mal-toolbox 0.3.11__py3-none-any.whl → 1.0.1__py3-none-any.whl

maltoolbox/model.py

@@ -27,108 +27,6 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
-@dataclass
-class AttackerAttachment:
-    """Used to attach attackers to attack step entry points of assets"""
-    id: Optional[int] = None
-    name: Optional[str] = None
-    entry_points: list[tuple[ModelAsset, list[str]]] = \
-        field(default_factory=lambda: [])
-
-
-    def get_entry_point_tuple(
-            self,
-            asset: ModelAsset
-        ) -> Optional[tuple[ModelAsset, list[str]]]:
-        """Return an entry point tuple of an AttackerAttachment matching the
-        asset provided.
-
-
-        Arguments:
-        asset           - the asset to add entry point to
-
-        Return:
-        The entry point tuple containing the asset and the list of attack
-        steps if the asset has any entry points defined for this attacker
-        attachemnt.
-        None, otherwise.
-        """
-        return next((ep_tuple for ep_tuple in self.entry_points
-                                 if ep_tuple[0] == asset), None)
-
-
-    def add_entry_point(
-            self, asset: ModelAsset, attackstep_name: str):
-        """Add an entry point to an AttackerAttachment
-
-        self.entry_points contain tuples, first element of each tuple
-        is an asset, second element is a list of attack step names that
-        are entry points for the attacker.
-
-        Arguments:
-        asset           - the asset to add the entry point to
-        attackstep_name - the name of the attack step to add as an entry point
-        """
-
-        logger.debug(
-            f'Add entry point "{attackstep_name}" on asset "{asset.name}" '
-            f'to AttackerAttachment "{self.name}".'
-        )
-
-        # Get the entry point tuple for the asset if it already exists
-        entry_point_tuple = self.get_entry_point_tuple(asset)
-
-        if entry_point_tuple:
-            if attackstep_name not in entry_point_tuple[1]:
-                # If it exists and does not already have the attack step,
-                # add it
-                entry_point_tuple[1].append(attackstep_name)
-            else:
-                logger.info(
-                    f'Entry point "{attackstep_name}" on asset "{asset.name}"'
-                    f' already existed for AttackerAttachment "{self.name}".'
-                )
-        else:
-            # Otherwise, create the entry point tuple and the initial entry
-            # point
-            self.entry_points.append((asset, [attackstep_name]))
-
-
-    def remove_entry_point(
-            self, asset: ModelAsset, attackstep_name: str):
-        """Remove an entry point from an AttackerAttachment if it exists
-
-        Arguments:
-        asset           - the asset to remove the entry point from
-        """
-
-        logger.debug(
-            f'Remove entry point "{attackstep_name}" on asset "{asset.name}" '
-            f'from AttackerAttachment "{self.name}".'
-        )
-
-        # Get the entry point tuple for the asset if it exists
-        entry_point_tuple = self.get_entry_point_tuple(asset)
-
-        if entry_point_tuple:
-            if attackstep_name in entry_point_tuple[1]:
-                # If it exists and not already has the attack step, add it
-                entry_point_tuple[1].remove(attackstep_name)
-            else:
-                logger.warning(
-                    f'Failed to find entry point "{attackstep_name}" on '
-                    f'asset "{asset.name}" for AttackerAttachment '
-                    f'"{self.name}". Nothing to remove.'
-                )
-
-            if not entry_point_tuple[1]:
-                self.entry_points.remove(entry_point_tuple)
-        else:
-            logger.warning(
-                f'Failed to find entry points on asset "{asset.name}" '
-                f'for AttackerAttachment "{self.name}". Nothing to remove.'
-            )
-
 
 class Model():
     """An implementation of a MAL language model containing assets"""
@@ -148,7 +46,6 @@ class Model():
         self.name = name
         self.assets: dict[int, ModelAsset] = {}
         self._name_to_asset:dict[str, ModelAsset] = {} # optimization
-        self.attackers: list[AttackerAttachment] = []
         self.lang_graph = lang_graph
         self.maltoolbox_version: str = mt_version
 
@@ -222,11 +119,6 @@ class Model():
         return asset
 
 
-    def remove_attacker(self, attacker: AttackerAttachment) -> None:
-        """Remove attacker"""
-        self.attackers.remove(attacker)
-
-
     def remove_asset(self, asset: ModelAsset) -> None:
         """Remove an asset from the model.
 
