Malware Ontology

FLOW ALGEBRA
Malware Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/cybersecurity/malware-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "MalwareOntology" v4.0

# ---------- DOMAIN ----------
DOMAIN := ComputingOntology
SUBDOMAIN := Cybersecurity
ONTOLOGY := MalwareOntology

# ---------- PRIMARY ENTITY ----------
ENTITY Malware {
    definition:
        "Software, code or computational logic intentionally designed or used
         to perform unauthorised, harmful, deceptive, disruptive or
         compromising actions within a digital system.";

    objectives_of_analysis: [
        Classification,
        Detection,
        Containment,
        Eradication,
        Recovery,
        Prevention
    ];
}

# ---------- CORE ENTITIES ----------
MalwareType := {
    Virus,
    Worm,
    Trojan,
    Ransomware,
    Spyware,
    Rootkit,
    Bot,
    Downloader,
    Dropper,
    Backdoor,
    Wiper,
    Cryptominer
};

MalwareComponent := {
    Payload,
    Loader,
    PersistenceMechanism,
    CommandChannel,
    Configuration,
    ObfuscationLayer
};

TargetAsset := {
    Endpoint,
    Server,
    Application,
    OperatingSystem,
    Network,
    Account,
    Credential,
    Data,
    Service
};

MalwareState := {
    Dormant,
    Executing,
    Persistent,
    Communicating,
    Detected,
    Contained,
    Eradicated
};

# ---------- FUNDAMENTAL RELATIONSHIPS ----------
Malware IS_A CyberThreat;
Malware TARGETS TargetAsset;
Malware MAY_EXPLOIT Vulnerability;
Malware MAY_EXECUTE Payload;
Malware MAY_ESTABLISH PersistenceMechanism;
Malware MAY_COMMUNICATE_WITH CommandInfrastructure;
Malware MAY_MODIFY SystemState;
Malware MAY_ACCESS Data;
Malware MAY_STEAL Credential;
Malware MAY_DISRUPT Service;

SecurityControl DETECTS_OR_MITIGATES Malware;

# ---------- MALWARE LIFECYCLE ----------
MalwareLifecycle :=
    Delivery
    -> Execution
    -> Persistence
    -> Propagation
    -> ObjectiveExecution
    -> Detection
    -> Containment
    -> Eradication
    -> Recovery;

Delivery MAY_PRECEDE Execution;
Execution MAY_ENABLE Persistence;
Persistence MAY_ENABLE RepeatedExecution;

# ---------- DELIVERY ----------
DeliveryVector := {
    MaliciousAttachment,
    MaliciousLink,
    CompromisedWebsite,
    ExploitedService,
    RemovableMedia,
    SoftwareSupplyChain,
    MaliciousDownload
};

DeliveryVector DELIVERS Malware TO TargetAsset;

IF DeliveryPrevented
THEN MalwareExecution := prevented;

# ---------- EXECUTION ----------
Execution :=
    MalwareCode
    -> RuntimeEnvironment
    -> ProcessOrScript
    -> SystemAction;

Execution MAY_REQUIRE {
    UserAction,
    Exploitation,
    ExistingPrivilege,
    Interpreter
};

IF Malware EXECUTES
THEN MalwareState := Executing;

# ---------- PERSISTENCE ----------
PersistenceMechanism := {
    StartupModification,
    ScheduledExecution,
    ServiceModification,
    AccountModification,
    BootModification,
    ApplicationModification
};

PersistenceMechanism ENABLES MalwareToSurviveRestartOrSessionChange;

IF PersistenceMechanism ACTIVE
THEN MalwareState := Persistent;

# ---------- PROPAGATION ----------
Propagation :=
    SourceHost
    -> PropagationMechanism
    -> DestinationHost;

PropagationMechanism MAY_USE {
    NetworkExploit,
    CredentialReuse,
    SharedResource,
    RemovableMedia,
    AutomatedScanning
};

