{
  "term": "AntiAnalysisBehavior",
  "role": "concept",
  "parent_concepts": [
    "AttackPattern"
  ],
  "layer": 3,
  "domain": "CreatedThings",
  "definition": "A malicious attack pattern designed to detect, evade, or subvert analysis tools, sandboxes, debuggers, or monitoring systems used in security research and malware analysis. These techniques allow malicious code to avoid detection or modify its behavior when under observation.",
  "definition_source": "SUMO",
  "aliases": [
    "anti analysis behavior",
    "analysis evasion",
    "sandbox evasion",
    "debugging detection",
    "anti-debugging technique"
  ],
  "wordnet": {
    "synsets": [
      "antianalysisbehavior.n.01"
    ],
    "canonical_synset": "antianalysisbehavior.n.01",
    "lemmas": [
      "anti analysis behavior",
      "analysis evasion",
      "sandbox evasion",
      "debugging detection",
      "anti-debugging technique"
    ],
    "pos": "noun"
  },
  "relationships": {
    "related": [],
    "antonyms": [],
    "has_part": [
      "AntiDetectionBehavior"
    ],
    "part_of": []
  },
  "safety_tags": {
    "risk_level": "high",
    "impacts": [],
    "treaty_relevant": false,
    "harness_relevant": true
  },
  "training_hints": {
    "positive_examples": [],
    "negative_examples": [],
    "disambiguation": "",
    "seed_terms": [
      "anti analysis behavior",
      "analysis evasion",
      "sandbox evasion",
      "debugging detection",
      "anti-debugging technique"
    ]
  },
  "children": [
    "AntiDetectionBehavior"
  ],
  "is_category_lens": true,
  "child_count": 1
}