(DoDAF/CADM): An ability to achieve an objective. (DDDS Counter (333/1)(A))
-(JC3IEDM): The potential ability to do work, perform a function or mission, achieve an objective, or provide a service.
-(MODAF): Capabilities in the MODAF sense are specifically not about equipment but are a high level specification of the enterprise’s ability. A capability is a classification of some ability - and can be specified regardless of whether the enterprise is currently able to achieve it. For example, one could define a capability “Manned Interplanetary Travel” which no-one can currently achieve, but which may be planned or aspired to. Capabilities in MODAF are not time-dependent - once defined they are persistent. It is only the Capability Requirement that changes.
-(NAF): The ability of one or more resources to deliver a specified type of effect or a specified course of action. (GEN TERM)
-(NAF): A high level specification of the enterprise's ability. (MM)
-(JCS 1-02): The ability to execute a specified course of action. (A capability may or may not be accompanied by an intention.)
-(Webster's): 1. The quality of being capable; ability. 2. A talent or ability that has potential for development or use. 3. The capacity to be used, treated, or developed for a specific purpose.
-(Merriam-Webster's Eleventh Collegiate Dictionary): A feature or factor capable of development: POTENTIALITY. 3. The facility or potential for an indicated use or deployment.
-(Joint Publication 1-02, Dictionary of Military and Associated Terms, 12 Apr 2001 (as amended trhough 30 May 2008) ): The ability to exercise a specified course of action (A capability may or may not be accompanied by an intention)
-(Dictionary.com): The quality of being capable; capacity; ability: His capability was unquestionable. The ability to undergo or be affected by a given treatment or action: the capability of glass in resisting heat. Usually, capabilities. qualities, abilities, features, etc., that can be used or developed; potential: Though dilapidated, the house has great capabilities
-(Wiktionary): The power or ability to generate an outcome
-(www.staffordshireprepared.gov.uk/glossary/): Originally a military term which includes the aspects of personnel, equipment, training, planning and operational doctrine. Now used to mean a demonstrable capacity or ability to respond to and recover from a particular threat or hazard."
-
-CJCS Guide 3401D: https://www.jcs.mil/Portals/36/Documents/Library/Handbooks/g3401.pdf?ver=2016-02-05-175742-457 : "capability. The ability to execute a specified course of action. (A capability may or may not be accompanied by an intention.)"
-
-USG Compendium of Interagency and Associated Terms: https://www.jcs.mil/Portals/36/Documents/Doctrine/dictionary/repository/usg_compendium.pdf?ver=2019-11-04-174229-423 "capability - means to accomplish a mission, function, or objective." DHS, DHS Lexicon, Terms, Mar 17;
-
-USG Compendium of Interagency and Associated Terms: https://www.jcs.mil/Portals/36/Documents/Doctrine/dictionary/repository/usg_compendium.pdf?ver=2019-11-04-174229-423 "capability - Provides the means to accomplish a mission or function resulting from the performance of one or more critical tasks, under specified conditions, to target levels of performance. A capability may be delivered with any combination of properly planned, organized, equipped, trained, and exercised personnel that achieves the desired outcome."
-DHHS, National Health Security Review 2010- 2014, Terms, Jan 17""" ;
- rdfs:seeAlso .
-
-:CAPEC-663 a :CommonAttackPattern,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Exploitation of Transient Instruction Execution" ;
- rdfs:subClassOf :CommonAttackPattern ;
- rdfs:isDefinedBy ;
- :capec-id "CAPEC-553" .
-
-:CAPECThing a owl:Class ;
- rdfs:label "CAPEC Thing" ;
- rdfs:subClassOf :ExternalThreatModelThing .
-
-:CART a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "CART" ;
- rdfs:subClassOf :DecisionTree ;
- :d3fend-id "D3A-CAR" ;
- :definition "The CART algorithm is a type of classification algorithm that is required to build a decision tree on the basis of Gini’s impurity index." ;
- :kb-article """## References
-Classification and Regression Tree (CART) Algorithm. Analytics Steps. [Link](https://www.analyticssteps.com/blogs/classification-and-regression-tree-cart-algorithm).""" .
-
-:CCIControl a owl:Class ;
- rdfs:label "CCI Control" ;
- rdfs:subClassOf :ExternalControl,
- [ a owl:Restriction ;
- owl:onProperty :control-name ;
- owl:someValuesFrom xsd:string ],
- [ a owl:Restriction ;
- owl:onProperty :member-of ;
- owl:someValuesFrom :ControlCorrelationIdentifierCatalog ],
- [ a owl:Restriction ;
- owl:onProperty :published ;
- owl:someValuesFrom xsd:dateTime ] .
-
-:CentralProcessingUnit a owl:Class ;
- rdfs:label "Central Processing Unit" ;
- rdfs:subClassOf :Processor,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :ProcessorRegister ],
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :CacheMemory ],
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :MemoryManagementUnit ],
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :MemoryProtectionUnit ] ;
- rdfs:isDefinedBy ;
- :definition "A central processing unit (CPU), also called a central processor, main processor or just processor, is the electronic circuitry that executes instructions comprising a computer program. The CPU performs basic arithmetic, logic, controlling, and input/output (I/O) operations specified by the instructions in the program. This contrasts with external components such as main memory and I/O circuitry, and specialized processors such as graphics" ;
- :synonym "Central Processor",
- "CPU",
- "Main Processor" .
-
-:CentralTendency a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Central Tendency" ;
- rdfs:subClassOf :DescriptiveStatistics ;
- :d3fend-id "D3A-CT" ;
- :definition "A measure of central tendency ) is a summary measure that attempts to describe a whole set of data with a single value that represents the middle or centre of its distribution." ;
- :kb-article """## References
-Australian Bureau of Statistics. (n.d.). Measures of Central Tendency. [Link](https://www.abs.gov.au/statistics/understanding-statistics/statistical-terms-and-concepts/measures-central-tendency)
-
-Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)""" .
-
-:Centroid-basedClustering a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Centroid-based Clustering" ;
- rdfs:subClassOf :ClusterAnalysis ;
- :d3fend-id "D3A-CBC" ;
- :definition "Centroid-based clustering organizes the data into non-hierarchical clusters, in contrast to hierarchical clustering defined below. K-means is the most widely-used centroid-based clustering algorithm. Centroid-based algorithms are efficient but sensitive to initial conditions and outliers." ;
- :kb-article """## References
-Google Developers. (n.d.). Clustering Algorithms. [Link](https://developers.google.com/machine-learning/clustering/clustering-algorithms)""" .
-
-:Certificate a owl:Class ;
- rdfs:label "Certificate" ;
- skos:altLabel "Public Key Certificate" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :Identifier ],
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :PublicKey ] ;
- rdfs:isDefinedBy ;
- :definition "In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ownership of a public key. The certificate includes information about the key, information about the identity of its owner (called the subject), and the digital signature of an entity that has verified the certificate's contents (called the issuer). If the signature is valid, and the software examining the certificate trusts the issuer, then it can use that key to communicate securely with the certificate's subject. In email encryption, code signing, and e-signature systems, a certificate's subject is typically a person or organization. However, in Transport Layer Security (TLS) a certificate's subject is typically a computer or other device." ;
- rdfs:seeAlso ;
- :todo "Since we say it contains a PK, must be PKC. Rewire certificate hierarchy to include attribute/authorization certificates more generally. Push this down to specifically represent PKCs. Also key and authority issues may require parallel adjustments http://dbpedia.org/resource/Authorization_certificate" .
-
-:Certificate-basedAuthentication a :Certificate-basedAuthentication,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Certificate-based Authentication" ;
- rdfs:subClassOf :AgentAuthentication,
- [ a owl:Restriction ;
- owl:onProperty :reads ;
- owl:someValuesFrom :Certificate ] ;
- :d3fend-id "D3-CBAN" ;
- :definition "Requiring a digital certificate in order to authenticate a user." ;
- :kb-article """## How it works
-
-Certificate-based authentication is a security mechanism that uses digital certificates to verify the identity of a user, device, or server before granting access to a network or system. This method relies on a pair of cryptographic keys: a public key and a private key.
-
-## Considerations
-
-* Private Key Protection: Ensure that private keys are securely stored and protected against unauthorized access.
-* Certificate Revocation: Implement a robust process for revoking certificates if they are compromised or no longer needed.
-* Man-in-the Middle Attacks: Use mutual authentication to mitigate the risk of these attacks.""" ;
- :kb-reference :Reference-FederalPublicKeyInfrastructure101 .
-
-:CertificateAnalysis a :CertificateAnalysis,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Certificate Analysis" ;
- rdfs:subClassOf :NetworkTrafficAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :CertificateFile ] ;
- :d3fend-id "D3-CA" ;
- :definition "Analyzing Public Key Infrastructure certificates to detect if they have been misconfigured or spoofed using both network traffic, certificate fields and third-party logs." ;
- :kb-article """## How it works
-Certificate Analysis ensures that the data elements of the certificate are current and anchored in a known trust model. Certificate authorities, revocation lists, and third-party secure logs are used in the analysis. Analysis includes detection of server impersonation, phishing domains, and forged certificates.
-
-TLS certificates are designed to expire to ensure that the cryptographic keys are forced to be changed on a regular basis. The certificates in the trust path also expire and can cause a break in the trust chain. This means that even if a server certificate is updated correctly, intermediate certificates can expire and the trust chain is not maintained. This can cause services to become unavailable.""" ;
- :kb-reference :Reference-SecuringWebTransactions .
-
-:CertificateFile a owl:Class ;
- rdfs:label "Certificate File" ;
- rdfs:subClassOf :File,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :Certificate ] ;
- rdfs:isDefinedBy ;
- :definition "A file containing a digital certificate. In cryptography, a public key certificate (also known as a digital certificate or identity certificate) is an electronic document used to prove the ownership of a public key. The certificate includes information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner." .
-
-:CertificatePinning a :CertificatePinning,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Certificate Pinning" ;
- rdfs:subClassOf :CredentialHardening,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :PublicKey ],
- [ a owl:Restriction ;
- owl:onProperty :hardens ;
- owl:someValuesFrom :Certificate ] ;
- :d3fend-id "D3-CP" ;
- :definition "Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections." ;
- :kb-article """## How it works
-Pinning allows for a trusted copy of a certificate or public key to be associated with a server and thus reducing the likelihood of frequently visited sites being subjected to man-in-the-middle attacks. Certificates or public keys can be pinned after a trusted connection has been established or the pinning can be preloaded in an application, which is the preferred method for mobile applications.
-
-Pinning can take the form of certificate pinning or public key pinning.
-
-## Forms of Pinning
-* Certificate Pinning (CP) allows for the client to verify the X.509 certificate with a preloaded certificate. Typically, this is involves storing a hash of the certificate and using the stored hash for comparison to the hash of the certificate submitted during the SSL handshake.
-
-* Public Key Pinning (PKP) requires the extraction of a public key from server's certificate. The stored public key is compared to the server's presented public key. A public key is expected to rotate less frequently than an X.509 certificate and is generally favored over certificate pinning.
-
-An extension of PKP is Subject Public Key Information Pinning (SPKI) includes public key pinning plus additional information for SSL connections. The additional information can include preferred algorithms.
-
-## Considerations
-
-* With pinned certificates whenever a server updates its certificate, the pinned certificates will also need to be updated
-* With pinned public keys the extracted key may be subject to key refresh policies but much less frequently
-* Servers can become unavailable if pinned objects are set and not updated with the rotated identities. This may require a pinning strategy to be developed.
-* The application of this technique within web browser applications has been [deprecated](https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning) by popular web browser developers. They now favor certificate analysis via public certificate transparency logs, and the EXPECT-CT HTTP header.""" ;
- :kb-reference :Reference-CertificateAndPublicKeyPinning,
- :Reference-End-to-endCertificatePinning,
- :Reference-PublicKeyPinningExtensionForHTTP .
-
-:CertificateRotation a :CertificateRotation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Certificate Rotation" ;
- rdfs:subClassOf :CredentialRotation,
- [ a owl:Restriction ;
- owl:onProperty :regenerates ;
- owl:someValuesFrom :Certificate ] ;
- :d3fend-id "D3-CERO" ;
- :definition "Certificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise risks and ensuring continuous secure communications." ;
- :kb-article """## How it works
-
-Certificate rotation should be performed when:
-- Any certificate expires.
-- A new CA authority is substituted for the old, thus requiring a replacement root certificate.
-- New or modified constraints need to be imposed on one or more certificates.
-- A security breach has occurred.
-
-Considerations:
-- Managing certificate rotation across an enterprise can be complex. Automated solutions, sold by multiple vendors, should be considered to manage this complexity.""" ;
- :kb-reference :Reference-PasswordandKeyRotation-SSH ;
- rdfs:seeAlso .
-
-:CertificateTrustStore a owl:Class ;
- rdfs:label "Certificate Trust Store" ;
- rdfs:subClassOf :TrustStore,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :Certificate ] ;
- :definition "A certificate truststore is used to store public certificates used to authenticate clients by the server for an SSL connection." ;
- rdfs:seeAlso ,
- .
-
-:ChangeDefaultPassword a :ChangeDefaultPassword,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Change Default Password" ;
- rdfs:subClassOf :StrongPasswordPolicy,
- [ a owl:Restriction ;
- owl:onProperty :hardens ;
- owl:someValuesFrom :OTController ],
- [ a owl:Restriction ;
- owl:onProperty :strengthens ;
- owl:someValuesFrom :Password ],
- [ a owl:Restriction ;
- owl:onProperty :strengthens ;
- owl:someValuesFrom :UserAccount ] ;
- :d3fend-id "D3-CDP" ;
- :definition "Changing the default password means replacing the factory-set credentials with a strong, unique password before the device is deployed, preventing unauthorized access." ;
- :kb-article """## How it works
-Change the default password as soon as a new device is received. The default credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means.
-
-## Considerations
-* These should be changed before a device is brought online so that an adversary cannot take advantage of these default credentials.
-* Strong and complex passwords are preferred if the technology allows.""" ;
- :kb-reference :Reference-CPGChecklist,
- :Reference-GuideToOTSecurity,
- :Reference-MITREATTACKPasswordPolicies .
-
-:ChatroomClient a owl:Class ;
- rdfs:label "Chatroom Client" ;
- skos:altLabel "Chat Room Client" ;
- rdfs:subClassOf :CollaborativeSoftware ;
- rdfs:isDefinedBy ;
- :definition "Client software used to describe conduct any form of synchronous conferencing, occasionally even asynchronous conferencing. The term can thus mean any technology ranging from real-time online chat and online interaction with strangers (e.g., online forums) to fully immersive graphical social environments." .
-
-:ChildProcess a owl:Class ;
- rdfs:label "Child Process" ;
- rdfs:subClassOf :Process ;
- rdfs:isDefinedBy ;
- :definition "A child process in computing is a process created by another process (the parent process). This technique pertains to multitasking operating systems, and is sometimes called a subprocess or traditionally a subtask. There are two major procedures for creating a child process: the fork system call (preferred in Unix-like systems and the POSIX standard) and the spawn (preferred in the modern (NT) kernel of Microsoft Windows, as well as in some historical operating systems)." ;
- rdfs:seeAlso .
-
-:Classification a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Classification" ;
- rdfs:subClassOf :SupervisedLearning ;
- :d3fend-id "D3A-CLA" ;
- :definition "Classification uses an algorithm to accurately assign test data into specific categories." ;
- :kb-article """## How it works
-Classification recognizes specific entities within the dataset and attempts to draw some conclusions on how those entities should be labeled or defined. Common classification algorithms are linear classifiers, support vector machines (SVM), decision trees, k-nearest neighbor, and random forest, which are described in more detail below.
-
-## Considerations:
-
-There are many different types of classification algorithms for modeling classification predictive modeling problems.
-
-There is no single theory on how to map algorithms onto problem types; instead, it is generally recommended that a practitioner use controlled experiments and discover which algorithm and algorithm configuration results in the best performance for a given classification task.
-
-## Key Test Considerations
-
-- **Machine Learning**:
-
- - **Verify the dataset quality**: Check the data to make sure it is
- free of errors. Quantify the degree of missing values,
- outliers, and noise in the data collection. If the data quality
- is low, it may be difficult or impossible to create models and
- systems with the desired performance.
-
- - **Verify development datasets are representative** of expected
- operational environment and data collection means. Compare
- distributions of dataset features and labels with exploratory
- data analysis and assess the difference in tests on training
- data and tests on evaluation data (where the evaluation data
- must be drawn from a representative dataset.)
-
- - **Use software libraries**: and tools built for ML where possible, so
- that the underlying code is verified by prior use.**
-
- - **Diagnose model errors with domain SMEs**: Have problem domain
- SMEs investigate model errors for conditions for which the model
- may underperform and suggest refinements.
-
-- **Classification**:
-
- - **Use Standard Classification Performance Measures**: Not all of
- the following may be necessary, but should be considered for
- both verification (developmental test) and operational test
- stages use:
-
- - **Accuracy**: The fraction of predictions that were corret.
-
- - **Precision**: The proportion of positive identifications that were correct.
-
- - **Recall**: The proportion of actual positive cases identified correctly.
-
- - **F-Measure**: Combines the preicion and recall into a single
- score. It is the harmonic mean of the precision and recall.
-
- - **Receiver Operating Characteristic (ROC) Curve**: A ROC curve
- shows the performance of a classification model at all
- classification thresholds. It graphs the True Positive Rate
- over the False Positive Rate.
-
- - **Area Under the ROC Curve (AUC)**: This measures the
- two-dimensional area under the ROC Curve. AUC is
- scale-invariant and classification-threshold invariant.
-
- - **ROC TP vs FP points**: In addition to a specific AUC score,
- the performance at points
-
- - **Confusion Matrix**: A confusion matrix is a table layout that
- allows the visualization of the performance of an
- algorithm. Each row of the matrix represents the instances in
- an actual class while each column represents the instances in
- a predicted class, or vice versa. It is a special kind of
- contingency table, with two dimensions ("actual" and
- "predicted"), and identical sets of "classes" in both
- dimensions (each combination of dimension and class is a
- variable in the contingency table.)
-
- - **Prediction Bias**: The difference between the average of the
- predicted labels and the average of the labels in the data
- set. One should check for prediction bias when evaluating the
- classifier's results. Causes of bias can include:
-
- - **Noisy data set**: Errors in original data can as the
- collection method may have an underlying bias.
-
- - **Processing bug**: Errors in the data pipeline can
- introduce bias.
-
- - **Biased training sample (unbalanced samples)**: Model
- parameters may be skewed towards majority classes.
-
- - **Overly strong regularization**: Model may be underfitting
- model and too simple.
-
- - **Proxy variables**: Model features may be highly
- correlated.
-
- - **Overfitting and Underfitting**: Overfitting occurs when the the
- model built corresponds too closely or exactly to a particular
- set of data, and thus may fail to fit to predict additional data
- reliably. An overfitted model is a mathematical model that
- contains more parameters than can be justified by the data.
- Underfitting occurs when the model built does adequately capture
- the patterns in the data. As an example, a linear model will
- underfit a non-linear dataset.
-
-## Platforms, Tools, or Libraries:
-
-- **Python**:
-
- - **scikit-learn**: Is a free software machine learning library for
- Python and includes features for classification.
-
- - **TensorFlow**: is an end-to-end source machine learning
- platform.
-
- - **Keras**: is an open-source library that provides a Python API
- designed to enable fast experimentation with deep neural networks.
-
- - **PyTorch**: Is a machine learning framework based on the Torch
- library.
-
-- **R**:
-
- - **caret**: Classification And REgression Training package contains
- functions to streamline model training for complex regression
- and classification problems.
-
- - **randomForest**: Implementation of classification and regression
- based on forest of trees.
-
-## References
-
-1. Supervised Learning. IBM.
-[Link](https://www.ibm.com/topics/supervised-learning).
-
-1. Types of Classification in Machine Learning. Machine Learning Mastery.
-[Link](https://machinelearningmastery.com/types-of-classification-in-machine-learning/).
-
-1. Google. (18 July 2022). Classification: Precision and Recall.
-[Link](https://developers.google.com/machine-learning/crash-course/classification/precision-and-recall).
-
-1. Wikipedia. (18 Aug 2023). Overfitting.
-[Link](https://en.wikipedia.org/wiki/Overfitting).
-
-1. Wikipedia. (19 Aug 2023). Confusion matrix.
-[Link](https://en.wikipedia.org/wiki/Confusion_matrix).""" .
-
-:Classifying a owl:Class ;
- rdfs:label "Classifying" ;
- rdfs:subClassOf :AnalyticalPurpose .
-
-:Client-serverPayloadProfiling a :Client-serverPayloadProfiling,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Client-server Payload Profiling" ;
- rdfs:subClassOf :NetworkTrafficAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :NetworkTraffic ] ;
- :d3fend-id "D3-CSPP" ;
- :definition "Comparing client-server request and response payloads to a baseline profile to identify outliers." ;
- :kb-article """## How it works
-Profiling request and response payloads across multiple clients to a single server to develop a baseline of their characteristics. May take into account request/response sizes, entropy, frequency, and rhythm. Finally, identify outliers as they may indicate a malicious payload delivery and subsequent server exploitation.
-
-
-## Considerations
-* Collecting metrics to establish a profile can be challenging since user behavior can change easily.
-* Employees may work different hours or inconsistent schedules which will cause false positives.
-* Collection of network activity to generate metrics is a computationally intensive process.
-* Users may log into different workstations which may cause false positives.""" ;
- :kb-reference :Reference-MethodAndSystemForDetectingMaliciousPayloads_VectraNetworksInc .
-
-:ClientApplication a owl:Class ;
- rdfs:label "Client Application" ;
- rdfs:subClassOf :Application ;
- rdfs:isDefinedBy ;
- :definition "A client application is software that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network. The term applies to the role that programs or devices play in the client-server model" ;
- rdfs:seeAlso :T1554 .
-
-:ClientComputer a owl:Class ;
- rdfs:label "Client Computer" ;
- rdfs:subClassOf :Host ;
- rdfs:isDefinedBy ;
- :definition "A client computer is a host that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network." ;
- rdfs:seeAlso .
-
-:Clipboard a owl:Class ;
- rdfs:label "Clipboard" ;
- rdfs:subClassOf :DigitalInformationBearer ;
- rdfs:isDefinedBy ;
- :definition "The clipboard is a buffer that some operating systems provide for short-term storage and transfer within and between application programs. The clipboard is usually temporary and unnamed, and its contents reside in the computer's RAM. The clipboard is sometimes called the paste buffer. Windows, Linux and macOS support a single clipboard transaction. Each cut or copy overwrites the previous contents. Normally, paste operations copy the contents, leaving the contents available in the clipboard for further pasting." .
-
-:Cloud-basedDatabaseApplication a owl:Class ;
- rdfs:label "Cloud-based Database Application" ;
- rdfs:subClassOf :DatabaseServiceApplication,
- [ a owl:Restriction ;
- owl:onProperty :provider ;
- owl:someValuesFrom :CloudServiceProvider ] ;
- :definition "A database application where the underlying infrastructure is managed by a third-party cloud provider. Examples include DynamoDB, Firestore, and CosmosDB." ;
- :synonym "Serverless Database Application" .
-
-:CloudConfiguration a owl:Class ;
- rdfs:label "Cloud Configuration" ;
- skos:altLabel "Cloud Configuration Information" ;
- rdfs:subClassOf :ConfigurationResource ;
- :definition "Information used to configure the services, parameters, and initial settings for a virtual server instance running in a cloud service." .
-
-:CloudConfigurationModificationEvent a owl:Class ;
- rdfs:label "Cloud Configuration Modification Event" ;
- rdfs:subClassOf :ConfigurationModificationEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :CloudConfiguration ] ;
- :definition "An event that updates cloud-hosted resource configurations such as IAM policies, virtual network constructs, storage settings, or managed-service parameters; impacting resource provisioning, access control, functionality, or compliance." .
-
-:CloudInstanceMetadata a owl:Class ;
- rdfs:label "Cloud Instance Metadata" ;
- rdfs:subClassOf :CloudConfiguration ;
- :definition "Cloud instance metadata is configuration information on the instance and users of the instance. This includes such information as security groups, public ip addresses, and private addresses, public keys configured, and event rotating security keys. User data can contain initialization scripts, variables, passwords, and more." ;
- rdfs:seeAlso .
-
-:CloudServiceAuthentication a owl:Class ;
- rdfs:label "Cloud Service Authentication" ;
- rdfs:subClassOf :WebAuthentication ;
- :definition "A request-response comprising a user credential presentation to a system and a verification response where the verifying party is a cloud service." .
-
-:CloudServiceAuthorization a owl:Class ;
- rdfs:label "Cloud Service Authorization" ;
- rdfs:subClassOf :Authorization ;
- :definition "Cloud authorization is the function of specifying access rights to cloud resources." .
-
-:CloudServiceProvider a owl:Class ;
- rdfs:label "Cloud Service Provider" ;
- rdfs:subClassOf :ServiceProvider ;
- :definition "A cloud service provider delivers scalable and distributed computing resources over a network, enabling clients to access infrastructure, platforms, and applications remotely." .
-
-:CloudServiceSensor a owl:Class ;
- rdfs:label "Cloud Service Sensor" ;
- rdfs:subClassOf :CyberSensor,
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :CloudServiceAuthentication ],
- [ a owl:Restriction ;
- owl:onProperty :monitors ;
- owl:someValuesFrom :CloudServiceAuthorization ] ;
- :definition "Senses data from cloud service platforms. Including data from cloud service authentications, authorizations, and other activities." .
-
-:CloudStorage a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Cloud Storage" ;
- rdfs:subClassOf :SecondaryStorage ;
- rdfs:isDefinedBy ;
- :definition "Cloud storage is storage held within a computing cloud." ;
- rdfs:seeAlso .
-
-:CloudUserAccount a owl:Class ;
- rdfs:label "Cloud User Account" ;
- rdfs:subClassOf :UserAccount ;
- :definition "A user account on a given host is a local user account for a given cloud and specified resources within that cloud." .
-
-:ClusterAnalysis a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Cluster Analysis" ;
- rdfs:subClassOf :UnsupervisedLearning ;
- :d3fend-id "D3A-CA" ;
- :definition "Cluster analysis or clustering is the task of grouping a set of objects in such a way that objects in the same group (called a cluster) are more similar (in some sense) to each other than to those in other groups (clusters)." ;
- :kb-article """## References
-Cluster analysis. (n.d.). Wikipedia. [Link](https://en.wikipedia.org/wiki/Cluster_analysis)""" .
-
-:Clustering a owl:Class ;
- rdfs:label "Clustering" ;
- rdfs:subClassOf :Summarizing .
-
-:CodeAnalyzer a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Code Analyzer" ;
- skos:altLabel "Program Analysis Tool" ;
- rdfs:subClassOf :DeveloperApplication ;
- :definition "Code analyzers automatically analyze the composition or behavior of computer programs regarding a property such as correctness, robustness, security, and safety. Program analysis can be performed without executing the program (static program analysis), during runtime (dynamic program analysis) or in a combination of both." ;
- rdfs:seeAlso ;
- :todo "Damn these wikipedia articles are present, but not that great; riffing and borrowing parts, not exact defs." .
-
-:CodecApplication a owl:Class ;
- rdfs:label "Codec Application" ;
- rdfs:subClassOf :UserApplication,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :CodecLibrary ] ;
- :definition "An application that encodes and decodes digital data." .
-
-:CodecLibrary a owl:Class ;
- rdfs:label "Codec Library" ;
- rdfs:subClassOf :SoftwareLibrary ;
- :definition "A software component that encodes or decodes a data stream of signal." .
-
-:CodeRepository a owl:Class ;
- rdfs:label "Code Repository" ;
- skos:altLabel "Repository",
- "Version Control Repository" ;
- rdfs:subClassOf :Database ;
- rdfs:isDefinedBy ;
- :definition "A code repository is a form of database where code, typically source code, is stored and managed. In revision control systems, a repository is a data structure that stores metadata for a set of files or directory structure. Depending on whether the version control system in use is distributed like (Git or Mercurial) or centralized like (Subversion, CVS, or Perforce), the whole set of information in the repository may be duplicated on every user's system or may be maintained on a single server." .
-
-:CoefficientOfVariation a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Coefficient of Variation" ;
- rdfs:subClassOf :Variability ;
- :d3fend-id "D3A-COV" ;
- :definition """The coefficient of variation (CV), also known as relative standard deviation (RSD), is a standardized measure of dispersion of a probability distribution or frequency distribution.
-
-The coefficient of variation (CV) is defined as the ratio of the standard deviation to the mean .""" ;
- :kb-article """## References
-Wikipedia. (n.d.). Coefficient of variation. [Link](https://en.wikipedia.org/wiki/Coefficient_of_variation)""" ;
- :synonym "Relative Standard Deviation",
- "RSD" .
-
-:CollaborativeSoftware a owl:Class ;
- rdfs:label "Collaborative Software" ;
- rdfs:subClassOf :UserApplication ;
- rdfs:isDefinedBy ;
- :definition "Collaborative software or groupware is application software designed to help people working on a common task to attain their goals. One of the earliest definitions of groupware is \"intentional group processes plus software to support them\". Collaborative software is a broad concept that overlaps considerably with computer-supported cooperative work (CSCW). According to Carstensen and Schmidt (1999) groupware is part of CSCW. The authors claim that CSCW, and thereby groupware, addresses \"how collaborative activities and their coordination can be supported by means of computer systems.\"" .
-
-:CollectionTechnique a owl:Class ;
- rdfs:label "Collection Technique" ;
- rdfs:subClassOf :ATTACKEnterpriseTechnique,
- :OffensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0009 ] ;
- :definition "The adversary is trying to gather data of interest to their goal." .
-
-:CombinationLock a owl:Class ;
- rdfs:label "Combination Lock" ;
- rdfs:subClassOf :PhysicalLock,
- [ a owl:Restriction ;
- owl:onProperty :uses ;
- owl:someValuesFrom :Password ] ;
- rdfs:isDefinedBy ;
- :definition "A combination lock is a type of locking device in which a sequence of symbols, usually numbers, is used to open the lock. " ;
- rdfs:seeAlso "Federal Specification FL-L-2937" .
-
-:Command a owl:Class ;
- rdfs:label "Command" ;
- rdfs:subClassOf :DigitalInformation ;
- rdfs:isDefinedBy ;
- :definition "A directive (i.e., an instruction specifying a procedure) which, when issued to a computer system, software, or hardware component, causes that entity to execute a specific action, operation, or computation." .
-
-:CommandAndControlTechnique a owl:Class ;
- rdfs:label "Command and Control Technique" ;
- rdfs:subClassOf :ATTACKEnterpriseTechnique,
- :OffensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0011 ] ;
- :definition "The adversary is trying to communicate with compromised systems to control them." .
-
-:CommandHistoryLog a owl:Class ;
- rdfs:label "Command History Log" ;
- rdfs:subClassOf :EventLog ;
- :definition "A log of commands run in an operating system shell." ;
- rdfs:seeAlso :CommandLineInterface,
- .
-
-:CommandHistoryLogFile a owl:Class ;
- rdfs:label "Command History Log File" ;
- rdfs:subClassOf :LogFile,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :CommandHistoryLog ] ;
- :definition "A command history log file is a file containing a command history, which the history of commands run in an operating system shell." ;
- rdfs:seeAlso .
-
-:CommandLineInterface a owl:Class ;
- rdfs:label "Command Line Interface" ;
- skos:altLabel "CLI",
- "Command-line Interface",
- "CUI" ;
- rdfs:subClassOf :UserInterface ;
- rdfs:isDefinedBy ;
- :definition "A command-line interface or command language interpreter (CLI), also known as command-line user interface, console user interface, and character user interface (CUI), is a means of interacting with a computer program where the user (or client) issues commands to the program in the form of successive lines of text (command lines). Command-line interfaces to computer operating systems are less widely used by casual computer users, who favor graphical user interfaces. Programs with command-line interfaces are generally easier to automate via scripting." .
-
-:CommonAttackPattern a owl:Class ;
- rdfs:label "Common Attack Pattern" ;
- rdfs:subClassOf :CAPECThing ;
- :definition "A common attack pattern that is in the CAPEC knowledge base." .
-
-:Compiler a owl:Class ;
- rdfs:label "Compiler" ;
- rdfs:subClassOf :BuildTool,
- [ a owl:Restriction ;
- owl:onProperty :reads ;
- owl:someValuesFrom :CompilerConfigurationFile ] ;
- rdfs:isDefinedBy ;
- :definition "In computing, a compiler is a computer program that translates computer code written in one programming language (the source language) into another language (the target language). The name \"compiler\" is primarily used for programs that translate source code from a high-level programming language to a lower level language (e.g., assembly language, object code, or machine code) to create an executable program." .
-
-:CompilerConfigurationFile a owl:Class ;
- rdfs:label "Compiler Configuration File" ;
- rdfs:subClassOf :ApplicationConfigurationFile ;
- :definition "A file containing Information used to configure the parameters and initial settings for a compiler." .
-
-:ComputeDeviceEvent a owl:Class ;
- rdfs:label "Compute Device Event" ;
- rdfs:subClassOf :HardwareDeviceEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :Processor ] ;
- :definition "An event capturing the operation, state, or performance of computational hardware, such as CPUs, GPUs, or accelerators. These events reflect processing capacity changes, utilization anomalies, or device health." .
-
-:ComputerCabinet a owl:Class ;
- rdfs:label "Computer Cabinet" ;
- rdfs:subClassOf :ComputerEnclosure ;
- :definition "A computer cabinet houses one or more computers and can range in size and material." ;
- rdfs:seeAlso "https://dbpedia.org/page/Computer_cabinet",
- "IEEE C37.20.2" .
-
-:ComputerCase a owl:Class ;
- rdfs:label "Computer Case" ;
- rdfs:subClassOf :ComputerEnclosure ;
- :definition "A computer case is a computer enclosure which encloses a single primary computer." ;
- rdfs:seeAlso "https://dbpedia.org/page/Computer_case" .
-
-:ComputerEnclosure a owl:Class ;
- rdfs:label "Computer Enclosure" ;
- rdfs:subClassOf :PhysicalArtifact,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :ComputerPlatform ],
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :PhysicalLock ] ;
- :definition "A part providing protection of computer equipment against certain external influences and protects against direct contact." ;
- rdfs:seeAlso "[IEV 826-03-12]",
- .
-
-:ComputerNetworkNode a owl:Class ;
- rdfs:label "Computer Network Node" ;
- rdfs:subClassOf :ComputerPlatform,
- :NetworkNode ;
- :definition "A network node running on a computer platform." .
-
-:ComputerPlatform a owl:Class ;
- rdfs:label "Computer Platform" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :Firmware ],
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :HardwareDevice ],
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :OperatingSystem ],
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :SystemPlatformVariable ] ;
- :definition "Platform includes the hardware and OS. The term computing platform can refer to different abstraction levels, including a certain hardware architecture, an operating system (OS), and runtime libraries. In total it can be said to be the stage on which computer programs can run." ;
- rdfs:seeAlso ;
- :synonym "Computing Platform" ;
- :todo "Future work might identify an application platform like Chrome, however Chrome OS would be considered a platform with respect to cybersecurity architects." .
-
-:ComputingImage a owl:Class ;
- rdfs:label "Computing Image" ;
- rdfs:subClassOf :DigitalInformationBearer ;
- rdfs:isDefinedBy ;
- :definition "A computing image captures the full state or contents of a computing entity, such as a process or volume." .
-
-:ComputingServer a owl:Class ;
- rdfs:label "Computing Server" ;
- rdfs:subClassOf :Server ;
- rdfs:isDefinedBy ;
- :definition "A compute server is a system specifically designed to undertake large amounts of computation, usually but not necessarily in a client/server environment." .
-
-:ComputingSnapshot a owl:Class ;
- rdfs:label "Computing Snapshot" ;
- skos:altLabel "Snapshot" ;
- rdfs:subClassOf :DigitalInformationBearer ;
- rdfs:isDefinedBy ;
- :definition "In computer systems, a snapshot is the state of a system at a particular point in time." .
-
-:Condition a owl:Class ;
- rdfs:label "Condition" ;
- rdfs:subClassOf :D3FENDCore ;
- rdfs:comment "Less common usage versus state, meant to superclass precondition, postcondition, and effect." ;
- rdfs:isDefinedBy "n-06768279" ;
- :definition "An assumption on which rests the validity or effect of something else." .
-
-:ConfigurationDatabase a owl:Class ;
- rdfs:label "Configuration Database" ;
- rdfs:subClassOf :ConfigurationResource,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :ConfigurationDatabaseRecord ] .
