A YANG Data Model for Network Attack Sample Metadata

+--------------------------------------------------------------------------+
|                          Network Attack Sample Object                    |
|                                                                          |
|  +-------------------+  +---------------------------------------------+  |
|  |  1. Sample Meta   |  |  2. Collection Context                      |  |
|  |  - ID, Version    |  |  - Collection Time (Start/End)              |  |
|  |  - Author/Source  |  |  - Collecting Device (Vendor, Type, OS)     |  |
|  |  - Usage/License  |  |  - Observation Point / Topology             |  |
|  |  -  Anonymization |  |  - Data Source (PCAP/Flow/Session/Log)      |  |
|  +-------------------+  +---------------------------------------------+  |
|                                                                          |
|  +--------------------------------------------------------------------+  |
|  |  3. Attack Context                                                 |  |
|  |  - Attack Path (source -> target -> lateral -> C2 -> exfiltration)  |
|  |  - Attack Category / External Taxonomy Reference                    |  |
|  |  - Lifecycle Stage (recon -> exploit -> C2 -> exfiltration)         |  |
|  |  - Target Vulnerability / Affected Service                         |  |
|  +--------------------------------------------------------------------+  |
|                                                                          |
|  +--------------------------------------------------------------------+  |
|  |  5. Reproducibility Context                                        |  |
|  |  - Dataset Version / Generation Tool / Replay Parameters           |  |
|  |  - Sanitization and Anonymization Procedure                        |  |
|  |  - Validation Result References                                    |  |
|  +--------------------------------------------------------------------+  |
|                                                                          |
|  +--------------------------------------------------------------------+  |
|  |  4. Data Content Description                                       |  |
|  |  - Packet-level (Headers, Payload, Fingerprints)                   |  |
|  |  - Flow-level (IPFIX-compatible statistics)                        |  |
|  |  - Session-level Behavior (Timing, Rate, Direction, Ratios)        |  |
|  |  - Traffic Features (Entropy, Flag Patterns, Unusual Behavior)     |  |
|  +--------------------------------------------------------------------+  |
|                                                                          |
+--------------------------------------------------------------------------+
                                  |
                                  v
    Interoperability Layer (IPFIX / IODEF / Data Manifest / PCAP)

                 Figure 1: Architecture Diagram

grouping sample-metadata {
  leaf sample-id {
    type string;
    description
      "Unique identifier for the attack sample. A UUID is RECOMMENDED.";
  }
  leaf sample-version {
    type string;
    description
      "Version identifier of the attack sample.";
  }
  leaf sample-name {
    type string;
    description
      "Human-readable name of the attack sample.";
  }
  leaf description {
    type string;
    description
      "Detailed description of the attack scenario.";
  }
  leaf creator {
    type string;
    description
      "Creator or organization that produced the sample.";
  }
  leaf creation-time {
    type yang:date-and-time;
    description
      "Time when the attack sample was created.";
  }
  leaf usage-scope {
    type enumeration {
      enum training;
      enum testing;
      enum analysis;
      enum rule-verification;
      enum research;
    }
    description
      "Intended usage of the attack sample.";
  }
  leaf anonymization {
    type enumeration {
      enum none;
      enum partial;
      enum full;
    }
    description
      "Level of anonymization applied to the sample.";
  }
}

grouping collection-context {
  leaf collection-start-time {
    type yang:date-and-time;
    description
      "Start time of the data collection interval.";
  }
  leaf collection-end-time {
    type yang:date-and-time;
    description
      "End time of the data collection interval.";
  }
  leaf collecting-device-type {
    type enumeration {
      enum router;
      enum switch;
      enum firewall;
      enum probe;
      enum host;
      enum controller;
    }
    description
      "Type of device that collected the traffic.";
  }
  leaf device-vendor {
    type string;
    description
      "Vendor of the collecting device.";
  }
  leaf device-model {
    type string;
    description
      "Hardware model of the collecting device.";
  }
  leaf os-version {
    type string;
    description
      "Operating system or firmware version.";
  }
  leaf observation-point {
    type string;
    description
      "Capture point: ingress interface, mirror port, or sensor location.";
  }
  leaf topology-desc {
    type string;
    description
      "Brief network topology description.";
  }
  leaf data-source-type {
    type enumeration {
      enum pcap;
      enum flow;
      enum session;
      enum log;
      enum payload;
    }
    description
      "Underlying data format of the sample.";
  }
}

grouping attack-context {
  leaf attack-path {
    type string;
    description
      "Full attack path, e.g., attacker -> target -> lateral -> C2 -> exfiltration.";
  }
  leaf attack-category {
    type enumeration {
      enum reconnaissance;
      enum brute-force;
      enum dos;
      enum exploitation;
      enum malware;
      enum c2;
      enum tunneling;
      enum data-exfiltration;
    }
    description
      "High-level attack category.";
  }
  leaf attack-technique {
    type string;
    description
      "MITRE ATT&CK technique identifier (optional).";
  }
  leaf attack-stage {
    type enumeration {
      enum reconnaissance;
      enum exploitation;
      enum persistence;
      enum c2;
      enum exfiltration;
    }
    description
      "Attack lifecycle stage.";
  }
  leaf attack-intent {
    type enumeration {
      enum disruption;
      enum info-disclosure;
      enum privilege-escalation;
      enum data-theft;
    }
    description
      "Intended goal of the attack.";
  }
  leaf targeted-cve {
    type string;
    description
      "Targeted CVE identifier if applicable.";
  }
  leaf affected-service {
    type string;
    description
      "Affected protocol or service.";
  }
}

grouping data-content {
  leaf packet-included {
    type boolean;
    description
      "Whether full packet data is included.";
  }
  leaf flow-included {
    type boolean;
    description
      "Whether flow records (IPFIX-compatible) are included.";
  }
  leaf payload-included {
    type boolean;
    description
      "Whether application-layer payloads are included.";
  }
  leaf flow-count {
    type uint32;
    description
      "Total number of flow records in the sample.";
  }
  leaf packet-count {
    type uint64;
    description
      "Total number of packets in the sample.";
  }
  leaf duration {
    type yang:timedelta;
    description
      "Total time duration covered by the sample.";
  }
  leaf-list flow-attributes {
    type string;
    description
      "List of flow attributes included (e.g., 5-tuple, packet-count, flags).";
  }
}

grouping reproducibility-context {
  leaf dataset-version {
    type string;
    description
      "Version of the dataset or corpus that contains this sample.";
  }
  leaf generation-tool {
    type string;
    description
      "Tool, generator, replay system, or collector used to produce the sample.";
  }
  leaf generation-parameters {
    type string;
    description
      "Parameters used to generate or replay the sample. Sensitive values
       SHOULD be omitted, redacted, or referenced through controlled access.";
  }
  leaf sanitization-method {
    type string;
    description
      "Anonymization, minimization, or sanitization method applied to the sample.";
  }
  leaf validation-reference {
    type string;
    description
      "Reference to validation results, detection-rule evaluation, or incident-analysis output.";
  }
}

grouping attack-sample {
  uses sample-metadata;
  uses collection-context;
  uses attack-context;
  uses data-content;
  uses reproducibility-context;
  description
    "Top-level grouping that represents a full network attack sample.";
}