The specified type was not recognized error deserializing XML

Question

I'm trying to deserialize the following XML using C#:

<stix:STIX_Package xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1" 
    xmlns:stixCommon="http://stix.mitre.org/common-1" 
    xmlns:stix="http://stix.mitre.org/stix-1" 
    xmlns:indicator="http://stix.mitre.org/Indicator-2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    id="repository:03163c66-23ed-4e7f-8814-be1d08406" version="1.0">
    <stix:Indicators>
        <stix:Indicator id="repository:9df9af32-3b29-4482-81ac-9c090a44db8c"
            xsi:type="indicator:IndicatorType" negate="false" version="2.0">
            <indicator:Title>admin on 24th September 2014 - (1) FileObjects</indicator:Title>
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-   1.0">Exfiltration</indicator:Type>
            <indicator:Description>Some Ex filtration Happened</indicator:Description>
        </stix:Indicator>
        <stix:Indicator id="repository:9df9af32-3b29-4482-81ac-9c090a44db8d" xsi:type="indicator:IndicatorType" negate="false" version="2.0">
            <indicator:Title>admin on 24th September 2014 - (2) FileObjects</indicator:Title>
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.0">Exfiltration</indicator:Type>
            <indicator:Description>Some Ex filtration Happened Again</indicator:Description>
        </stix:Indicator>
    </stix:Indicators>
</stix:STIX_Package>

My class structure:

[XmlType(AnonymousType = true, Namespace = "http://stix.mitre.org/stix-1")]
[XmlRoot(Namespace = "http://stix.mitre.org/stix-1", IsNullable = false)]
public class STIX_Package
{
    [XmlArrayItemAttribute("Indicator", IsNullable = false)]
    public IndicatorType[] Indicators { get; set; }

    [XmlAttribute]
    public string id { get; set; }

    [XmlAttribute]
    public decimal version { get; set; }
}

[XmlRoot(ElementName = "Indicator")]
[XmlType("Indicator", Namespace = "http://stix.mitre.org/stix-1")]
public class IndicatorType : IndicatorBaseType
{
    [XmlElement("Title", Namespace = "http://stix.mitre.org/Indicator-2")]
    public string Title { get; set; }

    [XmlElement("Type", Namespace = "http://stix.mitre.org/Indicator-2")]
    public List<ControlledVocabularyStringType> Type { get; set; }

    [XmlElement("Description", Namespace = "http://stix.mitre.org/Indicator-2")]
    public StructuredTextType Description { get; set; }

    [XmlAttribute, System.ComponentModel.DefaultValueAttribute(false)]
    public bool negate { get; set; }
}

[XmlRoot(ElementName = "Indicator")]
[XmlInclude(typeof(IndicatorType))]
public class IndicatorBaseType
{
    [XmlAttribute]
    public XmlQualifiedName id { get; set; }

    [XmlAttribute]
    public string version { get; set; }
}

public class ControlledVocabularyStringType
{
    public string vocab_name { get; set; }

    public string vocab_reference { get; set; }

    [XmlText]
    public string Value { get; set; }
}

My deserialization code:

using (var stream = new StreamReader("Test.xml"))
{
    var xml = new XmlSerializer(typeof(STIX_Package));

    return (STIX_Package) xml.Deserialize(stream);
}

Deserialization produces the error:

"System.InvalidOperationException: There is an error in XML document (3, 10). ---> System.InvalidOperationException: The specified type was not recognized: name='IndicatorType', namespace='http://stix.mitre.org/Indicator-2', at http://stix.mitre.org/stix-1'>."

How do I structure/annotate my POCOs so that the XML above can be deserialized?

Answer 1

Ok, I've managed to deserialize your xml by altering the IndicatorType class. I've changed the namespace on the IndicatorType class and the namespace on the Type property

[XmlRoot(ElementName = "Indicator")]
[XmlType(Namespace = "http://stix.mitre.org/Indicator-2", TypeName = "IndicatorType")]
public class IndicatorType : IndicatorBaseType
{
    [XmlElement("Title", Namespace = "http://stix.mitre.org/Indicator-2")]
    public string Title { get; set; }

    [XmlElement("Type", Namespace = "http://stix.mitre.org/default_vocabularies-1")]
    public List<ControlledVocabularyStringType> Type { get; set; }

    [XmlElement("Description", Namespace = "http://stix.mitre.org/Indicator-2")]
    public string Description { get; set; }

    [XmlAttribute, System.ComponentModel.DefaultValueAttribute(false)]
    public bool negate { get; set; }
}

If you check out the XML you can see that the elements are in a different namespace. These are defined in the root element of your XML

<stix:Indicator xsi:type="indicator:IndicatorType"> <---HERE
  <indicator:Title>admin on 24th September 2014 - (1) FileObjects</indicator:Title>
  <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.0">Exfiltration</indicator:Type> <--- HERE
  <indicator:Description>Some Ex filtration Happened</indicator:Description>
</stix:Indicator>