-
-:ConfigurationDatabaseRecord a owl:Class ;
- rdfs:label "Configuration Database Record" ;
- rdfs:subClassOf :ConfigurationResource,
- :DatabaseRecord ;
- :definition "A Configuration Database Record defines settings, parameters, or preferences for applications, systems, or devices." ;
- :synonym "Configuration Record" .
-
-:ConfigurationEvent a owl:Class ;
- rdfs:label "Configuration Event" ;
- rdfs:subClassOf :DigitalEvent,
- [ a owl:Restriction ;
- owl:onProperty :has-participant ;
- owl:someValuesFrom :ConfigurationResource ] ;
- :definition "A discrete event that creates, applies, modifies, or deletes configuration resources to determine or alter the function of a system, device, application, or service." .
-
-:ConfigurationFile a owl:Class ;
- rdfs:label "Configuration File" ;
- skos:altLabel "Settings File" ;
- rdfs:subClassOf :File ;
- rdfs:isDefinedBy ;
- :definition "A file containing Information used to configure the parameters and initial settings for some computer programs. They are used for user applications, server processes and operating system settings." .
-
-:ConfigurationInventory a :ConfigurationInventory,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Configuration Inventory" ;
- rdfs:subClassOf :AssetInventory,
- [ a owl:Restriction ;
- owl:onProperty :inventories ;
- owl:someValuesFrom :ConfigurationResource ] ;
- :d3fend-id "D3-CI" ;
- :definition "Configuration inventory identifies and records the configuration of software and hardware and their components throughout the organization." ;
- :kb-article """## How it works
-
-The organization retrieves configuration information through means of SNMP (MIB records), WBEM (CIM records), other protocols, or custom scripts and captures that information in a repository, typically known as a Configuration Management Database (CMDB).\"""" ;
- :kb-reference :Reference-Web-BasedEnterpriseManagement,
- :Reference-Windows-Management-Infrastructure,
- :Reference-Windows-Management-Instrumentation .
-
-:ConfigurationManagementDatabase a owl:Class ;
- rdfs:label "Configuration Management Database" ;
- rdfs:subClassOf :ConfigurationDatabase ;
- rdfs:isDefinedBy ;
- :definition "A database used to store configuration records throughout their lifecycle. The Configuration Management System (CMS) maintains one or more CMDBs, and each CMDB stores attributes of configuration items (CIs), and relationships with other CIs." ;
- rdfs:seeAlso ,
- ,
- .
-
-:ConfigurationModificationEvent a owl:Class ;
- rdfs:label "Configuration Modification Event" ;
- rdfs:subClassOf :ConfigurationEvent ;
- :definition "An event that changes the persisted state of configuration resources by adding, updating, or removing parameters, impacting the target component's behavior." .
-
-:ConfigurationResource a owl:Class ;
- rdfs:label "Configuration Resource" ;
- rdfs:subClassOf :Resource ;
- :definition "A resource used to configure a system including software and hardware." .
-
-:ConnectedHoneynet a :ConnectedHoneynet,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Connected Honeynet" ;
- rdfs:subClassOf :DecoyEnvironment,
- [ a owl:Restriction ;
- owl:onProperty :spoofs ;
- owl:someValuesFrom :LocalAreaNetwork ] ;
- :d3fend-id "D3-CHN" ;
- :definition "A decoy service, system, or environment, that is connected to the enterprise network, and simulates or emulates certain functionality to the network, without exposing full access to a production system." ;
- :kb-article """## How it works
-Decoy honeypots are deployed within the enterprise environment that emulate certain services or portions of an OS to attract attackers.
-
-## Considerations
-A connected honeynet provides a tradeoff between emulating certain functionality but not being as sophisticated as an integrated honeynet. The connected honeynet may not provide enough functionality to detect new attack patterns or zero day exploits but could provide enough functionality for specific known vulnerabilities.""" ;
- :kb-reference :Reference-ModificationOfAServerToMimicADeceptionMechanism_AcalvioTechnologiesInc .
-
-:ConnectionAttemptAnalysis a :ConnectionAttemptAnalysis,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Connection Attempt Analysis" ;
- rdfs:subClassOf :NetworkTrafficAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :IntranetNetworkTraffic ] ;
- :d3fend-id "D3-CAA" ;
- :definition "Analyzing failed connections in a network to detect unauthorized activity." ;
- :kb-article """## How it works
-Connection Attempt Analysis in multiple ways.
-
-### Monitoring traffic to unallocated IP space
-One approach looks for failed connection attempts against unallocated IP space. First, network traffic is captured to map out the network to identify network assets as well as unallocated IP space. The map is then used to determine if connection attempts are being made to the unallocated IP space.
-
-### Monitoring for sequentially transmitted traffic
-Another approach passively inspects network traffic with application protocol analyzers observing network activity characteristics such as volume of packets sent/ received, TCP session attributes, and connection information between hosts (start time, source/destination host, services, etc.). Then using pattern matching to identify traffic which appears to be probing for network hosts.
-
-## Considerations
-
-* Implementations that rely on analysis of unallocated IP address space increase in their complexity with network size and decentralized network infrastructure.
-* Inventory of unallocated IP space should should be continuously updated to mitigate the risk of false positives.
-* IPv6 also introduces challenges including IPv6 traffic bypassing IPv4 specific protection systems (ex. firewalls and IDS) and complexity in managing both IPv6 and IPv4 addresses.""" ;
- :kb-reference :Reference-DetectingNetworkReconnaissanceByTrackingIntranetDark-netCommunications_VECTRANETWORKSInc ;
- :synonym "Network Scan Detection" .
-
-:ConnectSocket a owl:Class ;
- rdfs:label "Connect Socket" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :connects ;
- owl:someValuesFrom :Pipe ] ;
- :definition "The connect socket system call connects the socket to a target address." ;
- rdfs:seeAlso .
-
-:ConsoleOutputFunction a owl:Class ;
- rdfs:label "Console Output Function" ;
- rdfs:subClassOf :Subroutine ;
- :definition "Outputs characters to a computer console." .
-
-:ContainerBuildTool a owl:Class ;
- rdfs:label "Container Build Tool" ;
- rdfs:subClassOf :SoftwarePackagingTool ;
- :definition "A software build tool that creates a container (e.g., Docker container) for deployment." .
-
-:ContainerImage a owl:Class ;
- rdfs:label "Container Image" ;
- rdfs:subClassOf :ComputingImage,
- :SoftwarePackage ;
- rdfs:isDefinedBy ;
- :definition """A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another. A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries and settings.
-
-Container images become containers at runtime and in the case of Docker containers - images become containers when they run on Docker Engine. Available for both Linux and Windows-based applications, containerized software will always run the same, regardless of the infrastructure. Containers isolate software from its environment and ensure that it works uniformly despite differences for instance between development and staging.""" ;
- rdfs:seeAlso .
-
-:ContainerImageAnalysis a :ContainerImageAnalysis,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Container Image Analysis" ;
- rdfs:subClassOf :AssetVulnerabilityEnumeration,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :ContainerImage ] ;
- :d3fend-id "D3-CIA" ;
- :definition "Analyzing a Container Image with respect to a set of policies." ;
- :kb-article """## How it works
-
-Container images are standalone collections of the executable code and
-content that are used to populate a container environment.
-They are usually created by either building a container from scratch or by
-building on top of an existing image pulled from a repository.
-
-Throughout the container build workflow,
-images should be scanned to identify:
-
-- outdated libraries,
-- known vulnerabilities,
-- or misconfigurations, such as insecure ports or permissions.
-
-Scanning should also provide the flexibility to disregard false positives
-for vulnerability detection where knowledgeable
-cybersecurity professionals have deemed alerts to be inaccurate.
-
-One approach to implementing image scanning is to use an admission controller
-to block deployments if the image does not comply with the organization's
-security policies.
-
-An admission controller is a Container Orchestration feature that can intercept and
-process requests to the Container Orchestration API prior to persistence of the object,
-but after the request is authenticated and authorized.
-A webhook can be implemented to scan any image before it is deployed in the orchestrator.
-This admission controller
-
-## Considerations
-
-* Image scanning is key to ensuring deployed containers are secure.
-* Using trusted repositories to build containers is a critical part of the container build workflow.
-* This technique does not necessarly prevent the build process to add insecure or unsecured
- files to the Image.
-""" ;
- :kb-reference :Reference-ContainerImageAnalysis ;
- :synonym "Container Image Scanning" .
-
-:ContainerOrchestrationSoftware a owl:Class ;
- rdfs:label "Container Orchestration Software" ;
- rdfs:subClassOf :ServiceApplication,
- [ a owl:Restriction ;
- owl:onProperty :manages ;
- owl:someValuesFrom :ContainerProcess ] ;
- :definition "A d3f:Software which manages and coordinates running one or more d3f:ContainerProcess." .
-
-:ContainerProcess a owl:Class ;
- rdfs:label "Container Process" ;
- rdfs:subClassOf :ApplicationProcess ;
- :definition "A running instance of a container image." ;
- rdfs:seeAlso :ContainerImage,
- .
-
-:ContainerRuntime a owl:Class ;
- rdfs:label "Container Runtime" ;
- rdfs:subClassOf :ServiceApplication,
- [ a owl:Restriction ;
- owl:onProperty :runs ;
- owl:someValuesFrom :ContainerImage ] ;
- :definition "A software layer between a container process and a kernel which often mediates the invocation of a system call." ;
- rdfs:seeAlso :ContainerProcess,
- :Kernel,
- :SystemCall .
-
-:ContentExcision a :ContentExcision,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Excision" ;
- rdfs:subClassOf :ContentModification ;
- :d3fend-id "D3-CNE" ;
- :definition "Removing specific, potentially malicious, parts of content" ;
- :kb-article """## How it works
-
-If malicious or unecessary elements is discovered within the content, or if a specific embedded portion does not comply with policy, it may be removed to ensure safety.""" ;
- :kb-reference :Reference-MethodForContentDisarmandReconstruction_OPSWATInc .
-
-:ContentFiltering a :ContentFiltering,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Filtering" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Isolate ],
- [ a owl:Restriction ;
- owl:onProperty :enforces ;
- owl:someValuesFrom :ContentPolicy ],
- [ a owl:Restriction ;
- owl:onProperty :filters ;
- owl:someValuesFrom :File ] ;
- :d3fend-id "D3-CF" ;
- :definition "Content Filtering techniques aid in the process of analyzing an input file for malicious or erroneous content and outputing a sanitized version." ;
- :kb-reference :Reference-MethodForContentDisarmandReconstruction_OPSWATInc .
-
-:ContentFormatConversion a :ContentFormatConversion,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Format Conversion" ;
- rdfs:subClassOf :ContentModification ;
- :d3fend-id "D3-CFC" ;
- :definition "Content format conversion is mechanical transformation from one format to another which may be normalization or specifically flattening." ;
- :kb-article """## How it works
-
-This technique may enhance security by transforming files into safer or normalized formats.""" ;
- :kb-reference :Reference-MethodForContentDisarmandReconstruction_OPSWATInc .
-
-:ContentModification a :ContentModification,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Modification" ;
- rdfs:subClassOf :ContentFiltering,
- [ a owl:Restriction ;
- owl:onProperty :filters ;
- owl:someValuesFrom :DigitalMedia ],
- [ a owl:Restriction ;
- owl:onProperty :filters ;
- owl:someValuesFrom :FileContentBlock ],
- [ a owl:Restriction ;
- owl:onProperty :filters ;
- owl:someValuesFrom :FileMetadata ],
- [ a owl:Restriction ;
- owl:onProperty :modifies ;
- owl:someValuesFrom :File ] ;
- :d3fend-id "D3-CM" ;
- :definition "Modify content that does not comply with policy." ;
- :kb-article """## How it works
-
-When content is found to not comply with it's content policy, it may be transformed to a safer state by modifying it.""" ;
- :kb-reference :Reference-MethodForContentDisarmandReconstruction_OPSWATInc .
-
-:ContentPolicy a owl:Class ;
- rdfs:label "Content Policy" ;
- rdfs:subClassOf :DigitalInformationBearer ;
- :definition "A set of rules and guidelines that dictate the acceptable use, distribution, and management of digital content within a system or platform. It defines what content is allowed, restricted, or prohibited, ensuring compliance with legal, ethical, and organizational standards." .
-
-:ContentQuarantine a :ContentQuarantine,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Quarantine" ;
- rdfs:subClassOf :ContentFiltering,
- [ a owl:Restriction ;
- owl:onProperty :quarantines ;
- owl:someValuesFrom :DatabaseRecord ],
- [ a owl:Restriction ;
- owl:onProperty :quarantines ;
- owl:someValuesFrom :File ] ;
- :d3fend-id "D3-CQ" ;
- :definition "Transfer content that does not comply with policy to a quarantine zone." ;
- :kb-article """## How it works
-
-Quarantining serves as a protective measure to isolate potentially harmful files or elements until they can be safely analyzed or processed.""" ;
- :kb-reference :Reference-MethodForContentDisarmandReconstruction_OPSWATInc .
-
-:ContentRebuild a :ContentRebuild,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Rebuild" ;
- rdfs:subClassOf :ContentModification ;
- :d3fend-id "D3-CNR" ;
- :definition "Rebuild the file according to the spec so any unreferenced components or objects are removed." ;
- :kb-article """## How it works
-
-If inputted content is divided up into components for further scrutiny, the components may be combined back afterwards in a safer state.""" ;
- :kb-reference :Reference-MethodForContentDisarmandReconstruction_OPSWATInc ;
- :synonym "Content Reconstruction" .
-
-:ContentSubstitution a :ContentSubstitution,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Substitution" ;
- rdfs:subClassOf :ContentModification ;
- :d3fend-id "D3-CNS" ;
- :definition "Modifies specific digital content information by replacing it with something else." ;
- :kb-article """## How it works
-
-If malicious or unecessary elements is discovered within the content, or if a specific embedded portion does not comply with policy, it may be replaced with alternatives to ensure safety.""" ;
- :kb-reference :Reference-MethodForContentDisarmandReconstruction_OPSWATInc .
-
-:ContentValidation a :ContentValidation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Content Validation" ;
- rdfs:subClassOf :ContentFiltering ;
- :d3fend-id "D3-CV" ;
- :definition "Verify and validate contents complies with policy" ;
- :kb-article """## How it works
-
-To ensure that content is safe, it's composition must be validated according to its content policy.""" ;
- :kb-reference :Reference-FileSecurityUsingFileFormatValidation_OPSWATInc .
-
-:ControlCatalog a owl:Class ;
- rdfs:label "Control Catalog" ;
- rdfs:subClassOf :ExternalControlThing,
- [ a owl:Restriction ;
- owl:onProperty :has-member ;
- owl:someValuesFrom :ExternalControl ],
- [ a owl:Restriction ;
- owl:onProperty :version ;
- owl:someValuesFrom [ a rdfs:Datatype ;
- owl:unionOf (
- xsd:integer
- xsd:string ) ] ] ;
- :definition "A control catalog is a complete list of protective measures for systems, organizations, or individuals for subject domains (e.g., security and privacy.)" ;
- rdfs:seeAlso .
-
-:ControlCorrelationIdentifierCatalog a owl:Class ;
- rdfs:label "Control Correlation Identifier Catalog" ;
- rdfs:subClassOf :ControlCatalog,
- [ a owl:Restriction ;
- owl:onProperty :has-member ;
- owl:someValuesFrom :CCIControl ] ;
- :definition "A control correlation identifier (CCI) catalog provides a catalog of CCIs for a given release date." ;
- rdfs:seeAlso .
-
-:ConvolutionalNeuralNetwork a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Convolutional Neural Network" ;
- rdfs:subClassOf :DeepNeuralNetClassification ;
- :d3fend-id "D3A-CNN" ;
- :definition "A class of artificial neural network most commonly applied to analyze visual imagery.CNNs use a mathematical operation called convolution in place of general matrix multiplication in at least one of their layers." ;
- :kb-article """## References
-Wikipedia. (n.d.). Convolutional neural network. [Link](https://en.wikipedia.org/wiki/Convolutional_neural_network)""" .
-
-:CopyMemoryFunction a owl:Class ;
- rdfs:label "Copy Memory Function" ;
- rdfs:subClassOf :Subroutine,
- [ a owl:Restriction ;
- owl:onProperty :copies ;
- owl:someValuesFrom :MemoryBlock ] ;
- :definition "Copies a memory block from one location to another." .
-
-:CopyToken a owl:Class,
- owl:NamedIndividual,
- :SystemCall ;
- rdfs:label "Copy Token" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :copies ;
- owl:someValuesFrom :AccessToken ] .
-
-:Correlation a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Correlation" ;
- rdfs:subClassOf :DescriptiveStatistics ;
- :d3fend-id "D3A-COR" ;
- :definition "Correlation is the degree to which two or more quantities are linearly associated." ;
- :kb-article "Wolfram MathWorld. (n.d.). Correlation. [Link](https://mathworld.wolfram.com/Correlation.html)" .
-
-:CorrelationClustering a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Correlation Clustering" ;
- rdfs:subClassOf :High-dimensionClustering ;
- :d3fend-id "D3A-CC" ;
- :definition "Correlation clustering provides a method for clustering a set of objects into the optimum number of clusters without specifying that number in advance." ;
- :kb-article """## References
-Wikipedia. (n.d.). Correlation clustering. [Link](https://en.wikipedia.org/wiki/Correlation_clustering)""" .
-
-:CramersV a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Cramer's V" ;
- rdfs:subClassOf :Correlation ;
- :d3fend-id "D3A-CV" ;
- :definition "Cramér's V (sometimes referred to as Cramér's phi and denoted as φc) is a measure of association between two nominal variables, giving a value between 0 and +1 (inclusive) and is based on Pearson's chi-squared statistic." ;
- :kb-article """## References
-Wikipedia. (n.d.). Cramér's V. [Link](https://en.wikipedia.org/wiki/Cram%C3%A9r%27s_V)""" ;
- :synonym "Cramer's Phi" .
-
-:CreateFile a owl:Class ;
- rdfs:label "Create File" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :creates ;
- owl:someValuesFrom :File ] ;
- :definition "System call to create a new file on a file system. Some operating systems implement this functionality as part of their d3f:OpenFile system call." ;
- rdfs:seeAlso ,
- ,
- ,
- .
-
-:CreateProcess a owl:Class ;
- rdfs:label "Create Process" ;
- skos:altLabel "Execute Process",
- "Process Spawn",
- "Spawn Process" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :executes ;
- owl:someValuesFrom :Process ] ;
- :definition "A process spawn refers to a function that loads and executes a new child process.The current process may wait for the child to terminate or may continue to execute asynchronously. Creating a new subprocess requires enough memory in which both the child process and the current program can execute. There is a family of spawn functions in DOS, inherited by Microsoft Windows. There is also a different family of spawn functions in an optional extension of the POSIX standards. Fork-exec is another technique combining two Unix system calls, which can effect a process spawn.",
- "Creates a process.",
- "Executes a process." ;
- rdfs:seeAlso ,
- ,
- ,
- ,
- ,
- .
-
-:CreateSocket a owl:Class ;
- rdfs:label "Create Socket" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :creates ;
- owl:someValuesFrom :Pipe ] ;
- :definition "A create socket system call creates an endpoint for communication and returns a file descriptor that refers to that endpoint." ;
- rdfs:seeAlso .
-
-:CreateThread a owl:Class ;
- rdfs:label "Create Thread" ;
- rdfs:subClassOf :SystemCall,
- [ a owl:Restriction ;
- owl:onProperty :creates ;
- owl:someValuesFrom :Thread ] ;
- :definition "Threads are an execution model that exists independently from a language, as well as a parallel execution model. They enable a program to control multiple different flows of work that overlap in time." ;
- rdfs:seeAlso ,
- .
-
-:Credential a owl:Class ;
- rdfs:label "Credential" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :authenticates ;
- owl:someValuesFrom :UserAccount ] ;
- rdfs:isDefinedBy ;
- :definition "A credential is a physical/tangible object, a piece of knowledge, or a facet of a person's physical being that enables an individual access to a given physical facility or computer-based information system. Typically, credentials can be something a person knows (such as a number or PIN), something they have (such as an access badge), something they are (such as a biometric feature), something they do (measurable behavioral patterns) or some combination of these items. This is known as multi-factor authentication. The typical credential is an access card or key-fob, and newer software can also turn users' smartphones into access devices." ;
- rdfs:seeAlso .
-
-:CredentialAccessTechnique a owl:Class ;
- rdfs:label "Credential Access Technique" ;
- rdfs:subClassOf :ATTACKEnterpriseTechnique,
- :OffensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :accesses ;
- owl:someValuesFrom :Credential ],
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :TA0006 ],
- [ a owl:Restriction ;
- owl:onProperty :may-access ;
- owl:someValuesFrom :PasswordFile ],
- [ a owl:Restriction ;
- owl:onProperty :may-invoke ;
- owl:someValuesFrom :CreateProcess ] .
-
-:CredentialCompromiseScopeAnalysis a :CredentialCompromiseScopeAnalysis,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Credential Compromise Scope Analysis" ;
- rdfs:subClassOf :UserBehaviorAnalysis,
- [ a owl:Restriction ;
- owl:onProperty :analyzes ;
- owl:someValuesFrom :Credential ] ;
- :d3fend-id "D3-CCSA" ;
- :definition "Determining which credentials may have been compromised by analyzing the user logon history of a particular system." ;
- :kb-article """## How it works
-
-#### Memory
-Credentials may be stored in memory for a variety of reasons; on Windows, they may be stored in lsass.exe. Once a credential dumper like mimikatz runs and dumps the memory of lsass.exe, the credentials of every account logged on since boot are potentially compromised.
-When such an event occurs, this analytic will give the forensic context to identify compromised users. Those users could potentially be used in later events for additional logons.
-
-
-#### Hard disk
-Operating System may cache a certain number of credentials onto the hard disk to use as a source of truth if it cannot contact the credential server. In many versions of Microsoft Windows, the 10 most recent are cached by default; this setting can be changed in the Microsoft Management Console's Local Security Policy: ```Computer Configuration -> Windows Settings -> Local Policy -> Security Options -> Interactive Logon: Number of previous logons to cache -> 0``` Here we are not concerned with the alteration of the credentials but the fact that they might be read. If the attacker has physical access to the machine they are unlikely to be stopped from reading files on the filesystem.
-"In the event that the domain controller is unavailable Windows will check the last password hashes that has been cached in order to authenticate the user with the system. These password hashes are cached in the following registry setting:
-HKEY_LOCAL_MACHINE\\SECURITY\\Cache
-Mimikatz can retrieve these hashes if the following command is executed:
-lsadump::cache" [1]
-
-The Registry Hive, HKEY_LOCAL_MACHINE\\SAM, which is stored in the supporting files %systemroot%\\System32\\Config\\{Sam,sam.log,sam.sav}, contains the SAM file.
-
-DC: This is stored in %systemroot%\\ntds\\ntds.dit. (https://www.ultimatewindowssecurity.com/blog/default.aspx?d=10/2017)
-
-Sometimes memory, which contains credentials, could get on the hard disk. Like with hiberfil.sys in Windows. Equivalent on Linux
-
-
-In Linux, an attacker could read the /etc/shadow file.
-
-Reading from /proc directory: mimipenguin, many others.
-
-## Considerations
-Effective implementation requires identifying any location that could end up containing credentials, and detecting an method of potential access to a source of credential data.
-
-1. https://medium.com/blue-team/preventing-mimikatz-attacks-ed283e7ebdd5""" ;
- :kb-reference :Reference-AllLoginsSinceLastBoot_MITRE,
- :Reference-SystemsAndMethodsForDetectingCredentialTheft_SymantecCorp .
-
-:CredentialEviction a :CredentialEviction,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Credential Eviction" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Evict ] ;
- :d3fend-id "D3-CE" ;
- :definition "Credential Eviction techniques disable or remove compromised credentials from a computer network." ;
- :kb-reference :Reference-AccountMonitoring_ForescoutTechnologies .
-
-:CredentialHardening a :CredentialHardening,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Credential Hardening" ;
- rdfs:subClassOf :DefensiveTechnique,
- [ a owl:Restriction ;
- owl:onProperty :enables ;
- owl:someValuesFrom :Harden ],
- [ a owl:Restriction ;
- owl:onProperty :hardens ;
- owl:someValuesFrom :Credential ] ;
- :d3fend-id "D3-CH" ;
- :definition "Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials." ;
- :enables :Harden .
-
-:CredentialManagementSystem a owl:Class ;
- rdfs:label "Credential Management System" ;
- rdfs:subClassOf :ServiceApplication,
- [ a owl:Restriction ;
- owl:onProperty :manages ;
- owl:someValuesFrom :Credential ] ;
- rdfs:isDefinedBy ;
- :definition "Credential Management, also referred to as a Credential Management System (CMS), is an established form of software that is used for issuing and managing credentials as part of public key infrastructure (PKI)." .
-
-:CredentialRevocation a :CredentialRevocation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Credential Revocation" ;
- rdfs:subClassOf :CredentialEviction,
- [ a owl:Restriction ;
- owl:onProperty :deletes ;
- owl:someValuesFrom :Credential ] ;
- :d3fend-id "D3-CR" ;
- :definition "Deleting a set of credentials permanently to prevent them from being used to authenticate." ;
- :kb-article """## How it works
-
-Management servers with enterprise policies for account management provide the ability remove permissions, accounts, or credentials. Compromised credentials should be revoked to prevent further malicious activity.""" ;
- :kb-reference :Reference-RevokingaPreviouslyIssuedVerifiableCredential-Microsoft .
-
-:CredentialRotation a :CredentialRotation,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Credential Rotation" ;
- rdfs:subClassOf :CredentialHardening,
- [ a owl:Restriction ;
- owl:onProperty :regenerates ;
- owl:someValuesFrom :Credential ] ;
- :d3fend-id "D3-CRO" ;
- :definition "Credential rotation is a security procedure in which authentication credentials, such as passwords, API keys, or certificates, are regularly changed or replaced to minimize the risk of unauthorized access." ;
- :kb-article """## How it works
-
-Credentials can be systematically changed at predetermined intervals or based on specific events. Credentials such as user passwords may be rotated manually, but it is increasingly common to use an automated system to manage rotation of enterprise passwords, certificates and keys.
-
-## Considerations
-
-- Rotation of credentials must be managed carefully to avoid inadvertent service interruption
-- Management servers with enterprise policies for account management provide the ability to change or reset passwords for accounts. Some organizations rotate credentials periodically to limit the risk of stolen credentials.
-- When responding to an incident, severity of compromise should be considered to determine what credentials to what accounts should be regenerated
-- If proactively rotating credentials periodically, several factors should be considered to determine the frequency. Also introduces some risk including promoting the creation of weak passwords and poor storage practices for employees and presents challenges in proper tracking.""" ;
- :kb-reference ,
- :Reference-PasswordandKeyRotation-SSH ;
- rdfs:seeAlso .
-
-:CredentialScrubbing a :CredentialScrubbing,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Credential Scrubbing" ;
- rdfs:subClassOf :SourceCodeHardening,
- [ a owl:Restriction ;
- owl:onProperty :hardens ;
- owl:someValuesFrom :Subroutine ] ;
- :d3fend-id "D3-CS" ;
- :definition "The systematic removal of hard-coded credentials from source code to prevent accidental exposure and unauthorized access." ;
- :kb-article """## How it Works
-Credential Scrubbing involves identifying and eliminating hard-coded credentials such as usernames, passwords, API keys, and tokens from source code repositories. These credentials should be managed securely using environment variables, secret management tools, or secure vaults where they can be safely accessed when needed.
-
-## Considerations
-* Developers should conduct regular audits of source code to ensure credentials are not hard-coded.
-* Exposed credentials found in version control history must be disabled and replaced promptly.
-* Adopt role-based access controls and credential rotation policies to minimize security risks.""" ;
- :kb-reference :Reference-SecretsManagementCheatSheet-OWASP ;
- rdfs:seeAlso :CWE-798,
- .
-
-:CredentialTransmissionScoping a :CredentialTransmissionScoping,
- owl:Class,
- owl:NamedIndividual ;
- rdfs:label "Credential Transmission Scoping" ;
- rdfs:subClassOf :AccessMediation,
- [ a owl:Restriction ;
- owl:onProperty :isolates ;
- owl:someValuesFrom :Credential ] ;
- :d3fend-id "D3-CTS" ;
- :definition "Limiting the transmission of a credential to a scoped set of relying parties." ;
- :kb-reference :Reference-WebAuthentication_AnAPIForAccessingPublicKeyCredentialsLevel2 ;
- rdfs:seeAlso ,
- ;
- :synonym "Phishing Resistant Authentication" .
-
-:CryptographicKey a owl:Class ;
- rdfs:label "Cryptographic Key" ;
- rdfs:subClassOf :DigitalInformation ;
- rdfs:isDefinedBy ;
- :definition "In cryptography, a key is a piece of information (a parameter) that determines the functional output of a cryptographic algorithm. For encryption algorithms, a key specifies the transformation of plaintext into ciphertext, and vice versa for decryption algorithms. Keys also specify transformations in other cryptographic algorithms, such as digital signature schemes and message authentication codes." .
-
-:CustomArchiveFile a owl:Class ;
- rdfs:label "Custom Archive File" ;
- rdfs:subClassOf :ArchiveFile ;
- :definition "A custom archive file is an archive file conforming to a custom format; that is, an archive file that does not conform to a common standard." .
-
-:CWE-5 a owl:Class ;
- rdfs:label "J2EE Misconfiguration: Data Transmission Without Encryption" ;
- rdfs:subClassOf :CWE-319 ;
- :cwe-id "CWE-5" ;
- :definition "Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted." .
-
-:CWE-6 a owl:Class ;
- rdfs:label "J2EE Misconfiguration: Insufficient Session-ID Length" ;
- rdfs:subClassOf :CWE-334 ;
- :cwe-id "CWE-6" ;
- :definition "The J2EE application is configured to use an insufficient session ID length." .
-
-:CWE-7 a owl:Class ;
- rdfs:label "J2EE Misconfiguration: Missing Custom Error Page" ;
- rdfs:subClassOf :CWE-756 ;
- :cwe-id "CWE-7" ;
- :definition "The default error page of a web application should not display sensitive information about the product." .
-
-:CWE-8 a owl:Class ;
- rdfs:label "J2EE Misconfiguration: Entity Bean Declared Remote" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-8" ;
- :definition "When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities." .
-
-:CWE-9 a owl:Class ;
- rdfs:label "J2EE Misconfiguration: Weak Access Permissions for EJB Methods" ;
- rdfs:subClassOf :CWE-266 ;
- :cwe-id "CWE-9" ;
- :definition "If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product." .
-
-:CWE-11 a owl:Class ;
- rdfs:label "ASP.NET Misconfiguration: Creating Debug Binary" ;
- rdfs:subClassOf :CWE-489 ;
- :cwe-id "CWE-11" ;
- :definition "Debugging messages help attackers learn about the system and plan a form of attack." .
-
-:CWE-12 a owl:Class ;
- rdfs:label "ASP.NET Misconfiguration: Missing Custom Error Page" ;
- rdfs:subClassOf :CWE-756 ;
- :cwe-id "CWE-12" ;
- :definition "An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses." .
-
-:CWE-13 a owl:Class ;
- rdfs:label "ASP.NET Misconfiguration: Password in Configuration File" ;
- rdfs:subClassOf :CWE-260 ;
- :cwe-id "CWE-13" ;
- :definition "Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers." .
-
-:CWE-14 a owl:Class ;
- rdfs:label "Compiler Removal of Code to Clear Buffers" ;
- rdfs:subClassOf :CWE-733 ;
- :cwe-id "CWE-14" ;
- :definition "Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka \"dead store removal.\"" .
-
-:CWE-15 a owl:Class ;
- rdfs:label "External Control of System or Configuration Setting" ;
- rdfs:subClassOf :CWE-610,
- :CWE-642 ;
- :cwe-id "CWE-15" ;
- :definition "One or more system settings or configuration elements can be externally controlled by a user." .
-
-:CWE-20 a owl:Class ;
- rdfs:label "Improper Input Validation" ;
- rdfs:subClassOf :CWE-707,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-20" ;
- :definition "The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly." .
-
-:CWE-22 a owl:Class ;
- rdfs:label "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" ;
- rdfs:subClassOf :CWE-668,
- :CWE-706,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-22" ;
- :definition "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory." ;
- :synonym "Directory traversal",
- "Path traversal" .
-
-:CWE-23 a owl:Class ;
- rdfs:label "Relative Path Traversal" ;
- rdfs:subClassOf :CWE-22 ;
- :cwe-id "CWE-23" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as \"..\" that can resolve to a location that is outside of that directory." ;
- :synonym "Zip Slip" .
-
-:CWE-24 a owl:Class ;
- rdfs:label "Path Traversal: '../filedir'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-24" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize \"../\" sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-25 a owl:Class ;
- rdfs:label "Path Traversal: '/../filedir'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-25" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize \"/../\" sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-26 a owl:Class ;
- rdfs:label "Path Traversal: '/dir/../filename'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-26" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize \"/dir/../filename\" sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-27 a owl:Class ;
- rdfs:label "Path Traversal: 'dir/../../filename'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-27" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal \"../\" sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-28 a owl:Class ;
- rdfs:label "Path Traversal: '..\\filedir'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-28" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize \"..\\\" sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-29 a owl:Class ;
- rdfs:label "Path Traversal: '\\..\\filename'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-29" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\..\\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-30 a owl:Class ;
- rdfs:label "Path Traversal: '\\dir\\..\\filename'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-30" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\dir\\..\\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-31 a owl:Class ;
- rdfs:label "Path Traversal: 'dir\\..\\..\\filename'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-31" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\\..\\..\\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-32 a owl:Class ;
- rdfs:label "Path Traversal: '...' (Triple Dot)" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-32" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '...' (triple dot) sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-33 a owl:Class ;
- rdfs:label "Path Traversal: '....' (Multiple Dot)" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-33" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....' (multiple dot) sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-34 a owl:Class ;
- rdfs:label "Path Traversal: '....//'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-34" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-35 a owl:Class ;
- rdfs:label "Path Traversal: '.../...//'" ;
- rdfs:subClassOf :CWE-23 ;
- :cwe-id "CWE-35" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory." .
-
-:CWE-36 a owl:Class ;
- rdfs:label "Absolute Path Traversal" ;
- rdfs:subClassOf :CWE-22 ;
- :cwe-id "CWE-36" ;
- :definition "The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as \"/abs/path\" that can resolve to a location that is outside of that directory." .
-
-:CWE-37 a owl:Class ;
- rdfs:label "Path Traversal: '/absolute/pathname/here'" ;
- rdfs:subClassOf :CWE-36,
- :CWE-160 ;
- :cwe-id "CWE-37" ;
- :definition "The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-38 a owl:Class ;
- rdfs:label "Path Traversal: '\\absolute\\pathname\\here'" ;
- rdfs:subClassOf :CWE-36 ;
- :cwe-id "CWE-38" ;
- :definition "The product accepts input in the form of a backslash absolute path ('\\absolute\\pathname\\here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-39 a owl:Class ;
- rdfs:label "Path Traversal: 'C:dirname'" ;
- rdfs:subClassOf :CWE-36 ;
- :cwe-id "CWE-39" ;
- :definition "The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially redirects access to an unintended location or arbitrary file." .
-
-:CWE-40 a owl:Class ;
- rdfs:label "Path Traversal: '\\\\UNC\\share\\name\\' (Windows UNC Share)" ;
- rdfs:subClassOf :CWE-36 ;
- :cwe-id "CWE-40" ;
- :definition "The product accepts input that identifies a Windows UNC share ('\\\\UNC\\share\\name') that potentially redirects access to an unintended location or arbitrary file." .
-
-:CWE-41 a owl:Class ;
- rdfs:label "Improper Resolution of Path Equivalence" ;
- rdfs:subClassOf :CWE-706 ;
- :cwe-id "CWE-41" ;
- :definition "The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object." .
