<commit_before>{
  "$id": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/sdos/malware-analysis.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "malware-analysis",
  "description": "Malware Analysis captures the metadata and results of a particular analysis performed (static or dynamic) on the malware instance or family.",
  "type": "object",
  "allOf": [
    {
      "$ref": "../common/core.json"
    },
    {
      "properties": {
        "type": {
          "type": "string",
          "description": "The type of this object, which MUST be the literal `malware-analysis`.",
          "enum": [
            "malware-analysis"
          ]
        },
        "id": {
          "title": "id",
          "pattern": "^malware-analysis--"
        },
        "product": {
          "type": "string",
          "description": "The name of the analysis engine or product that was used for this analysis."
        },
        "version": {
          "type": "string",
          "description": "The version of the analysis product that was used to perform this analysis."
        },
        "configuration_version": {
          "type": "string",
          "description": "The version of the analysis product configuration that was used to perform this analysis."
        },
        "modules": {
          "type" : "array",
          "items": {
            "type": "string"
          },
          "description": "The particular analysis product modules that were used to perform the analysis.",
          "minItems": 1
        },
        "analysis_engine_version": {
          "type": "string",
          "description": "The version of the analysis engine or product that was used to perform this analysis."
        },
        "analysis_definition_version": {
          "type": "string",
          "description": "The version of the analysis definitions used by the analysis tool."
        },
        "submitted": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that this malware was first submitted for scanning or analysis."
        },
        "analysis_started": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that the malware analysis was initiated."
        },
        "analysis_ended": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that the malware analysis ended."
        },
        "result_name": {
          "type": "string",
          "description": "The classification result or name assigned to the malware instance by the scanner tool."
        },
        "result": {
          "type": "string",
          "description": "The classification result as determined by the scanner or tool analysis process."
        },
        "host_vm_ref": {
          "description": "A description of the virtual machine environment used to host the guest operating system (if applicable) that was used for the dynamic analysis of the malware instance or family.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "pattern": "^software--"
            }
          ]
        },
        "operating_system_ref": {
          "description": "The operating system that was used to perform the dynamic analysis.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "pattern": "^software--"
            }
          ]
        },
        "installed_software_refs": {
          "type": "array",
          "description": "Any non-standard software installed on the operating system used for the dynamic analysis of the malware instance or family.",
          "items": {
            "allOf": [
              {
                "$ref": "../common/identifier.json"
              },
              {
                "pattern": "^software--"
              }
            ]
          },
          "minItems": 1
        },
        "analysis_sco_refs": {
          "type": "array",
          "description": "The list of STIX objects that were captured during the analysis process.",
          "items": {
            "$ref": "../common/identifier.json"
          },
          "minItems": 1
        },
        "sample_ref": {
          "description": "Refers to the object this analysis was performed against.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "oneOf": [
                {
                  "pattern": "^artifact--"
                },
                {
                  "pattern": "^file--"
                },
                {
                  "pattern": "^network-traffic--"
                }
              ]
            }
          ]
        }
      }
    }
  ],
  "required": [
    "product"
  ],
  "oneOf": [
    {
      "required": [
        "result"
      ]
    },
    {
      "required": [
        "analysis_sco_refs"
      ]
    }
  ],
  "definitions": {
    "malware-av-result-ov": {
      "type": "string",
      "enum": [
        "malicious",
        "suspicious",
        "benign",
        "unknown"
      ]
    }<commit_msg>Allow both `result` and `analysis_sco_refs`<commit_after>{
  "$id": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/sdos/malware-analysis.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "malware-analysis",
  "description": "Malware Analysis captures the metadata and results of a particular analysis performed (static or dynamic) on the malware instance or family.",
  "type": "object",
  "allOf": [
    {
      "$ref": "../common/core.json"
    },
    {
      "properties": {
        "type": {
          "type": "string",
          "description": "The type of this object, which MUST be the literal `malware-analysis`.",
          "enum": [
            "malware-analysis"
          ]
        },
        "id": {
          "title": "id",
          "pattern": "^malware-analysis--"
        },
        "product": {
          "type": "string",
          "description": "The name of the analysis engine or product that was used for this analysis."
        },
        "version": {
          "type": "string",
          "description": "The version of the analysis product that was used to perform this analysis."
        },
        "configuration_version": {
          "type": "string",
          "description": "The version of the analysis product configuration that was used to perform this analysis."
        },
        "modules": {
          "type" : "array",
          "items": {
            "type": "string"
          },
          "description": "The particular analysis product modules that were used to perform the analysis.",
          "minItems": 1
        },
        "analysis_engine_version": {
          "type": "string",
          "description": "The version of the analysis engine or product that was used to perform this analysis."
        },
        "analysis_definition_version": {
          "type": "string",
          "description": "The version of the analysis definitions used by the analysis tool."
        },
        "submitted": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that this malware was first submitted for scanning or analysis."
        },
        "analysis_started": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that the malware analysis was initiated."
        },
        "analysis_ended": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that the malware analysis ended."
        },
        "result_name": {
          "type": "string",
          "description": "The classification result or name assigned to the malware instance by the scanner tool."
        },
        "result": {
          "type": "string",
          "description": "The classification result as determined by the scanner or tool analysis process."
        },
        "host_vm_ref": {
          "description": "A description of the virtual machine environment used to host the guest operating system (if applicable) that was used for the dynamic analysis of the malware instance or family.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "pattern": "^software--"
            }
          ]
        },
        "operating_system_ref": {
          "description": "The operating system that was used to perform the dynamic analysis.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "pattern": "^software--"
            }
          ]
        },
        "installed_software_refs": {
          "type": "array",
          "description": "Any non-standard software installed on the operating system used for the dynamic analysis of the malware instance or family.",
          "items": {
            "allOf": [
              {
                "$ref": "../common/identifier.json"
              },
              {
                "pattern": "^software--"
              }
            ]
          },
          "minItems": 1
        },
        "analysis_sco_refs": {
          "type": "array",
          "description": "The list of STIX objects that were captured during the analysis process.",
          "items": {
            "$ref": "../common/identifier.json"
          },
          "minItems": 1
        },
        "sample_ref": {
          "description": "Refers to the object this analysis was performed against.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "oneOf": [
                {
                  "pattern": "^artifact--"
                },
                {
                  "pattern": "^file--"
                },
                {
                  "pattern": "^network-traffic--"
                }
              ]
            }
          ]
        }
      }
    }
  ],
  "required": [
    "product"
  ],
  "anyOf": [
    {"required": ["result"]},
    {"required": ["analysis_sco_refs"]}
  ],
  "definitions": {
    "malware-av-result-ov": {
      "type": "string",
      "enum": [
        "malicious",
        "suspicious",
        "benign",
        "unknown"
      ]
    }
{'fraction_non_alphanumeric': 0.1336643116287951, 'fraction_numerical': 0.0015275921329005156, 'mean_word_length': 1.5222730556224415, 'pattern_counts': {'":': 180, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '801345', 'n_tokens_mistral': 2719, 'n_tokens_neox': 2626, 'n_words': 778}