malware-analysis_test.go

// Copyright 2020 Joakim Kennedy. All rights reserved. Use of
// this source code is governed by the included BSD license.

package stix2

import (
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
)

func TestMalwareAnalysis(t *testing.T) {
	assert := assert.New(t)

	product := "AV Product"
	ip := NewIdentifier(TypeIPv4Addr)
	ips := []Identifier{ip}
	result := MalwareResultMalicious

	t.Run("missing_property", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("", "", []Identifier{}, nil)
		assert.Nil(obj)
		assert.Equal(ErrPropertyMissing, err)
	})

	t.Run("no_optional", func(t *testing.T) {
		obj, err := NewMalwareAnalysis(product, result, ips, nil)
		assert.NotNil(obj)
		assert.NoError(err)
	})

	t.Run("with_options", func(t *testing.T) {
		conf := 50
		ts := &Timestamp{time.Now()}
		createdBy := NewIdentifier(TypeIdentity)
		ref := &ExternalReference{}
		marking := make([]*GranularMarking, 0)
		labels := []string{"tag1", "tag2"}
		lang := "en"
		objmark := []Identifier{Identifier("id")}
		specVer := "2.0"

		ver := "1.0.0"
		hostVM := NewIdentifier(TypeIPv4Addr)
		software := []Identifier{hostVM}
		confver := "9.9.9"
		modules := []string{"mod 1", "mod 2"}
		anenver := "2.2.2"
		andef := "3.2.2"
		resultName := "Some name"
		sample := Identifier("something")

		opts := []STIXOption{
			OptionConfidence(conf),
			OptionCreated(ts),
			OptionModified(ts),
			OptionCreatedBy(createdBy),
			OptionExternalReferences([]*ExternalReference{ref}),
			OptionGranularMarking(marking),
			OptionLabels(labels),
			OptionLang(lang),
			OptionObjectMarking(objmark),
			OptionRevoked(true),
			OptionSpecVersion(specVer),
			//
			OptionVersion(ver),
			OptionHostVM(hostVM),
			OptionOperatingSystem(hostVM),
			OptionInstalledSoftware(software),
			OptionConfigurationVersion(confver),
			OptionModules(modules),
			OptionAnalysisEngineVersion(anenver),
			OptionAnalysisDefinitionVersion(andef),
			OptionSubmitted(ts),
			OptionAnalysisStarted(ts),
			OptionAnalysisEnded(ts),
			OptionResultName(resultName),
			OptionSample(sample),
		}
		obj, err := NewMalwareAnalysis(product, result, ips, opts...)
		assert.NotNil(obj)
		assert.NoError(err)
		assert.Equal(conf, obj.Confidence)
		assert.Equal(ts, obj.Created)
		assert.Equal(ts, obj.Modified)
		assert.Equal(createdBy, obj.CreatedBy)
		assert.Contains(obj.ExternalReferences, ref)
		assert.Equal(marking, obj.GranularMarking)
		assert.Equal(labels, obj.Labels)
		assert.Equal(lang, obj.Lang)
		assert.Equal(objmark, obj.ObjectMarking)
		assert.True(obj.Revoked)
		assert.Equal(specVer, obj.SpecVersion)

		assert.Equal(product, obj.Product)
		assert.Equal(result, obj.Result)
		assert.Equal(ips, obj.AnalysisSCOs)
		assert.Equal(ver, obj.Version)
		assert.Equal(hostVM, obj.HostVM)
		assert.Equal(hostVM, obj.OperatingSystem)
		assert.Equal(software, obj.InstalledSoftware)
		assert.Equal(confver, obj.ConfigurationVersion)
		assert.Equal(modules, obj.Modules)
		assert.Equal(anenver, obj.AnalysisEngineVersion)
		assert.Equal(andef, obj.AnalysisDefinitionVersion)
		assert.Equal(ts, obj.Submitted)
		assert.Equal(ts, obj.AnalysisStarted)
		assert.Equal(ts, obj.AnalysisEnded)
		assert.Equal(resultName, obj.ResultName)
		assert.Equal(sample, obj.Sample)
	})
}

func TestMalwareAnalysisAddCharacterizes(t *testing.T) {
	assert := assert.New(t)

	t.Run("characterizes", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddCharacterizes(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeCharacterizes, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddCharacterizes(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareAnalysisAddAVAnalysisOf(t *testing.T) {
	assert := assert.New(t)

	t.Run("characterizes", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddAnalysisOf(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeAnalysisOf, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddAnalysisOf(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareAnalysisAddStaticAnalysisOf(t *testing.T) {
	assert := assert.New(t)

	t.Run("characterizes", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddStaticAnalysisOf(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeStaticAnalysisOf, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddStaticAnalysisOf(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareAnalysisAddDynamicAnalysisOf(t *testing.T) {
	assert := assert.New(t)

	t.Run("characterizes", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddDynamicAnalysisOf(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeDynamicAnalysisOf, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalwareAnalysis("prod", MalwareResultMalicious, []Identifier{})
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddDynamicAnalysisOf(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}