|Incident Classification Taxonomy|
|N°||INCIDENT CLASSIFICATION||INCIDENT EXAMPLES||DESCRIPTION|
|1||Abusive content||Child/Sexual/Violence/…||Child pornography, glorification of violence, …|
|Spam||«Unsolicited Bulk Email», this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content.
|Harmful Speech||Discreditation or discrimination of somebody.|
|2||Malicious Code||Malware, Virus, Worm, Trojan, Spyware, Dialler, Rootkit||Software that is intentionally included or inserted in a system for a harmful purpose. A user interaction is normally necessary to activate the code.|
|3||Information Gathering||Scanning||Attacks that send requests to a system to discover weak points. This includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, …), port scanning.
|Sniffing||Observing and recording of network traffic (wiretapping).|
|Social engineering||Gathering information from a human being in a non‐technical way (e.g. lies, tricks, bribes, or threats).
|4||Intrusion Attemps||Login attempts||Multiple login attempts (Guessing / cracking of passwords, brute force).|
|Exploiting known vulnerabilities||An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.).|
|New attack signature||An attempt using an unknown exploit.|
|5||Intrusions||Privileged account compromise||A successful compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access. Also includes being part of a botnet.|
|Unprivileged account compromise|
|Application compromise, Bot|
|6||Availability||Denial of Service (DoS / DDoS)||By this kind of an attack a system is bombarded with so many packets that the operations are delayed or the system crashes. DoS examples are ICMP and SYN floods, Teardrop attacks and mail-bombing. DDoS often is based
on DoS attacks originating from botnets, but also other scenarios exist like DNS Amplification attacks. However, the availability also can be affected by local actions (destruction, disruption of power supply, etc.) – or by Act of God, spontaneous failures or human error, without malice or gross neglect being involved.
|Outage (no malice)|
|7||Information Content Security||Unauthorised access to information||Besides a local abuse of data and systems the information security can be endangered by a successful account or application compromise. Furthermore, attacks are possible that intercept and access information during transmission (wiretapping, spoofing or hijacking). Human/configuration/software error can also be the cause.|
|Unauthorised modification of information|
|8||Fraud||Phishing||Masquerading as another entity in order to persuade the user to reveal a private credential|
|Copyright||Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).|
|Unauthorized use of resources||Using resources for unauthorized purposes including profit-making ventures (E.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes).|
|Masquerade||Type of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it.|
|9||Vulnerable||Open for abuse||Open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus signatures not up-to-date, etc|
|10||Other||All incidents which do not fit in one of the given categories should be put into this class
||If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised.
|11||Test||Meant for testing||Meant for testing