The Incident Object Description Exchange Format

Danyliw, Roman; Meijer, J.J.C.; Demchenko, Yuri

doi:10.17487/rfc5070

Cited by 96 publications

(84 citation statements)

References 9 publications

(12 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…o The data model found in this document is an evolution of the one previously specified in [RFC5070]. New fields were added to represent additional information.…”

Section: About the Iodef Data Modelmentioning

confidence: 99%

“…New fields were added to represent additional information. [RFC5070] was developed primarily to represent incident reports. This document builds upon it by adding support for indicators and revising it to reflect the current challenges faced by CSIRTs.…”

Section: About the Iodef Data Modelmentioning

confidence: 99%

“…A detailed list of additions made to the data model in [RFC5070] o Updated the data types (Section 2) to improve internationalization, clarify ambiguity, and ensure consistency in extensions.…”

Section: Changes From Rfc 5070mentioning

confidence: 99%

“…The IODEF data model in this document makes a number of changes to [RFC5070]. These changes were largely additive --classes and enumerated values were added.…”

Section: Incompatibilities With V1mentioning

confidence: 99%

See 3 more Smart Citations

The Incident Object Description Exchange Format Version 2

Danyliw¹

2016

Self Cite

View full text Add to dashboard Cite

The Incident Object Description Exchange Format (IODEF) defines a data representation for security incident reports and indicators commonly exchanged by operational security teams for mitigation and watch and warning. This document describes an updated information model for the IODEF and provides an associated data model specified with the XML schema. This new information and data model obsoletes RFCs 5070 and 6685.

show abstract

“…o The data model found in this document is an evolution of the one previously specified in [RFC5070]. New fields were added to represent additional information.…”

Section: About the Iodef Data Modelmentioning

confidence: 99%

Section: About the Iodef Data Modelmentioning

confidence: 99%

Section: Changes From Rfc 5070mentioning

confidence: 99%

“…The IODEF data model in this document makes a number of changes to [RFC5070]. These changes were largely additive --classes and enumerated values were added.…”

Section: Incompatibilities With V1mentioning

confidence: 99%

See 2 more Smart Citations

The Incident Object Description Exchange Format Version 2

Danyliw¹

2016

Self Cite

View full text Add to dashboard Cite

show abstract

“…It is anticipated that this requirement will exist in other standardization efforts within several IETF Working Groups, but the scope of this document pertains solely to IODEF. This format is used in IODEF v2 [IODEFv2], which will replace the original IODEF v1 [IODEF] specification; this document does not specify use of this format in IODEF v1 [IODEF].…”

Section: Introductionmentioning

confidence: 99%

Enumeration Reference Format for the Incident Object Description Exchange Format (IODEF)

Montville¹,

Black²

2015

View full text Add to dashboard Cite

The Incident Object Description Exchange Format (IODEF) is an XML data representation framework for sharing information about computer security incidents. In IODEF, the Reference class provides references to externally specified information such as a vulnerability, Intrusion Detection System (IDS) alert, malware sample, advisory, or attack technique. In practice, these references are based on external enumeration specifications that define both the enumeration format and the specific enumeration values, but the IODEF Reference class (as specified in IODEF v1 in RFC 5070) does not indicate how to include both of these important pieces of information.

show abstract

Web of cybersecurity: Linking, locating, and discovering structured cybersecurity information

Takahashi

Panta

Kadobayashi

et al. 2017

Int J Communication

View full text Add to dashboard Cite

SummaryCybersecurity is one of the main concerns of many organizations today, and accessibility to cybersecurity information in a timely manner is crucial to maintaining cybersecurity. Various repositories of cybersecurity-related information are publicly available on the Internet. However, users are unaware of many of them, and it is impractical for them to keep track of all of them. Cybersecurity information stored in these repositories must be able to be located and accessed by the parties who need it. To address this issue, this paper proposes a mechanism of linking, locating, and discovering various cybersecurity information to improve its accessibility in a timely manner. This mechanism allows us to locate various cybersecurity information having different schemata by generating metadata with which a list of cybersecurity information is managed. The information structure incorporated in this mechanism is unique, and it makes our mechanism flexible and extensible. The structure consists of categories and formats that are linked to each other. The mechanism can propagate information updates to minimize the risk of obsolete information. This paper also introduces a prototype of the mechanism to demonstrate its feasibility, and it analyzes the mechanism's extensibility, scalability, and information credibility. Through this study, we aim to improve the accessibility of cybersecurity information on the Internet and facilitate information sharing beyond organizational borders, with the eventual goal of creating a web of cybersecurity.

show abstract

The Incident Object Description Exchange Format

Cited by 96 publications

References 9 publications

The Incident Object Description Exchange Format Version 2

The Incident Object Description Exchange Format Version 2

Enumeration Reference Format for the Incident Object Description Exchange Format (IODEF)

Web of cybersecurity: Linking, locating, and discovering structured cybersecurity information

Contact Info

Product

Resources

About