Worm HAS_CAPABILITY AutomatedPropagation;

# ---------- PAYLOAD ----------
PayloadAction := {
    DataTheft,
    CredentialTheft,
    EncryptionOfData,
    DataDestruction,
    Surveillance,
    RemoteControl,
    ResourceAbuse,
    ServiceDisruption,
    AdditionalMalwareDelivery
};

Payload PERFORMS PayloadAction;
PayloadAction AFFECTS TargetAsset;

# ---------- RANSOMWARE ----------
Ransomware IS_A Malware;

Ransomware MAY {
    EncryptData,
    DisruptAccess,
    ExfiltrateData
};

IF DataEncryptedWithoutAuthorisation
THEN AvailabilityImpact := HIGH;

# ---------- SPYWARE ----------
Spyware IS_A Malware;
Spyware COLLECTS InformationWithoutAuthorisedPurpose;

Spyware MAY_CAPTURE {
    UserActivity,
    Credential,
    Communication,
    SystemInformation
};

# ---------- TROJAN ----------
Trojan IS_A Malware;
Trojan PRESENTS_AS LegitimateOrDesiredSoftware;
Trojan DEPENDS_ON DeceptiveExecutionContext;

# ---------- VIRUS ----------
Virus IS_A Malware;
Virus ATTACHES_OR_EMBEDS_IN HostObject;
Virus REPLICATES_WHEN HostExecutionConditionsMet;

# ---------- WORM ----------
Worm IS_A Malware;
Worm SELF_PROPAGATES AcrossReachableSystems;

# ---------- BOT ----------
Bot IS_A Malware WHEN MaliciouslyControlled;
Bot MAY_RECEIVE Commands FROM CommandInfrastructure;
Bot MAY_PARTICIPATE_IN Botnet;

Botnet := SET_OF(CompromisedBots);

# ---------- COMMAND AND CONTROL ----------
CommandInfrastructure COMMUNICATES_WITH Malware;

CommandChannel MAY_USE {
    NetworkProtocol,
    WebProtocol,
    EncryptedChannel,
    PeerToPeerCommunication
};

IF CommandChannel DETECTED
THEN {
    NetworkIndicator := true;
    ContainmentPriority := increase;
};

# ---------- OBFUSCATION ----------
ObfuscationTechnique := {
    Packing,
    Encoding,
    Encryption,
    CodeTransformation,
    DynamicLoading
};

Malware MAY_USE ObfuscationTechnique;
ObfuscationTechnique REDUCES StaticVisibility;

Obfuscation DOES_NOT_IMPLY Maliciousness;

# ---------- INDICATORS ----------
MalwareIndicator := {
    FileHash,
    FileName,
    ProcessBehaviour,
    NetworkDestination,
    Domain,
    IPAddress,
    RegistryChange,
    PersistenceArtifact,
    CommandPattern
};

MalwareIndicator MAY_INDICATE MalwarePresence;

IndicatorConfidence :=
    f(
        Specificity,
        Reliability,
        Recency,
        Context
    );

# ---------- DETECTION ----------
DetectionMethod := {
    SignatureDetection,
    BehaviourDetection,
    HeuristicDetection,
    ReputationDetection,
    AnomalyDetection
};

DetectionMethod ANALYSES {
    File,
    Process,
    Memory,
    NetworkTraffic,
    SystemEvent
};

IF DetectionEvidence >= DetectionThreshold
THEN MalwareState := Detected;

# ---------- CONTAINMENT ----------
ContainmentAction := {
    IsolateHost,
    BlockCommunication,
    StopProcess,
    DisableAccount,
    QuarantineFile,
    RestrictNetworkAccess
};

ContainmentAction LIMITS MalwareImpact;

DetectedMalware
    -> AssessScope
    -> SelectContainment
    -> ApplyContainment;

# ---------- ERADICATION ----------
Eradication :=
    RemoveMalware
    + RemovePersistence
    + RemediateVulnerability
    + ResetCompromisedCredentials
    + ValidateSystemState;

