The Meta Attack Language (MAL) is a language used to create domain-specific threat modeling languages - a malLang.

We can think of it as a bridge between systems modeling (like UML) and attack graphs. It formalizes the process of generating potential attack graphs based on how a system is designed.

To build a language in MAL, you define four primary elements:

• Assets: The categories of things in your system (e.g., Computers, Applications, Networks, Data, Credentials).
• Relationships: How those assets are related (e.g., a Computer runs Applications; a Computer is connected to a Network).
• Attack Steps: The specific actions that can be taken against an Asset (e.g., connect, authenticate, guess credentials, or compromise a Computer).
• Causal Links: How one successful attack may enable the next one.

Example: An attacker succeeds with the connect action to a Computer asset. They can now attempt to authenticate (if they have succeeded to compromise the right Credentials) or guessCredentials. Success in either leads to a compromise of that Computer asset. The compromised Computer asset then allows the attacker to connect to any other device on the Network that the Computer is connected to.

By looking at your specific system architecture (how your assets are configured), MAL determines every possible attack vector and expresses them in an attack graph.

MAL allows cybersecurity expertise to be encoded and reused across diverse system environments. By capturing how systems are attacked and defended, MAL empowers designers and maintainers to analyze their specific infrastructures.

MAL enables the creation of a cybersecurity digital twin, facilitating several high-level functions:

• Red & blue teaming: Perform large-scale red team simulations and evaluate the effectiveness of blue team interventions.
• Threat modeling: Identify optimal security designs and guide operational protective actions based on observed attack chains.
• Simulation-based training: Utilize MAL asset and attack graphs as an infrastructure to train attacker and defender agents, for instance by using methods like machine learning.

The usual workflow one would do with MAL is the following:

1. You either use a pre-existing malLang or write your own.
2. Load your malLang and create a model, either programmatically using Python modules via MAL toolbox or manually with the MAL-GUI.
3. Simulate attacks with the simulation tool (MAL simulator).

graph LR
    %% Main nodes
    Step1(<b>1. Create/Load malLang</b><br/>.mal-file definition)
    Step3(<b>3. Running Simulations</b><br/>MAL-simulator)

    %% PATH A: Graphical path (Connected by a dotted line)
    Step1 -.- Path2_A
    subgraph Graphic_Approach ["<b>2A. Graphic Approach (MAL-GUI)</b>"]
        Path2_A["<b>Model Creation</b><br/><i>Via MAL-GUI</i>"]
        Path3_A["<b>Scenario File (.yml)</b><br/><i>Includes: lang + model + agents</i>"]
        Path2_A --> Path3_A
    end

    %% PATH B: Programmatic path (Connected by a dotted line)
    Step1 -.- Path2_B
    
    subgraph Programmatic_Flow ["<b>2B. Programmatic Approach (MAL-toolbox)</b>"]
        Path2_B["<b>Model Creation</b><br/><i>Via MAL-Toolbox</i>"]
        Path3_B["<b>Create AttackGraph</b><br/><i>Includes: lang + model</i>"]
        Path4_B["<b>Add Agent Settings</b>"]
        Path2_B --> Path3_B --> Path4_B
    end

    Path3_A--> Step3
    Path4_B --> Step3

    %% Aesthetics and Colours
    style Step1 fill:#f8f9fa,stroke:#343a40
    style Step3 fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px
    
    style Path2_A fill:#fff3e0,stroke:#ef6c00
    style Path2_B fill:#fff3e0,stroke:#ef6c00
    style Path3_A fill:#ede7f6,stroke:#5e35b1
    style Path3_B fill:#ede7f6,stroke:#5e35b1
    style Path4_B fill:#ede7f6,stroke:#5e35b1
    
    style Programmatic_Flow fill:#fafafa,stroke:#9e9e9e,stroke-dasharray: 5 5
    style Graphic_Approach fill:#fafafa,stroke:#9e9e9e,stroke-dasharray: 5 5

MAL has been developed by Software Systems Architecture and Security group [1] [2] at KTH Royal Institute of Technology in Sweden and this GitHub organization gathers results of many of the various projects that the research group has been working on over the years. A few highlights of these are:

• MAL specification wiki documents the MAL syntax and sematics and describes how languages are built.

• The MAL toolbox, which contains support for building asset instance models from a given MAL language and then generating the corresponding attack graph from the asset instance model.

• The MAL simulator, which is an infrastructure for using the MAL attack graphs as a game board where defender and attacker agents can “play” against each other. It can be used as a simulator for machine learning of the agents.

• The MAL-GUI, which is a super simple drag-n-drop studio for creating instance models given some chosen MAL-language.

• MAL tutorials to learn how the MAL tools work.

• The mal-vs-code-extension for MAL language support in VS Code.
• mal-language-server

• exampleLang, which is a language devised to demonstrate how MAL works and good to start with if you are new to MAL.

• coreLang, which is a language that has the ambition to cover the most common attack vectors found in common IT environments (example scenarios).

• tyrLang, a simpler variant of coreLang built for an external project (example scenarios).

More academic papers related to various MAL projects have been produced than what can be mentioned here, but there exist two papers on MAL per se:

• Pontus Johnson, Robert Lagerström, and Mathias Ekstedt. 2018. A Meta Language for Threat Modeling and Attack Simulations. In Proceedings of the 13th International Conference on Availability, Reliability and Security (ARES '18). Association for Computing Machinery, New York, NY, USA, Article 38, 1–8. https://doi.org/10.1145/3230833.3232799
• Wojciech Wideł, Simon Hacks, Mathias Ekstedt, Pontus Johnson, Robert Lagerström, The meta attack language - a formal description, Computers & Security, Volume 130, 2023, 103284, ISSN 0167-4048, https://doi.org/10.1016/j.cose.2023.103284

Check out more MAL related projects!