-
-:CWE-42 a owl:Class ;
- rdfs:label "Path Equivalence: 'filename.' (Trailing Dot)" ;
- rdfs:subClassOf :CWE-41,
- :CWE-162 ;
- :cwe-id "CWE-42" ;
- :definition "The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-43 a owl:Class ;
- rdfs:label "Path Equivalence: 'filename....' (Multiple Trailing Dot)" ;
- rdfs:subClassOf :CWE-42,
- :CWE-163 ;
- :cwe-id "CWE-43" ;
- :definition "The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-44 a owl:Class ;
- rdfs:label "Path Equivalence: 'file.name' (Internal Dot)" ;
- rdfs:subClassOf :CWE-41 ;
- :cwe-id "CWE-44" ;
- :definition "The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-45 a owl:Class ;
- rdfs:label "Path Equivalence: 'file...name' (Multiple Internal Dot)" ;
- rdfs:subClassOf :CWE-44,
- :CWE-165 ;
- :cwe-id "CWE-45" ;
- :definition "The product accepts path input in the form of multiple internal dot ('file...dir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-46 a owl:Class ;
- rdfs:label "Path Equivalence: 'filename ' (Trailing Space)" ;
- rdfs:subClassOf :CWE-41,
- :CWE-162 ;
- :cwe-id "CWE-46" ;
- :definition "The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-47 a owl:Class ;
- rdfs:label "Path Equivalence: ' filename' (Leading Space)" ;
- rdfs:subClassOf :CWE-41 ;
- :cwe-id "CWE-47" ;
- :definition "The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-48 a owl:Class ;
- rdfs:label "Path Equivalence: 'file name' (Internal Whitespace)" ;
- rdfs:subClassOf :CWE-41 ;
- :cwe-id "CWE-48" ;
- :definition "The product accepts path input in the form of internal space ('file(SPACE)name') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-49 a owl:Class ;
- rdfs:label "Path Equivalence: 'filename/' (Trailing Slash)" ;
- rdfs:subClassOf :CWE-41,
- :CWE-162 ;
- :cwe-id "CWE-49" ;
- :definition "The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-50 a owl:Class ;
- rdfs:label "Path Equivalence: '//multiple/leading/slash'" ;
- rdfs:subClassOf :CWE-41,
- :CWE-161 ;
- :cwe-id "CWE-50" ;
- :definition "The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-51 a owl:Class ;
- rdfs:label "Path Equivalence: '/multiple//internal/slash'" ;
- rdfs:subClassOf :CWE-41 ;
- :cwe-id "CWE-51" ;
- :definition "The product accepts path input in the form of multiple internal slash ('/multiple//internal/slash/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-52 a owl:Class ;
- rdfs:label "Path Equivalence: '/multiple/trailing/slash//'" ;
- rdfs:subClassOf :CWE-41,
- :CWE-163 ;
- :cwe-id "CWE-52" ;
- :definition "The product accepts path input in the form of multiple trailing slash ('/multiple/trailing/slash//') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-53 a owl:Class ;
- rdfs:label "Path Equivalence: '\\multiple\\\\internal\\backslash'" ;
- rdfs:subClassOf :CWE-41,
- :CWE-165 ;
- :cwe-id "CWE-53" ;
- :definition "The product accepts path input in the form of multiple internal backslash ('\\multiple\\trailing\\\\slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-54 a owl:Class ;
- rdfs:label "Path Equivalence: 'filedir\\' (Trailing Backslash)" ;
- rdfs:subClassOf :CWE-41,
- :CWE-162 ;
- :cwe-id "CWE-54" ;
- :definition "The product accepts path input in the form of trailing backslash ('filedir\\') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-55 a owl:Class ;
- rdfs:label "Path Equivalence: '/./' (Single Dot Directory)" ;
- rdfs:subClassOf :CWE-41 ;
- :cwe-id "CWE-55" ;
- :definition "The product accepts path input in the form of single dot directory exploit ('/./') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-56 a owl:Class ;
- rdfs:label "Path Equivalence: 'filedir*' (Wildcard)" ;
- rdfs:subClassOf :CWE-41,
- :CWE-155 ;
- :cwe-id "CWE-56" ;
- :definition "The product accepts path input in the form of asterisk wildcard ('filedir*') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files." .
-
-:CWE-57 a owl:Class ;
- rdfs:label "Path Equivalence: 'fakedir/../realdir/filename'" ;
- rdfs:subClassOf :CWE-41 ;
- :cwe-id "CWE-57" ;
- :definition "The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file." .
-
-:CWE-58 a owl:Class ;
- rdfs:label "Path Equivalence: Windows 8.3 Filename" ;
- rdfs:subClassOf :CWE-41 ;
- :cwe-id "CWE-58" ;
- :definition "The product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short \"8.3\" filename." .
-
-:CWE-59 a owl:Class ;
- rdfs:label "Improper Link Resolution Before File Access ('Link Following')" ;
- rdfs:subClassOf :CWE-706 ;
- :cwe-id "CWE-59" ;
- :definition "The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource." ;
- :synonym "insecure temporary file",
- "Zip Slip" .
-
-:CWE-61 a owl:Class ;
- rdfs:label "UNIX Symbolic Link (Symlink) Following" ;
- rdfs:subClassOf :CWE-59 ;
- :cwe-id "CWE-61" ;
- :definition "The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files." ;
- :synonym "Symlink following",
- "symlink vulnerability" .
-
-:CWE-62 a owl:Class ;
- rdfs:label "UNIX Hard Link" ;
- rdfs:subClassOf :CWE-59 ;
- :cwe-id "CWE-62" ;
- :definition "The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files." .
-
-:CWE-64 a owl:Class ;
- rdfs:label "Windows Shortcut Following (.LNK)" ;
- rdfs:subClassOf :CWE-59 ;
- :cwe-id "CWE-64" ;
- :definition "The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files." ;
- :synonym "symlink",
- "Windows symbolic link following" .
-
-:CWE-65 a owl:Class ;
- rdfs:label "Windows Hard Link" ;
- rdfs:subClassOf :CWE-59 ;
- :cwe-id "CWE-65" ;
- :definition "The product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files." .
-
-:CWE-66 a owl:Class ;
- rdfs:label "Improper Handling of File Names that Identify Virtual Resources" ;
- rdfs:subClassOf :CWE-706 ;
- :cwe-id "CWE-66" ;
- :definition "The product does not handle or incorrectly handles a file name that identifies a \"virtual\" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file." .
-
-:CWE-67 a owl:Class ;
- rdfs:label "Improper Handling of Windows Device Names" ;
- rdfs:subClassOf :CWE-66 ;
- :cwe-id "CWE-67" ;
- :definition "The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file." .
-
-:CWE-69 a owl:Class ;
- rdfs:label "Improper Handling of Windows ::DATA Alternate Data Stream" ;
- rdfs:subClassOf :CWE-66 ;
- :cwe-id "CWE-69" ;
- :definition "The product does not properly prevent access to, or detect usage of, alternate data streams (ADS)." .
-
-:CWE-72 a owl:Class ;
- rdfs:label "Improper Handling of Apple HFS+ Alternate Data Stream Path" ;
- rdfs:subClassOf :CWE-66 ;
- :cwe-id "CWE-72" ;
- :definition "The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system." .
-
-:CWE-73 a owl:Class ;
- rdfs:label "External Control of File Name or Path" ;
- rdfs:subClassOf :CWE-610,
- :CWE-642 ;
- :cwe-id "CWE-73" ;
- :definition "The product allows user input to control or influence paths or file names that are used in filesystem operations." .
-
-:CWE-74 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" ;
- rdfs:subClassOf :CWE-707 ;
- :cwe-id "CWE-74" ;
- :definition "The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component." .
-
-:CWE-75 a owl:Class ;
- rdfs:label "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)" ;
- rdfs:subClassOf :CWE-74 ;
- :cwe-id "CWE-75" ;
- :definition "The product does not adequately filter user-controlled input for special elements with control implications." .
-
-:CWE-76 a owl:Class ;
- rdfs:label "Improper Neutralization of Equivalent Special Elements" ;
- rdfs:subClassOf :CWE-75 ;
- :cwe-id "CWE-76" ;
- :definition "The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements." .
-
-:CWE-77 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements used in a Command ('Command Injection')" ;
- rdfs:subClassOf :CWE-74,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-77" ;
- :definition "The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component." ;
- :synonym "Command injection" .
-
-:CWE-78 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" ;
- rdfs:subClassOf :CWE-77,
- [ a owl:Restriction ;
- owl:onProperty :may-be-weakness-of ;
- owl:someValuesFrom :EvalFunction ],
- [ a owl:Restriction ;
- owl:onProperty :may-be-weakness-of ;
- owl:someValuesFrom :ProcessStartFunction ],
- [ a owl:Restriction ;
- owl:onProperty :may-be-weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-78" ;
- :definition "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component." ;
- :synonym "OS Command Injection",
- "Shell injection",
- "Shell metacharacters" .
-
-:CWE-79 a owl:Class ;
- rdfs:label "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" ;
- rdfs:subClassOf :CWE-74,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-79" ;
- :definition "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users." ;
- :synonym "CSS",
- "DOM-Based XSS / Type 0 XSS",
- "HTML Injection",
- "Reflected XSS / Non-Persistent XSS / Type 1 XSS",
- "Stored XSS / Persistent XSS / Type 2 XSS",
- "XSS" .
-
-:CWE-80 a owl:Class ;
- rdfs:label "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" ;
- rdfs:subClassOf :CWE-79 ;
- :cwe-id "CWE-80" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as \"<\", \">\", and \"&\" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages." .
-
-:CWE-81 a owl:Class ;
- rdfs:label "Improper Neutralization of Script in an Error Message Web Page" ;
- rdfs:subClassOf :CWE-79 ;
- :cwe-id "CWE-81" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page." .
-
-:CWE-82 a owl:Class ;
- rdfs:label "Improper Neutralization of Script in Attributes of IMG Tags in a Web Page" ;
- rdfs:subClassOf :CWE-83 ;
- :cwe-id "CWE-82" ;
- :definition "The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute." .
-
-:CWE-83 a owl:Class ;
- rdfs:label "Improper Neutralization of Script in Attributes in a Web Page" ;
- rdfs:subClassOf :CWE-79 ;
- :cwe-id "CWE-83" ;
- :definition "The product does not neutralize or incorrectly neutralizes \"javascript:\" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style." .
-
-:CWE-84 a owl:Class ;
- rdfs:label "Improper Neutralization of Encoded URI Schemes in a Web Page" ;
- rdfs:subClassOf :CWE-79 ;
- :cwe-id "CWE-84" ;
- :definition "The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings." .
-
-:CWE-85 a owl:Class ;
- rdfs:label "Doubled Character XSS Manipulations" ;
- rdfs:subClassOf :CWE-79 ;
- :cwe-id "CWE-85" ;
- :definition "The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters." .
-
-:CWE-86 a owl:Class ;
- rdfs:label "Improper Neutralization of Invalid Characters in Identifiers in Web Pages" ;
- rdfs:subClassOf :CWE-79,
- :CWE-436 ;
- :cwe-id "CWE-86" ;
- :definition "The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers." .
-
-:CWE-87 a owl:Class ;
- rdfs:label "Improper Neutralization of Alternate XSS Syntax" ;
- rdfs:subClassOf :CWE-79 ;
- :cwe-id "CWE-87" ;
- :definition "The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax." .
-
-:CWE-88 a owl:Class ;
- rdfs:label "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" ;
- rdfs:subClassOf :CWE-77 ;
- :cwe-id "CWE-88" ;
- :definition "The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string." .
-
-:CWE-89 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" ;
- rdfs:subClassOf :CWE-943,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-89" ;
- :definition "The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data." ;
- :synonym "SQL injection",
- "SQLi" .
-
-:CWE-90 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" ;
- rdfs:subClassOf :CWE-943 ;
- :cwe-id "CWE-90" ;
- :definition "The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component." .
-
-:CWE-91 a owl:Class ;
- rdfs:label "XML Injection (aka Blind XPath Injection)" ;
- rdfs:subClassOf :CWE-74 ;
- :cwe-id "CWE-91" ;
- :definition "The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system." .
-
-:CWE-93 a owl:Class ;
- rdfs:label "Improper Neutralization of CRLF Sequences ('CRLF Injection')" ;
- rdfs:subClassOf :CWE-74 ;
- :cwe-id "CWE-93" ;
- :definition "The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs." .
-
-:CWE-94 a owl:Class ;
- rdfs:label "Improper Control of Generation of Code ('Code Injection')" ;
- rdfs:subClassOf :CWE-74,
- :CWE-913,
- [ a owl:Restriction ;
- owl:onProperty :may-be-weakness-of ;
- owl:someValuesFrom :EvalFunction ],
- [ a owl:Restriction ;
- owl:onProperty :may-be-weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-94" ;
- :definition "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment." ;
- :synonym "Code Injection" .
-
-:CWE-95 a owl:Class ;
- rdfs:label "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" ;
- rdfs:subClassOf :CWE-94 ;
- :cwe-id "CWE-95" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. \"eval\")." .
-
-:CWE-96 a owl:Class ;
- rdfs:label "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')" ;
- rdfs:subClassOf :CWE-94 ;
- :cwe-id "CWE-96" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template." .
-
-:CWE-97 a owl:Class ;
- rdfs:label "Improper Neutralization of Server-Side Includes (SSI) Within a Web Page" ;
- rdfs:subClassOf :CWE-96 ;
- :cwe-id "CWE-97" ;
- :definition "The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive." .
-
-:CWE-98 a owl:Class ;
- rdfs:label "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')" ;
- rdfs:subClassOf :CWE-706,
- :CWE-829 ;
- :cwe-id "CWE-98" ;
- :definition "The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in \"require,\" \"include,\" or similar functions." ;
- :synonym "Local file inclusion",
- "Remote file include",
- "RFI" .
-
-:CWE-99 a owl:Class ;
- rdfs:label "Improper Control of Resource Identifiers ('Resource Injection')" ;
- rdfs:subClassOf :CWE-74 ;
- :cwe-id "CWE-99" ;
- :definition "The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control." ;
- :synonym "Insecure Direct Object Reference" .
-
-:CWE-102 a owl:Class ;
- rdfs:label "Struts: Duplicate Validation Forms" ;
- rdfs:subClassOf :CWE-694,
- :CWE-1173 ;
- :cwe-id "CWE-102" ;
- :definition "The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect." .
-
-:CWE-103 a owl:Class ;
- rdfs:label "Struts: Incomplete validate() Method Definition" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-103" ;
- :definition "The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate()." .
-
-:CWE-104 a owl:Class ;
- rdfs:label "Struts: Form Bean Does Not Extend Validation Class" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-104" ;
- :definition "If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation." .
-
-:CWE-105 a owl:Class ;
- rdfs:label "Struts: Form Field Without Validator" ;
- rdfs:subClassOf :CWE-1173 ;
- :cwe-id "CWE-105" ;
- :definition "The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation." .
-
-:CWE-106 a owl:Class ;
- rdfs:label "Struts: Plug-in Framework not in Use" ;
- rdfs:subClassOf :CWE-1173 ;
- :cwe-id "CWE-106" ;
- :definition "When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation." .
-
-:CWE-107 a owl:Class ;
- rdfs:label "Struts: Unused Validation Form" ;
- rdfs:subClassOf :CWE-1164 ;
- :cwe-id "CWE-107" ;
- :definition "An unused validation form indicates that validation logic is not up-to-date." .
-
-:CWE-108 a owl:Class ;
- rdfs:label "Struts: Unvalidated Action Form" ;
- rdfs:subClassOf :CWE-1173 ;
- :cwe-id "CWE-108" ;
- :definition "Every Action Form must have a corresponding validation form." .
-
-:CWE-109 a owl:Class ;
- rdfs:label "Struts: Validator Turned Off" ;
- rdfs:subClassOf :CWE-1173 ;
- :cwe-id "CWE-109" ;
- :definition "Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation." .
-
-:CWE-110 a owl:Class ;
- rdfs:label "Struts: Validator Without Form Field" ;
- rdfs:subClassOf :CWE-1164 ;
- :cwe-id "CWE-110" ;
- :definition "Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date." .
-
-:CWE-111 a owl:Class ;
- rdfs:label "Direct Use of Unsafe JNI" ;
- rdfs:subClassOf :CWE-695 ;
- :cwe-id "CWE-111" ;
- :definition "When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java." .
-
-:CWE-112 a owl:Class ;
- rdfs:label "Missing XML Validation" ;
- rdfs:subClassOf :CWE-1286 ;
- :cwe-id "CWE-112" ;
- :definition "The product accepts XML from an untrusted source but does not validate the XML against the proper schema." .
-
-:CWE-113 a owl:Class ;
- rdfs:label "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')" ;
- rdfs:subClassOf :CWE-93,
- :CWE-436 ;
- :cwe-id "CWE-113" ;
- :definition "The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers." ;
- :synonym "HTTP Request Splitting",
- "HTTP Response Splitting" .
-
-:CWE-114 a owl:Class ;
- rdfs:label "Process Control" ;
- rdfs:subClassOf :CWE-73 ;
- :cwe-id "CWE-114" ;
- :definition "Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker." .
-
-:CWE-115 a owl:Class ;
- rdfs:label "Misinterpretation of Input" ;
- rdfs:subClassOf :CWE-436 ;
- :cwe-id "CWE-115" ;
- :definition "The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion." .
-
-:CWE-116 a owl:Class ;
- rdfs:label "Improper Encoding or Escaping of Output" ;
- rdfs:subClassOf :CWE-707 ;
- :cwe-id "CWE-116" ;
- :definition "The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved." ;
- :synonym "Output Encoding",
- "Output Sanitization",
- "Output Validation" .
-
-:CWE-117 a owl:Class ;
- rdfs:label "Improper Output Neutralization for Logs" ;
- rdfs:subClassOf :CWE-116 ;
- :cwe-id "CWE-117" ;
- :definition "The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file." ;
- :synonym "Log forging" .
-
-:CWE-118 a owl:Class ;
- rdfs:label "Incorrect Access of Indexable Resource ('Range Error')" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-118" ;
- :definition "The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files." .
-
-:CWE-119 a owl:Class ;
- rdfs:label "Improper Restriction of Operations within the Bounds of a Memory Buffer" ;
- rdfs:subClassOf :CWE-118,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :RawMemoryAccessFunction ] ;
- :cwe-id "CWE-119" ;
- :definition "The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data." ;
- :synonym "Buffer Overflow",
- "buffer overrun",
- "memory safety" .
-
-:CWE-120 a owl:Class ;
- rdfs:label "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" ;
- rdfs:subClassOf :CWE-119,
- :CWE-787 ;
- :cwe-id "CWE-120" ;
- :definition "The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow." ;
- :synonym "Classic Buffer Overflow",
- "Unbounded Transfer" .
-
-:CWE-121 a owl:Class ;
- rdfs:label "Stack-based Buffer Overflow" ;
- rdfs:subClassOf :CWE-787,
- :CWE-788 ;
- :cwe-id "CWE-121" ;
- :definition "A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function)." ;
- :synonym "Stack Overflow" .
-
-:CWE-122 a owl:Class ;
- rdfs:label "Heap-based Buffer Overflow" ;
- rdfs:subClassOf :CWE-787,
- :CWE-788 ;
- :cwe-id "CWE-122" ;
- :definition "A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc()." .
-
-:CWE-123 a owl:Class ;
- rdfs:label "Write-what-where Condition" ;
- rdfs:subClassOf :CWE-787 ;
- :cwe-id "CWE-123" ;
- :definition "Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow." .
-
-:CWE-124 a owl:Class ;
- rdfs:label "Buffer Underwrite ('Buffer Underflow')" ;
- rdfs:subClassOf :CWE-786,
- :CWE-787 ;
- :cwe-id "CWE-124" ;
- :definition "The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer." ;
- :synonym "buffer underrun" .
-
-:CWE-125 a owl:Class ;
- rdfs:label "Out-of-bounds Read" ;
- rdfs:subClassOf :CWE-119,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :RawMemoryAccessFunction ] ;
- :cwe-id "CWE-125" ;
- :definition "The product reads data past the end, or before the beginning, of the intended buffer." ;
- :synonym "OOB read" .
-
-:CWE-126 a owl:Class ;
- rdfs:label "Buffer Over-read" ;
- rdfs:subClassOf :CWE-125,
- :CWE-788 ;
- :cwe-id "CWE-126" ;
- :definition "The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer." .
-
-:CWE-127 a owl:Class ;
- rdfs:label "Buffer Under-read" ;
- rdfs:subClassOf :CWE-125,
- :CWE-786 ;
- :cwe-id "CWE-127" ;
- :definition "The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer." .
-
-:CWE-128 a owl:Class ;
- rdfs:label "Wrap-around Error" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-128" ;
- :definition "Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore \"wraps around\" to a very small, negative, or undefined value." .
-
-:CWE-129 a owl:Class ;
- rdfs:label "Improper Validation of Array Index" ;
- rdfs:subClassOf :CWE-1285 ;
- :cwe-id "CWE-129" ;
- :definition "The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array." ;
- :synonym "array index underflow",
- "index-out-of-range",
- "out-of-bounds array index" .
-
-:CWE-130 a owl:Class ;
- rdfs:label "Improper Handling of Length Parameter Inconsistency" ;
- rdfs:subClassOf :CWE-240 ;
- :cwe-id "CWE-130" ;
- :definition "The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data." ;
- :synonym "length manipulation",
- "length tampering" .
-
-:CWE-131 a owl:Class ;
- rdfs:label "Incorrect Calculation of Buffer Size" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-131" ;
- :definition "The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow." .
-
-:CWE-134 a owl:Class ;
- rdfs:label "Use of Externally-Controlled Format String" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-134" ;
- :definition "The product uses a function that accepts a format string as an argument, but the format string originates from an external source." .
-
-:CWE-135 a owl:Class ;
- rdfs:label "Incorrect Calculation of Multi-Byte String Length" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-135" ;
- :definition "The product does not correctly calculate the length of strings that can contain wide or multi-byte characters." .
-
-:CWE-138 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements" ;
- rdfs:subClassOf :CWE-707 ;
- :cwe-id "CWE-138" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component." .
-
-:CWE-140 a owl:Class ;
- rdfs:label "Improper Neutralization of Delimiters" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-140" ;
- :definition "The product does not neutralize or incorrectly neutralizes delimiters." .
-
-:CWE-141 a owl:Class ;
- rdfs:label "Improper Neutralization of Parameter/Argument Delimiters" ;
- rdfs:subClassOf :CWE-140 ;
- :cwe-id "CWE-141" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component." .
-
-:CWE-142 a owl:Class ;
- rdfs:label "Improper Neutralization of Value Delimiters" ;
- rdfs:subClassOf :CWE-140 ;
- :cwe-id "CWE-142" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component." .
-
-:CWE-143 a owl:Class ;
- rdfs:label "Improper Neutralization of Record Delimiters" ;
- rdfs:subClassOf :CWE-140 ;
- :cwe-id "CWE-143" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component." .
-
-:CWE-144 a owl:Class ;
- rdfs:label "Improper Neutralization of Line Delimiters" ;
- rdfs:subClassOf :CWE-140 ;
- :cwe-id "CWE-144" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component." .
-
-:CWE-145 a owl:Class ;
- rdfs:label "Improper Neutralization of Section Delimiters" ;
- rdfs:subClassOf :CWE-140 ;
- :cwe-id "CWE-145" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component." .
-
-:CWE-146 a owl:Class ;
- rdfs:label "Improper Neutralization of Expression/Command Delimiters" ;
- rdfs:subClassOf :CWE-140 ;
- :cwe-id "CWE-146" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component." .
-
-:CWE-147 a owl:Class ;
- rdfs:label "Improper Neutralization of Input Terminators" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-147" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component." .
-
-:CWE-148 a owl:Class ;
- rdfs:label "Improper Neutralization of Input Leaders" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-148" ;
- :definition "The product does not properly handle when a leading character or sequence (\"leader\") is missing or malformed, or if multiple leaders are used when only one should be allowed." .
-
-:CWE-149 a owl:Class ;
- rdfs:label "Improper Neutralization of Quoting Syntax" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-149" ;
- :definition "Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions." .
-
-:CWE-150 a owl:Class ;
- rdfs:label "Improper Neutralization of Escape, Meta, or Control Sequences" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-150" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component." .
-
-:CWE-151 a owl:Class ;
- rdfs:label "Improper Neutralization of Comment Delimiters" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-151" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component." .
-
-:CWE-152 a owl:Class ;
- rdfs:label "Improper Neutralization of Macro Symbols" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-152" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbols when they are sent to a downstream component." .
-
-:CWE-153 a owl:Class ;
- rdfs:label "Improper Neutralization of Substitution Characters" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-153" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component." .
-
-:CWE-154 a owl:Class ;
- rdfs:label "Improper Neutralization of Variable Name Delimiters" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-154" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component." .
-
-:CWE-155 a owl:Class ;
- rdfs:label "Improper Neutralization of Wildcards or Matching Symbols" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-155" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component." .
-
-:CWE-156 a owl:Class ;
- rdfs:label "Improper Neutralization of Whitespace" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-156" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component." ;
- :synonym "White space" .
-
-:CWE-157 a owl:Class ;
- rdfs:label "Failure to Sanitize Paired Delimiters" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-157" ;
- :definition "The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces." .
-
-:CWE-158 a owl:Class ;
- rdfs:label "Improper Neutralization of Null Byte or NUL Character" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-158" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component." .
-
-:CWE-159 a owl:Class ;
- rdfs:label "Improper Handling of Invalid Use of Special Elements" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-159" ;
- :definition "The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity." .
-
-:CWE-160 a owl:Class ;
- rdfs:label "Improper Neutralization of Leading Special Elements" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-160" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component." .
-
-:CWE-161 a owl:Class ;
- rdfs:label "Improper Neutralization of Multiple Leading Special Elements" ;
- rdfs:subClassOf :CWE-160 ;
- :cwe-id "CWE-161" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component." .
-
-:CWE-162 a owl:Class ;
- rdfs:label "Improper Neutralization of Trailing Special Elements" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-162" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component." .
-
-:CWE-163 a owl:Class ;
- rdfs:label "Improper Neutralization of Multiple Trailing Special Elements" ;
- rdfs:subClassOf :CWE-162 ;
- :cwe-id "CWE-163" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component." .
-
-:CWE-164 a owl:Class ;
- rdfs:label "Improper Neutralization of Internal Special Elements" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-164" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component." .
-
-:CWE-165 a owl:Class ;
- rdfs:label "Improper Neutralization of Multiple Internal Special Elements" ;
- rdfs:subClassOf :CWE-164 ;
- :cwe-id "CWE-165" ;
- :definition "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component." .
-
-:CWE-166 a owl:Class ;
- rdfs:label "Improper Handling of Missing Special Element" ;
- rdfs:subClassOf :CWE-159,
- :CWE-228,
- :CWE-703 ;
- :cwe-id "CWE-166" ;
- :definition "The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing." .
-
-:CWE-167 a owl:Class ;
- rdfs:label "Improper Handling of Additional Special Element" ;
- rdfs:subClassOf :CWE-159,
- :CWE-228,
- :CWE-703 ;
- :cwe-id "CWE-167" ;
- :definition "The product receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided." .
-
-:CWE-168 a owl:Class ;
- rdfs:label "Improper Handling of Inconsistent Special Elements" ;
- rdfs:subClassOf :CWE-159,
- :CWE-228,
- :CWE-703 ;
- :cwe-id "CWE-168" ;
- :definition "The product does not properly handle input in which an inconsistency exists between two or more special characters or reserved words." .
-
-:CWE-170 a owl:Class ;
- rdfs:label "Improper Null Termination" ;
- rdfs:subClassOf :CWE-707 ;
- :cwe-id "CWE-170" ;
- :definition "The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator." .
-
-:CWE-172 a owl:Class ;
- rdfs:label "Encoding Error" ;
- rdfs:subClassOf :CWE-707 ;
- :cwe-id "CWE-172" ;
- :definition "The product does not properly encode or decode the data, resulting in unexpected values." .
-
-:CWE-173 a owl:Class ;
- rdfs:label "Improper Handling of Alternate Encoding" ;
- rdfs:subClassOf :CWE-172 ;
- :cwe-id "CWE-173" ;
- :definition "The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent." .
-
-:CWE-174 a owl:Class ;
- rdfs:label "Double Decoding of the Same Data" ;
- rdfs:subClassOf :CWE-172,
- :CWE-675 ;
- :cwe-id "CWE-174" ;
- :definition "The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations." .
-
-:CWE-175 a owl:Class ;
- rdfs:label "Improper Handling of Mixed Encoding" ;
- rdfs:subClassOf :CWE-172 ;
- :cwe-id "CWE-175" ;
- :definition "The product does not properly handle when the same input uses several different (mixed) encodings." .
-
-:CWE-176 a owl:Class ;
- rdfs:label "Improper Handling of Unicode Encoding" ;
- rdfs:subClassOf :CWE-172 ;
- :cwe-id "CWE-176" ;
- :definition "The product does not properly handle when an input contains Unicode encoding." .
-
-:CWE-177 a owl:Class ;
- rdfs:label "Improper Handling of URL Encoding (Hex Encoding)" ;
- rdfs:subClassOf :CWE-172 ;
- :cwe-id "CWE-177" ;
- :definition "The product does not properly handle when all or part of an input has been URL encoded." .
-
-:CWE-178 a owl:Class ;
- rdfs:label "Improper Handling of Case Sensitivity" ;
- rdfs:subClassOf :CWE-706 ;
- :cwe-id "CWE-178" ;
- :definition "The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results." .
-
-:CWE-179 a owl:Class ;
- rdfs:label "Incorrect Behavior Order: Early Validation" ;
- rdfs:subClassOf :CWE-20,
- :CWE-696 ;
- :cwe-id "CWE-179" ;
- :definition "The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification." .
-
-:CWE-180 a owl:Class ;
- rdfs:label "Incorrect Behavior Order: Validate Before Canonicalize" ;
- rdfs:subClassOf :CWE-179 ;
- :cwe-id "CWE-180" ;
- :definition "The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step." .
-
-:CWE-181 a owl:Class ;
- rdfs:label "Incorrect Behavior Order: Validate Before Filter" ;
- rdfs:subClassOf :CWE-179 ;
- :cwe-id "CWE-181" ;
- :definition "The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step." ;
- :synonym "Validate-before-cleanse" .
-
-:CWE-182 a owl:Class ;
- rdfs:label "Collapse of Data into Unsafe Value" ;
- rdfs:subClassOf :CWE-693,
- :CWE-707 ;
- :cwe-id "CWE-182" ;
- :definition "The product filters data in a way that causes it to be reduced or \"collapsed\" into an unsafe value that violates an expected security property." .
-
-:CWE-183 a owl:Class ;
- rdfs:label "Permissive List of Allowed Inputs" ;
- rdfs:subClassOf :CWE-697 ;
- :cwe-id "CWE-183" ;
- :definition "The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses." ;
- :synonym "Allowlist / Allow List",
- "Safelist / Safe List",
- "Whitelist / White List" .
-
-:CWE-184 a owl:Class ;
- rdfs:label "Incomplete List of Disallowed Inputs" ;
- rdfs:subClassOf :CWE-693,
- :CWE-1023 ;
- :cwe-id "CWE-184" ;
- :definition "The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete." ;
- :synonym "Blacklist / Black List",
- "Blocklist / Block List",
- "Denylist / Deny List" .
-
-:CWE-185 a owl:Class ;
- rdfs:label "Incorrect Regular Expression" ;
- rdfs:subClassOf :CWE-697 ;
- :cwe-id "CWE-185" ;
- :definition "The product specifies a regular expression in a way that causes data to be improperly matched or compared." .
-
-:CWE-186 a owl:Class ;
- rdfs:label "Overly Restrictive Regular Expression" ;
- rdfs:subClassOf :CWE-185 ;
- :cwe-id "CWE-186" ;
- :definition "A regular expression is overly restrictive, which prevents dangerous values from being detected." .
-
-:CWE-187 a owl:Class ;
- rdfs:label "Partial String Comparison" ;
- rdfs:subClassOf :CWE-1023 ;
- :cwe-id "CWE-187" ;
- :definition "The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses." .
-
-:CWE-188 a owl:Class ;
- rdfs:label "Reliance on Data/Memory Layout" ;
- rdfs:subClassOf :CWE-435,
- :CWE-1105 ;
- :cwe-id "CWE-188" ;
- :definition "The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior." .
-
-:CWE-190 a owl:Class ;
- rdfs:label "Integer Overflow or Wraparound" ;
- rdfs:subClassOf :CWE-682,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :MathematicalFunction ] ;
- :cwe-id "CWE-190" ;
- :definition "The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number." ;
- :synonym "Overflow",
- "wrap, wrap-around, wrap around",
- "Wraparound" .
-
-:CWE-191 a owl:Class ;
- rdfs:label "Integer Underflow (Wrap or Wraparound)" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-191" ;
- :definition "The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result." ;
- :synonym "Integer underflow" .
-
-:CWE-192 a owl:Class ;
- rdfs:label "Integer Coercion Error" ;
- rdfs:subClassOf :CWE-681 ;
- :cwe-id "CWE-192" ;
- :definition "Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types." .
-
-:CWE-193 a owl:Class ;
- rdfs:label "Off-by-one Error" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-193" ;
- :definition "A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value." ;
- :synonym "off-by-five" .
-
-:CWE-194 a owl:Class ;
- rdfs:label "Unexpected Sign Extension" ;
- rdfs:subClassOf :CWE-681 ;
- :cwe-id "CWE-194" ;
- :definition "The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses." .
-
-:CWE-195 a owl:Class ;
- rdfs:label "Signed to Unsigned Conversion Error" ;
- rdfs:subClassOf :CWE-681 ;
- :cwe-id "CWE-195" ;
- :definition "The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive." .
-
-:CWE-196 a owl:Class ;
- rdfs:label "Unsigned to Signed Conversion Error" ;
- rdfs:subClassOf :CWE-681 ;
- :cwe-id "CWE-196" ;
- :definition "The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive." .
-
-:CWE-197 a owl:Class ;
- rdfs:label "Numeric Truncation Error" ;
- rdfs:subClassOf :CWE-681 ;
- :cwe-id "CWE-197" ;
- :definition "Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion." .
-
-:CWE-198 a owl:Class ;
- rdfs:label "Use of Incorrect Byte Ordering" ;
- rdfs:subClassOf :CWE-188 ;
- :cwe-id "CWE-198" ;
- :definition "The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used." .
-
-:CWE-200 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information to an Unauthorized Actor" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-200" ;
- :definition "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information." ;
- :synonym "Information Disclosure",
- "Information Leak" .
-
-:CWE-201 a owl:Class ;
- rdfs:label "Insertion of Sensitive Information Into Sent Data" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-201" ;
- :definition "The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor." .
-
-:CWE-202 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information Through Data Queries" ;
- rdfs:subClassOf :CWE-1230 ;
- :cwe-id "CWE-202" ;
- :definition "When trying to keep information confidential, an attacker can often infer some of the information by using statistics." .
-
-:CWE-203 a owl:Class ;
- rdfs:label "Observable Discrepancy" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-203" ;
- :definition "The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not." ;
- :synonym "Side Channel Attack" .
-
-:CWE-204 a owl:Class ;
- rdfs:label "Observable Response Discrepancy" ;
- rdfs:subClassOf :CWE-203 ;
- :cwe-id "CWE-204" ;
- :definition "The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere." .
-
-:CWE-205 a owl:Class ;
- rdfs:label "Observable Behavioral Discrepancy" ;
- rdfs:subClassOf :CWE-203 ;
- :cwe-id "CWE-205" ;
- :definition "The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality." .
-
-:CWE-206 a owl:Class ;
- rdfs:label "Observable Internal Behavioral Discrepancy" ;
- rdfs:subClassOf :CWE-205 ;
- :cwe-id "CWE-206" ;
- :definition "The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points." .
-
-:CWE-207 a owl:Class ;
- rdfs:label "Observable Behavioral Discrepancy With Equivalent Products" ;
- rdfs:subClassOf :CWE-205 ;
- :cwe-id "CWE-207" ;
- :definition "The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker." .
-
-:CWE-208 a owl:Class ;
- rdfs:label "Observable Timing Discrepancy" ;
- rdfs:subClassOf :CWE-203 ;
- :cwe-id "CWE-208" ;
- :definition "Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not." .
-
-:CWE-209 a owl:Class ;
- rdfs:label "Generation of Error Message Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-200,
- :CWE-755 ;
- :cwe-id "CWE-209" ;
- :definition "The product generates an error message that includes sensitive information about its environment, users, or associated data." .
-
-:CWE-210 a owl:Class ;
- rdfs:label "Self-generated Error Message Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-209 ;
- :cwe-id "CWE-210" ;
- :definition "The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information." .
-
-:CWE-211 a owl:Class ;
- rdfs:label "Externally-Generated Error Message Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-209 ;
- :cwe-id "CWE-211" ;
- :definition "The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information." .
-
-:CWE-212 a owl:Class ;
- rdfs:label "Improper Removal of Sensitive Information Before Storage or Transfer" ;
- rdfs:subClassOf :CWE-669 ;
- :cwe-id "CWE-212" ;
- :definition "The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors." .
