The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs
MAL Simulator grounds attack-defense graph simulations in a CRATE-emulated network, training RL attacker and defender agents where attackers outperform search methods.
The MAL Simulator is a cyber operations simulator built on the Meta Attack Language (MAL), enabling decision-driven attack and defense simulations adaptable to new domains without modifying source code. Case studies trained defensive and offensive agents, grounded in data collected from an emulated network implemented in the CRATE cyber range. The trained attacker policy reached designated targets more efficiently than compared search methods, and the trained defender induced lower costs than a naive heuristic under noisy alerts, though defender performance dropped significantly against an RL attacker.
- Simulator built on Meta Attack Language adapts to new domains without code changes
- Models grounded in emulated network data from the CRATE cyber range
- Trained attacker policy reaches targets more efficiently than compared search methods
- RL defender performance drops significantly when facing an RL attacker
From the original article
1 min read at arxiv.orgWe have developed the MAL Simulator, a cyber operation simulator based on the Meta Attack Language (MAL). The MAL Simulator is intended for decision-driven cyber attack and defense simulations, for system analysis and the development of automated agents. By building the simulator around an attack modeling language, it can be adapted to different target domains without modifying the source code.
By Jakob Nyberg · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.