MAECO-Lite: Modular Ontology for Dynamic Malware Analysis

Researchers propose MAECO-Lite, a lightweight ontology for dynamic malware analysis that improves upon existing standards like MAEC and STIX by clearly separating enduring artifacts from runtime events. The modular framework demonstrates significantly better performance in machine learning-based threat intelligence processing while maintaining semantic precision.

The cybersecurity research community faces a critical gap in how malware behavior is formally represented and processed. Existing standards like MAEC and STIX, while widely adopted, conflate important conceptual distinctions between static malware artifacts and dynamic execution events, creating structural ambiguity that hampers both human analysis and automated reasoning systems. This foundational problem limits the effectiveness of threat intelligence sharing and makes it harder for security teams to extract meaningful patterns from execution traces.

MAECO-Lite addresses this through rigorous ontological analysis using Unified Foundational Ontology as a theoretical framework. The proposed system organizes data around five core entities—samples, processes, actions, system artifacts, and MITRE ATT&CK Techniques—while maintaining explicit separation between entities that persist independently and events that occur during execution. This structural clarity enables more coherent representation of malware behavior chains and execution sequences that are central to modern threat analysis.

For cybersecurity practitioners and threat intelligence platforms, the ontology's modular design offers practical benefits beyond theoretical elegance. Initial evaluation demonstrates that the simplified structure dramatically improves performance of machine learning algorithms applied to malware analysis, meaning automated detection and attribution systems can operate more efficiently. This has direct implications for Security Operations Centers processing high-volume threat data and for organizations implementing threat hunting workflows.

The work establishes a foundation for next-generation threat intelligence systems that marry formal semantic rigor with computational efficiency. Future adoption could standardize how organizations represent and exchange malware intelligence, potentially becoming relevant to security tool vendors and enterprise defenders seeking better interoperability across their security stacks.

• →MAECO-Lite separates malware artifacts from runtime events, eliminating conceptual conflation present in MAEC and STIX standards.
• →The lightweight ontology significantly improves machine learning algorithm performance for malware analysis tasks.
• →Modular structure centered on samples, processes, actions, artifacts, and MITRE ATT&CK techniques provides clearer threat representation.
• →Better semantic clarity and computational efficiency could enhance threat intelligence sharing and SOC operations.
• →Foundational ontological work may influence future standardization of dynamic malware representation in cybersecurity industry.