-
-:CWE-213 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information Due to Incompatible Policies" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-213" ;
- :definition "The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed." .
-
-:CWE-214 a owl:Class ;
- rdfs:label "Invocation of Process Using Visible Sensitive Information" ;
- rdfs:subClassOf :CWE-497 ;
- :cwe-id "CWE-214" ;
- :definition "A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system." .
-
-:CWE-215 a owl:Class ;
- rdfs:label "Insertion of Sensitive Information Into Debugging Code" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-215" ;
- :definition "The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production." .
-
-:CWE-219 a owl:Class ;
- rdfs:label "Storage of File with Sensitive Data Under Web Root" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-219" ;
- :definition "The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties." .
-
-:CWE-220 a owl:Class ;
- rdfs:label "Storage of File With Sensitive Data Under FTP Root" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-220" ;
- :definition "The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties." .
-
-:CWE-221 a owl:Class ;
- rdfs:label "Information Loss or Omission" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-221" ;
- :definition "The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis." .
-
-:CWE-222 a owl:Class ;
- rdfs:label "Truncation of Security-relevant Information" ;
- rdfs:subClassOf :CWE-221 ;
- :cwe-id "CWE-222" ;
- :definition "The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack." .
-
-:CWE-223 a owl:Class ;
- rdfs:label "Omission of Security-relevant Information" ;
- rdfs:subClassOf :CWE-221 ;
- :cwe-id "CWE-223" ;
- :definition "The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe." .
-
-:CWE-224 a owl:Class ;
- rdfs:label "Obscured Security-relevant Information by Alternate Name" ;
- rdfs:subClassOf :CWE-221 ;
- :cwe-id "CWE-224" ;
- :definition "The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name." .
-
-:CWE-226 a owl:Class ;
- rdfs:label "Sensitive Information in Resource Not Removed Before Reuse" ;
- rdfs:subClassOf :CWE-212,
- :CWE-459 ;
- :cwe-id "CWE-226" ;
- :definition "The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or \"zeroize\" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities." .
-
-:CWE-228 a owl:Class ;
- rdfs:label "Improper Handling of Syntactically Invalid Structure" ;
- rdfs:subClassOf :CWE-703,
- :CWE-707 ;
- :cwe-id "CWE-228" ;
- :definition "The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification." .
-
-:CWE-229 a owl:Class ;
- rdfs:label "Improper Handling of Values" ;
- rdfs:subClassOf :CWE-228 ;
- :cwe-id "CWE-229" ;
- :definition "The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined." .
-
-:CWE-230 a owl:Class ;
- rdfs:label "Improper Handling of Missing Values" ;
- rdfs:subClassOf :CWE-229 ;
- :cwe-id "CWE-230" ;
- :definition "The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null." .
-
-:CWE-231 a owl:Class ;
- rdfs:label "Improper Handling of Extra Values" ;
- rdfs:subClassOf :CWE-229 ;
- :cwe-id "CWE-231" ;
- :definition "The product does not handle or incorrectly handles when more values are provided than expected." .
-
-:CWE-232 a owl:Class ;
- rdfs:label "Improper Handling of Undefined Values" ;
- rdfs:subClassOf :CWE-229 ;
- :cwe-id "CWE-232" ;
- :definition "The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name." .
-
-:CWE-233 a owl:Class ;
- rdfs:label "Improper Handling of Parameters" ;
- rdfs:subClassOf :CWE-228 ;
- :cwe-id "CWE-233" ;
- :definition "The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined." .
-
-:CWE-234 a owl:Class ;
- rdfs:label "Failure to Handle Missing Parameter" ;
- rdfs:subClassOf :CWE-233 ;
- :cwe-id "CWE-234" ;
- :definition "If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well." .
-
-:CWE-235 a owl:Class ;
- rdfs:label "Improper Handling of Extra Parameters" ;
- rdfs:subClassOf :CWE-233 ;
- :cwe-id "CWE-235" ;
- :definition "The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount." .
-
-:CWE-236 a owl:Class ;
- rdfs:label "Improper Handling of Undefined Parameters" ;
- rdfs:subClassOf :CWE-233 ;
- :cwe-id "CWE-236" ;
- :definition "The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product." .
-
-:CWE-237 a owl:Class ;
- rdfs:label "Improper Handling of Structural Elements" ;
- rdfs:subClassOf :CWE-228 ;
- :cwe-id "CWE-237" ;
- :definition "The product does not handle or incorrectly handles inputs that are related to complex structures." .
-
-:CWE-238 a owl:Class ;
- rdfs:label "Improper Handling of Incomplete Structural Elements" ;
- rdfs:subClassOf :CWE-237 ;
- :cwe-id "CWE-238" ;
- :definition "The product does not handle or incorrectly handles when a particular structural element is not completely specified." .
-
-:CWE-239 a owl:Class ;
- rdfs:label "Failure to Handle Incomplete Element" ;
- rdfs:subClassOf :CWE-237 ;
- :cwe-id "CWE-239" ;
- :definition "The product does not properly handle when a particular element is not completely specified." .
-
-:CWE-240 a owl:Class ;
- rdfs:label "Improper Handling of Inconsistent Structural Elements" ;
- rdfs:subClassOf :CWE-237,
- :CWE-707 ;
- :cwe-id "CWE-240" ;
- :definition "The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not." .
-
-:CWE-241 a owl:Class ;
- rdfs:label "Improper Handling of Unexpected Data Type" ;
- rdfs:subClassOf :CWE-228 ;
- :cwe-id "CWE-241" ;
- :definition "The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z)." .
-
-:CWE-242 a owl:Class ;
- rdfs:label "Use of Inherently Dangerous Function" ;
- rdfs:subClassOf :CWE-1177 ;
- :cwe-id "CWE-242" ;
- :definition "The product calls a function that can never be guaranteed to work safely." .
-
-:CWE-243 a owl:Class ;
- rdfs:label "Creation of chroot Jail Without Changing Working Directory" ;
- rdfs:subClassOf :CWE-573,
- :CWE-669 ;
- :cwe-id "CWE-243" ;
- :definition "The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail." .
-
-:CWE-244 a owl:Class ;
- rdfs:label "Improper Clearing of Heap Memory Before Release ('Heap Inspection')" ;
- rdfs:subClassOf :CWE-226 ;
- :cwe-id "CWE-244" ;
- :definition "Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory." .
-
-:CWE-245 a owl:Class ;
- rdfs:label "J2EE Bad Practices: Direct Management of Connections" ;
- rdfs:subClassOf :CWE-695 ;
- :cwe-id "CWE-245" ;
- :definition "The J2EE application directly manages connections, instead of using the container's connection management facilities." .
-
-:CWE-246 a owl:Class ;
- rdfs:label "J2EE Bad Practices: Direct Use of Sockets" ;
- rdfs:subClassOf :CWE-695 ;
- :cwe-id "CWE-246" ;
- :definition "The J2EE application directly uses sockets instead of using framework method calls." .
-
-:CWE-248 a owl:Class ;
- rdfs:label "Uncaught Exception" ;
- rdfs:subClassOf :CWE-703,
- :CWE-705,
- :CWE-755 ;
- :cwe-id "CWE-248" ;
- :definition "An exception is thrown from a function, but it is not caught." .
-
-:CWE-250 a owl:Class ;
- rdfs:label "Execution with Unnecessary Privileges" ;
- rdfs:subClassOf :CWE-269,
- :CWE-657 ;
- :cwe-id "CWE-250" ;
- :definition "The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses." .
-
-:CWE-252 a owl:Class ;
- rdfs:label "Unchecked Return Value" ;
- rdfs:subClassOf :CWE-754 ;
- :cwe-id "CWE-252" ;
- :definition "The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions." .
-
-:CWE-253 a owl:Class ;
- rdfs:label "Incorrect Check of Function Return Value" ;
- rdfs:subClassOf :CWE-573,
- :CWE-754 ;
- :cwe-id "CWE-253" ;
- :definition "The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions." .
-
-:CWE-256 a owl:Class ;
- rdfs:label "Plaintext Storage of a Password" ;
- rdfs:subClassOf :CWE-522 ;
- :cwe-id "CWE-256" ;
- :definition "Storing a password in plaintext may result in a system compromise." .
-
-:CWE-257 a owl:Class ;
- rdfs:label "Storing Passwords in a Recoverable Format" ;
- rdfs:subClassOf :CWE-522 ;
- :cwe-id "CWE-257" ;
- :definition "The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts." .
-
-:CWE-258 a owl:Class ;
- rdfs:label "Empty Password in Configuration File" ;
- rdfs:subClassOf :CWE-260,
- :CWE-521 ;
- :cwe-id "CWE-258" ;
- :definition "Using an empty string as a password is insecure." .
-
-:CWE-259 a owl:Class ;
- rdfs:label "Use of Hard-coded Password" ;
- rdfs:subClassOf :CWE-798 ;
- :cwe-id "CWE-259" ;
- :definition "The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components." .
-
-:CWE-260 a owl:Class ;
- rdfs:label "Password in Configuration File" ;
- rdfs:subClassOf :CWE-522 ;
- :cwe-id "CWE-260" ;
- :definition "The product stores a password in a configuration file that might be accessible to actors who do not know the password." .
-
-:CWE-261 a owl:Class ;
- rdfs:label "Weak Encoding for Password" ;
- rdfs:subClassOf :CWE-522 ;
- :cwe-id "CWE-261" ;
- :definition "Obscuring a password with a trivial encoding does not protect the password." .
-
-:CWE-262 a owl:Class ;
- rdfs:label "Not Using Password Aging" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-262" ;
- :definition "The product does not have a mechanism in place for managing password aging." .
-
-:CWE-263 a owl:Class ;
- rdfs:label "Password Aging with Long Expiration" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-263" ;
- :definition "The product supports password aging, but the expiration period is too long." .
-
-:CWE-266 a owl:Class ;
- rdfs:label "Incorrect Privilege Assignment" ;
- rdfs:subClassOf :CWE-269 ;
- :cwe-id "CWE-266" ;
- :definition "A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor." .
-
-:CWE-267 a owl:Class ;
- rdfs:label "Privilege Defined With Unsafe Actions" ;
- rdfs:subClassOf :CWE-269 ;
- :cwe-id "CWE-267" ;
- :definition "A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity." .
-
-:CWE-268 a owl:Class ;
- rdfs:label "Privilege Chaining" ;
- rdfs:subClassOf :CWE-269 ;
- :cwe-id "CWE-268" ;
- :definition "Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination." .
-
-:CWE-269 a owl:Class ;
- rdfs:label "Improper Privilege Management" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-269" ;
- :definition "The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor." .
-
-:CWE-270 a owl:Class ;
- rdfs:label "Privilege Context Switching Error" ;
- rdfs:subClassOf :CWE-269 ;
- :cwe-id "CWE-270" ;
- :definition "The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control." .
-
-:CWE-271 a owl:Class ;
- rdfs:label "Privilege Dropping / Lowering Errors" ;
- rdfs:subClassOf :CWE-269 ;
- :cwe-id "CWE-271" ;
- :definition "The product does not drop privileges before passing control of a resource to an actor that does not have those privileges." .
-
-:CWE-272 a owl:Class ;
- rdfs:label "Least Privilege Violation" ;
- rdfs:subClassOf :CWE-271 ;
- :cwe-id "CWE-272" ;
- :definition "The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed." .
-
-:CWE-273 a owl:Class ;
- rdfs:label "Improper Check for Dropped Privileges" ;
- rdfs:subClassOf :CWE-271,
- :CWE-754 ;
- :cwe-id "CWE-273" ;
- :definition "The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded." .
-
-:CWE-274 a owl:Class ;
- rdfs:label "Improper Handling of Insufficient Privileges" ;
- rdfs:subClassOf :CWE-269,
- :CWE-755 ;
- :cwe-id "CWE-274" ;
- :definition "The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses." .
-
-:CWE-276 a owl:Class ;
- rdfs:label "Incorrect Default Permissions" ;
- rdfs:subClassOf :CWE-732,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :ApplicationInstaller ] ;
- :cwe-id "CWE-276" ;
- :definition "During installation, installed file permissions are set to allow anyone to modify those files." .
-
-:CWE-277 a owl:Class ;
- rdfs:label "Insecure Inherited Permissions" ;
- rdfs:subClassOf :CWE-732 ;
- :cwe-id "CWE-277" ;
- :definition "A product defines a set of insecure permissions that are inherited by objects that are created by the program." .
-
-:CWE-278 a owl:Class ;
- rdfs:label "Insecure Preserved Inherited Permissions" ;
- rdfs:subClassOf :CWE-732 ;
- :cwe-id "CWE-278" ;
- :definition "A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement." .
-
-:CWE-279 a owl:Class ;
- rdfs:label "Incorrect Execution-Assigned Permissions" ;
- rdfs:subClassOf :CWE-732 ;
- :cwe-id "CWE-279" ;
- :definition "While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user." .
-
-:CWE-280 a owl:Class ;
- rdfs:label "Improper Handling of Insufficient Permissions or Privileges " ;
- rdfs:subClassOf :CWE-755 ;
- :cwe-id "CWE-280" ;
- :definition "The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state." .
-
-:CWE-281 a owl:Class ;
- rdfs:label "Improper Preservation of Permissions" ;
- rdfs:subClassOf :CWE-732 ;
- :cwe-id "CWE-281" ;
- :definition "The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended." .
-
-:CWE-282 a owl:Class ;
- rdfs:label "Improper Ownership Management" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-282" ;
- :definition "The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource." .
-
-:CWE-283 a owl:Class ;
- rdfs:label "Unverified Ownership" ;
- rdfs:subClassOf :CWE-282 ;
- :cwe-id "CWE-283" ;
- :definition "The product does not properly verify that a critical resource is owned by the proper entity." .
-
-:CWE-284 a owl:Class ;
- rdfs:label "Improper Access Control" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-284" ;
- :definition "The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor." ;
- :synonym "Authorization" .
-
-:CWE-285 a owl:Class ;
- rdfs:label "Improper Authorization" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-285" ;
- :definition "The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action." ;
- :synonym "AuthZ" .
-
-:CWE-286 a owl:Class ;
- rdfs:label "Incorrect User Management" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-286" ;
- :definition "The product does not properly manage a user within its environment." .
-
-:CWE-287 a owl:Class ;
- rdfs:label "Improper Authentication" ;
- rdfs:subClassOf :CWE-284,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :AuthenticationFunction ] ;
- :cwe-id "CWE-287" ;
- :definition "When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct." ;
- :synonym "AuthC",
- "authentification",
- "AuthN" .
-
-:CWE-288 a owl:Class ;
- rdfs:label "Authentication Bypass Using an Alternate Path or Channel" ;
- rdfs:subClassOf :CWE-306 ;
- :cwe-id "CWE-288" ;
- :definition "The product requires authentication, but the product has an alternate path or channel that does not require authentication." .
-
-:CWE-289 a owl:Class ;
- rdfs:label "Authentication Bypass by Alternate Name" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-289" ;
- :definition "The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor." .
-
-:CWE-290 a owl:Class ;
- rdfs:label "Authentication Bypass by Spoofing" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-290" ;
- :definition "This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks." .
-
-:CWE-291 a owl:Class ;
- rdfs:label "Reliance on IP Address for Authentication" ;
- rdfs:subClassOf :CWE-290,
- :CWE-471,
- :CWE-923 ;
- :cwe-id "CWE-291" ;
- :definition "The product uses an IP address for authentication." .
-
-:CWE-293 a owl:Class ;
- rdfs:label "Using Referer Field for Authentication" ;
- rdfs:subClassOf :CWE-290 ;
- :cwe-id "CWE-293" ;
- :definition "The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking." ;
- :synonym "referrer" .
-
-:CWE-294 a owl:Class ;
- rdfs:label "Authentication Bypass by Capture-replay" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-294" ;
- :definition "A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes)." .
-
-:CWE-295 a owl:Class ;
- rdfs:label "Improper Certificate Validation" ;
- rdfs:subClassOf :CWE-287 ;
- :cwe-id "CWE-295" ;
- :definition "The product does not validate, or incorrectly validates, a certificate." .
-
-:CWE-296 a owl:Class ;
- rdfs:label "Improper Following of a Certificate's Chain of Trust" ;
- rdfs:subClassOf :CWE-295,
- :CWE-573 ;
- :cwe-id "CWE-296" ;
- :definition "The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate." .
-
-:CWE-297 a owl:Class ;
- rdfs:label "Improper Validation of Certificate with Host Mismatch" ;
- rdfs:subClassOf :CWE-295,
- :CWE-923 ;
- :cwe-id "CWE-297" ;
- :definition "The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host." .
-
-:CWE-298 a owl:Class ;
- rdfs:label "Improper Validation of Certificate Expiration" ;
- rdfs:subClassOf :CWE-295,
- :CWE-672 ;
- :cwe-id "CWE-298" ;
- :definition "A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to certificates that have been abandoned due to age." .
-
-:CWE-299 a owl:Class ;
- rdfs:label "Improper Check for Certificate Revocation" ;
- rdfs:subClassOf :CWE-295,
- :CWE-404 ;
- :cwe-id "CWE-299" ;
- :definition "The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised." .
-
-:CWE-300 a owl:Class ;
- rdfs:label "Channel Accessible by Non-Endpoint" ;
- rdfs:subClassOf :CWE-923 ;
- :cwe-id "CWE-300" ;
- :definition "The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint." ;
- :synonym "Adversary-in-the-Middle / AITM",
- "Interception attack",
- "Man-in-the-Middle / MITM",
- "Manipulator-in-the-Middle",
- "Monkey-in-the-Middle",
- "Monster-in-the-Middle",
- "On-path attack",
- "Person-in-the-Middle / PITM" .
-
-:CWE-301 a owl:Class ;
- rdfs:label "Reflection Attack in an Authentication Protocol" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-301" ;
- :definition "Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user." .
-
-:CWE-302 a owl:Class ;
- rdfs:label "Authentication Bypass by Assumed-Immutable Data" ;
- rdfs:subClassOf :CWE-807,
- :CWE-1390 ;
- :cwe-id "CWE-302" ;
- :definition "The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker." .
-
-:CWE-303 a owl:Class ;
- rdfs:label "Incorrect Implementation of Authentication Algorithm" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-303" ;
- :definition "The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect." .
-
-:CWE-304 a owl:Class ;
- rdfs:label "Missing Critical Step in Authentication" ;
- rdfs:subClassOf :CWE-303,
- :CWE-573 ;
- :cwe-id "CWE-304" ;
- :definition "The product implements an authentication technique, but it skips a step that weakens the technique." .
-
-:CWE-305 a owl:Class ;
- rdfs:label "Authentication Bypass by Primary Weakness" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-305" ;
- :definition "The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error." .
-
-:CWE-306 a owl:Class ;
- rdfs:label "Missing Authentication for Critical Function" ;
- rdfs:subClassOf :CWE-287 ;
- :comment "Too broad to map to digital artifacts as it could consume any resource." ;
- :cwe-id "CWE-306" ;
- :definition "The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources." .
-
-:CWE-307 a owl:Class ;
- rdfs:label "Improper Restriction of Excessive Authentication Attempts" ;
- rdfs:subClassOf :CWE-799,
- :CWE-1390 ;
- :cwe-id "CWE-307" ;
- :definition "The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame." .
-
-:CWE-308 a owl:Class ;
- rdfs:label "Use of Single-factor Authentication" ;
- rdfs:subClassOf :CWE-654,
- :CWE-1390 ;
- :cwe-id "CWE-308" ;
- :definition "The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme." .
-
-:CWE-309 a owl:Class ;
- rdfs:label "Use of Password System for Primary Authentication" ;
- rdfs:subClassOf :CWE-654,
- :CWE-1390 ;
- :cwe-id "CWE-309" ;
- :definition "The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism." .
-
-:CWE-311 a owl:Class ;
- rdfs:label "Missing Encryption of Sensitive Data" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-311" ;
- :definition "The product does not encrypt sensitive or critical information before storage or transmission." .
-
-:CWE-312 a owl:Class ;
- rdfs:label "Cleartext Storage of Sensitive Information" ;
- rdfs:subClassOf :CWE-311,
- :CWE-922 ;
- :cwe-id "CWE-312" ;
- :definition "The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere." .
-
-:CWE-313 a owl:Class ;
- rdfs:label "Cleartext Storage in a File or on Disk" ;
- rdfs:subClassOf :CWE-312 ;
- :cwe-id "CWE-313" ;
- :definition "The product stores sensitive information in cleartext in a file, or on disk." .
-
-:CWE-314 a owl:Class ;
- rdfs:label "Cleartext Storage in the Registry" ;
- rdfs:subClassOf :CWE-312 ;
- :cwe-id "CWE-314" ;
- :definition "The product stores sensitive information in cleartext in the registry." .
-
-:CWE-315 a owl:Class ;
- rdfs:label "Cleartext Storage of Sensitive Information in a Cookie" ;
- rdfs:subClassOf :CWE-312 ;
- :cwe-id "CWE-315" ;
- :definition "The product stores sensitive information in cleartext in a cookie." .
-
-:CWE-316 a owl:Class ;
- rdfs:label "Cleartext Storage of Sensitive Information in Memory" ;
- rdfs:subClassOf :CWE-312 ;
- :cwe-id "CWE-316" ;
- :definition "The product stores sensitive information in cleartext in memory." .
-
-:CWE-317 a owl:Class ;
- rdfs:label "Cleartext Storage of Sensitive Information in GUI" ;
- rdfs:subClassOf :CWE-312 ;
- :cwe-id "CWE-317" ;
- :definition "The product stores sensitive information in cleartext within the GUI." .
-
-:CWE-318 a owl:Class ;
- rdfs:label "Cleartext Storage of Sensitive Information in Executable" ;
- rdfs:subClassOf :CWE-312 ;
- :cwe-id "CWE-318" ;
- :definition "The product stores sensitive information in cleartext in an executable." .
-
-:CWE-319 a owl:Class ;
- rdfs:label "Cleartext Transmission of Sensitive Information" ;
- rdfs:subClassOf :CWE-311 ;
- :cwe-id "CWE-319" ;
- :definition "The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors." .
-
-:CWE-321 a owl:Class ;
- rdfs:label "Use of Hard-coded Cryptographic Key" ;
- rdfs:subClassOf :CWE-798 ;
- :cwe-id "CWE-321" ;
- :definition "The product uses a hard-coded, unchangeable cryptographic key." .
-
-:CWE-322 a owl:Class ;
- rdfs:label "Key Exchange without Entity Authentication" ;
- rdfs:subClassOf :CWE-306 ;
- :cwe-id "CWE-322" ;
- :definition "The product performs a key exchange with an actor without verifying the identity of that actor." .
-
-:CWE-323 a owl:Class ;
- rdfs:label "Reusing a Nonce, Key Pair in Encryption" ;
- rdfs:subClassOf :CWE-344 ;
- :cwe-id "CWE-323" ;
- :definition "Nonces should be used for the present occasion and only once." .
-
-:CWE-324 a owl:Class ;
- rdfs:label "Use of a Key Past its Expiration Date" ;
- rdfs:subClassOf :CWE-672 ;
- :cwe-id "CWE-324" ;
- :definition "The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key." .
-
-:CWE-325 a owl:Class ;
- rdfs:label "Missing Cryptographic Step" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-325" ;
- :definition "The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm." .
-
-:CWE-326 a owl:Class ;
- rdfs:label "Inadequate Encryption Strength" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-326" ;
- :definition "The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required." .
-
-:CWE-327 a owl:Class ;
- rdfs:label "Use of a Broken or Risky Cryptographic Algorithm" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-327" ;
- :definition "The product uses a broken or risky cryptographic algorithm or protocol." .
-
-:CWE-328 a owl:Class ;
- rdfs:label "Use of Weak Hash" ;
- rdfs:subClassOf :CWE-326,
- :CWE-327 ;
- :cwe-id "CWE-328" ;
- :definition "The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack)." .
-
-:CWE-329 a owl:Class ;
- rdfs:label "Generation of Predictable IV with CBC Mode" ;
- rdfs:subClassOf :CWE-573,
- :CWE-1204 ;
- :cwe-id "CWE-329" ;
- :definition "The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key." .
-
-:CWE-330 a owl:Class ;
- rdfs:label "Use of Insufficiently Random Values" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-330" ;
- :definition "The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers." .
-
-:CWE-331 a owl:Class ;
- rdfs:label "Insufficient Entropy" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-331" ;
- :definition "The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others." .
-
-:CWE-332 a owl:Class ;
- rdfs:label "Insufficient Entropy in PRNG" ;
- rdfs:subClassOf :CWE-331 ;
- :cwe-id "CWE-332" ;
- :definition "The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat." .
-
-:CWE-333 a owl:Class ;
- rdfs:label "Improper Handling of Insufficient Entropy in TRNG" ;
- rdfs:subClassOf :CWE-331,
- :CWE-703,
- :CWE-755 ;
- :cwe-id "CWE-333" ;
- :definition "True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block." .
-
-:CWE-334 a owl:Class ;
- rdfs:label "Small Space of Random Values" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-334" ;
- :definition "The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks." .
-
-:CWE-335 a owl:Class ;
- rdfs:label "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-335" ;
- :definition "The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds." .
-
-:CWE-336 a owl:Class ;
- rdfs:label "Same Seed in Pseudo-Random Number Generator (PRNG)" ;
- rdfs:subClassOf :CWE-335 ;
- :cwe-id "CWE-336" ;
- :definition "A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized." .
-
-:CWE-337 a owl:Class ;
- rdfs:label "Predictable Seed in Pseudo-Random Number Generator (PRNG)" ;
- rdfs:subClassOf :CWE-335 ;
- :cwe-id "CWE-337" ;
- :definition "A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time." .
-
-:CWE-338 a owl:Class ;
- rdfs:label "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-338" ;
- :definition "The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong." .
-
-:CWE-339 a owl:Class ;
- rdfs:label "Small Seed Space in PRNG" ;
- rdfs:subClassOf :CWE-335 ;
- :cwe-id "CWE-339" ;
- :definition "A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks." .
-
-:CWE-340 a owl:Class ;
- rdfs:label "Generation of Predictable Numbers or Identifiers" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-340" ;
- :definition "The product uses a scheme that generates numbers or identifiers that are more predictable than required." .
-
-:CWE-341 a owl:Class ;
- rdfs:label "Predictable from Observable State" ;
- rdfs:subClassOf :CWE-340 ;
- :cwe-id "CWE-341" ;
- :definition "A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc." .
-
-:CWE-342 a owl:Class ;
- rdfs:label "Predictable Exact Value from Previous Values" ;
- rdfs:subClassOf :CWE-340 ;
- :cwe-id "CWE-342" ;
- :definition "An exact value or random number can be precisely predicted by observing previous values." .
-
-:CWE-343 a owl:Class ;
- rdfs:label "Predictable Value Range from Previous Values" ;
- rdfs:subClassOf :CWE-340 ;
- :cwe-id "CWE-343" ;
- :definition "The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated." .
-
-:CWE-344 a owl:Class ;
- rdfs:label "Use of Invariant Value in Dynamically Changing Context" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-344" ;
- :definition "The product uses a constant value, name, or reference, but this value can (or should) vary across different environments." .
-
-:CWE-345 a owl:Class ;
- rdfs:label "Insufficient Verification of Data Authenticity" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-345" ;
- :definition "The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data." .
-
-:CWE-346 a owl:Class ;
- rdfs:label "Origin Validation Error" ;
- rdfs:subClassOf :CWE-284,
- :CWE-345 ;
- :cwe-id "CWE-346" ;
- :definition "The product does not properly verify that the source of data or communication is valid." .
-
-:CWE-347 a owl:Class ;
- rdfs:label "Improper Verification of Cryptographic Signature" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-347" ;
- :definition "The product does not verify, or incorrectly verifies, the cryptographic signature for data." .
-
-:CWE-348 a owl:Class ;
- rdfs:label "Use of Less Trusted Source" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-348" ;
- :definition "The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack." .
-
-:CWE-349 a owl:Class ;
- rdfs:label "Acceptance of Extraneous Untrusted Data With Trusted Data" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-349" ;
- :definition "The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted." .
-
-:CWE-350 a owl:Class ;
- rdfs:label "Reliance on Reverse DNS Resolution for a Security-Critical Action" ;
- rdfs:subClassOf :CWE-290,
- :CWE-807 ;
- :cwe-id "CWE-350" ;
- :definition "The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname." .
-
-:CWE-351 a owl:Class ;
- rdfs:label "Insufficient Type Distinction" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-351" ;
- :definition "The product does not properly distinguish between different types of elements in a way that leads to insecure behavior." .
-
-:CWE-352 a owl:Class ;
- rdfs:label "Cross-Site Request Forgery (CSRF)" ;
- rdfs:subClassOf :CWE-345,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-352" ;
- :definition "The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. " ;
- :synonym "Cross Site Reference Forgery",
- "CSRF",
- "Session Riding",
- "XSRF" .
-
-:CWE-353 a owl:Class ;
- rdfs:label "Missing Support for Integrity Check" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-353" ;
- :definition "The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum." .
-
-:CWE-354 a owl:Class ;
- rdfs:label "Improper Validation of Integrity Check Value" ;
- rdfs:subClassOf :CWE-345,
- :CWE-754 ;
- :cwe-id "CWE-354" ;
- :definition "The product does not validate or incorrectly validates the integrity check values or \"checksums\" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission." .
-
-:CWE-356 a owl:Class ;
- rdfs:label "Product UI does not Warn User of Unsafe Actions" ;
- rdfs:subClassOf :CWE-221 ;
- :cwe-id "CWE-356" ;
- :definition "The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system." .
-
-:CWE-357 a owl:Class ;
- rdfs:label "Insufficient UI Warning of Dangerous Operations" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-357" ;
- :definition "The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention." .
-
-:CWE-358 a owl:Class ;
- rdfs:label "Improperly Implemented Security Check for Standard" ;
- rdfs:subClassOf :CWE-573,
- :CWE-693 ;
- :cwe-id "CWE-358" ;
- :definition "The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique." .
-
-:CWE-359 a owl:Class ;
- rdfs:label "Exposure of Private Personal Information to an Unauthorized Actor" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-359" ;
- :definition "The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected." ;
- :synonym "Privacy leak",
- "Privacy leakage",
- "Privacy violation" .
-
-:CWE-360 a owl:Class ;
- rdfs:label "Trust of System Event Data" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-360" ;
- :definition "Security based on event locations are insecure and can be spoofed." .
-
-:CWE-362 a owl:Class ;
- rdfs:label "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" ;
- rdfs:subClassOf :CWE-691,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :SharedResourceAccessFunction ] ;
- :cwe-id "CWE-362" ;
- :definition "The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently." ;
- :synonym "Race Condition" .
-
-:CWE-363 a owl:Class ;
- rdfs:label "Race Condition Enabling Link Following" ;
- rdfs:subClassOf :CWE-367 ;
- :cwe-id "CWE-363" ;
- :definition "The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file." .
-
-:CWE-364 a owl:Class ;
- rdfs:label "Signal Handler Race Condition" ;
- rdfs:subClassOf :CWE-362 ;
- :cwe-id "CWE-364" ;
- :definition "The product uses a signal handler that introduces a race condition." .
-
-:CWE-366 a owl:Class ;
- rdfs:label "Race Condition within a Thread" ;
- rdfs:subClassOf :CWE-362 ;
- :cwe-id "CWE-366" ;
- :definition "If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined." .
-
-:CWE-367 a owl:Class ;
- rdfs:label "Time-of-check Time-of-use (TOCTOU) Race Condition" ;
- rdfs:subClassOf :CWE-362 ;
- :cwe-id "CWE-367" ;
- :definition "The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state." ;
- :synonym "TOCCTOU",
- "TOCTTOU" .
-
-:CWE-368 a owl:Class ;
- rdfs:label "Context Switching Race Condition" ;
- rdfs:subClassOf :CWE-362 ;
- :cwe-id "CWE-368" ;
- :definition "A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch." .
-
-:CWE-369 a owl:Class ;
- rdfs:label "Divide By Zero" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-369" ;
- :definition "The product divides a value by zero." .
-
-:CWE-370 a owl:Class ;
- rdfs:label "Missing Check for Certificate Revocation after Initial Check" ;
- rdfs:subClassOf :CWE-299 ;
- :cwe-id "CWE-370" ;
- :definition "The product does not check the revocation status of a certificate after its initial revocation check, which can cause the product to perform privileged actions even after the certificate is revoked at a later time." .
-
-:CWE-372 a owl:Class ;
- rdfs:label "Incomplete Internal State Distinction" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-372" ;
- :definition "The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner." .
-
-:CWE-374 a owl:Class ;
- rdfs:label "Passing Mutable Objects to an Untrusted Method" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-374" ;
- :definition "The product sends non-cloned mutable data as an argument to a method or function." .
-
-:CWE-375 a owl:Class ;
- rdfs:label "Returning a Mutable Object to an Untrusted Caller" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-375" ;
- :definition "Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function." .
-
-:CWE-377 a owl:Class ;
- rdfs:label "Insecure Temporary File" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-377" ;
- :definition "Creating and using insecure temporary files can leave application and system data vulnerable to attack." .
-
-:CWE-378 a owl:Class ;
- rdfs:label "Creation of Temporary File With Insecure Permissions" ;
- rdfs:subClassOf :CWE-377 ;
- :cwe-id "CWE-378" ;
- :definition "Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack." .
-
-:CWE-379 a owl:Class ;
- rdfs:label "Creation of Temporary File in Directory with Insecure Permissions" ;
- rdfs:subClassOf :CWE-377 ;
- :cwe-id "CWE-379" ;
- :definition "The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file." .
-
-:CWE-382 a owl:Class ;
- rdfs:label "J2EE Bad Practices: Use of System.exit()" ;
- rdfs:subClassOf :CWE-705 ;
- :cwe-id "CWE-382" ;
- :definition "A J2EE application uses System.exit(), which also shuts down its container." .
-
-:CWE-383 a owl:Class ;
- rdfs:label "J2EE Bad Practices: Direct Use of Threads" ;
- rdfs:subClassOf :CWE-695 ;
- :cwe-id "CWE-383" ;
- :definition "Thread management in a Web application is forbidden in some circumstances and is always highly error prone." .
-
-:CWE-384 a owl:Class ;
- rdfs:label "Session Fixation" ;
- rdfs:subClassOf :CWE-610 ;
- :cwe-id "CWE-384" ;
- :definition "Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions." .
-
-:CWE-385 a owl:Class ;
- rdfs:label "Covert Timing Channel" ;
- rdfs:subClassOf :CWE-514 ;
- :cwe-id "CWE-385" ;
- :definition "Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information." .
-
-:CWE-386 a owl:Class ;
- rdfs:label "Symbolic Name not Mapping to Correct Object" ;
- rdfs:subClassOf :CWE-706 ;
- :cwe-id "CWE-386" ;
- :definition "A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time." .
-
-:CWE-390 a owl:Class ;
- rdfs:label "Detection of Error Condition Without Action" ;
- rdfs:subClassOf :CWE-755 ;
- :cwe-id "CWE-390" ;
- :definition "The product detects a specific error, but takes no actions to handle the error." .
-
-:CWE-391 a owl:Class ;
- rdfs:label "Unchecked Error Condition" ;
- rdfs:subClassOf :CWE-754 ;
- :cwe-id "CWE-391" ;
- :definition "[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed." .
-
-:CWE-392 a owl:Class ;
- rdfs:label "Missing Report of Error Condition" ;
- rdfs:subClassOf :CWE-684,
- :CWE-703,
- :CWE-755 ;
- :cwe-id "CWE-392" ;
- :definition "The product encounters an error but does not provide a status code or return value to indicate that an error has occurred." .
-
-:CWE-393 a owl:Class ;
- rdfs:label "Return of Wrong Status Code" ;
- rdfs:subClassOf :CWE-684,
- :CWE-703 ;
- :cwe-id "CWE-393" ;
- :definition "A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result." .
-
-:CWE-394 a owl:Class ;
- rdfs:label "Unexpected Status Code or Return Value" ;
- rdfs:subClassOf :CWE-754 ;
- :cwe-id "CWE-394" ;
- :definition "The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product." .
-
-:CWE-395 a owl:Class ;
- rdfs:label "Use of NullPointerException Catch to Detect NULL Pointer Dereference" ;
- rdfs:subClassOf :CWE-705,
- :CWE-755 ;
- :cwe-id "CWE-395" ;
- :definition "Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer." .