IF MalwareRemoved
AND PersistenceRemoved
AND CompromiseClosed
THEN MalwareState := Eradicated;

# ---------- RECOVERY ----------
Recovery :=
    RestoreTrustedState
    -> RestoreData
    -> RestoreService
    -> ValidateSecurity
    -> ResumeOperation
    -> Monitor;

Recovery SHOULD_FOLLOW EradicationOrTrustedRebuild;

# ---------- THREAT RELATIONSHIPS ----------
MalwareThreat := {
    InitialCompromise,
    PrivilegeEscalation,
    Persistence,
    LateralMovement,
    DataExfiltration,
    DataDestruction,
    ServiceDisruption
};

Malware MAY_ENABLE MalwareThreat;
MalwareThreat MAY_CAUSE SecurityIncident;

# ---------- SEMANTIC REASONING ----------
IF MaliciousCode EXECUTES
AND PerformsUnauthorisedAction
THEN MalwareClassification := probable;

IF FileHash MATCHES KnownMalwareHash
THEN MalwareConfidence := increase;

IF Process EXHIBITS MultipleMaliciousBehaviours
THEN MalwareConfidence := increase;

IF Malware ESTABLISHES Persistence
THEN ReinfectionRisk := increase;

IF Malware COMMUNICATES_WITH KnownMaliciousInfrastructure
THEN ThreatConfidence := increase;

IF Malware DETECTED_ON Host
THEN {
    ScopeAssessment := required;
    ContainmentEvaluation := required;
};

IF Credential MAY_HAVE_BEEN_STOLEN
THEN CredentialRemediation := required;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "malware" ~= "malicious software";
    "malicious code" ~= "malware" WHEN context == executable_threat;
    "computer virus" ~= "virus" WHEN context == malware;
    "computer worm" ~= "worm" WHEN context == malware;
    "remote access trojan" ~= "RAT" WHEN context == malware;
    "command and control" ~= "C2";
    "indicator of compromise" ~= "IOC";
    "malware removal" ~= "malware eradication" WHEN context == incident_response;
}

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_MALWARE_TYPE(q) ->
    IDENTIFY_TARGET_ASSET(q) ->
    IDENTIFY_BEHAVIOUR(q) ->
    IDENTIFY_INDICATORS(q) ->
    IDENTIFY_MALWARE_STATE(q) ->
    MAP_TO_ONTOLOGY(q) ->
    APPLY_REASONING(q) ->
    SCORE_CONFIDENCE(q) ->
    RETURN_RELEVANT_KNOWLEDGE;

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        source_reliability,
        behavioural_evidence,
        indicator_quality,
        semantic_consistency,
        contextual_relevance
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: Malware;
    ontology: MalwareOntology;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_malware_type:
        validate
        -> classify
        -> identify_behaviours
        -> identify_targets
        -> integrate;

    new_indicator:
        validate
        -> classify
        -> associate_malware
        -> score_confidence
        -> integrate;

    new_behaviour:
        validate
        -> map_lifecycle_stage
        -> map_target
        -> update_detection_logic
        -> integrate;

    threat_revision:
        update_indicators
        -> update_behaviours
        -> recompute_confidence
        -> regenerate_flow_hash;

    conflict:
        preserve_provenance
        -> compare_evidence
        -> adjust_confidence
        -> flag_review;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + MalwareType
    + MalwareComponent
    + TargetAsset
    + MalwareState
    + MalwareLifecycle
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
MalwareOntology
    -> IdentifyMalware
    -> ClassifyMalwareType
    -> IdentifyDeliveryVector
    -> IdentifyExecutionBehaviour
    -> IdentifyPersistence
    -> IdentifyPayload
    -> DetectIndicators
    -> AssessAffectedAssets
    -> ContainMalware
    -> EradicateMalware
    -> RecoverTrustedState
    -> ReduceFutureExposure;

END FLOW