Structured language for encoding and sharing information about malware. Uses attributes such as behaviours, artefacts, and relationships between malware samples