-
-:CWE-396 a owl:Class ;
- rdfs:label "Declaration of Catch for Generic Exception" ;
- rdfs:subClassOf :CWE-221,
- :CWE-705,
- :CWE-755 ;
- :cwe-id "CWE-396" ;
- :definition "Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities." .
-
-:CWE-397 a owl:Class ;
- rdfs:label "Declaration of Throws for Generic Exception" ;
- rdfs:subClassOf :CWE-221,
- :CWE-703,
- :CWE-705 ;
- :cwe-id "CWE-397" ;
- :definition "The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions." .
-
-:CWE-400 a owl:Class ;
- rdfs:label "Uncontrolled Resource Consumption" ;
- rdfs:subClassOf :CWE-664 ;
- :comment "Cannot directly relate to artifacts due to breadth. Resource monitoring and limiting allocation is an approach to counter." ;
- :cwe-id "CWE-400" ;
- :definition "The product does not properly control the allocation and maintenance of a limited resource." ;
- :synonym "Resource Exhaustion" .
-
-:CWE-401 a owl:Class ;
- rdfs:label "Missing Release of Memory after Effective Lifetime" ;
- rdfs:subClassOf :CWE-772 ;
- :cwe-id "CWE-401" ;
- :definition "The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse." ;
- :synonym "Memory Leak" .
-
-:CWE-402 a owl:Class ;
- rdfs:label "Transmission of Private Resources into a New Sphere ('Resource Leak')" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-402" ;
- :definition "The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product." ;
- :synonym "Resource Leak" .
-
-:CWE-403 a owl:Class ;
- rdfs:label "Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')" ;
- rdfs:subClassOf :CWE-402 ;
- :cwe-id "CWE-403" ;
- :definition "A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors." ;
- :synonym "File descriptor leak" .
-
-:CWE-404 a owl:Class ;
- rdfs:label "Improper Resource Shutdown or Release" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-404" ;
- :definition "The product does not release or incorrectly releases a resource before it is made available for re-use." .
-
-:CWE-405 a owl:Class ;
- rdfs:label "Asymmetric Resource Consumption (Amplification)" ;
- rdfs:subClassOf :CWE-400,
- :CWE-664 ;
- :cwe-id "CWE-405" ;
- :definition "The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is \"asymmetric.\"" .
-
-:CWE-406 a owl:Class ;
- rdfs:label "Insufficient Control of Network Message Volume (Network Amplification)" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-406" ;
- :definition "The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor." .
-
-:CWE-407 a owl:Class ;
- rdfs:label "Inefficient Algorithmic Complexity" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-407" ;
- :definition "An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached." ;
- :synonym "Quadratic Complexity" .
-
-:CWE-408 a owl:Class ;
- rdfs:label "Incorrect Behavior Order: Early Amplification" ;
- rdfs:subClassOf :CWE-405,
- :CWE-696 ;
- :cwe-id "CWE-408" ;
- :definition "The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place." .
-
-:CWE-409 a owl:Class ;
- rdfs:label "Improper Handling of Highly Compressed Data (Data Amplification)" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-409" ;
- :definition "The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output." .
-
-:CWE-410 a owl:Class ;
- rdfs:label "Insufficient Resource Pool" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-410" ;
- :definition "The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources." .
-
-:CWE-412 a owl:Class ;
- rdfs:label "Unrestricted Externally Accessible Lock" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-412" ;
- :definition "The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control." .
-
-:CWE-413 a owl:Class ;
- rdfs:label "Improper Resource Locking" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-413" ;
- :definition "The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource." .
-
-:CWE-414 a owl:Class ;
- rdfs:label "Missing Lock Check" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-414" ;
- :definition "A product does not check to see if a lock is present before performing sensitive operations on a resource." .
-
-:CWE-415 a owl:Class ;
- rdfs:label "Double Free" ;
- rdfs:subClassOf :CWE-666,
- :CWE-825,
- :CWE-1341,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :MemoryFreeFunction ] ;
- :cwe-id "CWE-415" ;
- :definition "The product calls free() twice on the same memory address." ;
- :synonym "Double-free" .
-
-:CWE-416 a owl:Class ;
- rdfs:label "Use After Free" ;
- rdfs:subClassOf :CWE-825 ;
- :cwe-id "CWE-416" ;
- :definition "The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer." ;
- :synonym "Dangling pointer",
- "UAF",
- "Use-After-Free" ;
- :todo "Model these memory artifacts." .
-
-:CWE-419 a owl:Class ;
- rdfs:label "Unprotected Primary Channel" ;
- rdfs:subClassOf :CWE-923 ;
- :cwe-id "CWE-419" ;
- :definition "The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel." .
-
-:CWE-420 a owl:Class ;
- rdfs:label "Unprotected Alternate Channel" ;
- rdfs:subClassOf :CWE-923 ;
- :cwe-id "CWE-420" ;
- :definition "The product protects a primary channel, but it does not use the same level of protection for an alternate channel." .
-
-:CWE-421 a owl:Class ;
- rdfs:label "Race Condition During Access to Alternate Channel" ;
- rdfs:subClassOf :CWE-362,
- :CWE-420 ;
- :cwe-id "CWE-421" ;
- :definition "The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors." .
-
-:CWE-422 a owl:Class ;
- rdfs:label "Unprotected Windows Messaging Channel ('Shatter')" ;
- rdfs:subClassOf :CWE-360,
- :CWE-420 ;
- :cwe-id "CWE-422" ;
- :definition "The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product." .
-
-:CWE-424 a owl:Class ;
- rdfs:label "Improper Protection of Alternate Path" ;
- rdfs:subClassOf :CWE-638,
- :CWE-693 ;
- :cwe-id "CWE-424" ;
- :definition "The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources." .
-
-:CWE-425 a owl:Class ;
- rdfs:label "Direct Request ('Forced Browsing')" ;
- rdfs:subClassOf :CWE-288,
- :CWE-424,
- :CWE-862 ;
- :cwe-id "CWE-425" ;
- :definition "The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files." ;
- :synonym "forced browsing" .
-
-:CWE-426 a owl:Class ;
- rdfs:label "Untrusted Search Path" ;
- rdfs:subClassOf :CWE-642,
- :CWE-673 ;
- :cwe-id "CWE-426" ;
- :definition "The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control." ;
- :synonym "Untrusted Path" .
-
-:CWE-427 a owl:Class ;
- rdfs:label "Uncontrolled Search Path Element" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-427" ;
- :definition "The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors." ;
- :synonym "Binary planting",
- "Dependency confusion",
- "DLL preloading",
- "Insecure library loading" .
-
-:CWE-428 a owl:Class ;
- rdfs:label "Unquoted Search Path or Element" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-428" ;
- :definition "The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path." .
-
-:CWE-430 a owl:Class ;
- rdfs:label "Deployment of Wrong Handler" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-430" ;
- :definition "The wrong \"handler\" is assigned to process an object." .
-
-:CWE-431 a owl:Class ;
- rdfs:label "Missing Handler" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-431" ;
- :definition "A handler is not available or implemented." .
-
-:CWE-432 a owl:Class ;
- rdfs:label "Dangerous Signal Handler not Disabled During Sensitive Operations" ;
- rdfs:subClassOf :CWE-364 ;
- :cwe-id "CWE-432" ;
- :definition "The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running." .
-
-:CWE-433 a owl:Class ;
- rdfs:label "Unparsed Raw Web Content Delivery" ;
- rdfs:subClassOf :CWE-219 ;
- :cwe-id "CWE-433" ;
- :definition "The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server." .
-
-:CWE-434 a owl:Class ;
- rdfs:label "Unrestricted Upload of File with Dangerous Type" ;
- rdfs:subClassOf :CWE-669,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-434" ;
- :definition "The product allows the upload or transfer of dangerous file types that are automatically processed within its environment." ;
- :synonym "Unrestricted File Upload" .
-
-:CWE-435 a owl:Class ;
- rdfs:label "Improper Interaction Between Multiple Correctly-Behaving Entities" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-435" ;
- :definition "An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses." ;
- :synonym "Emergent Fault",
- "Interaction Error" .
-
-:CWE-436 a owl:Class ;
- rdfs:label "Interpretation Conflict" ;
- rdfs:subClassOf :CWE-435 ;
- :cwe-id "CWE-436" ;
- :definition "Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state." .
-
-:CWE-437 a owl:Class ;
- rdfs:label "Incomplete Model of Endpoint Features" ;
- rdfs:subClassOf :CWE-436 ;
- :cwe-id "CWE-437" ;
- :definition "A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model." .
-
-:CWE-439 a owl:Class ;
- rdfs:label "Behavioral Change in New Version or Environment" ;
- rdfs:subClassOf :CWE-435 ;
- :cwe-id "CWE-439" ;
- :definition "A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B." ;
- :synonym "Functional change" .
-
-:CWE-440 a owl:Class ;
- rdfs:label "Expected Behavior Violation" ;
- rdfs:subClassOf :CWE-684 ;
- :cwe-id "CWE-440" ;
- :definition "A feature, API, or function does not perform according to its specification." .
-
-:CWE-441 a owl:Class ;
- rdfs:label "Unintended Proxy or Intermediary ('Confused Deputy')" ;
- rdfs:subClassOf :CWE-610 ;
- :cwe-id "CWE-441" ;
- :definition "The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor." ;
- :synonym "Confused Deputy" .
-
-:CWE-444 a owl:Class ;
- rdfs:label "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" ;
- rdfs:subClassOf :CWE-436 ;
- :cwe-id "CWE-444" ;
- :definition "The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination." ;
- :synonym "HTTP Request Smuggling",
- "HTTP Response Smuggling",
- "HTTP Smuggling" .
-
-:CWE-446 a owl:Class ;
- rdfs:label "UI Discrepancy for Security Feature" ;
- rdfs:subClassOf :CWE-684 ;
- :cwe-id "CWE-446" ;
- :definition "The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state." .
-
-:CWE-447 a owl:Class ;
- rdfs:label "Unimplemented or Unsupported Feature in UI" ;
- rdfs:subClassOf :CWE-446,
- :CWE-671 ;
- :cwe-id "CWE-447" ;
- :definition "A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented." .
-
-:CWE-448 a owl:Class ;
- rdfs:label "Obsolete Feature in UI" ;
- rdfs:subClassOf :CWE-446 ;
- :cwe-id "CWE-448" ;
- :definition "A UI function is obsolete and the product does not warn the user." .
-
-:CWE-449 a owl:Class ;
- rdfs:label "The UI Performs the Wrong Action" ;
- rdfs:subClassOf :CWE-446 ;
- :cwe-id "CWE-449" ;
- :definition "The UI performs the wrong action with respect to the user's request." .
-
-:CWE-450 a owl:Class ;
- rdfs:label "Multiple Interpretations of UI Input" ;
- rdfs:subClassOf :CWE-357 ;
- :cwe-id "CWE-450" ;
- :definition "The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation." .
-
-:CWE-451 a owl:Class ;
- rdfs:label "User Interface (UI) Misrepresentation of Critical Information" ;
- rdfs:subClassOf :CWE-221,
- :CWE-684 ;
- :cwe-id "CWE-451" ;
- :definition "The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks." .
-
-:CWE-453 a owl:Class ;
- rdfs:label "Insecure Default Variable Initialization" ;
- rdfs:subClassOf :CWE-1188 ;
- :cwe-id "CWE-453" ;
- :definition "The product, by default, initializes an internal variable with an insecure or less secure value than is possible." .
-
-:CWE-454 a owl:Class ;
- rdfs:label "External Initialization of Trusted Variables or Data Stores" ;
- rdfs:subClassOf :CWE-665,
- :CWE-1419 ;
- :cwe-id "CWE-454" ;
- :definition "The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors." .
-
-:CWE-455 a owl:Class ;
- rdfs:label "Non-exit on Failed Initialization" ;
- rdfs:subClassOf :CWE-636,
- :CWE-665,
- :CWE-705 ;
- :cwe-id "CWE-455" ;
- :definition "The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator." .
-
-:CWE-456 a owl:Class ;
- rdfs:label "Missing Initialization of a Variable" ;
- rdfs:subClassOf :CWE-909 ;
- :cwe-id "CWE-456" ;
- :definition "The product does not initialize critical variables, which causes the execution environment to use unexpected values." .
-
-:CWE-457 a owl:Class ;
- rdfs:label "Use of Uninitialized Variable" ;
- rdfs:subClassOf :CWE-908 ;
- :cwe-id "CWE-457" ;
- :definition "The code uses a variable that has not been initialized, leading to unpredictable or unintended results." .
-
-:CWE-459 a owl:Class ;
- rdfs:label "Incomplete Cleanup" ;
- rdfs:subClassOf :CWE-404 ;
- :cwe-id "CWE-459" ;
- :definition "The product does not properly \"clean up\" and remove temporary or supporting resources after they have been used." ;
- :synonym "Insufficient Cleanup" .
-
-:CWE-460 a owl:Class ;
- rdfs:label "Improper Cleanup on Thrown Exception" ;
- rdfs:subClassOf :CWE-459,
- :CWE-755 ;
- :cwe-id "CWE-460" ;
- :definition "The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow." .
-
-:CWE-462 a owl:Class ;
- rdfs:label "Duplicate Key in Associative List (Alist)" ;
- rdfs:subClassOf :CWE-694 ;
- :cwe-id "CWE-462" ;
- :definition "Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error." .
-
-:CWE-463 a owl:Class ;
- rdfs:label "Deletion of Data Structure Sentinel" ;
- rdfs:subClassOf :CWE-707 ;
- :cwe-id "CWE-463" ;
- :definition "The accidental deletion of a data-structure sentinel can cause serious programming logic problems." .
-
-:CWE-464 a owl:Class ;
- rdfs:label "Addition of Data Structure Sentinel" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-464" ;
- :definition "The accidental addition of a data-structure sentinel can cause serious programming logic problems." .
-
-:CWE-466 a owl:Class ;
- rdfs:label "Return of Pointer Value Outside of Expected Range" ;
- rdfs:subClassOf :CWE-119 ;
- :cwe-id "CWE-466" ;
- :definition "A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference." .
-
-:CWE-467 a owl:Class ;
- rdfs:label "Use of sizeof() on a Pointer Type" ;
- rdfs:subClassOf :CWE-131 ;
- :cwe-id "CWE-467" ;
- :definition "The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to." .
-
-:CWE-468 a owl:Class ;
- rdfs:label "Incorrect Pointer Scaling" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-468" ;
- :definition "In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled." .
-
-:CWE-469 a owl:Class ;
- rdfs:label "Use of Pointer Subtraction to Determine Size" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-469" ;
- :definition "The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk." .
-
-:CWE-470 a owl:Class ;
- rdfs:label "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')" ;
- rdfs:subClassOf :CWE-610,
- :CWE-913 ;
- :cwe-id "CWE-470" ;
- :definition "The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code." ;
- :synonym "Reflection Injection" .
-
-:CWE-471 a owl:Class ;
- rdfs:label "Modification of Assumed-Immutable Data (MAID)" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-471" ;
- :definition "The product does not properly protect an assumed-immutable element from being modified by an attacker." .
-
-:CWE-472 a owl:Class ;
- rdfs:label "External Control of Assumed-Immutable Web Parameter" ;
- rdfs:subClassOf :CWE-471,
- :CWE-642 ;
- :cwe-id "CWE-472" ;
- :definition "The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields." ;
- :synonym "Assumed-Immutable Parameter Tampering" .
-
-:CWE-473 a owl:Class ;
- rdfs:label "PHP External Variable Modification" ;
- rdfs:subClassOf :CWE-471 ;
- :cwe-id "CWE-473" ;
- :definition "A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise." .
-
-:CWE-474 a owl:Class ;
- rdfs:label "Use of Function with Inconsistent Implementations" ;
- rdfs:subClassOf :CWE-758 ;
- :cwe-id "CWE-474" ;
- :definition "The code uses a function that has inconsistent implementations across operating systems and versions." .
-
-:CWE-475 a owl:Class ;
- rdfs:label "Undefined Behavior for Input to API" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-475" ;
- :definition "The behavior of this function is undefined unless its control parameter is set to a specific value." .
-
-:CWE-476 a owl:Class ;
- rdfs:label "NULL Pointer Dereference" ;
- rdfs:subClassOf :CWE-710,
- :CWE-754,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :PointerDereferencingFunction ] ;
- :cwe-id "CWE-476" ;
- :definition "The product dereferences a pointer that it expects to be valid but is NULL." ;
- :synonym "nil pointer dereference",
- "NPD",
- "NPE",
- "null deref" .
-
-:CWE-477 a owl:Class ;
- rdfs:label "Use of Obsolete Function" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-477" ;
- :definition "The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained." .
-
-:CWE-478 a owl:Class ;
- rdfs:label "Missing Default Case in Multiple Condition Expression" ;
- rdfs:subClassOf :CWE-1023 ;
- :cwe-id "CWE-478" ;
- :definition "The code does not have a default case in an expression with multiple conditions, such as a switch statement." .
-
-:CWE-479 a owl:Class ;
- rdfs:label "Signal Handler Use of a Non-reentrant Function" ;
- rdfs:subClassOf :CWE-663,
- :CWE-828 ;
- :cwe-id "CWE-479" ;
- :definition "The product defines a signal handler that calls a non-reentrant function." .
-
-:CWE-480 a owl:Class ;
- rdfs:label "Use of Incorrect Operator" ;
- rdfs:subClassOf :CWE-670 ;
- :cwe-id "CWE-480" ;
- :definition "The product accidentally uses the wrong operator, which changes the logic in security-relevant ways." .
-
-:CWE-481 a owl:Class ;
- rdfs:label "Assigning instead of Comparing" ;
- rdfs:subClassOf :CWE-480 ;
- :cwe-id "CWE-481" ;
- :definition "The code uses an operator for assignment when the intention was to perform a comparison." .
-
-:CWE-482 a owl:Class ;
- rdfs:label "Comparing instead of Assigning" ;
- rdfs:subClassOf :CWE-480 ;
- :cwe-id "CWE-482" ;
- :definition "The code uses an operator for comparison when the intention was to perform an assignment." .
-
-:CWE-483 a owl:Class ;
- rdfs:label "Incorrect Block Delimitation" ;
- rdfs:subClassOf :CWE-670 ;
- :cwe-id "CWE-483" ;
- :definition "The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error." .
-
-:CWE-484 a owl:Class ;
- rdfs:label "Omitted Break Statement in Switch" ;
- rdfs:subClassOf :CWE-670,
- :CWE-710 ;
- :cwe-id "CWE-484" ;
- :definition "The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition." .
-
-:CWE-486 a owl:Class ;
- rdfs:label "Comparison of Classes by Name" ;
- rdfs:subClassOf :CWE-1025 ;
- :cwe-id "CWE-486" ;
- :definition "The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name." .
-
-:CWE-487 a owl:Class ;
- rdfs:label "Reliance on Package-level Scope" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-487" ;
- :definition "Java packages are not inherently closed; therefore, relying on them for code security is not a good practice." .
-
-:CWE-488 a owl:Class ;
- rdfs:label "Exposure of Data Element to Wrong Session" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-488" ;
- :definition "The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session." .
-
-:CWE-489 a owl:Class ;
- rdfs:label "Active Debug Code" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-489" ;
- :definition "The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information." ;
- :synonym "Leftover debug code" .
-
-:CWE-491 a owl:Class ;
- rdfs:label "Public cloneable() Method Without Final ('Object Hijack')" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-491" ;
- :definition "A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state." .
-
-:CWE-492 a owl:Class ;
- rdfs:label "Use of Inner Class Containing Sensitive Data" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-492" ;
- :definition "Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers." .
-
-:CWE-493 a owl:Class ;
- rdfs:label "Critical Public Variable Without Final Modifier" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-493" ;
- :definition "The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values." .
-
-:CWE-494 a owl:Class ;
- rdfs:label "Download of Code Without Integrity Check" ;
- rdfs:subClassOf :CWE-345,
- :CWE-669 ;
- :cwe-id "CWE-494" ;
- :definition "The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code." .
-
-:CWE-495 a owl:Class ;
- rdfs:label "Private Data Structure Returned From A Public Method" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-495" ;
- :definition "The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways." .
-
-:CWE-496 a owl:Class ;
- rdfs:label "Public Data Assigned to Private Array-Typed Field" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-496" ;
- :definition "Assigning public data to a private array is equivalent to giving public access to the array." .
-
-:CWE-497 a owl:Class ;
- rdfs:label "Exposure of Sensitive System Information to an Unauthorized Control Sphere" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-497" ;
- :definition "The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does." .
-
-:CWE-498 a owl:Class ;
- rdfs:label "Cloneable Class Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-498" ;
- :definition "The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class." .
-
-:CWE-499 a owl:Class ;
- rdfs:label "Serializable Class Containing Sensitive Data" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-499" ;
- :definition "The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class." .
-
-:CWE-500 a owl:Class ;
- rdfs:label "Public Static Field Not Marked Final" ;
- rdfs:subClassOf :CWE-493 ;
- :cwe-id "CWE-500" ;
- :definition "An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways." .
-
-:CWE-501 a owl:Class ;
- rdfs:label "Trust Boundary Violation" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-501" ;
- :definition "The product mixes trusted and untrusted data in the same data structure or structured message." .
-
-:CWE-502 a owl:Class ;
- rdfs:label "Deserialization of Untrusted Data" ;
- rdfs:subClassOf :CWE-913,
- [ a owl:Restriction ;
- owl:onProperty :may-be-weakness-of ;
- owl:someValuesFrom :UserInputFunction ],
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :DeserializationFunction ] ;
- :cwe-id "CWE-502" ;
- :definition "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid." ;
- :synonym "Marshaling, Unmarshaling",
- "PHP Object Injection",
- "Pickling, Unpickling" .
-
-:CWE-506 a owl:Class ;
- rdfs:label "Embedded Malicious Code" ;
- rdfs:subClassOf :CWE-912 ;
- :cwe-id "CWE-506" ;
- :definition "The product contains code that appears to be malicious in nature." .
-
-:CWE-507 a owl:Class ;
- rdfs:label "Trojan Horse" ;
- rdfs:subClassOf :CWE-506 ;
- :cwe-id "CWE-507" ;
- :definition "The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator." .
-
-:CWE-508 a owl:Class ;
- rdfs:label "Non-Replicating Malicious Code" ;
- rdfs:subClassOf :CWE-507 ;
- :cwe-id "CWE-508" ;
- :definition "Non-replicating malicious code only resides on the target system or product that is attacked; it does not attempt to spread to other systems." .
-
-:CWE-509 a owl:Class ;
- rdfs:label "Replicating Malicious Code (Virus or Worm)" ;
- rdfs:subClassOf :CWE-507 ;
- :cwe-id "CWE-509" ;
- :definition "Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product." .
-
-:CWE-510 a owl:Class ;
- rdfs:label "Trapdoor" ;
- rdfs:subClassOf :CWE-506 ;
- :cwe-id "CWE-510" ;
- :definition "A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism." .
-
-:CWE-511 a owl:Class ;
- rdfs:label "Logic/Time Bomb" ;
- rdfs:subClassOf :CWE-506 ;
- :cwe-id "CWE-511" ;
- :definition "The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met." .
-
-:CWE-512 a owl:Class ;
- rdfs:label "Spyware" ;
- rdfs:subClassOf :CWE-506 ;
- :cwe-id "CWE-512" ;
- :definition "The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product." .
-
-:CWE-514 a owl:Class ;
- rdfs:label "Covert Channel" ;
- rdfs:subClassOf :CWE-1229 ;
- :cwe-id "CWE-514" ;
- :definition "A covert channel is a path that can be used to transfer information in a way not intended by the system's designers." .
-
-:CWE-515 a owl:Class ;
- rdfs:label "Covert Storage Channel" ;
- rdfs:subClassOf :CWE-514 ;
- :cwe-id "CWE-515" ;
- :definition "A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information." .
-
-:CWE-520 a owl:Class ;
- rdfs:label ".NET Misconfiguration: Use of Impersonation" ;
- rdfs:subClassOf :CWE-266 ;
- :cwe-id "CWE-520" ;
- :definition "Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks." .
-
-:CWE-521 a owl:Class ;
- rdfs:label "Weak Password Requirements" ;
- rdfs:subClassOf :CWE-1391 ;
- :cwe-id "CWE-521" ;
- :definition "The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts." .
-
-:CWE-522 a owl:Class ;
- rdfs:label "Insufficiently Protected Credentials" ;
- rdfs:subClassOf :CWE-668,
- :CWE-1390 ;
- :cwe-id "CWE-522" ;
- :definition "The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval." .
-
-:CWE-523 a owl:Class ;
- rdfs:label "Unprotected Transport of Credentials" ;
- rdfs:subClassOf :CWE-522 ;
- :cwe-id "CWE-523" ;
- :definition "Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server." .
-
-:CWE-524 a owl:Class ;
- rdfs:label "Use of Cache Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-524" ;
- :definition "The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere." .
-
-:CWE-525 a owl:Class ;
- rdfs:label "Use of Web Browser Cache Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-524 ;
- :cwe-id "CWE-525" ;
- :definition "The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached." .
-
-:CWE-526 a owl:Class ;
- rdfs:label "Cleartext Storage of Sensitive Information in an Environment Variable" ;
- rdfs:subClassOf :CWE-312 ;
- :cwe-id "CWE-526" ;
- :definition "The product uses an environment variable to store unencrypted sensitive information." .
-
-:CWE-527 a owl:Class ;
- rdfs:label "Exposure of Version-Control Repository to an Unauthorized Control Sphere" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-527" ;
- :definition "The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors." .
-
-:CWE-528 a owl:Class ;
- rdfs:label "Exposure of Core Dump File to an Unauthorized Control Sphere" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-528" ;
- :definition "The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors." .
-
-:CWE-529 a owl:Class ;
- rdfs:label "Exposure of Access Control List Files to an Unauthorized Control Sphere" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-529" ;
- :definition "The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere." .
-
-:CWE-530 a owl:Class ;
- rdfs:label "Exposure of Backup File to an Unauthorized Control Sphere" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-530" ;
- :definition "A backup file is stored in a directory or archive that is made accessible to unauthorized actors." .
-
-:CWE-531 a owl:Class ;
- rdfs:label "Inclusion of Sensitive Information in Test Code" ;
- rdfs:subClassOf :CWE-540 ;
- :cwe-id "CWE-531" ;
- :definition "Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions." .
-
-:CWE-532 a owl:Class ;
- rdfs:label "Insertion of Sensitive Information into Log File" ;
- rdfs:subClassOf :CWE-538 ;
- :cwe-id "CWE-532" ;
- :definition "The product writes sensitive information to a log file." .
-
-:CWE-535 a owl:Class ;
- rdfs:label "Exposure of Information Through Shell Error Message" ;
- rdfs:subClassOf :CWE-211 ;
- :cwe-id "CWE-535" ;
- :definition "A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system." .
-
-:CWE-536 a owl:Class ;
- rdfs:label "Servlet Runtime Error Message Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-211 ;
- :cwe-id "CWE-536" ;
- :definition "A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker." .
-
-:CWE-537 a owl:Class ;
- rdfs:label "Java Runtime Error Message Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-211 ;
- :cwe-id "CWE-537" ;
- :definition "In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system." .
-
-:CWE-538 a owl:Class ;
- rdfs:label "Insertion of Sensitive Information into Externally-Accessible File or Directory" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-538" ;
- :definition "The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information." .
-
-:CWE-539 a owl:Class ;
- rdfs:label "Use of Persistent Cookies Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-539" ;
- :definition "The web application uses persistent cookies, but the cookies contain sensitive information." .
-
-:CWE-540 a owl:Class ;
- rdfs:label "Inclusion of Sensitive Information in Source Code" ;
- rdfs:subClassOf :CWE-538 ;
- :cwe-id "CWE-540" ;
- :definition "Source code on a web server or repository often contains sensitive information and should generally not be accessible to users." .
-
-:CWE-541 a owl:Class ;
- rdfs:label "Inclusion of Sensitive Information in an Include File" ;
- rdfs:subClassOf :CWE-540 ;
- :cwe-id "CWE-541" ;
- :definition "If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system." .
-
-:CWE-543 a owl:Class ;
- rdfs:label "Use of Singleton Pattern Without Synchronization in a Multithreaded Context" ;
- rdfs:subClassOf :CWE-820 ;
- :cwe-id "CWE-543" ;
- :definition "The product uses the singleton pattern when creating a resource within a multithreaded environment." .
-
-:CWE-544 a owl:Class ;
- rdfs:label "Missing Standardized Error Handling Mechanism" ;
- rdfs:subClassOf :CWE-755 ;
- :cwe-id "CWE-544" ;
- :definition "The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses." .
-
-:CWE-546 a owl:Class ;
- rdfs:label "Suspicious Comment" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-546" ;
- :definition "The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses." .
-
-:CWE-547 a owl:Class ;
- rdfs:label "Use of Hard-coded, Security-relevant Constants" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-547" ;
- :definition "The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change." .
-
-:CWE-548 a owl:Class ;
- rdfs:label "Exposure of Information Through Directory Listing" ;
- rdfs:subClassOf :CWE-497 ;
- :cwe-id "CWE-548" ;
- :definition "The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory." .
-
-:CWE-549 a owl:Class ;
- rdfs:label "Missing Password Field Masking" ;
- rdfs:subClassOf :CWE-522 ;
- :cwe-id "CWE-549" ;
- :definition "The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords." .
-
-:CWE-550 a owl:Class ;
- rdfs:label "Server-generated Error Message Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-209 ;
- :cwe-id "CWE-550" ;
- :definition "Certain conditions, such as network failure, will cause a server error message to be displayed." .
-
-:CWE-551 a owl:Class ;
- rdfs:label "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization" ;
- rdfs:subClassOf :CWE-696,
- :CWE-863 ;
- :cwe-id "CWE-551" ;
- :definition "If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection." .
-
-:CWE-552 a owl:Class ;
- rdfs:label "Files or Directories Accessible to External Parties" ;
- rdfs:subClassOf :CWE-285,
- :CWE-668 ;
- :cwe-id "CWE-552" ;
- :definition "The product makes files or directories accessible to unauthorized actors, even though they should not be." .
-
-:CWE-553 a owl:Class ;
- rdfs:label "Command Shell in Externally Accessible Directory" ;
- rdfs:subClassOf :CWE-552 ;
- :cwe-id "CWE-553" ;
- :definition "A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server." .
-
-:CWE-554 a owl:Class ;
- rdfs:label "ASP.NET Misconfiguration: Not Using Input Validation Framework" ;
- rdfs:subClassOf :CWE-1173 ;
- :cwe-id "CWE-554" ;
- :definition "The ASP.NET application does not use an input validation framework." .
-
-:CWE-555 a owl:Class ;
- rdfs:label "J2EE Misconfiguration: Plaintext Password in Configuration File" ;
- rdfs:subClassOf :CWE-260 ;
- :cwe-id "CWE-555" ;
- :definition "The J2EE application stores a plaintext password in a configuration file." .
-
-:CWE-556 a owl:Class ;
- rdfs:label "ASP.NET Misconfiguration: Use of Identity Impersonation" ;
- rdfs:subClassOf :CWE-266 ;
- :cwe-id "CWE-556" ;
- :definition "Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges." .
-
-:CWE-558 a owl:Class ;
- rdfs:label "Use of getlogin() in Multithreaded Application" ;
- rdfs:subClassOf :CWE-663 ;
- :cwe-id "CWE-558" ;
- :definition "The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values." .
-
-:CWE-560 a owl:Class ;
- rdfs:label "Use of umask() with chmod-style Argument" ;
- rdfs:subClassOf :CWE-687 ;
- :cwe-id "CWE-560" ;
- :definition "The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod()." .
-
-:CWE-561 a owl:Class ;
- rdfs:label "Dead Code" ;
- rdfs:subClassOf :CWE-1164 ;
- :cwe-id "CWE-561" ;
- :definition "The product contains dead code, which can never be executed." .
-
-:CWE-562 a owl:Class ;
- rdfs:label "Return of Stack Variable Address" ;
- rdfs:subClassOf :CWE-758 ;
- :cwe-id "CWE-562" ;
- :definition "A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash." .
-
-:CWE-563 a owl:Class ;
- rdfs:label "Assignment to Variable without Use" ;
- rdfs:subClassOf :CWE-1164 ;
- :cwe-id "CWE-563" ;
- :definition "The variable's value is assigned but never used, making it a dead store." ;
- :synonym "Unused Variable" .
-
-:CWE-564 a owl:Class ;
- rdfs:label "SQL Injection: Hibernate" ;
- rdfs:subClassOf :CWE-89 ;
- :cwe-id "CWE-564" ;
- :definition "Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands." .
-
-:CWE-565 a owl:Class ;
- rdfs:label "Reliance on Cookies without Validation and Integrity Checking" ;
- rdfs:subClassOf :CWE-602,
- :CWE-642 ;
- :cwe-id "CWE-565" ;
- :definition "The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user." .
-
-:CWE-566 a owl:Class ;
- rdfs:label "Authorization Bypass Through User-Controlled SQL Primary Key" ;
- rdfs:subClassOf :CWE-639 ;
- :cwe-id "CWE-566" ;
- :definition "The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor." .
-
-:CWE-567 a owl:Class ;
- rdfs:label "Unsynchronized Access to Shared Data in a Multithreaded Context" ;
- rdfs:subClassOf :CWE-820 ;
- :cwe-id "CWE-567" ;
- :definition "The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes." .
-
-:CWE-568 a owl:Class ;
- rdfs:label "finalize() Method Without super.finalize()" ;
- rdfs:subClassOf :CWE-459,
- :CWE-573 ;
- :cwe-id "CWE-568" ;
- :definition "The product contains a finalize() method that does not call super.finalize()." .
-
-:CWE-570 a owl:Class ;
- rdfs:label "Expression is Always False" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-570" ;
- :definition "The product contains an expression that will always evaluate to false." .
-
-:CWE-571 a owl:Class ;
- rdfs:label "Expression is Always True" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-571" ;
- :definition "The product contains an expression that will always evaluate to true." .
-
-:CWE-572 a owl:Class ;
- rdfs:label "Call to Thread run() instead of start()" ;
- rdfs:subClassOf :CWE-821 ;
- :cwe-id "CWE-572" ;
- :definition "The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee." .
-
-:CWE-573 a owl:Class ;
- rdfs:label "Improper Following of Specification by Caller" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-573" ;
- :definition "The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform." .
-
-:CWE-574 a owl:Class ;
- rdfs:label "EJB Bad Practices: Use of Synchronization Primitives" ;
- rdfs:subClassOf :CWE-695,
- :CWE-821 ;
- :cwe-id "CWE-574" ;
- :definition "The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives." .
-
-:CWE-575 a owl:Class ;
- rdfs:label "EJB Bad Practices: Use of AWT Swing" ;
- rdfs:subClassOf :CWE-695 ;
- :cwe-id "CWE-575" ;
- :definition "The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing." .
-
-:CWE-576 a owl:Class ;
- rdfs:label "EJB Bad Practices: Use of Java I/O" ;
- rdfs:subClassOf :CWE-695 ;
- :cwe-id "CWE-576" ;
- :definition "The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package." .
-
-:CWE-577 a owl:Class ;
- rdfs:label "EJB Bad Practices: Use of Sockets" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-577" ;
- :definition "The product violates the Enterprise JavaBeans (EJB) specification by using sockets." .
-
-:CWE-578 a owl:Class ;
- rdfs:label "EJB Bad Practices: Use of Class Loader" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-578" ;
- :definition "The product violates the Enterprise JavaBeans (EJB) specification by using the class loader." .
-
-:CWE-579 a owl:Class ;
- rdfs:label "J2EE Bad Practices: Non-serializable Object Stored in Session" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-579" ;
- :definition "The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability." .
-
-:CWE-580 a owl:Class ;
- rdfs:label "clone() Method Without super.clone()" ;
- rdfs:subClassOf :CWE-573,
- :CWE-664 ;
- :cwe-id "CWE-580" ;
- :definition "The product contains a clone() method that does not call super.clone() to obtain the new object." .
-
-:CWE-581 a owl:Class ;
- rdfs:label "Object Model Violation: Just One of Equals and Hashcode Defined" ;
- rdfs:subClassOf :CWE-573,
- :CWE-697 ;
- :cwe-id "CWE-581" ;
- :definition "The product does not maintain equal hashcodes for equal objects." .
-
-:CWE-582 a owl:Class ;
- rdfs:label "Array Declared Public, Final, and Static" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-582" ;
- :definition "The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified." .
