diff --git a/README.md b/README.md index f9d40e6..71909fa 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,7 @@ The following taxonomies are described: - [TLP - Traffic Light Protocol](./tlp) - [Vocabulaire des probabilités estimatives](./vocabulaire-des-probabilites-estimatives) - Vocabulary for Event Recording and Incident Sharing [VERIS](./veris) +- [Binary Classification](./binary-class) safe/malicious binary tagging ### [Admiralty Scale](./admiralty-scale) diff --git a/binary-class/README.md b/binary-class/README.md new file mode 100644 index 0000000..cb2b59d --- /dev/null +++ b/binary-class/README.md @@ -0,0 +1,25 @@ +# Binary Classification + +Custom taxonomy for tagging of known binary files + +## type + +
+
good
+
Known good/safe
+
bad
+
Known bad/malicious
+
unknown
+
Not yet known
+
+ +# Machine-parsable Binary Taxonomy + +The repository contains a [JSON file including the machine-parsable tags](machinetag.json) +along with their human-readable description. The software can use both +representation on the user-interface and store the tag as machine-parsable. + +~~~~ +binary-class:type="good" +~~~~ + diff --git a/binary-class/machinetag.json b/binary-class/machinetag.json new file mode 100644 index 0000000..31a38e1 --- /dev/null +++ b/binary-class/machinetag.json @@ -0,0 +1,30 @@ +{ + "namespace": "binary-class", + "description": "Custom taxonomy for types of binary file.", + "version": 1, + "predicates": [ + { + "value": "type", + "expanded": "Binary Type" + } + ], + "values": [ + { + "predicate": "type", + "entry": [ + { + "value": "good", + "expanded": "Known Good/Safe" + }, + { + "value": "malicious", + "expanded": "Known Bad/Malicious" + }, + { + "value": "unknown", + "expanded": "Not yet known" + } + ] + } + ] +}