ITU-T Recommendations

The malware attribute enumeration and characterization (MAEC) language includes enumerations of malware attributes and behaviour that provide a common vocabulary. These enumerations are at different levels of abstraction: low-level observables, mid-level behaviours and high-level taxonomies. Recommendation ITU-T X.1546, which is the initial version of MAEC, focuses on the creation of the enumeration of low-level malware attributes, and leverages the few instances of similar work already done in this area. Thus it will initially be capable of characterizing the most common malware types, including Trojans, worms and rootkits, but it will ultimately be applicable to more esoteric malware types.