-
-:CWE-583 a owl:Class ;
- rdfs:label "finalize() Method Declared Public" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-583" ;
- :definition "The product violates secure coding principles for mobile code by declaring a finalize() method public." .
-
-:CWE-584 a owl:Class ;
- rdfs:label "Return Inside Finally Block" ;
- rdfs:subClassOf :CWE-705 ;
- :cwe-id "CWE-584" ;
- :definition "The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded." .
-
-:CWE-585 a owl:Class ;
- rdfs:label "Empty Synchronized Block" ;
- rdfs:subClassOf :CWE-1071 ;
- :cwe-id "CWE-585" ;
- :definition "The product contains an empty synchronized block." .
-
-:CWE-586 a owl:Class ;
- rdfs:label "Explicit Call to Finalize()" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-586" ;
- :definition "The product makes an explicit call to the finalize() method from outside the finalizer." .
-
-:CWE-587 a owl:Class ;
- rdfs:label "Assignment of a Fixed Address to a Pointer" ;
- rdfs:subClassOf :CWE-344,
- :CWE-758 ;
- :cwe-id "CWE-587" ;
- :definition "The product sets a pointer to a specific address other than NULL or 0." .
-
-:CWE-588 a owl:Class ;
- rdfs:label "Attempt to Access Child of a Non-structure Pointer" ;
- rdfs:subClassOf :CWE-704,
- :CWE-758 ;
- :cwe-id "CWE-588" ;
- :definition "Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption." .
-
-:CWE-589 a owl:Class ;
- rdfs:label "Call to Non-ubiquitous API" ;
- rdfs:subClassOf :CWE-474 ;
- :cwe-id "CWE-589" ;
- :definition "The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences." .
-
-:CWE-590 a owl:Class ;
- rdfs:label "Free of Memory not on the Heap" ;
- rdfs:subClassOf :CWE-762,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :MemoryFreeFunction ] ;
- :cwe-id "CWE-590" ;
- :definition "The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc()." .
-
-:CWE-591 a owl:Class ;
- rdfs:label "Sensitive Data Storage in Improperly Locked Memory" ;
- rdfs:subClassOf :CWE-413 ;
- :cwe-id "CWE-591" ;
- :definition "The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors." .
-
-:CWE-593 a owl:Class ;
- rdfs:label "Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created" ;
- rdfs:subClassOf :CWE-666,
- :CWE-1390 ;
- :cwe-id "CWE-593" ;
- :definition "The product modifies the SSL context after connection creation has begun." .
-
-:CWE-594 a owl:Class ;
- rdfs:label "J2EE Framework: Saving Unserializable Objects to Disk" ;
- rdfs:subClassOf :CWE-710,
- :CWE-1076 ;
- :cwe-id "CWE-594" ;
- :definition "When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully." .
-
-:CWE-595 a owl:Class ;
- rdfs:label "Comparison of Object References Instead of Object Contents" ;
- rdfs:subClassOf :CWE-1025 ;
- :cwe-id "CWE-595" ;
- :definition "The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects." .
-
-:CWE-597 a owl:Class ;
- rdfs:label "Use of Wrong Operator in String Comparison" ;
- rdfs:subClassOf :CWE-480,
- :CWE-595 ;
- :cwe-id "CWE-597" ;
- :definition "The product uses the wrong operator when comparing a string, such as using \"==\" when the .equals() method should be used instead." .
-
-:CWE-598 a owl:Class ;
- rdfs:label "Use of GET Request Method With Sensitive Query Strings" ;
- rdfs:subClassOf :CWE-201 ;
- :cwe-id "CWE-598" ;
- :definition "The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request." .
-
-:CWE-599 a owl:Class ;
- rdfs:label "Missing Validation of OpenSSL Certificate" ;
- rdfs:subClassOf :CWE-295 ;
- :cwe-id "CWE-599" ;
- :definition "The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements." .
-
-:CWE-600 a owl:Class ;
- rdfs:label "Uncaught Exception in Servlet " ;
- rdfs:subClassOf :CWE-248 ;
- :cwe-id "CWE-600" ;
- :definition "The Servlet does not catch all exceptions, which may reveal sensitive debugging information." ;
- :synonym "Missing Catch Block" .
-
-:CWE-601 a owl:Class ;
- rdfs:label "URL Redirection to Untrusted Site ('Open Redirect')" ;
- rdfs:subClassOf :CWE-610 ;
- :cwe-id "CWE-601" ;
- :definition "The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect." ;
- :synonym "Cross-domain Redirect",
- "Cross-site Redirect",
- "Open Redirect",
- "Unvalidated Redirect" .
-
-:CWE-602 a owl:Class ;
- rdfs:label "Client-Side Enforcement of Server-Side Security" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-602" ;
- :definition "The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server." .
-
-:CWE-603 a owl:Class ;
- rdfs:label "Use of Client-Side Authentication" ;
- rdfs:subClassOf :CWE-602,
- :CWE-1390 ;
- :cwe-id "CWE-603" ;
- :definition "A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check." .
-
-:CWE-605 a owl:Class ;
- rdfs:label "Multiple Binds to the Same Port" ;
- rdfs:subClassOf :CWE-666,
- :CWE-675 ;
- :cwe-id "CWE-605" ;
- :definition "When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed." .
-
-:CWE-606 a owl:Class ;
- rdfs:label "Unchecked Input for Loop Condition" ;
- rdfs:subClassOf :CWE-1284 ;
- :cwe-id "CWE-606" ;
- :definition "The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping." .
-
-:CWE-607 a owl:Class ;
- rdfs:label "Public Static Final Field References Mutable Object" ;
- rdfs:subClassOf :CWE-471 ;
- :cwe-id "CWE-607" ;
- :definition "A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package." .
-
-:CWE-608 a owl:Class ;
- rdfs:label "Struts: Non-private Field in ActionForm Class" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-608" ;
- :definition "An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter." .
-
-:CWE-609 a owl:Class ;
- rdfs:label "Double-Checked Locking" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-609" ;
- :definition "The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient." .
-
-:CWE-610 a owl:Class ;
- rdfs:label "Externally Controlled Reference to a Resource in Another Sphere" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-610" ;
- :definition "The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere." .
-
-:CWE-611 a owl:Class ;
- rdfs:label "Improper Restriction of XML External Entity Reference" ;
- rdfs:subClassOf :CWE-610,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :ExternalContentInclusionFunction ] ;
- :cwe-id "CWE-611" ;
- :definition "The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output." ;
- :synonym "XXE" .
-
-:CWE-612 a owl:Class ;
- rdfs:label "Improper Authorization of Index Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-1230 ;
- :cwe-id "CWE-612" ;
- :definition "The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information." .
-
-:CWE-613 a owl:Class ;
- rdfs:label "Insufficient Session Expiration" ;
- rdfs:subClassOf :CWE-672 ;
- :cwe-id "CWE-613" ;
- :definition "According to WASC, \"Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.\"" .
-
-:CWE-614 a owl:Class ;
- rdfs:label "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" ;
- rdfs:subClassOf :CWE-319 ;
- :cwe-id "CWE-614" ;
- :definition "The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session." .
-
-:CWE-615 a owl:Class ;
- rdfs:label "Inclusion of Sensitive Information in Source Code Comments" ;
- rdfs:subClassOf :CWE-540 ;
- :cwe-id "CWE-615" ;
- :definition "While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc." .
-
-:CWE-616 a owl:Class ;
- rdfs:label "Incomplete Identification of Uploaded File Variables (PHP)" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-616" ;
- :definition "The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files." .
-
-:CWE-617 a owl:Class ;
- rdfs:label "Reachable Assertion" ;
- rdfs:subClassOf :CWE-670 ;
- :cwe-id "CWE-617" ;
- :definition "The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary." ;
- :synonym "assertion failure" .
-
-:CWE-618 a owl:Class ;
- rdfs:label "Exposed Unsafe ActiveX Method" ;
- rdfs:subClassOf :CWE-749 ;
- :cwe-id "CWE-618" ;
- :definition "An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain)." .
-
-:CWE-619 a owl:Class ;
- rdfs:label "Dangling Database Cursor ('Cursor Injection')" ;
- rdfs:subClassOf :CWE-402 ;
- :cwe-id "CWE-619" ;
- :definition "If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor \"dangling.\"" .
-
-:CWE-620 a owl:Class ;
- rdfs:label "Unverified Password Change" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-620" ;
- :definition "When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication." .
-
-:CWE-621 a owl:Class ;
- rdfs:label "Variable Extraction Error" ;
- rdfs:subClassOf :CWE-914 ;
- :cwe-id "CWE-621" ;
- :definition "The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables." ;
- :synonym "Variable overwrite" .
-
-:CWE-622 a owl:Class ;
- rdfs:label "Improper Validation of Function Hook Arguments" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-622" ;
- :definition "The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities." .
-
-:CWE-623 a owl:Class ;
- rdfs:label "Unsafe ActiveX Control Marked Safe For Scripting" ;
- rdfs:subClassOf :CWE-267 ;
- :cwe-id "CWE-623" ;
- :definition "An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting." .
-
-:CWE-624 a owl:Class ;
- rdfs:label "Executable Regular Expression Error" ;
- rdfs:subClassOf :CWE-77 ;
- :cwe-id "CWE-624" ;
- :definition "The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers." .
-
-:CWE-625 a owl:Class ;
- rdfs:label "Permissive Regular Expression" ;
- rdfs:subClassOf :CWE-185 ;
- :cwe-id "CWE-625" ;
- :definition "The product uses a regular expression that does not sufficiently restrict the set of allowed values." .
-
-:CWE-626 a owl:Class ;
- rdfs:label "Null Byte Interaction Error (Poison Null Byte)" ;
- rdfs:subClassOf :CWE-147,
- :CWE-436 ;
- :cwe-id "CWE-626" ;
- :definition "The product does not properly handle null bytes or NUL characters when passing data between different representations or components." .
-
-:CWE-627 a owl:Class ;
- rdfs:label "Dynamic Variable Evaluation" ;
- rdfs:subClassOf :CWE-914 ;
- :cwe-id "CWE-627" ;
- :definition "In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions." ;
- :synonym "Dynamic evaluation" .
-
-:CWE-628 a owl:Class ;
- rdfs:label "Function Call with Incorrectly Specified Arguments" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-628" ;
- :definition "The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses." .
-
-:CWE-636 a owl:Class ;
- rdfs:label "Not Failing Securely ('Failing Open')" ;
- rdfs:subClassOf :CWE-657,
- :CWE-755 ;
- :cwe-id "CWE-636" ;
- :definition "When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions." ;
- :synonym "Failing Open" .
-
-:CWE-637 a owl:Class ;
- rdfs:label "Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')" ;
- rdfs:subClassOf :CWE-657 ;
- :cwe-id "CWE-637" ;
- :definition "The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used." ;
- :synonym "Unnecessary Complexity" .
-
-:CWE-638 a owl:Class ;
- rdfs:label "Not Using Complete Mediation" ;
- rdfs:subClassOf :CWE-657,
- :CWE-862 ;
- :cwe-id "CWE-638" ;
- :definition "The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time." .
-
-:CWE-639 a owl:Class ;
- rdfs:label "Authorization Bypass Through User-Controlled Key" ;
- rdfs:subClassOf :CWE-863 ;
- :cwe-id "CWE-639" ;
- :definition "The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data." ;
- :synonym "Broken Object Level Authorization / BOLA",
- "Horizontal Authorization",
- "Insecure Direct Object Reference / IDOR" .
-
-:CWE-640 a owl:Class ;
- rdfs:label "Weak Password Recovery Mechanism for Forgotten Password" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-640" ;
- :definition "The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak." .
-
-:CWE-641 a owl:Class ;
- rdfs:label "Improper Restriction of Names for Files and Other Resources" ;
- rdfs:subClassOf :CWE-99 ;
- :cwe-id "CWE-641" ;
- :definition "The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name." .
-
-:CWE-642 a owl:Class ;
- rdfs:label "External Control of Critical State Data" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-642" ;
- :definition "The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors." .
-
-:CWE-643 a owl:Class ;
- rdfs:label "Improper Neutralization of Data within XPath Expressions ('XPath Injection')" ;
- rdfs:subClassOf :CWE-91,
- :CWE-943 ;
- :cwe-id "CWE-643" ;
- :definition "The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query." .
-
-:CWE-644 a owl:Class ;
- rdfs:label "Improper Neutralization of HTTP Headers for Scripting Syntax" ;
- rdfs:subClassOf :CWE-116 ;
- :cwe-id "CWE-644" ;
- :definition "The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash." .
-
-:CWE-645 a owl:Class ;
- rdfs:label "Overly Restrictive Account Lockout Mechanism" ;
- rdfs:subClassOf :CWE-287 ;
- :cwe-id "CWE-645" ;
- :definition "The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out." .
-
-:CWE-646 a owl:Class ;
- rdfs:label "Reliance on File Name or Extension of Externally-Supplied File" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-646" ;
- :definition "The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion." .
-
-:CWE-647 a owl:Class ;
- rdfs:label "Use of Non-Canonical URL Paths for Authorization Decisions" ;
- rdfs:subClassOf :CWE-863 ;
- :cwe-id "CWE-647" ;
- :definition "The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization." .
-
-:CWE-648 a owl:Class ;
- rdfs:label "Incorrect Use of Privileged APIs" ;
- rdfs:subClassOf :CWE-269 ;
- :cwe-id "CWE-648" ;
- :definition "The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly." .
-
-:CWE-649 a owl:Class ;
- rdfs:label "Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-649" ;
- :definition "The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified." .
-
-:CWE-650 a owl:Class ;
- rdfs:label "Trusting HTTP Permission Methods on the Server Side" ;
- rdfs:subClassOf :CWE-436 ;
- :cwe-id "CWE-650" ;
- :definition "The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state." .
-
-:CWE-651 a owl:Class ;
- rdfs:label "Exposure of WSDL File Containing Sensitive Information" ;
- rdfs:subClassOf :CWE-538 ;
- :cwe-id "CWE-651" ;
- :definition "The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return)." .
-
-:CWE-652 a owl:Class ;
- rdfs:label "Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')" ;
- rdfs:subClassOf :CWE-91,
- :CWE-943 ;
- :cwe-id "CWE-652" ;
- :definition "The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query." .
-
-:CWE-653 a owl:Class ;
- rdfs:label "Improper Isolation or Compartmentalization" ;
- rdfs:subClassOf :CWE-657,
- :CWE-693 ;
- :cwe-id "CWE-653" ;
- :definition "The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions." ;
- :synonym "Separation of Privilege" .
-
-:CWE-654 a owl:Class ;
- rdfs:label "Reliance on a Single Factor in a Security Decision" ;
- rdfs:subClassOf :CWE-657,
- :CWE-693 ;
- :cwe-id "CWE-654" ;
- :definition "A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality." ;
- :synonym "Separation of Privilege" .
-
-:CWE-655 a owl:Class ;
- rdfs:label "Insufficient Psychological Acceptability" ;
- rdfs:subClassOf :CWE-657,
- :CWE-693 ;
- :cwe-id "CWE-655" ;
- :definition "The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose." .
-
-:CWE-656 a owl:Class ;
- rdfs:label "Reliance on Security Through Obscurity" ;
- rdfs:subClassOf :CWE-657,
- :CWE-693 ;
- :cwe-id "CWE-656" ;
- :definition "The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism." ;
- :synonym "Never Assuming your secrets are safe" .
-
-:CWE-657 a owl:Class ;
- rdfs:label "Violation of Secure Design Principles" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-657" ;
- :definition "The product violates well-established principles for secure design." .
-
-:CWE-662 a owl:Class ;
- rdfs:label "Improper Synchronization" ;
- rdfs:subClassOf :CWE-664,
- :CWE-691 ;
- :cwe-id "CWE-662" ;
- :definition "The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes." .
-
-:CWE-663 a owl:Class ;
- rdfs:label "Use of a Non-reentrant Function in a Concurrent Context" ;
- rdfs:subClassOf :CWE-662 ;
- :cwe-id "CWE-663" ;
- :definition "The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state." .
-
-:CWE-664 a owl:Class ;
- rdfs:label "Improper Control of a Resource Through its Lifetime" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-664" ;
- :definition "The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release." .
-
-:CWE-665 a owl:Class ;
- rdfs:label "Improper Initialization" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-665" ;
- :definition "The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used." .
-
-:CWE-666 a owl:Class ;
- rdfs:label "Operation on Resource in Wrong Phase of Lifetime" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-666" ;
- :definition "The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors." .
-
-:CWE-667 a owl:Class ;
- rdfs:label "Improper Locking" ;
- rdfs:subClassOf :CWE-662 ;
- :cwe-id "CWE-667" ;
- :definition "The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors." .
-
-:CWE-668 a owl:Class ;
- rdfs:label "Exposure of Resource to Wrong Sphere" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-668" ;
- :definition "The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource." .
-
-:CWE-669 a owl:Class ;
- rdfs:label "Incorrect Resource Transfer Between Spheres" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-669" ;
- :definition "The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource." .
-
-:CWE-670 a owl:Class ;
- rdfs:label "Always-Incorrect Control Flow Implementation" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-670" ;
- :definition "The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated." .
-
-:CWE-671 a owl:Class ;
- rdfs:label "Lack of Administrator Control over Security" ;
- rdfs:subClassOf :CWE-657 ;
- :cwe-id "CWE-671" ;
- :definition "The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator." .
-
-:CWE-672 a owl:Class ;
- rdfs:label "Operation on a Resource after Expiration or Release" ;
- rdfs:subClassOf :CWE-666 ;
- :cwe-id "CWE-672" ;
- :definition "The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked." .
-
-:CWE-673 a owl:Class ;
- rdfs:label "External Influence of Sphere Definition" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-673" ;
- :definition "The product does not prevent the definition of control spheres from external actors." .
-
-:CWE-674 a owl:Class ;
- rdfs:label "Uncontrolled Recursion" ;
- rdfs:subClassOf :CWE-834 ;
- :cwe-id "CWE-674" ;
- :definition "The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack." ;
- :synonym "Stack Exhaustion" .
-
-:CWE-675 a owl:Class ;
- rdfs:label "Multiple Operations on Resource in Single-Operation Context" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-675" ;
- :definition "The product performs the same operation on a resource two or more times, when the operation should only be applied once." .
-
-:CWE-676 a owl:Class ;
- rdfs:label "Use of Potentially Dangerous Function" ;
- rdfs:subClassOf :CWE-1177 ;
- :cwe-id "CWE-676" ;
- :definition "The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely." .
-
-:CWE-680 a owl:Class ;
- rdfs:label "Integer Overflow to Buffer Overflow" ;
- rdfs:subClassOf :CWE-119,
- :CWE-190 ;
- :cwe-id "CWE-680" ;
- :definition "The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow." .
-
-:CWE-681 a owl:Class ;
- rdfs:label "Incorrect Conversion between Numeric Types" ;
- rdfs:subClassOf :CWE-704 ;
- :cwe-id "CWE-681" ;
- :definition "When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur." .
-
-:CWE-682 a owl:Class ;
- rdfs:label "Incorrect Calculation" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-682" ;
- :definition "The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management." .
-
-:CWE-683 a owl:Class ;
- rdfs:label "Function Call With Incorrect Order of Arguments" ;
- rdfs:subClassOf :CWE-628 ;
- :cwe-id "CWE-683" ;
- :definition "The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses." .
-
-:CWE-684 a owl:Class ;
- rdfs:label "Incorrect Provision of Specified Functionality" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-684" ;
- :definition "The code does not function according to its published specifications, potentially leading to incorrect usage." .
-
-:CWE-685 a owl:Class ;
- rdfs:label "Function Call With Incorrect Number of Arguments" ;
- rdfs:subClassOf :CWE-628 ;
- :cwe-id "CWE-685" ;
- :definition "The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses." .
-
-:CWE-686 a owl:Class ;
- rdfs:label "Function Call With Incorrect Argument Type" ;
- rdfs:subClassOf :CWE-628 ;
- :cwe-id "CWE-686" ;
- :definition "The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses." .
-
-:CWE-687 a owl:Class ;
- rdfs:label "Function Call With Incorrectly Specified Argument Value" ;
- rdfs:subClassOf :CWE-628 ;
- :cwe-id "CWE-687" ;
- :definition "The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses." .
-
-:CWE-688 a owl:Class ;
- rdfs:label "Function Call With Incorrect Variable or Reference as Argument" ;
- rdfs:subClassOf :CWE-628 ;
- :cwe-id "CWE-688" ;
- :definition "The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses." .
-
-:CWE-689 a owl:Class ;
- rdfs:label "Permission Race Condition During Resource Copy" ;
- rdfs:subClassOf :CWE-362 ;
- :cwe-id "CWE-689" ;
- :definition "The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place." .
-
-:CWE-690 a owl:Class ;
- rdfs:label "Unchecked Return Value to NULL Pointer Dereference" ;
- rdfs:subClassOf :CWE-252,
- :CWE-476 ;
- :cwe-id "CWE-690" ;
- :definition "The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference." .
-
-:CWE-691 a owl:Class ;
- rdfs:label "Insufficient Control Flow Management" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-691" ;
- :definition "The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways." .
-
-:CWE-692 a owl:Class ;
- rdfs:label "Incomplete Denylist to Cross-Site Scripting" ;
- rdfs:subClassOf :CWE-79,
- :CWE-184 ;
- :cwe-id "CWE-692" ;
- :definition "The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed." .
-
-:CWE-693 a owl:Class ;
- rdfs:label "Protection Mechanism Failure" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-693" ;
- :definition "The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product." .
-
-:CWE-694 a owl:Class ;
- rdfs:label "Use of Multiple Resources with Duplicate Identifier" ;
- rdfs:subClassOf :CWE-99,
- :CWE-573 ;
- :cwe-id "CWE-694" ;
- :definition "The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required." .
-
-:CWE-695 a owl:Class ;
- rdfs:label "Use of Low-Level Functionality" ;
- rdfs:subClassOf :CWE-573 ;
- :cwe-id "CWE-695" ;
- :definition "The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate." .
-
-:CWE-696 a owl:Class ;
- rdfs:label "Incorrect Behavior Order" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-696" ;
- :definition "The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses." .
-
-:CWE-697 a owl:Class ;
- rdfs:label "Incorrect Comparison" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-697" ;
- :definition "The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses." .
-
-:CWE-698 a owl:Class ;
- rdfs:label "Execution After Redirect (EAR)" ;
- rdfs:subClassOf :CWE-670,
- :CWE-705 ;
- :cwe-id "CWE-698" ;
- :definition "The web application sends a redirect to another location, but instead of exiting, it executes additional code." ;
- :synonym "Redirect Without Exit" .
-
-:CWE-703 a owl:Class ;
- rdfs:label "Improper Check or Handling of Exceptional Conditions" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-703" ;
- :definition "The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product." .
-
-:CWE-704 a owl:Class ;
- rdfs:label "Incorrect Type Conversion or Cast" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-704" ;
- :definition "The product does not correctly convert an object, resource, or structure from one type to a different type." .
-
-:CWE-705 a owl:Class ;
- rdfs:label "Incorrect Control Flow Scoping" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-705" ;
- :definition "The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition." .
-
-:CWE-706 a owl:Class ;
- rdfs:label "Use of Incorrectly-Resolved Name or Reference" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-706" ;
- :definition "The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere." .
-
-:CWE-707 a owl:Class ;
- rdfs:label "Improper Neutralization" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-707" ;
- :definition "The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component." .
-
-:CWE-708 a owl:Class ;
- rdfs:label "Incorrect Ownership Assignment" ;
- rdfs:subClassOf :CWE-282 ;
- :cwe-id "CWE-708" ;
- :definition "The product assigns an owner to a resource, but the owner is outside of the intended control sphere." .
-
-:CWE-710 a owl:Class ;
- rdfs:label "Improper Adherence to Coding Standards" ;
- rdfs:subClassOf :Weakness ;
- :cwe-id "CWE-710" ;
- :definition "The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities." .
-
-:CWE-732 a owl:Class ;
- rdfs:label "Incorrect Permission Assignment for Critical Resource" ;
- rdfs:subClassOf :CWE-285,
- :CWE-668 ;
- :cwe-id "CWE-732" ;
- :definition "The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors." .
-
-:CWE-733 a owl:Class ;
- rdfs:label "Compiler Optimization Removal or Modification of Security-critical Code" ;
- rdfs:subClassOf :CWE-1038 ;
- :cwe-id "CWE-733" ;
- :definition "The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified." .
-
-:CWE-749 a owl:Class ;
- rdfs:label "Exposed Dangerous Method or Function" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-749" ;
- :definition "The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted." .
-
-:CWE-754 a owl:Class ;
- rdfs:label "Improper Check for Unusual or Exceptional Conditions" ;
- rdfs:subClassOf :CWE-703 ;
- :cwe-id "CWE-754" ;
- :definition "The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product." .
-
-:CWE-755 a owl:Class ;
- rdfs:label "Improper Handling of Exceptional Conditions" ;
- rdfs:subClassOf :CWE-703 ;
- :cwe-id "CWE-755" ;
- :definition "The product does not handle or incorrectly handles an exceptional condition." .
-
-:CWE-756 a owl:Class ;
- rdfs:label "Missing Custom Error Page" ;
- rdfs:subClassOf :CWE-755 ;
- :cwe-id "CWE-756" ;
- :definition "The product does not return custom error pages to the user, possibly exposing sensitive information." .
-
-:CWE-757 a owl:Class ;
- rdfs:label "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-757" ;
- :definition "A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties." .
-
-:CWE-758 a owl:Class ;
- rdfs:label "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-758" ;
- :definition "The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity." .
-
-:CWE-759 a owl:Class ;
- rdfs:label "Use of a One-Way Hash without a Salt" ;
- rdfs:subClassOf :CWE-916 ;
- :cwe-id "CWE-759" ;
- :definition "The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input." .
-
-:CWE-760 a owl:Class ;
- rdfs:label "Use of a One-Way Hash with a Predictable Salt" ;
- rdfs:subClassOf :CWE-916 ;
- :cwe-id "CWE-760" ;
- :definition "The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input." .
-
-:CWE-761 a owl:Class ;
- rdfs:label "Free of Pointer not at Start of Buffer" ;
- rdfs:subClassOf :CWE-763,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :MemoryFreeFunction ] ;
- :cwe-id "CWE-761" ;
- :definition "The product calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at the start of the buffer." .
-
-:CWE-762 a owl:Class ;
- rdfs:label "Mismatched Memory Management Routines" ;
- rdfs:subClassOf :CWE-763 ;
- :cwe-id "CWE-762" ;
- :definition "The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource." .
-
-:CWE-763 a owl:Class ;
- rdfs:label "Release of Invalid Pointer or Reference" ;
- rdfs:subClassOf :CWE-404 ;
- :cwe-id "CWE-763" ;
- :definition "The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly." .
-
-:CWE-764 a owl:Class ;
- rdfs:label "Multiple Locks of a Critical Resource" ;
- rdfs:subClassOf :CWE-667,
- :CWE-675 ;
- :cwe-id "CWE-764" ;
- :definition "The product locks a critical resource more times than intended, leading to an unexpected state in the system." .
-
-:CWE-765 a owl:Class ;
- rdfs:label "Multiple Unlocks of a Critical Resource" ;
- rdfs:subClassOf :CWE-667,
- :CWE-675 ;
- :cwe-id "CWE-765" ;
- :definition "The product unlocks a critical resource more times than intended, leading to an unexpected state in the system." .
-
-:CWE-766 a owl:Class ;
- rdfs:label "Critical Data Element Declared Public" ;
- rdfs:subClassOf :CWE-732,
- :CWE-1061 ;
- :cwe-id "CWE-766" ;
- :definition "The product declares a critical variable, field, or member to be public when intended security policy requires it to be private." .
-
-:CWE-767 a owl:Class ;
- rdfs:label "Access to Critical Private Variable via Public Method" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-767" ;
- :definition "The product defines a public method that reads or modifies a private variable." .
-
-:CWE-768 a owl:Class ;
- rdfs:label "Incorrect Short Circuit Evaluation" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-768" ;
- :definition "The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring." .
-
-:CWE-770 a owl:Class ;
- rdfs:label "Allocation of Resources Without Limits or Throttling" ;
- rdfs:subClassOf :CWE-400,
- :CWE-665 ;
- :cwe-id "CWE-770" ;
- :definition "The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor." .
-
-:CWE-771 a owl:Class ;
- rdfs:label "Missing Reference to Active Allocated Resource" ;
- rdfs:subClassOf :CWE-400 ;
- :cwe-id "CWE-771" ;
- :definition "The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed." .
-
-:CWE-772 a owl:Class ;
- rdfs:label "Missing Release of Resource after Effective Lifetime" ;
- rdfs:subClassOf :CWE-404 ;
- :cwe-id "CWE-772" ;
- :definition "The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed." .
-
-:CWE-773 a owl:Class ;
- rdfs:label "Missing Reference to Active File Descriptor or Handle" ;
- rdfs:subClassOf :CWE-771 ;
- :cwe-id "CWE-773" ;
- :definition "The product does not properly maintain references to a file descriptor or handle, which prevents that file descriptor/handle from being reclaimed." .
-
-:CWE-774 a owl:Class ;
- rdfs:label "Allocation of File Descriptors or Handles Without Limits or Throttling" ;
- rdfs:subClassOf :CWE-770 ;
- :cwe-id "CWE-774" ;
- :definition "The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor." ;
- :synonym "File Descriptor Exhaustion" .
-
-:CWE-775 a owl:Class ;
- rdfs:label "Missing Release of File Descriptor or Handle after Effective Lifetime" ;
- rdfs:subClassOf :CWE-772 ;
- :cwe-id "CWE-775" ;
- :definition "The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed." .
-
-:CWE-776 a owl:Class ;
- rdfs:label "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')" ;
- rdfs:subClassOf :CWE-405,
- :CWE-674 ;
- :cwe-id "CWE-776" ;
- :definition "The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities." ;
- :synonym "Billion Laughs Attack",
- "XEE",
- "XML Bomb" .
-
-:CWE-777 a owl:Class ;
- rdfs:label "Regular Expression without Anchors" ;
- rdfs:subClassOf :CWE-625 ;
- :cwe-id "CWE-777" ;
- :definition "The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through." .
-
-:CWE-778 a owl:Class ;
- rdfs:label "Insufficient Logging" ;
- rdfs:subClassOf :CWE-223,
- :CWE-693 ;
- :cwe-id "CWE-778" ;
- :definition "When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it." .
-
-:CWE-779 a owl:Class ;
- rdfs:label "Logging of Excessive Data" ;
- rdfs:subClassOf :CWE-400 ;
- :cwe-id "CWE-779" ;
- :definition "The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack." .
-
-:CWE-780 a owl:Class ;
- rdfs:label "Use of RSA Algorithm without OAEP" ;
- rdfs:subClassOf :CWE-327 ;
- :cwe-id "CWE-780" ;
- :definition "The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption." .
-
-:CWE-781 a owl:Class ;
- rdfs:label "Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code" ;
- rdfs:subClassOf :CWE-1285 ;
- :cwe-id "CWE-781" ;
- :definition "The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided." .
-
-:CWE-782 a owl:Class ;
- rdfs:label "Exposed IOCTL with Insufficient Access Control" ;
- rdfs:subClassOf :CWE-749 ;
- :cwe-id "CWE-782" ;
- :definition "The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL." .
-
-:CWE-783 a owl:Class ;
- rdfs:label "Operator Precedence Logic Error" ;
- rdfs:subClassOf :CWE-670 ;
- :cwe-id "CWE-783" ;
- :definition "The product uses an expression in which operator precedence causes incorrect logic to be used." .
-
-:CWE-784 a owl:Class ;
- rdfs:label "Reliance on Cookies without Validation and Integrity Checking in a Security Decision" ;
- rdfs:subClassOf :CWE-565,
- :CWE-807 ;
- :cwe-id "CWE-784" ;
- :definition "The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user." .
-
-:CWE-785 a owl:Class ;
- rdfs:label "Use of Path Manipulation Function without Maximum-sized Buffer" ;
- rdfs:subClassOf :CWE-120,
- :CWE-676 ;
- :cwe-id "CWE-785" ;
- :definition "The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX." .
-
-:CWE-786 a owl:Class ;
- rdfs:label "Access of Memory Location Before Start of Buffer" ;
- rdfs:subClassOf :CWE-119 ;
- :cwe-id "CWE-786" ;
- :definition "The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer." .
-
-:CWE-787 a owl:Class ;
- rdfs:label "Out-of-bounds Write" ;
- rdfs:subClassOf :CWE-119,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :RawMemoryAccessFunction ] ;
- :cwe-id "CWE-787" ;
- :definition "The product writes data past the end, or before the beginning, of the intended buffer." ;
- :synonym "Memory Corruption" .
-
-:CWE-788 a owl:Class ;
- rdfs:label "Access of Memory Location After End of Buffer" ;
- rdfs:subClassOf :CWE-119 ;
- :cwe-id "CWE-788" ;
- :definition "The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer." .
-
-:CWE-789 a owl:Class ;
- rdfs:label "Memory Allocation with Excessive Size Value" ;
- rdfs:subClassOf :CWE-770,
- :CWE-1284 ;
- :cwe-id "CWE-789" ;
- :definition "The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated." ;
- :synonym "Stack Exhaustion" .
-
-:CWE-790 a owl:Class ;
- rdfs:label "Improper Filtering of Special Elements" ;
- rdfs:subClassOf :CWE-138 ;
- :cwe-id "CWE-790" ;
- :definition "The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component." .
-
-:CWE-791 a owl:Class ;
- rdfs:label "Incomplete Filtering of Special Elements" ;
- rdfs:subClassOf :CWE-790 ;
- :cwe-id "CWE-791" ;
- :definition "The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component." .
-
-:CWE-792 a owl:Class ;
- rdfs:label "Incomplete Filtering of One or More Instances of Special Elements" ;
- rdfs:subClassOf :CWE-791 ;
- :cwe-id "CWE-792" ;
- :definition "The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component." .
-
-:CWE-793 a owl:Class ;
- rdfs:label "Only Filtering One Instance of a Special Element" ;
- rdfs:subClassOf :CWE-792 ;
- :cwe-id "CWE-793" ;
- :definition "The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component." .
-
-:CWE-794 a owl:Class ;
- rdfs:label "Incomplete Filtering of Multiple Instances of Special Elements" ;
- rdfs:subClassOf :CWE-792 ;
- :cwe-id "CWE-794" ;
- :definition "The product receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component." .
-
-:CWE-795 a owl:Class ;
- rdfs:label "Only Filtering Special Elements at a Specified Location" ;
- rdfs:subClassOf :CWE-791 ;
- :cwe-id "CWE-795" ;
- :definition "The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component." .
-
-:CWE-796 a owl:Class ;
- rdfs:label "Only Filtering Special Elements Relative to a Marker" ;
- rdfs:subClassOf :CWE-795 ;
- :cwe-id "CWE-796" ;
- :definition "The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. \"at the beginning/end of a string; the second argument\"), thereby missing remaining special elements that may exist before sending it to a downstream component." .
-
-:CWE-797 a owl:Class ;
- rdfs:label "Only Filtering Special Elements at an Absolute Position" ;
- rdfs:subClassOf :CWE-795 ;
- :cwe-id "CWE-797" ;
- :definition "The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. \"byte number 10\"), thereby missing remaining special elements that may exist before sending it to a downstream component." .
-
-:CWE-798 a owl:Class ;
- rdfs:label "Use of Hard-coded Credentials" ;
- rdfs:subClassOf :CWE-344,
- :CWE-671,
- :CWE-1391,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :AuthenticationFunction ] ;
- :cwe-id "CWE-798" ;
- :definition "The product contains hard-coded credentials, such as a password or cryptographic key." .
-
-:CWE-799 a owl:Class ;
- rdfs:label "Improper Control of Interaction Frequency" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-799" ;
- :definition "The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests." ;
- :synonym "Brute force",
- "Insufficient anti-automation" .
-
-:CWE-804 a owl:Class ;
- rdfs:label "Guessable CAPTCHA" ;
- rdfs:subClassOf :CWE-863,
- :CWE-1390 ;
- :cwe-id "CWE-804" ;
- :definition "The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor." .
-
-:CWE-805 a owl:Class ;
- rdfs:label "Buffer Access with Incorrect Length Value" ;
- rdfs:subClassOf :CWE-119 ;
- :cwe-id "CWE-805" ;
- :definition "The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer." .
