Investigate Adding Context to Malware Subject Relationships

[ikiril01]

We should investigate adding the ability to add context to Malware Subject -> Malware Subject relationships. E.g., for the "dropped by/drops" relationship, it would be useful to have the ability to specify the particular Action that performed the "dropping".

[ikiril01]

From #89: Also, one thing that may be useful in this regard is to capture "supporting evidence" as part of a relationship; in this case, it could point to the Action that represents the basis for the Malware Subject relationship.

For example:

<Object id="object-1">
  <Properties xsi:type="FileObj:FileObjectType">
    <File_Name>winsvcc.exe</File_Name>
  </Properties>
</Object>

<Object id="object-2">
  <Properties xsi:type="FileObj:FileObjectType">
    <File_Name>stage2.exe</File_Name>
  </Properties>
</Object>

<Malware_Subject id="malware-subject-1">
  <Instance_Properties object_id="object-1">
  <Actions>
    <Action id="action-1">
       <Name>create file</Name>
       <Associated_Object_Reference object_id="object-1"/>
    </Action>
  </Actions>
</Malware_Subject>

<Malware_Subject id="malware-subject-2">
  <Instance_Properties object_id="object-2">
</Malware_Subject>

<Relationship source_id="malware-subject-1" target_id="malware-subject-2">
  <Type>drops</Type>
  <Supporting_Evidence>
     <Entity_Reference entity_id="action-1">
  </Supporting_Evidence>
</Relationship>