observable:WindowsPESection leaf node

core:UcoInherentCharacterizationThing
- observable:WindowsPESection

URI

https://ontology.unifiedcyberontology.org/uco/observable/WindowsPESection

Label

WindowsPESection

Description

A Windows PE section is a grouping of characteristics unique to a specific default or custom-defined region of a Windows PE (Portable Executable) file, consisting of an individual portion of the actual executable content of the file delineated according to unique purpose and memory protection requirements.

Superclasses (2)

core:UcoInherentCharacterizationThing

core:UcoThing

Shapes (1)

observable:WindowsPESection

Usage

Instances of observable:WindowsPESection can have the following properties:

PROPERTY	TYPE	DESCRIPTION	RANGE
From class owl:Thing
core:informalType	owl:DatatypeProperty	Informal Type serves as a parent property for string-valued properties meant to describe a type without implementing a class design. This property hierarchy supports a balancing point between semantic specificity and operational agility. The known benefits of describing types rather than implementing them include swift extensibility of some existing, or possibly non-existing, subclass hierarchy in UCO without requiring training in ontological development, taxonomic specification, or OWL, SHACL, or RDF maintenance logistics. The known detractions of using string-literals for type descriptions include that used vocabularies may require careful maintenance among data-sharing parties; that vocabularies require independent logistics (external to UCO) for providing definitions (i.e., dictionary-style semantics) to string-literals chosen; and that string-literals cannot by themselves encode hierarchical structure or entailments, such as the informal device type string 'ExamplePhone 8 P4321' entailing 'ExamplePhone 8', 'ExamplePhone', or 'ExamplePhone models discontinued in 2020'. Usage of Informal Type to house strings should be weighed against usage of classes when classes are available, and should periodically be reviewed for potential additions to UCO's class hierarchy or downstream extensions thereof.	owl:Thing
types:threadNextItem	owl:ObjectProperty	The link to a next item in a thread.	owl:Thing
types:threadPreviousItem	owl:ObjectProperty	A direct link to a previous item in a thread.	owl:Thing

Property Shapes

By the associated SHACL property shapes, instances of observable:WindowsPESection can have the following properties:

PROPERTY	PROPERTY TYPE	DESCRIPTION	MAX COUNT	LOCAL RANGE (type range for property on this class)	GLOBAL RANGE (type range for property globally)
observable:WindowsPESection
core:name	owl:DatatypeProperty	The name of a particular concept characterization.	1	xsd:string	xsd:string
observable:entropy	owl:DatatypeProperty	Shannon entropy (a measure of randomness) of the data.	1	xsd:decimal	xsd:decimal
observable:hashes	owl:ObjectProperty	Specifies any hashes computed over the section.		types:Hash	types:Hash
observable:size	owl:DatatypeProperty	Specifies the size of the section, in bytes.	1	xsd:integer	xsd:integer

Implementation

@prefix core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix types: <https://ontology.unifiedcyberontology.org/uco/types/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

observable:WindowsPESection a owl:Class,
        sh:NodeShape ;
    rdfs:label "WindowsPESection"@en ;
    rdfs:comment "A Windows PE section is a grouping of characteristics unique to a specific default or custom-defined region of a Windows PE (Portable Executable) file, consisting of an individual portion of the actual executable content of the file delineated according to unique purpose and memory protection requirements."@en ;
    rdfs:subClassOf core:UcoInherentCharacterizationThing ;
    sh:property [ sh:class types:Hash ;
            sh:nodeKind sh:IRI ;
            sh:path observable:hashes ],
        [ sh:datatype xsd:decimal ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path observable:entropy ],
        [ sh:datatype xsd:integer ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path observable:size ],
        [ sh:datatype xsd:string ;
            sh:maxCount 1 ;
            sh:nodeKind sh:Literal ;
            sh:path core:name ] ;
    sh:targetClass observable:WindowsPESection .