-
-:CWE-806 a owl:Class ;
- rdfs:label "Buffer Access Using Size of Source Buffer" ;
- rdfs:subClassOf :CWE-805 ;
- :cwe-id "CWE-806" ;
- :definition "The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer." .
-
-:CWE-807 a owl:Class ;
- rdfs:label "Reliance on Untrusted Inputs in a Security Decision" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-807" ;
- :definition "The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism." .
-
-:CWE-820 a owl:Class ;
- rdfs:label "Missing Synchronization" ;
- rdfs:subClassOf :CWE-662 ;
- :cwe-id "CWE-820" ;
- :definition "The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource." .
-
-:CWE-821 a owl:Class ;
- rdfs:label "Incorrect Synchronization" ;
- rdfs:subClassOf :CWE-662 ;
- :cwe-id "CWE-821" ;
- :definition "The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource." .
-
-:CWE-822 a owl:Class ;
- rdfs:label "Untrusted Pointer Dereference" ;
- rdfs:subClassOf :CWE-119,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :PointerDereferencingFunction ] ;
- :cwe-id "CWE-822" ;
- :definition "The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer." .
-
-:CWE-823 a owl:Class ;
- rdfs:label "Use of Out-of-range Pointer Offset" ;
- rdfs:subClassOf :CWE-119 ;
- :cwe-id "CWE-823" ;
- :definition "The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer." ;
- :synonym "Untrusted pointer offset" .
-
-:CWE-824 a owl:Class ;
- rdfs:label "Access of Uninitialized Pointer" ;
- rdfs:subClassOf :CWE-119,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :PointerDereferencingFunction ] ;
- :cwe-id "CWE-824" ;
- :definition "The product accesses or uses a pointer that has not been initialized." .
-
-:CWE-825 a owl:Class ;
- rdfs:label "Expired Pointer Dereference" ;
- rdfs:subClassOf :CWE-119,
- :CWE-672,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-825" ;
- :definition "The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid." ;
- :synonym "Dangling pointer" .
-
-:CWE-826 a owl:Class ;
- rdfs:label "Premature Release of Resource During Expected Lifetime" ;
- rdfs:subClassOf :CWE-666 ;
- :cwe-id "CWE-826" ;
- :definition "The product releases a resource that is still intended to be used by itself or another actor." .
-
-:CWE-827 a owl:Class ;
- rdfs:label "Improper Control of Document Type Definition" ;
- rdfs:subClassOf :CWE-706,
- :CWE-829 ;
- :cwe-id "CWE-827" ;
- :definition "The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker." .
-
-:CWE-828 a owl:Class ;
- rdfs:label "Signal Handler with Functionality that is not Asynchronous-Safe" ;
- rdfs:subClassOf :CWE-364 ;
- :cwe-id "CWE-828" ;
- :definition "The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted." .
-
-:CWE-829 a owl:Class ;
- rdfs:label "Inclusion of Functionality from Untrusted Control Sphere" ;
- rdfs:subClassOf :CWE-669 ;
- :cwe-id "CWE-829" ;
- :definition "The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere." .
-
-:CWE-830 a owl:Class ;
- rdfs:label "Inclusion of Web Functionality from an Untrusted Source" ;
- rdfs:subClassOf :CWE-829 ;
- :cwe-id "CWE-830" ;
- :definition "The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source." .
-
-:CWE-831 a owl:Class ;
- rdfs:label "Signal Handler Function Associated with Multiple Signals" ;
- rdfs:subClassOf :CWE-364 ;
- :cwe-id "CWE-831" ;
- :definition "The product defines a function that is used as a handler for more than one signal." .
-
-:CWE-832 a owl:Class ;
- rdfs:label "Unlock of a Resource that is not Locked" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-832" ;
- :definition "The product attempts to unlock a resource that is not locked." .
-
-:CWE-833 a owl:Class ;
- rdfs:label "Deadlock" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-833" ;
- :definition "The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock." .
-
-:CWE-834 a owl:Class ;
- rdfs:label "Excessive Iteration" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-834" ;
- :definition "The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed." .
-
-:CWE-835 a owl:Class ;
- rdfs:label "Loop with Unreachable Exit Condition ('Infinite Loop')" ;
- rdfs:subClassOf :CWE-834 ;
- :cwe-id "CWE-835" ;
- :definition "The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop." .
-
-:CWE-836 a owl:Class ;
- rdfs:label "Use of Password Hash Instead of Password for Authentication" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-836" ;
- :definition "The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store." .
-
-:CWE-837 a owl:Class ;
- rdfs:label "Improper Enforcement of a Single, Unique Action" ;
- rdfs:subClassOf :CWE-799 ;
- :cwe-id "CWE-837" ;
- :definition "The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction." .
-
-:CWE-838 a owl:Class ;
- rdfs:label "Inappropriate Encoding for Output Context" ;
- rdfs:subClassOf :CWE-116 ;
- :cwe-id "CWE-838" ;
- :definition "The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component." .
-
-:CWE-839 a owl:Class ;
- rdfs:label "Numeric Range Comparison Without Minimum Check" ;
- rdfs:subClassOf :CWE-1023 ;
- :cwe-id "CWE-839" ;
- :definition "The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum." ;
- :synonym "Signed comparison" .
-
-:CWE-841 a owl:Class ;
- rdfs:label "Improper Enforcement of Behavioral Workflow" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-841" ;
- :definition "The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence." .
-
-:CWE-842 a owl:Class ;
- rdfs:label "Placement of User into Incorrect Group" ;
- rdfs:subClassOf :CWE-286 ;
- :cwe-id "CWE-842" ;
- :definition "The product or the administrator places a user into an incorrect group." .
-
-:CWE-843 a owl:Class ;
- rdfs:label "Access of Resource Using Incompatible Type ('Type Confusion')" ;
- rdfs:subClassOf :CWE-704 ;
- :cwe-id "CWE-843" ;
- :definition "The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type." ;
- :synonym "Object Type Confusion" .
-
-:CWE-862 a owl:Class ;
- rdfs:label "Missing Authorization" ;
- rdfs:subClassOf :CWE-285 ;
- rdfs:comment "Broad and could apply to all resource accesses." ;
- :cwe-id "CWE-862" ;
- :definition "The product does not perform an authorization check when an actor attempts to access a resource or perform an action." ;
- :synonym "AuthZ" .
-
-:CWE-863 a owl:Class ;
- rdfs:label "Incorrect Authorization" ;
- rdfs:subClassOf :CWE-285 ;
- :cwe-id "CWE-863" ;
- :definition "The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check." ;
- :synonym "AuthZ" .
-
-:CWE-908 a owl:Class ;
- rdfs:label "Use of Uninitialized Resource" ;
- rdfs:subClassOf :CWE-665 ;
- :cwe-id "CWE-908" ;
- :definition "The product uses or accesses a resource that has not been initialized." .
-
-:CWE-909 a owl:Class ;
- rdfs:label "Missing Initialization of Resource" ;
- rdfs:subClassOf :CWE-665 ;
- :cwe-id "CWE-909" ;
- :definition "The product does not initialize a critical resource." .
-
-:CWE-910 a owl:Class ;
- rdfs:label "Use of Expired File Descriptor" ;
- rdfs:subClassOf :CWE-672 ;
- :cwe-id "CWE-910" ;
- :definition "The product uses or accesses a file descriptor after it has been closed." ;
- :synonym "Stale file descriptor" .
-
-:CWE-911 a owl:Class ;
- rdfs:label "Improper Update of Reference Count" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-911" ;
- :definition "The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count." .
-
-:CWE-912 a owl:Class ;
- rdfs:label "Hidden Functionality" ;
- rdfs:subClassOf :CWE-684 ;
- :cwe-id "CWE-912" ;
- :definition "The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators." .
-
-:CWE-913 a owl:Class ;
- rdfs:label "Improper Control of Dynamically-Managed Code Resources" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-913" ;
- :definition "The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements." .
-
-:CWE-914 a owl:Class ;
- rdfs:label "Improper Control of Dynamically-Identified Variables" ;
- rdfs:subClassOf :CWE-99,
- :CWE-913 ;
- :cwe-id "CWE-914" ;
- :definition "The product does not properly restrict reading from or writing to dynamically-identified variables." .
-
-:CWE-915 a owl:Class ;
- rdfs:label "Improperly Controlled Modification of Dynamically-Determined Object Attributes" ;
- rdfs:subClassOf :CWE-913 ;
- :cwe-id "CWE-915" ;
- :definition "The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified." ;
- :synonym "AutoBinding",
- "Mass Assignment",
- "PHP Object Injection" .
-
-:CWE-916 a owl:Class ;
- rdfs:label "Use of Password Hash With Insufficient Computational Effort" ;
- rdfs:subClassOf :CWE-327,
- :CWE-328 ;
- :cwe-id "CWE-916" ;
- :definition "The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive." .
-
-:CWE-917 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')" ;
- rdfs:subClassOf :CWE-77 ;
- :cwe-id "CWE-917" ;
- :definition "The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed." ;
- :synonym "EL Injection" .
-
-:CWE-918 a owl:Class ;
- rdfs:label "Server-Side Request Forgery (SSRF)" ;
- rdfs:subClassOf :CWE-441,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserInputFunction ] ;
- :cwe-id "CWE-918" ;
- :definition "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination." ;
- :synonym "SSRF",
- "XSPA" .
-
-:CWE-920 a owl:Class ;
- rdfs:label "Improper Restriction of Power Consumption" ;
- rdfs:subClassOf :CWE-400 ;
- :cwe-id "CWE-920" ;
- :definition "The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes." .
-
-:CWE-921 a owl:Class ;
- rdfs:label "Storage of Sensitive Data in a Mechanism without Access Control" ;
- rdfs:subClassOf :CWE-922 ;
- :cwe-id "CWE-921" ;
- :definition "The product stores sensitive information in a file system or device that does not have built-in access control." .
-
-:CWE-922 a owl:Class ;
- rdfs:label "Insecure Storage of Sensitive Information" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-922" ;
- :definition "The product stores sensitive information without properly limiting read or write access by unauthorized actors." .
-
-:CWE-923 a owl:Class ;
- rdfs:label "Improper Restriction of Communication Channel to Intended Endpoints" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-923" ;
- :definition "The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint." .
-
-:CWE-924 a owl:Class ;
- rdfs:label "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-924" ;
- :definition "The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission." .
-
-:CWE-925 a owl:Class ;
- rdfs:label "Improper Verification of Intent by Broadcast Receiver" ;
- rdfs:subClassOf :CWE-940 ;
- :cwe-id "CWE-925" ;
- :definition "The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source." ;
- :synonym "Intent Spoofing" .
-
-:CWE-926 a owl:Class ;
- rdfs:label "Improper Export of Android Application Components" ;
- rdfs:subClassOf :CWE-285 ;
- :cwe-id "CWE-926" ;
- :definition "The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains." .
-
-:CWE-927 a owl:Class ;
- rdfs:label "Use of Implicit Intent for Sensitive Communication" ;
- rdfs:subClassOf :CWE-285,
- :CWE-668 ;
- :cwe-id "CWE-927" ;
- :definition "The Android application uses an implicit intent for transmitting sensitive data to other applications." .
-
-:CWE-939 a owl:Class ;
- rdfs:label "Improper Authorization in Handler for Custom URL Scheme" ;
- rdfs:subClassOf :CWE-862 ;
- :cwe-id "CWE-939" ;
- :definition "The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme." .
-
-:CWE-940 a owl:Class ;
- rdfs:label "Improper Verification of Source of a Communication Channel" ;
- rdfs:subClassOf :CWE-346,
- :CWE-923 ;
- :cwe-id "CWE-940" ;
- :definition "The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin." .
-
-:CWE-941 a owl:Class ;
- rdfs:label "Incorrectly Specified Destination in a Communication Channel" ;
- rdfs:subClassOf :CWE-923 ;
- :cwe-id "CWE-941" ;
- :definition "The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor." .
-
-:CWE-942 a owl:Class ;
- rdfs:label "Permissive Cross-domain Policy with Untrusted Domains" ;
- rdfs:subClassOf :CWE-183,
- :CWE-863,
- :CWE-923 ;
- :cwe-id "CWE-942" ;
- :definition "The product uses a cross-domain policy file that includes domains that should not be trusted." .
-
-:CWE-943 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements in Data Query Logic" ;
- rdfs:subClassOf :CWE-74 ;
- :cwe-id "CWE-943" ;
- :definition "The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query." ;
- :synonym "NoSQL Injection, NoSQLi" .
-
-:CWE-1004 a owl:Class ;
- rdfs:label "Sensitive Cookie Without 'HttpOnly' Flag" ;
- rdfs:subClassOf :CWE-732 ;
- :cwe-id "CWE-1004" ;
- :definition "The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag." .
-
-:CWE-1007 a owl:Class ;
- rdfs:label "Insufficient Visual Distinction of Homoglyphs Presented to User" ;
- rdfs:subClassOf :CWE-451 ;
- :cwe-id "CWE-1007" ;
- :definition "The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action." ;
- :synonym "Homograph Attack" .
-
-:CWE-1021 a owl:Class ;
- rdfs:label "Improper Restriction of Rendered UI Layers or Frames" ;
- rdfs:subClassOf :CWE-441,
- :CWE-451 ;
- :cwe-id "CWE-1021" ;
- :definition "The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with." ;
- :synonym "Clickjacking",
- "Tapjacking",
- "UI Redress Attack" .
-
-:CWE-1022 a owl:Class ;
- rdfs:label "Use of Web Link to Untrusted Target with window.opener Access" ;
- rdfs:subClassOf :CWE-266 ;
- :cwe-id "CWE-1022" ;
- :definition "The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property." ;
- :synonym "tabnabbing" .
-
-:CWE-1023 a owl:Class ;
- rdfs:label "Incomplete Comparison with Missing Factors" ;
- rdfs:subClassOf :CWE-697 ;
- :cwe-id "CWE-1023" ;
- :definition "The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors." .
-
-:CWE-1024 a owl:Class ;
- rdfs:label "Comparison of Incompatible Types" ;
- rdfs:subClassOf :CWE-697 ;
- :cwe-id "CWE-1024" ;
- :definition "The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared." .
-
-:CWE-1025 a owl:Class ;
- rdfs:label "Comparison Using Wrong Factors" ;
- rdfs:subClassOf :CWE-697 ;
- :cwe-id "CWE-1025" ;
- :definition "The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses." .
-
-:CWE-1037 a owl:Class ;
- rdfs:label "Processor Optimization Removal or Modification of Security-critical Code" ;
- rdfs:subClassOf :CWE-1038 ;
- :cwe-id "CWE-1037" ;
- :definition "The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified." .
-
-:CWE-1038 a owl:Class ;
- rdfs:label "Insecure Automated Optimizations" ;
- rdfs:subClassOf :CWE-435,
- :CWE-758 ;
- :cwe-id "CWE-1038" ;
- :definition "The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption." .
-
-:CWE-1039 a owl:Class ;
- rdfs:label "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
- "Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism" ;
- rdfs:subClassOf :CWE-693,
- :CWE-697 ;
- :cwe-id "CWE-1039" ;
- :definition "The product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or audio) as a particular concept or category, but it does not properly detect or handle inputs that have been modified or constructed in a way that causes the mechanism to detect a different, incorrect concept." .
-
-:CWE-1041 a owl:Class ;
- rdfs:label "Use of Redundant Code" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1041" ;
- :definition "The product has multiple functions, methods, procedures, macros, etc. that contain the same code." .
-
-:CWE-1042 a owl:Class ;
- rdfs:label "Static Member Data Element outside of a Singleton Class Element" ;
- rdfs:subClassOf :CWE-1176 ;
- :cwe-id "CWE-1042" ;
- :definition "The code contains a member element that is declared as static (but not final), in which its parent class element is not a singleton class - that is, a class element that can be used only once in the 'to' association of a Create action." .
-
-:CWE-1043 a owl:Class ;
- rdfs:label "Data Element Aggregating an Excessively Large Number of Non-Primitive Elements" ;
- rdfs:subClassOf :CWE-1093 ;
- :cwe-id "CWE-1043" ;
- :definition "The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects." .
-
-:CWE-1044 a owl:Class ;
- rdfs:label "Architecture with Number of Horizontal Layers Outside of Expected Range" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1044" ;
- :definition "The product's architecture contains too many - or too few - horizontal layers." .
-
-:CWE-1045 a owl:Class ;
- rdfs:label "Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1045" ;
- :definition "A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor." .
-
-:CWE-1046 a owl:Class ;
- rdfs:label "Creation of Immutable Text Using String Concatenation" ;
- rdfs:subClassOf :CWE-1176 ;
- :cwe-id "CWE-1046" ;
- :definition "The product creates an immutable text string using string concatenation operations." .
-
-:CWE-1047 a owl:Class ;
- rdfs:label "Modules with Circular Dependencies" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1047" ;
- :definition "The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies." .
-
-:CWE-1048 a owl:Class ;
- rdfs:label "Invokable Control Element with Large Number of Outward Calls" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1048" ;
- :definition "The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large." .
-
-:CWE-1049 a owl:Class ;
- rdfs:label "Excessive Data Query Operations in a Large Data Table" ;
- rdfs:subClassOf :CWE-1176 ;
- :cwe-id "CWE-1049" ;
- :definition "The product performs a data query with a large number of joins and sub-queries on a large data table." .
-
-:CWE-1050 a owl:Class ;
- rdfs:label "Excessive Platform Resource Consumption within a Loop" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-1050" ;
- :definition "The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors." .
-
-:CWE-1051 a owl:Class ;
- rdfs:label "Initialization with Hard-Coded Network Resource Configuration Data" ;
- rdfs:subClassOf :CWE-665,
- :CWE-1419 ;
- :cwe-id "CWE-1051" ;
- :definition "The product initializes data using hard-coded values that act as network resource identifiers." .
-
-:CWE-1052 a owl:Class ;
- rdfs:label "Excessive Use of Hard-Coded Literals in Initialization" ;
- rdfs:subClassOf :CWE-665,
- :CWE-1419 ;
- :cwe-id "CWE-1052" ;
- :definition "The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element." .
-
-:CWE-1053 a owl:Class ;
- rdfs:label "Missing Documentation for Design" ;
- rdfs:subClassOf :CWE-1059 ;
- :cwe-id "CWE-1053" ;
- :definition "The product does not have documentation that represents how it is designed." .
-
-:CWE-1054 a owl:Class ;
- rdfs:label "Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer" ;
- rdfs:subClassOf :CWE-1061 ;
- :cwe-id "CWE-1054" ;
- :definition "The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the invocation skips at least one layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer." .
-
-:CWE-1055 a owl:Class ;
- rdfs:label "Multiple Inheritance from Concrete Classes" ;
- rdfs:subClassOf :CWE-1093 ;
- :cwe-id "CWE-1055" ;
- :definition "The product contains a class with inheritance from more than one concrete class." .
-
-:CWE-1056 a owl:Class ;
- rdfs:label "Invokable Control Element with Variadic Parameters" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1056" ;
- :definition "A named-callable or method control element has a signature that supports a variable (variadic) number of parameters or arguments." .
-
-:CWE-1057 a owl:Class ;
- rdfs:label "Data Access Operations Outside of Expected Data Manager Component" ;
- rdfs:subClassOf :CWE-1061 ;
- :cwe-id "CWE-1057" ;
- :definition "The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager." .
-
-:CWE-1058 a owl:Class ;
- rdfs:label "Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element" ;
- rdfs:subClassOf :CWE-662 ;
- :cwe-id "CWE-1058" ;
- :definition "The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element." .
-
-:CWE-1059 a owl:Class ;
- rdfs:label "Insufficient Technical Documentation" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1059" ;
- :definition "The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc." .
-
-:CWE-1060 a owl:Class ;
- rdfs:label "Excessive Number of Inefficient Server-Side Data Accesses" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1060" ;
- :definition "The product performs too many data queries without using efficient data processing functionality such as stored procedures." .
-
-:CWE-1061 a owl:Class ;
- rdfs:label "Insufficient Encapsulation" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1061" ;
- :definition "The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend." .
-
-:CWE-1062 a owl:Class ;
- rdfs:label "Parent Class with References to Child Class" ;
- rdfs:subClassOf :CWE-1061 ;
- :cwe-id "CWE-1062" ;
- :definition "The code has a parent class that contains references to a child class, its methods, or its members." .
-
-:CWE-1063 a owl:Class ;
- rdfs:label "Creation of Class Instance within a Static Code Block" ;
- rdfs:subClassOf :CWE-1176 ;
- :cwe-id "CWE-1063" ;
- :definition "A static code block creates an instance of a class." .
-
-:CWE-1064 a owl:Class ;
- rdfs:label "Invokable Control Element with Signature Containing an Excessive Number of Parameters" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1064" ;
- :definition "The product contains a function, subroutine, or method whose signature has an unnecessarily large number of parameters/arguments." .
-
-:CWE-1065 a owl:Class ;
- rdfs:label "Runtime Resource Management Control Element in a Component Built to Run on Application Servers" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1065" ;
- :definition "The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server." .
-
-:CWE-1066 a owl:Class ;
- rdfs:label "Missing Serialization Control Element" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1066" ;
- :definition "The product contains a serializable data element that does not have an associated serialization method." .
-
-:CWE-1067 a owl:Class ;
- rdfs:label "Excessive Execution of Sequential Searches of Data Resource" ;
- rdfs:subClassOf :CWE-1176 ;
- :cwe-id "CWE-1067" ;
- :definition "The product contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches to be performed." .
-
-:CWE-1068 a owl:Class ;
- rdfs:label "Inconsistency Between Implementation and Documented Design" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1068" ;
- :definition "The implementation of the product is not consistent with the design as described within the relevant documentation." .
-
-:CWE-1069 a owl:Class ;
- rdfs:label "Empty Exception Block" ;
- rdfs:subClassOf :CWE-1071 ;
- :cwe-id "CWE-1069" ;
- :definition "An invokable code block contains an exception handling block that does not contain any code, i.e. is empty." .
-
-:CWE-1070 a owl:Class ;
- rdfs:label "Serializable Data Element Containing non-Serializable Item Elements" ;
- rdfs:subClassOf :CWE-710,
- :CWE-1076 ;
- :cwe-id "CWE-1070" ;
- :definition "The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable." .
-
-:CWE-1071 a owl:Class ;
- rdfs:label "Empty Code Block" ;
- rdfs:subClassOf :CWE-1164 ;
- :cwe-id "CWE-1071" ;
- :definition "The source code contains a block that does not contain any code, i.e., the block is empty." .
-
-:CWE-1072 a owl:Class ;
- rdfs:label "Data Resource Access without Use of Connection Pooling" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-1072" ;
- :definition "The product accesses a data resource through a database without using a connection pooling capability." .
-
-:CWE-1073 a owl:Class ;
- rdfs:label "Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-1073" ;
- :definition "The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities." .
-
-:CWE-1074 a owl:Class ;
- rdfs:label "Class with Excessively Deep Inheritance" ;
- rdfs:subClassOf :CWE-1093 ;
- :cwe-id "CWE-1074" ;
- :definition "A class has an inheritance level that is too high, i.e., it has a large number of parent classes." .
-
-:CWE-1075 a owl:Class ;
- rdfs:label "Unconditional Control Flow Transfer outside of Switch Block" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1075" ;
- :definition "The product performs unconditional control transfer (such as a \"goto\") in code outside of a branching structure such as a switch block." .
-
-:CWE-1076 a owl:Class ;
- rdfs:label "Insufficient Adherence to Expected Conventions" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1076" ;
- :definition "The product's architecture, source code, design, documentation, or other artifact does not follow required conventions." .
-
-:CWE-1077 a owl:Class ;
- rdfs:label "Floating Point Comparison with Incorrect Operator" ;
- rdfs:subClassOf :CWE-697 ;
- :cwe-id "CWE-1077" ;
- :definition "The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision." .
-
-:CWE-1078 a owl:Class ;
- rdfs:label "Inappropriate Source Code Style or Formatting" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1078" ;
- :definition "The source code does not follow desired style or formatting for indentation, white space, comments, etc." .
-
-:CWE-1079 a owl:Class ;
- rdfs:label "Parent Class without Virtual Destructor Method" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1079" ;
- :definition "A parent class contains one or more child classes, but the parent class does not have a virtual destructor method." .
-
-:CWE-1080 a owl:Class ;
- rdfs:label "Source Code File with Excessive Number of Lines of Code" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1080" ;
- :definition "A source code file has too many lines of code." .
-
-:CWE-1082 a owl:Class ;
- rdfs:label "Class Instance Self Destruction Control Element" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1082" ;
- :definition "The code contains a class instance that calls the method or function to delete or destroy itself." .
-
-:CWE-1083 a owl:Class ;
- rdfs:label "Data Access from Outside Expected Data Manager Component" ;
- rdfs:subClassOf :CWE-1061 ;
- :cwe-id "CWE-1083" ;
- :definition "The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component." .
-
-:CWE-1084 a owl:Class ;
- rdfs:label "Invokable Control Element with Excessive File or Data Access Operations" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-1084" ;
- :definition "A function or method contains too many operations that utilize a data manager or file resource." .
-
-:CWE-1085 a owl:Class ;
- rdfs:label "Invokable Control Element with Excessive Volume of Commented-out Code" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1085" ;
- :definition "A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body." .
-
-:CWE-1086 a owl:Class ;
- rdfs:label "Class with Excessive Number of Child Classes" ;
- rdfs:subClassOf :CWE-1093 ;
- :cwe-id "CWE-1086" ;
- :definition "A class contains an unnecessarily large number of children." .
-
-:CWE-1087 a owl:Class ;
- rdfs:label "Class with Virtual Method without a Virtual Destructor" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1087" ;
- :definition "A class contains a virtual method, but the method does not have an associated virtual destructor." .
-
-:CWE-1088 a owl:Class ;
- rdfs:label "Synchronous Access of Remote Resource without Timeout" ;
- rdfs:subClassOf :CWE-821 ;
- :cwe-id "CWE-1088" ;
- :definition "The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite." .
-
-:CWE-1089 a owl:Class ;
- rdfs:label "Large Data Table with Excessive Number of Indices" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-1089" ;
- :definition "The product uses a large data table that contains an excessively large number of indices." .
-
-:CWE-1090 a owl:Class ;
- rdfs:label "Method Containing Access of a Member Element from Another Class" ;
- rdfs:subClassOf :CWE-1061 ;
- :cwe-id "CWE-1090" ;
- :definition "A method for a class performs an operation that directly accesses a member element from another class." .
-
-:CWE-1091 a owl:Class ;
- rdfs:label "Use of Object without Invoking Destructor Method" ;
- rdfs:subClassOf :CWE-772,
- :CWE-1076 ;
- :cwe-id "CWE-1091" ;
- :definition "The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method." .
-
-:CWE-1092 a owl:Class ;
- rdfs:label "Use of Same Invokable Control Element in Multiple Architectural Layers" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1092" ;
- :definition "The product uses the same control element across multiple architectural layers." .
-
-:CWE-1093 a owl:Class ;
- rdfs:label "Excessively Complex Data Representation" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1093" ;
- :definition "The product uses an unnecessarily complex internal representation for its data structures or interrelationships between those structures." .
-
-:CWE-1094 a owl:Class ;
- rdfs:label "Excessive Index Range Scan for a Data Resource" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-1094" ;
- :definition "The product contains an index range scan for a large data table, but the scan can cover a large number of rows." .
-
-:CWE-1095 a owl:Class ;
- rdfs:label "Loop Condition Value Update within the Loop" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1095" ;
- :definition "The product uses a loop with a control flow condition based on a value that is updated within the body of the loop." .
-
-:CWE-1096 a owl:Class ;
- rdfs:label "Singleton Class Instance Creation without Proper Locking or Synchronization" ;
- rdfs:subClassOf :CWE-820 ;
- :cwe-id "CWE-1096" ;
- :definition "The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once." .
-
-:CWE-1097 a owl:Class ;
- rdfs:label "Persistent Storable Data Element without Associated Comparison Control Element" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1097" ;
- :definition "The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison." .
-
-:CWE-1098 a owl:Class ;
- rdfs:label "Data Element containing Pointer Item without Proper Copy Control Element" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1098" ;
- :definition "The code contains a data element with a pointer that does not have an associated copy or constructor method." .
-
-:CWE-1099 a owl:Class ;
- rdfs:label "Inconsistent Naming Conventions for Identifiers" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1099" ;
- :definition "The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements." .
-
-:CWE-1100 a owl:Class ;
- rdfs:label "Insufficient Isolation of System-Dependent Functions" ;
- rdfs:subClassOf :CWE-1061 ;
- :cwe-id "CWE-1100" ;
- :definition "The product or code does not isolate system-dependent functionality into separate standalone modules." .
-
-:CWE-1101 a owl:Class ;
- rdfs:label "Reliance on Runtime Component in Generated Code" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1101" ;
- :definition "The product uses automatically-generated code that cannot be executed without a specific runtime support component." .
-
-:CWE-1102 a owl:Class ;
- rdfs:label "Reliance on Machine-Dependent Data Representation" ;
- rdfs:subClassOf :CWE-758 ;
- :cwe-id "CWE-1102" ;
- :definition "The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, OSes, or other physical components." .
-
-:CWE-1103 a owl:Class ;
- rdfs:label "Use of Platform-Dependent Third Party Components" ;
- rdfs:subClassOf :CWE-758 ;
- :cwe-id "CWE-1103" ;
- :definition "The product relies on third-party components that do not provide equivalent functionality across all desirable platforms." .
-
-:CWE-1104 a owl:Class ;
- rdfs:label "Use of Unmaintained Third Party Components" ;
- rdfs:subClassOf :CWE-1357 ;
- :cwe-id "CWE-1104" ;
- :definition "The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer." .
-
-:CWE-1105 a owl:Class ;
- rdfs:label "Insufficient Encapsulation of Machine-Dependent Functionality" ;
- rdfs:subClassOf :CWE-758,
- :CWE-1061 ;
- :cwe-id "CWE-1105" ;
- :definition "The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code." .
-
-:CWE-1106 a owl:Class ;
- rdfs:label "Insufficient Use of Symbolic Constants" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1106" ;
- :definition "The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants." .
-
-:CWE-1107 a owl:Class ;
- rdfs:label "Insufficient Isolation of Symbolic Constant Definitions" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1107" ;
- :definition "The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location." .
-
-:CWE-1108 a owl:Class ;
- rdfs:label "Excessive Reliance on Global Variables" ;
- rdfs:subClassOf :CWE-1076 ;
- :cwe-id "CWE-1108" ;
- :definition "The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context." .
-
-:CWE-1109 a owl:Class ;
- rdfs:label "Use of Same Variable for Multiple Purposes" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1109" ;
- :definition "The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data." .
-
-:CWE-1110 a owl:Class ;
- rdfs:label "Incomplete Design Documentation" ;
- rdfs:subClassOf :CWE-1059 ;
- :cwe-id "CWE-1110" ;
- :definition "The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design." .
-
-:CWE-1111 a owl:Class ;
- rdfs:label "Incomplete I/O Documentation" ;
- rdfs:subClassOf :CWE-1059 ;
- :cwe-id "CWE-1111" ;
- :definition "The product's documentation does not adequately define inputs, outputs, or system/software interfaces." .
-
-:CWE-1112 a owl:Class ;
- rdfs:label "Incomplete Documentation of Program Execution" ;
- rdfs:subClassOf :CWE-1059 ;
- :cwe-id "CWE-1112" ;
- :definition "The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed." .
-
-:CWE-1113 a owl:Class ;
- rdfs:label "Inappropriate Comment Style" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1113" ;
- :definition "The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product." .
-
-:CWE-1114 a owl:Class ;
- rdfs:label "Inappropriate Whitespace Style" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1114" ;
- :definition "The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product." .
-
-:CWE-1115 a owl:Class ;
- rdfs:label "Source Code Element without Standard Prologue" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1115" ;
- :definition "The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project." .
-
-:CWE-1116 a owl:Class ;
- rdfs:label "Inaccurate Comments" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1116" ;
- :definition "The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated." .
-
-:CWE-1117 a owl:Class ;
- rdfs:label "Callable with Insufficient Behavioral Summary" ;
- rdfs:subClassOf :CWE-1078 ;
- :cwe-id "CWE-1117" ;
- :definition "The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes." .
-
-:CWE-1118 a owl:Class ;
- rdfs:label "Insufficient Documentation of Error Handling Techniques" ;
- rdfs:subClassOf :CWE-1059 ;
- :cwe-id "CWE-1118" ;
- :definition "The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanisms." .
-
-:CWE-1119 a owl:Class ;
- rdfs:label "Excessive Use of Unconditional Branching" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1119" ;
- :definition "The code uses too many unconditional branches (such as \"goto\")." .
-
-:CWE-1120 a owl:Class ;
- rdfs:label "Excessive Code Complexity" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1120" ;
- :definition "The code is too complex, as calculated using a well-defined, quantitative measure." .
-
-:CWE-1121 a owl:Class ;
- rdfs:label "Excessive McCabe Cyclomatic Complexity" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1121" ;
- :definition "The code contains McCabe cyclomatic complexity that exceeds a desirable maximum." .
-
-:CWE-1122 a owl:Class ;
- rdfs:label "Excessive Halstead Complexity" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1122" ;
- :definition "The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum." .
-
-:CWE-1123 a owl:Class ;
- rdfs:label "Excessive Use of Self-Modifying Code" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1123" ;
- :definition "The product uses too much self-modifying code." .
-
-:CWE-1124 a owl:Class ;
- rdfs:label "Excessively Deep Nesting" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1124" ;
- :definition "The code contains a callable or other code grouping in which the nesting / branching is too deep." .
-
-:CWE-1125 a owl:Class ;
- rdfs:label "Excessive Attack Surface" ;
- rdfs:subClassOf :CWE-1120 ;
- :cwe-id "CWE-1125" ;
- :definition "The product has an attack surface whose quantitative measurement exceeds a desirable maximum." .
-
-:CWE-1126 a owl:Class ;
- rdfs:label "Declaration of Variable with Unnecessarily Wide Scope" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1126" ;
- :definition "The source code declares a variable in one scope, but the variable is only used within a narrower scope." .
-
-:CWE-1127 a owl:Class ;
- rdfs:label "Compilation with Insufficient Warnings or Errors" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1127" ;
- :definition "The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues." .
-
-:CWE-1164 a owl:Class ;
- rdfs:label "Irrelevant Code" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1164" ;
- :definition "The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness." .
-
-:CWE-1173 a owl:Class ;
- rdfs:label "Improper Use of Validation Framework" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-1173" ;
- :definition "The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library." .
-
-:CWE-1174 a owl:Class ;
- rdfs:label "ASP.NET Misconfiguration: Improper Model Validation" ;
- rdfs:subClassOf :CWE-1173 ;
- :cwe-id "CWE-1174" ;
- :definition "The ASP.NET application does not use, or incorrectly uses, the model validation framework." .
-
-:CWE-1176 a owl:Class ;
- rdfs:label "Inefficient CPU Computation" ;
- rdfs:subClassOf :CWE-405 ;
- :cwe-id "CWE-1176" ;
- :definition "The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further." .
-
-:CWE-1177 a owl:Class ;
- rdfs:label "Use of Prohibited Code" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1177" ;
- :definition "The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer." .
-
-:CWE-1188 a owl:Class ;
- rdfs:label "Initialization of a Resource with an Insecure Default",
- "Insecure Default Initialization of Resource" ;
- rdfs:subClassOf :CWE-665,
- :CWE-1419 ;
- :cwe-id "CWE-1188" ;
- :definition "The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure." .
-
-:CWE-1189 a owl:Class ;
- rdfs:label "Improper Isolation of Shared Resources on System-on-a-Chip (SoC)" ;
- rdfs:subClassOf :CWE-653,
- :CWE-668 ;
- :cwe-id "CWE-1189" ;
- :definition "The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents." .
-
-:CWE-1190 a owl:Class ;
- rdfs:label "DMA Device Enabled Too Early in Boot Phase" ;
- rdfs:subClassOf :CWE-696 ;
- :cwe-id "CWE-1190" ;
- :definition "The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product." .
-
-:CWE-1191 a owl:Class ;
- rdfs:label "On-Chip Debug and Test Interface With Improper Access Control" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1191" ;
- :definition "The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface." .
-
-:CWE-1192 a owl:Class ;
- rdfs:label "Improper Identifier for IP Block used in System-On-Chip (SOC)",
- "System-on-Chip (SoC) Using Components without Unique, Immutable Identifiers" ;
- rdfs:subClassOf :CWE-657 ;
- :cwe-id "CWE-1192" ;
- :definition "The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components." .
