@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
@prefix mcr: <https://registry.apicrafter.io/vocab#> .
@prefix dt: <https://registry.apicrafter.io/datatype/> .
@prefix cat: <https://registry.apicrafter.io/category/> .
@prefix country: <https://registry.apicrafter.io/country/> .
@prefix tool: <https://registry.apicrafter.io/tool/> .

dt:malware_detection_name a skos:Concept ;
    skos:inScheme <https://registry.apicrafter.io/> ;
    skos:topConceptOf <https://registry.apicrafter.io/> ;
    skos:notation "malware_detection_name" ;
    skos:prefLabel "Antivirus detection name"@en ;
    skos:definition "Name that an antivirus or anti-malware engine gives to the threat it detects in a file, URL or process, as shown in scan results, quarantine logs and the per-engine results of VirusTotal (last_analysis_results.result). Every vendor has its own scheme: most build on the CARO naming convention of type, platform, family and variant, but the order, separators and suffixes differ, and generic or machine-learning detections carry no family. The same file therefore gets different names from different engines; VirusTotal counts the tokens of these names to suggest one threat label (popular_threat_classification). The format is not fixed, so there is no regexp."@en ;
    skos:narrower dt:microsoft_malware_name ;
    skos:example "Gen:Variant.Marsilia.217465" ;
    skos:example "MSIL/Agent.YUF Trojan" ;
    skos:example "Backdoor.Win32.Xkcp.eas" ;
    skos:example "Trojan:Win32/Wacatac.B!ml" ;
    mcr:status "draft" ;
    mcr:isPII false ;
    mcr:classification "categorical" ;
    rdfs:seeAlso <https://virustotal.readme.io/reference/files> ;
    rdfs:seeAlso <https://learn.microsoft.com/en-us/defender-xdr/malware-naming> .