-
-:CWE-1193 a owl:Class ;
- rdfs:label "Power-On of Untrusted Execution Core Before Enabling Fabric Access Control" ;
- rdfs:subClassOf :CWE-696 ;
- :cwe-id "CWE-1193" ;
- :definition "The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled." .
-
-:CWE-1204 a owl:Class ;
- rdfs:label "Generation of Weak Initialization Vector (IV)" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-1204" ;
- :definition "The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive. " .
-
-:CWE-1209 a owl:Class ;
- rdfs:label "Failure to Disable Reserved Bits" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1209" ;
- :definition "The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits are used for future capabilities and should not support any functional logic in the design. However, designers might covertly use these bits to debug or further develop new capabilities in production hardware. Adversaries with access to these bits will write to them in hopes of compromising hardware state." .
-
-:CWE-1220 a owl:Class ;
- rdfs:label "Insufficient Granularity of Access Control" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1220" ;
- :definition "The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets." .
-
-:CWE-1221 a owl:Class ;
- rdfs:label "Incorrect Register Defaults or Module Parameters" ;
- rdfs:subClassOf :CWE-665,
- :CWE-1419 ;
- :cwe-id "CWE-1221" ;
- :definition "Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values." .
-
-:CWE-1222 a owl:Class ;
- rdfs:label "Insufficient Granularity of Address Regions Protected by Register Locks" ;
- rdfs:subClassOf :CWE-1220 ;
- :cwe-id "CWE-1222" ;
- :definition "The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process." .
-
-:CWE-1223 a owl:Class ;
- rdfs:label "Race Condition for Write-Once Attributes" ;
- rdfs:subClassOf :CWE-362 ;
- :cwe-id "CWE-1223" ;
- :definition "A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue." .
-
-:CWE-1224 a owl:Class ;
- rdfs:label "Improper Restriction of Write-Once Bit Fields" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1224" ;
- :definition "The hardware design control register \"sticky bits\" or write-once bit fields are improperly implemented, such that they can be reprogrammed by software." .
-
-:CWE-1229 a owl:Class ;
- rdfs:label "Creation of Emergent Resource" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-1229" ;
- :definition "The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy." .
-
-:CWE-1230 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information Through Metadata" ;
- rdfs:subClassOf :CWE-285 ;
- :cwe-id "CWE-1230" ;
- :definition "The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information." .
-
-:CWE-1231 a owl:Class ;
- rdfs:label "Improper Prevention of Lock Bit Modification" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1231" ;
- :definition "The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set." .
-
-:CWE-1232 a owl:Class ;
- rdfs:label "Improper Lock Behavior After Power State Transition" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-1232" ;
- :definition "Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable." .
-
-:CWE-1233 a owl:Class ;
- rdfs:label "Security-Sensitive Hardware Controls with Missing Lock Bit Protection" ;
- rdfs:subClassOf :CWE-284,
- :CWE-667 ;
- :cwe-id "CWE-1233" ;
- :definition "The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration." .
-
-:CWE-1234 a owl:Class ;
- rdfs:label "Hardware Internal or Debug Modes Allow Override of Locks" ;
- rdfs:subClassOf :CWE-667 ;
- :cwe-id "CWE-1234" ;
- :definition "System configuration protection may be bypassed during debug mode." .
-
-:CWE-1235 a owl:Class ;
- rdfs:label "Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations" ;
- rdfs:subClassOf :CWE-400 ;
- :cwe-id "CWE-1235" ;
- :definition "The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations." .
-
-:CWE-1236 a owl:Class ;
- rdfs:label "Improper Neutralization of Formula Elements in a CSV File" ;
- rdfs:subClassOf :CWE-74 ;
- :cwe-id "CWE-1236" ;
- :definition "The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product." ;
- :synonym "CSV Injection",
- "Excel Macro Injection",
- "Formula Injection" .
-
-:CWE-1239 a owl:Class ;
- rdfs:label "Improper Zeroization of Hardware Register" ;
- rdfs:subClassOf :CWE-226 ;
- :cwe-id "CWE-1239" ;
- :definition "The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes." .
-
-:CWE-1240 a owl:Class ;
- rdfs:label "Use of a Cryptographic Primitive with a Risky Implementation" ;
- rdfs:subClassOf :CWE-327 ;
- :cwe-id "CWE-1240" ;
- :definition "To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation." .
-
-:CWE-1241 a owl:Class ;
- rdfs:label "Use of Predictable Algorithm in Random Number Generator" ;
- rdfs:subClassOf :CWE-330 ;
- :cwe-id "CWE-1241" ;
- :definition "The device uses an algorithm that is predictable and generates a pseudo-random number." .
-
-:CWE-1242 a owl:Class ;
- rdfs:label "Inclusion of Undocumented Features or Chicken Bits" ;
- rdfs:subClassOf :CWE-284,
- :CWE-912 ;
- :cwe-id "CWE-1242" ;
- :definition "The device includes chicken bits or undocumented features that can create entry points for unauthorized actors." .
-
-:CWE-1243 a owl:Class ;
- rdfs:label "Sensitive Non-Volatile Information Not Protected During Debug" ;
- rdfs:subClassOf :CWE-1263 ;
- :cwe-id "CWE-1243" ;
- :definition "Access to security-sensitive information stored in fuses is not limited during debug." .
-
-:CWE-1244 a owl:Class ;
- rdfs:label "Internal Asset Exposed to Unsafe Debug Access Level or State" ;
- rdfs:subClassOf :CWE-863 ;
- :cwe-id "CWE-1244" ;
- :definition "The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents." .
-
-:CWE-1245 a owl:Class ;
- rdfs:label "Improper Finite State Machines (FSMs) in Hardware Logic" ;
- rdfs:subClassOf :CWE-684 ;
- :cwe-id "CWE-1245" ;
- :definition "Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system." .
-
-:CWE-1246 a owl:Class ;
- rdfs:label "Improper Write Handling in Limited-write Non-Volatile Memories" ;
- rdfs:subClassOf :CWE-400 ;
- :cwe-id "CWE-1246" ;
- :definition "The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories." .
-
-:CWE-1247 a owl:Class ;
- rdfs:label "Improper Protection Against Voltage and Clock Glitches" ;
- rdfs:subClassOf :CWE-1384 ;
- :cwe-id "CWE-1247" ;
- :definition "The device does not contain or contains incorrectly implemented circuitry or sensors to detect and mitigate voltage and clock glitches and protect sensitive information or software contained on the device." .
-
-:CWE-1248 a owl:Class ;
- rdfs:label "Semiconductor Defects in Hardware Logic with Security-Sensitive Implications" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1248" ;
- :definition "The security-sensitive hardware module contains semiconductor defects." .
-
-:CWE-1249 a owl:Class ;
- rdfs:label "Application-Level Admin Tool with Inconsistent View of Underlying Operating System" ;
- rdfs:subClassOf :CWE-1250 ;
- :cwe-id "CWE-1249" ;
- :definition "The product provides an application for administrators to manage parts of the underlying operating system, but the application does not accurately identify all of the relevant entities or resources that exist in the OS; that is, the application's model of the OS's state is inconsistent with the OS's actual state." ;
- :synonym "Ghost in the Shell" .
-
-:CWE-1250 a owl:Class ;
- rdfs:label "Improper Preservation of Consistency Between Independent Representations of Shared State" ;
- rdfs:subClassOf :CWE-664 ;
- :cwe-id "CWE-1250" ;
- :definition "The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other." .
-
-:CWE-1251 a owl:Class ;
- rdfs:label "Mirrored Regions with Different Values" ;
- rdfs:subClassOf :CWE-1250 ;
- :cwe-id "CWE-1251" ;
- :definition "The product's architecture mirrors regions without ensuring that their contents always stay in sync." .
-
-:CWE-1252 a owl:Class ;
- rdfs:label "CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1252" ;
- :definition "The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory. This allows an attacker to execute data from all of memory." .
-
-:CWE-1253 a owl:Class ;
- rdfs:label "Incorrect Selection of Fuse Values" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1253" ;
- :definition "The logic level used to set a system to a secure state relies on a fuse being unblown. An attacker can set the system to an insecure state merely by blowing the fuse." .
-
-:CWE-1254 a owl:Class ;
- rdfs:label "Incorrect Comparison Logic Granularity" ;
- rdfs:subClassOf :CWE-208,
- :CWE-697 ;
- :cwe-id "CWE-1254" ;
- :definition "The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes." .
-
-:CWE-1255 a owl:Class ;
- rdfs:label "Comparison Logic is Vulnerable to Power Side-Channel Attacks" ;
- rdfs:subClassOf :CWE-1300 ;
- :cwe-id "CWE-1255" ;
- :definition "A device's real time power consumption may be monitored during security token evaluation and the information gleaned may be used to determine the value of the reference token." .
-
-:CWE-1256 a owl:Class ;
- rdfs:label "Improper Restriction of Software Interfaces to Hardware Features" ;
- rdfs:subClassOf :CWE-285 ;
- :cwe-id "CWE-1256" ;
- :definition "The product provides software-controllable device functionality for capabilities such as power and clock management, but it does not properly limit functionality that can lead to modification of hardware memory or register bits, or the ability to observe physical side channels." .
-
-:CWE-1257 a owl:Class ;
- rdfs:label "Improper Access Control Applied to Mirrored or Aliased Memory Regions" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1257" ;
- :definition "Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the hardware. A possible result is that an untrusted agent is blocked from accessing a memory region but is not blocked from accessing the corresponding aliased memory region. " .
-
-:CWE-1258 a owl:Class ;
- rdfs:label "Exposure of Sensitive System Information Due to Uncleared Debug Information" ;
- rdfs:subClassOf :CWE-200,
- :CWE-212 ;
- :cwe-id "CWE-1258" ;
- :definition "The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered." .
-
-:CWE-1259 a owl:Class ;
- rdfs:label "Improper Restriction of Security Token Assignment" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1259" ;
- :definition "The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected." .
-
-:CWE-1260 a owl:Class ;
- rdfs:label "Improper Handling of Overlap Between Protected Memory Ranges" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1260" ;
- :definition "The product allows address regions to overlap, which can result in the bypassing of intended memory protection." .
-
-:CWE-1261 a owl:Class ;
- rdfs:label "Improper Handling of Single Event Upsets" ;
- rdfs:subClassOf :CWE-1384 ;
- :cwe-id "CWE-1261" ;
- :definition "The hardware logic does not effectively handle when single-event upsets (SEUs) occur." .
-
-:CWE-1262 a owl:Class ;
- rdfs:label "Improper Access Control for Register Interface" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1262" ;
- :definition "The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers." .
-
-:CWE-1263 a owl:Class ;
- rdfs:label "Improper Physical Access Control" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1263" ;
- :definition "The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas." .
-
-:CWE-1264 a owl:Class ;
- rdfs:label "Hardware Logic with Insecure De-Synchronization between Control and Data Channels" ;
- rdfs:subClassOf :CWE-821 ;
- :cwe-id "CWE-1264" ;
- :definition "The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete." .
-
-:CWE-1265 a owl:Class ;
- rdfs:label "Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-1265" ;
- :definition "During execution of non-reentrant code, the product performs a call that unintentionally produces a nested invocation of the non-reentrant code." .
-
-:CWE-1266 a owl:Class ;
- rdfs:label "Improper Scrubbing of Sensitive Data from Decommissioned Device" ;
- rdfs:subClassOf :CWE-404 ;
- :cwe-id "CWE-1266" ;
- :definition "The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect." .
-
-:CWE-1267 a owl:Class ;
- rdfs:label "Policy Uses Obsolete Encoding" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1267" ;
- :definition "The product uses an obsolete encoding mechanism to implement access controls." .
-
-:CWE-1268 a owl:Class ;
- rdfs:label "Policy Privileges are not Assigned Consistently Between Control and Data Agents" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1268" ;
- :definition "The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies. " .
-
-:CWE-1269 a owl:Class ;
- rdfs:label "Product Released in Non-Release Configuration" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1269" ;
- :definition "The product released to market is released in pre-production or manufacturing configuration." .
-
-:CWE-1270 a owl:Class ;
- rdfs:label "Generation of Incorrect Security Tokens" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1270" ;
- :definition "The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect." .
-
-:CWE-1271 a owl:Class ;
- rdfs:label "Uninitialized Value on Reset for Registers Holding Security Settings" ;
- rdfs:subClassOf :CWE-909 ;
- :cwe-id "CWE-1271" ;
- :definition "Security-critical logic is not set to a known value on reset." .
-
-:CWE-1272 a owl:Class ;
- rdfs:label "Sensitive Information Uncleared Before Debug/Power State Transition" ;
- rdfs:subClassOf :CWE-226 ;
- :cwe-id "CWE-1272" ;
- :definition "The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions." .
-
-:CWE-1273 a owl:Class ;
- rdfs:label "Device Unlock Credential Sharing" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-1273" ;
- :definition "The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information." .
-
-:CWE-1274 a owl:Class ;
- rdfs:label "Improper Access Control for Volatile Memory Containing Boot Code" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1274" ;
- :definition "The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other protections for the Volatile Memory." .
-
-:CWE-1275 a owl:Class ;
- rdfs:label "Sensitive Cookie with Improper SameSite Attribute" ;
- rdfs:subClassOf :CWE-923 ;
- :cwe-id "CWE-1275" ;
- :definition "The SameSite attribute for sensitive cookies is not set, or an insecure value is used." .
-
-:CWE-1276 a owl:Class ;
- rdfs:label "Hardware Child Block Incorrectly Connected to Parent System" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1276" ;
- :definition "Signals between a hardware IP and the parent system design are incorrectly connected causing security risks." .
-
-:CWE-1277 a owl:Class ;
- rdfs:label "Firmware Not Updateable" ;
- rdfs:subClassOf :CWE-1329 ;
- :cwe-id "CWE-1277" ;
- :definition "The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present." .
-
-:CWE-1278 a owl:Class ;
- rdfs:label "Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1278" ;
- :definition "Information stored in hardware may be recovered by an attacker with the capability to capture and analyze images of the integrated circuit using techniques such as scanning electron microscopy." .
-
-:CWE-1279 a owl:Class ;
- rdfs:label "Cryptographic Operations are run Before Supporting Units are Ready" ;
- rdfs:subClassOf :CWE-665,
- :CWE-696 ;
- :cwe-id "CWE-1279" ;
- :definition "Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result." .
-
-:CWE-1280 a owl:Class ;
- rdfs:label "Access Control Check Implemented After Asset is Accessed" ;
- rdfs:subClassOf :CWE-284,
- :CWE-696 ;
- :cwe-id "CWE-1280" ;
- :definition "A product's hardware-based access control check occurs after the asset has been accessed." .
-
-:CWE-1281 a owl:Class ;
- rdfs:label "Sequence of Processor Instructions Leads to Unexpected Behavior" ;
- rdfs:subClassOf :CWE-691 ;
- :cwe-id "CWE-1281" ;
- :definition "Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed." .
-
-:CWE-1282 a owl:Class ;
- rdfs:label "Assumed-Immutable Data is Stored in Writable Memory" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-1282" ;
- :definition "Immutable data, such as a first-stage bootloader, device identifiers, and \"write-once\" configuration settings are stored in writable memory that can be re-programmed or updated in the field." .
-
-:CWE-1283 a owl:Class ;
- rdfs:label "Mutable Attestation or Measurement Reporting Data" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1283" ;
- :definition "The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary." .
-
-:CWE-1284 a owl:Class ;
- rdfs:label "Improper Validation of Specified Quantity in Input" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-1284" ;
- :definition "The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties." .
-
-:CWE-1285 a owl:Class ;
- rdfs:label "Improper Validation of Specified Index, Position, or Offset in Input" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-1285" ;
- :definition "The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties." .
-
-:CWE-1286 a owl:Class ;
- rdfs:label "Improper Validation of Syntactic Correctness of Input" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-1286" ;
- :definition "The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax." .
-
-:CWE-1287 a owl:Class ;
- rdfs:label "Improper Validation of Specified Type of Input" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-1287" ;
- :definition "The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type." .
-
-:CWE-1288 a owl:Class ;
- rdfs:label "Improper Validation of Consistency within Input" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-1288" ;
- :definition "The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent." .
-
-:CWE-1289 a owl:Class ;
- rdfs:label "Improper Validation of Unsafe Equivalence in Input" ;
- rdfs:subClassOf :CWE-20 ;
- :cwe-id "CWE-1289" ;
- :definition "The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value." .
-
-:CWE-1290 a owl:Class ;
- rdfs:label "Incorrect Decoding of Security Identifiers " ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1290" ;
- :definition "The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset." .
-
-:CWE-1291 a owl:Class ;
- rdfs:label "Public Key Re-Use for Signing both Debug and Production Code" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1291" ;
- :definition "The same public key is used for signing both debug and production code." .
-
-:CWE-1292 a owl:Class ;
- rdfs:label "Incorrect Conversion of Security Identifiers" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1292" ;
- :definition "The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly implemented, untrusted agents can gain unauthorized access to the asset." .
-
-:CWE-1293 a owl:Class ;
- rdfs:label "Missing Source Correlation of Multiple Independent Data" ;
- rdfs:subClassOf :CWE-345 ;
- :cwe-id "CWE-1293" ;
- :definition "The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source." .
-
-:CWE-1294 a owl:Class ;
- rdfs:label "Insecure Security Identifier Mechanism" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1294" ;
- :definition "The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented." .
-
-:CWE-1295 a owl:Class ;
- rdfs:label "Debug Messages Revealing Unnecessary Information" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-1295" ;
- :definition "The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages." .
-
-:CWE-1296 a owl:Class ;
- rdfs:label "Incorrect Chaining or Granularity of Debug Components" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1296" ;
- :definition "The product's debug components contain incorrect chaining or granularity of debug components." .
-
-:CWE-1297 a owl:Class ;
- rdfs:label "Unprotected Confidential Information on Device is Accessible by OSAT Vendors" ;
- rdfs:subClassOf :CWE-285 ;
- :cwe-id "CWE-1297" ;
- :definition "The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors." .
-
-:CWE-1298 a owl:Class ;
- rdfs:label "Hardware Logic Contains Race Conditions" ;
- rdfs:subClassOf :CWE-362 ;
- :cwe-id "CWE-1298" ;
- :definition "A race condition in the hardware logic results in undermining security guarantees of the system." .
-
-:CWE-1299 a owl:Class ;
- rdfs:label "Missing Protection Mechanism for Alternate Hardware Interface" ;
- rdfs:subClassOf :CWE-288,
- :CWE-420 ;
- :cwe-id "CWE-1299" ;
- :definition "The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path." .
-
-:CWE-1300 a owl:Class ;
- rdfs:label "Improper Protection of Physical Side Channels" ;
- rdfs:subClassOf :CWE-203 ;
- :cwe-id "CWE-1300" ;
- :definition "The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions." .
-
-:CWE-1301 a owl:Class ;
- rdfs:label "Insufficient or Incomplete Data Removal within Hardware Component" ;
- rdfs:subClassOf :CWE-226 ;
- :cwe-id "CWE-1301" ;
- :definition "The product's data removal process does not completely delete all data and potentially sensitive information within hardware components." .
-
-:CWE-1302 a owl:Class ;
- rdfs:label "Missing Security Identifier",
- "Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)" ;
- rdfs:subClassOf :CWE-1294 ;
- :cwe-id "CWE-1302" ;
- :definition "The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier." .
-
-:CWE-1303 a owl:Class ;
- rdfs:label "Non-Transparent Sharing of Microarchitectural Resources" ;
- rdfs:subClassOf :CWE-203,
- :CWE-1189 ;
- :cwe-id "CWE-1303" ;
- :definition "Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts." .
-
-:CWE-1304 a owl:Class ;
- rdfs:label "Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1304" ;
- :definition "The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation." .
-
-:CWE-1310 a owl:Class ;
- rdfs:label "Missing Ability to Patch ROM Code" ;
- rdfs:subClassOf :CWE-1329 ;
- :cwe-id "CWE-1310" ;
- :definition "Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state." .
-
-:CWE-1311 a owl:Class ;
- rdfs:label "Improper Translation of Security Attributes by Fabric Bridge" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1311" ;
- :definition "The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another." .
-
-:CWE-1312 a owl:Class ;
- rdfs:label "Missing Protection for Mirrored Regions in On-Chip Fabric Firewall" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1312" ;
- :definition "The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions." .
-
-:CWE-1313 a owl:Class ;
- rdfs:label "Hardware Allows Activation of Test or Debug Logic at Runtime" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1313" ;
- :definition "During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can alter the intended behavior of the system and allow for alteration and leakage of sensitive data by an adversary." .
-
-:CWE-1314 a owl:Class ;
- rdfs:label "Missing Write Protection for Parametric Data Values" ;
- rdfs:subClassOf :CWE-862 ;
- :cwe-id "CWE-1314" ;
- :definition "The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure." .
-
-:CWE-1315 a owl:Class ;
- rdfs:label "Improper Setting of Bus Controlling Capability in Fabric End-point" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1315" ;
- :definition "The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric." .
-
-:CWE-1316 a owl:Class ;
- rdfs:label "Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1316" ;
- :definition "The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region." .
-
-:CWE-1317 a owl:Class ;
- rdfs:label "Improper Access Control in Fabric Bridge" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1317" ;
- :definition "The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privilege, identity, or other access control checks between those IP blocks." .
-
-:CWE-1318 a owl:Class ;
- rdfs:label "Missing Support for Security Features in On-chip Fabrics or Buses" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1318" ;
- :definition " On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control. " .
-
-:CWE-1319 a owl:Class ;
- rdfs:label "Improper Protection against Electromagnetic Fault Injection (EM-FI)" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1319" ;
- :definition "The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed." .
-
-:CWE-1320 a owl:Class ;
- rdfs:label "Improper Protection for Outbound Error Messages and Alert Signals" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1320" ;
- :definition "Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts. " .
-
-:CWE-1321 a owl:Class ;
- rdfs:label "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')" ;
- rdfs:subClassOf :CWE-915 ;
- :cwe-id "CWE-1321" ;
- :definition "The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype." .
-
-:CWE-1322 a owl:Class ;
- rdfs:label "Use of Blocking Code in Single-threaded, Non-blocking Context" ;
- rdfs:subClassOf :CWE-834 ;
- :cwe-id "CWE-1322" ;
- :definition "The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked." .
-
-:CWE-1323 a owl:Class ;
- rdfs:label "Improper Management of Sensitive Trace Data" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1323" ;
- :definition "Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents." .
-
-:CWE-1325 a owl:Class ;
- rdfs:label "Improperly Controlled Sequential Memory Allocation" ;
- rdfs:subClassOf :CWE-770 ;
- :cwe-id "CWE-1325" ;
- :definition "The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects." ;
- :synonym "Stack Exhaustion" .
-
-:CWE-1326 a owl:Class ;
- rdfs:label "Missing Immutable Root of Trust in Hardware" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1326" ;
- :definition "A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code." .
-
-:CWE-1327 a owl:Class ;
- rdfs:label "Binding to an Unrestricted IP Address" ;
- rdfs:subClassOf :CWE-668 ;
- :cwe-id "CWE-1327" ;
- :definition "The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely." .
-
-:CWE-1328 a owl:Class ;
- rdfs:label "Security Version Number Mutable to Older Versions" ;
- rdfs:subClassOf :CWE-285 ;
- :cwe-id "CWE-1328" ;
- :definition "Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions." .
-
-:CWE-1329 a owl:Class ;
- rdfs:label "Reliance on Component That is Not Updateable" ;
- rdfs:subClassOf :CWE-664,
- :CWE-1357 ;
- :cwe-id "CWE-1329" ;
- :definition "The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs." .
-
-:CWE-1330 a owl:Class ;
- rdfs:label "Remanent Data Readable after Memory Erase" ;
- rdfs:subClassOf :CWE-1301 ;
- :cwe-id "CWE-1330" ;
- :definition "Confidential information stored in memory circuits is readable or recoverable after being cleared or erased." .
-
-:CWE-1331 a owl:Class ;
- rdfs:label "Improper Isolation of Shared Resources in Network On Chip (NoC)" ;
- rdfs:subClassOf :CWE-653,
- :CWE-668 ;
- :cwe-id "CWE-1331" ;
- :definition "The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untrusted agents, creating timing channels." .
-
-:CWE-1332 a owl:Class ;
- rdfs:label "Improper Handling of Faults that Lead to Instruction Skips" ;
- rdfs:subClassOf :CWE-1384 ;
- :cwe-id "CWE-1332" ;
- :definition "The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur." .
-
-:CWE-1333 a owl:Class ;
- rdfs:label "Inefficient Regular Expression Complexity" ;
- rdfs:subClassOf :CWE-407 ;
- :cwe-id "CWE-1333" ;
- :definition "The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles." ;
- :synonym "Catastrophic backtracking",
- "ReDoS",
- "Regular Expression Denial of Service" .
-
-:CWE-1334 a owl:Class ;
- rdfs:label "Unauthorized Error Injection Can Degrade Hardware Redundancy" ;
- rdfs:subClassOf :CWE-284 ;
- :cwe-id "CWE-1334" ;
- :definition "An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode." .
-
-:CWE-1335 a owl:Class ;
- rdfs:label "Incorrect Bitwise Shift of Integer" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-1335" ;
- :definition "An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result." .
-
-:CWE-1336 a owl:Class ;
- rdfs:label "Improper Neutralization of Special Elements Used in a Template Engine" ;
- rdfs:subClassOf :CWE-94 ;
- :cwe-id "CWE-1336" ;
- :definition "The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine." ;
- :synonym "Client-Side Template Injection / CSTI",
- "Server-Side Template Injection / SSTI" .
-
-:CWE-1338 a owl:Class ;
- rdfs:label "Improper Protections Against Hardware Overheating" ;
- rdfs:subClassOf :CWE-693 ;
- :cwe-id "CWE-1338" ;
- :definition "A hardware device is missing or has inadequate protection features to prevent overheating." .
-
-:CWE-1339 a owl:Class ;
- rdfs:label "Insufficient Precision or Accuracy of a Real Number" ;
- rdfs:subClassOf :CWE-682 ;
- :cwe-id "CWE-1339" ;
- :definition "The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result." .
-
-:CWE-1341 a owl:Class ;
- rdfs:label "Multiple Releases of Same Resource or Handle" ;
- rdfs:subClassOf :CWE-675 ;
- :cwe-id "CWE-1341" ;
- :definition "The product attempts to close or release a resource or handle more than once, without any successful open between the close operations." .
-
-:CWE-1342 a owl:Class ;
- rdfs:label "Information Exposure through Microarchitectural State after Transient Execution" ;
- rdfs:subClassOf :CWE-226 ;
- :cwe-id "CWE-1342" ;
- :definition "The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution." .
-
-:CWE-1351 a owl:Class ;
- rdfs:label "Improper Handling of Hardware Behavior in Exceptionally Cold Environments" ;
- rdfs:subClassOf :CWE-1384 ;
- :cwe-id "CWE-1351" ;
- :definition "A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures." .
-
-:CWE-1357 a owl:Class ;
- rdfs:label "Reliance on Insufficiently Trustworthy Component" ;
- rdfs:subClassOf :CWE-710 ;
- :cwe-id "CWE-1357" ;
- :definition "The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability." .
-
-:CWE-1384 a owl:Class ;
- rdfs:label "Improper Handling of Physical or Environmental Conditions" ;
- rdfs:subClassOf :CWE-703 ;
- :cwe-id "CWE-1384" ;
- :definition "The product does not properly handle unexpected physical or environmental conditions that occur naturally or are artificially induced." .
-
-:CWE-1385 a owl:Class ;
- rdfs:label "Missing Origin Validation in WebSockets" ;
- rdfs:subClassOf :CWE-346 ;
- :cwe-id "CWE-1385" ;
- :definition "The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid." ;
- :synonym "Cross-Site WebSocket hijacking (CSWSH)" .
-
-:CWE-1386 a owl:Class ;
- rdfs:label "Insecure Operation on Windows Junction / Mount Point" ;
- rdfs:subClassOf :CWE-59 ;
- :cwe-id "CWE-1386" ;
- :definition "The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere." .
-
-:CWE-1389 a owl:Class ;
- rdfs:label "Incorrect Parsing of Numbers with Different Radices" ;
- rdfs:subClassOf :CWE-704 ;
- :cwe-id "CWE-1389" ;
- :definition "The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix)." .
-
-:CWE-1390 a owl:Class ;
- rdfs:label "Weak Authentication" ;
- rdfs:subClassOf :CWE-287 ;
- :cwe-id "CWE-1390" ;
- :definition "The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct." .
-
-:CWE-1391 a owl:Class ;
- rdfs:label "Use of Weak Credentials" ;
- rdfs:subClassOf :CWE-1390 ;
- :cwe-id "CWE-1391" ;
- :definition "The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker." .
-
-:CWE-1392 a owl:Class ;
- rdfs:label "Use of Default Credentials" ;
- rdfs:subClassOf :CWE-1391 ;
- :cwe-id "CWE-1392" ;
- :definition "The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality." .
-
-:CWE-1393 a owl:Class ;
- rdfs:label "Use of Default Password" ;
- rdfs:subClassOf :CWE-1392,
- [ a owl:Restriction ;
- owl:onProperty :weakness-of ;
- owl:someValuesFrom :UserAccount ] ;
- :cwe-id "CWE-1393" ;
- :definition "The product uses default passwords for potentially critical functionality." .
-
-:CWE-1394 a owl:Class ;
- rdfs:label "Use of Default Cryptographic Key" ;
- rdfs:subClassOf :CWE-1392 ;
- :cwe-id "CWE-1394" ;
- :definition "The product uses a default cryptographic key for potentially critical functionality." .
-
-:CWE-1395 a owl:Class ;
- rdfs:label "Dependency on Vulnerable Third-Party Component" ;
- rdfs:subClassOf :CWE-657 ;
- :cwe-id "CWE-1395" ;
- :definition "The product has a dependency on a third-party component that contains one or more known vulnerabilities." .
-
-:CWE-1419 a owl:Class ;
- rdfs:label "Incorrect Initialization of Resource" ;
- rdfs:subClassOf :CWE-665 ;
- :cwe-id "CWE-1419" ;
- :definition "The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed." .
-
-:CWE-1420 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information during Transient Execution" ;
- rdfs:subClassOf :CWE-669 ;
- :cwe-id "CWE-1420" ;
- :definition "A processor event or prediction may allow incorrect operations (or correct operations with incorrect data) to execute transiently, potentially exposing data over a covert channel." .
-
-:CWE-1421 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution" ;
- rdfs:subClassOf :CWE-1420 ;
- :cwe-id "CWE-1421" ;
- :definition " A processor event may allow transient operations to access architecturally restricted data (for example, in another address space) in a shared microarchitectural structure (for example, a CPU cache), potentially exposing the data over a covert channel. " .
-
-:CWE-1422 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution" ;
- rdfs:subClassOf :CWE-1420 ;
- :cwe-id "CWE-1422" ;
- :definition "A processor event or prediction may allow incorrect or stale data to be forwarded to transient operations, potentially exposing data over a covert channel." .
-
-:CWE-1423 a owl:Class ;
- rdfs:label "Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution" ;
- rdfs:subClassOf :CWE-1420 ;
- :cwe-id "CWE-1423" ;
- :definition "Shared microarchitectural predictor state may allow code to influence transient execution across a hardware boundary, potentially exposing data that is accessible beyond the boundary over a covert channel. " .
-
-:CWE-1426 a owl:Class ;
- rdfs:label "Improper Validation of Generative AI Output" ;
- rdfs:subClassOf :CWE-707 ;
- :cwe-id "CWE-1426" ;
- :definition "The product invokes a generative AI/ML component whose behaviors and outputs cannot be directly controlled, but the product does not validate or insufficiently validates the outputs to ensure that they align with the intended security, content, or privacy policy." .
-
-:CWE-1427 a owl:Class ;
- rdfs:label "Improper Neutralization of Input Used for LLM Prompting" ;
- rdfs:subClassOf :CWE-77 ;
- :cwe-id "CWE-1427" ;
- :definition "The product uses externally-provided data to build prompts provided to large language models (LLMs), but the way these prompts are constructed causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives." ;
- :synonym "prompt injection" .
-
-:CWE-1428 a owl:Class ;
- rdfs:label "Reliance on HTTP instead of HTTPS" ;
- rdfs:subClassOf :CWE-319 ;
- :cwe-id "CWE-1428" ;
- :definition "The product provides or relies on use of HTTP communications when HTTPS is available." .
-
-:CWE-1429 a owl:Class ;
- rdfs:label "Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface" ;
- rdfs:subClassOf :CWE-223 ;
- :cwe-id "CWE-1429" ;
- :definition "The product has a hardware interface that silently discards operations in situations for which feedback would be security-relevant, such as the timely detection of failures or attacks." .
-
-:CWE-1431 a owl:Class ;
- rdfs:label "Driving Intermediate Cryptographic State/Results to Hardware Module Outputs" ;
- rdfs:subClassOf :CWE-200 ;
- :cwe-id "CWE-1431" ;
- :definition "The product uses a hardware module implementing a cryptographic algorithm that writes sensitive information about the intermediate state or results of its cryptographic operations via one of its output wires (typically the output port containing the final result)." .
-
-:CyberAction a owl:Class ;
- rdfs:label "Cyber Action" ;
- rdfs:subClassOf :Action .
-
-:CyberSensor a owl:Class ;
- rdfs:label "Cyber Sensor" ;
- rdfs:subClassOf :Sensor ;
- :definition "A cyber sensor collects and monitors data related to cyber activities, events, or environments." .
-
-:CyberTechnique a owl:Class ;
- rdfs:label "Cyber Technique" ;
- rdfs:subClassOf :Technique,
- [ a owl:Restriction ;
- owl:onProperty :implemented-by ;
- owl:someValuesFrom :Procedure ] .
-
-:CycleGAN a owl:Class,
- owl:NamedIndividual ;
- rdfs:label "CycleGAN" ;
- rdfs:subClassOf :Image-to-ImageTranslationGAN ;
- :d3fend-id "D3A-CYC" ;
- :definition "The Cycle Generative Adversarial Network (CycleGAN) is an approach to training a deep convolutional neural network for image-to-image translation tasks by mapping between input and output images using unpaired dataset." ;
- :kb-article """## References
-Esri. (n.d.). How CycleGAN Works. [Link](https://developers.arcgis.com/python/guide/how-cyclegan-works/)""" .
-
-:D3FENDCore a owl:Class ;
- rdfs:label "D3FEND Core" .
-
-:D3FENDKBThing a owl:Class ;
- rdfs:label "D3FEND KB Thing" .
-
-:DataAcquisitionAgent a owl:Class ;
- rdfs:label "Data Acquisition Agent" ;
- rdfs:subClassOf :Application ;
- :definition "A software component which connects to data sources to gather raw, time-stamped data. It often connects to databases or historian gateways for storage and analysis." ;
- rdfs:seeAlso ;
- :synonym "Data Gateway; Historian Collector" .
-
-:DataAcquisitionUnit a owl:Class ;
- rdfs:label "Data Acquisition Unit" ;
- rdfs:subClassOf :HardwareDevice,
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :DataAcquisitionAgent ] ;
- :definition "The hardware component which connects to data sources to gather raw, time-stamped data. It often connects to databases or historian gateways for storage and analysis." ;
- rdfs:seeAlso .
-
-:DataArtifactServer a owl:Class ;
- rdfs:label "Data Artifact Server" ;
- rdfs:subClassOf :ArtifactServer ;
- :definition "A data artifact server provides access services to content in a content repository. The content repository or content store is a database of digital content with an associated set of data management, search and access methods allowing application-independent access to the content, rather like a digital library, but with the ability to store and modify content in addition to searching and retrieving. The content repository acts as the storage engine for a larger application such as a content management system or a document management system, which adds a user interface on top of the repository's application programming interface." ;
- rdfs:seeAlso .
-
-:Database a owl:Class ;
- rdfs:label "Database" ;
- rdfs:subClassOf :DigitalInformationBearer,
- [ a owl:Restriction ;
- owl:onProperty :contains ;
- owl:someValuesFrom :DatabaseRecord ],
- [ a owl:Restriction ;
- owl:onProperty :may-contain ;
- owl:someValuesFrom :StoredProcedure ] ;
- rdfs:isDefinedBy ;
- :definition "A database is an organized collection of data, generally stored and accessed electronically from a computer system. Where databases are more complex they are often developed using formal design and modeling techniques." ;
- rdfs:seeAlso