@@ -251,39 +143,10 @@ class Model():
         for fieldname, assoc_assets in associated_fieldnames.items():
             asset.remove_associated_assets(fieldname, assoc_assets)
 
-        # Also remove all of the entry points
-        for attacker in self.attackers:
-            entry_point_tuple = attacker.get_entry_point_tuple(asset)
-            if entry_point_tuple:
-                attacker.entry_points.remove(entry_point_tuple)
-
         del self.assets[asset.id]
         del self._name_to_asset[asset.name]
 
 
-    def add_attacker(
-            self,
-            attacker: AttackerAttachment,
-            attacker_id: Optional[int] = None
-        ) -> None:
-        """Add an attacker to the model.
-
-        Arguments:
-        attacker        - the attacker to add
-        attacker_id     - optional id for the attacker
-        """
-
-        if attacker_id is not None:
-            attacker.id = attacker_id
-        else:
-            attacker.id = self.next_id
-        self.next_id = max(attacker.id + 1, self.next_id)
-
-        if not hasattr(attacker, 'name') or not attacker.name:
-            attacker.name = 'Attacker:' + str(attacker.id)
-        self.attackers.append(attacker)
-
-
     def get_asset_by_id(
             self, asset_id: int
         ) -> Optional[ModelAsset]:
@@ -322,57 +185,12 @@ class Model():
         return self._name_to_asset.get(asset_name, None)
 
 
-    def get_attacker_by_id(
-            self, attacker_id: int
-        ) -> Optional[AttackerAttachment]:
-        """
-        Find an attacker in the model based on its id.
-
-        Arguments:
-        attacker_id     - the id of the attacker we are looking for
-
-        Return:
-        An attacker matching the id if it exists in the model.
-        """
-        logger.debug(
-            'Get attacker with id %d from model "%s".',
-            attacker_id, self.name
-        )
-        return next(
-                (attacker for attacker in self.attackers
-                if attacker.id == attacker_id), None
-            )
-
-
-    def attacker_to_dict(
-            self, attacker: AttackerAttachment
-        ) -> tuple[Optional[int], dict]:
-        """Get dictionary representation of the attacker.
-
-        Arguments:
-        attacker    - attacker to get dictionary representation of
-        """
-
-        logger.debug('Translating %s to dictionary.', attacker.name)
-        attacker_dict: dict[str, Any] = {
-            'name': attacker.name,
-            'entry_points': {},
-        }
-        for (asset, attack_steps) in attacker.entry_points:
-            attacker_dict['entry_points'][asset.name] = {
-                'asset_id': asset.id,
-                'attack_steps' : attack_steps
-            }
-        return (attacker.id, attacker_dict)
-
-
     def _to_dict(self) -> dict:
         """Get dictionary representation of the model."""
         logger.debug('Translating model to dict.')
         contents: dict[str, Any] = {
             'metadata': {},
             'assets': {},
-            'attackers' : {}
         }
         contents['metadata'] = {
             'name': self.name,
@@ -387,10 +205,6 @@ class Model():
         for asset in self.assets.values():
             contents['assets'].update(asset._to_dict())
 
-        logger.debug('Translating attackers to dictionary.')
-        for attacker in self.attackers:
-            (attacker_id, attacker_dict) = self.attacker_to_dict(attacker)
-            contents['attackers'][attacker_id] = attacker_dict
         return contents
 
 
@@ -459,29 +273,13 @@ class Model():
                         for assoc_asset_id in assoc_assets}
                 )
 
-        # Reconstruct the attackers
+        # Attackers no longer part of mal-toolbox
         if 'attackers' in serialized_object:
-            attackers_info = serialized_object['attackers']
-            for attacker_id in attackers_info:
-                attacker = AttackerAttachment(name = attackers_info[attacker_id]['name'])
-                for asset_name, entry_points_dict in \
-                        attackers_info[attacker_id]['entry_points'].items():
-                    target_asset = model.get_asset_by_id(
-                        entry_points_dict['asset_id'])
-                    if target_asset is None:
-                        raise LookupError(
-                            'Asset "%s"(%d) is not part of model "%s".' % (
-                                asset_name,
-                                entry_points_dict['asset_id'],
-                                model.name)
-                        )
-                    attacker.entry_points.append(
-                            (
-                                target_asset,
-                                entry_points_dict['attack_steps']
-                            )
-                        )
-                model.add_attacker(attacker, attacker_id = int(attacker_id))
+            msg = ("Defining attackers in a model file is deprecated,"
+                   " use mal-simulator for attacker simulations.")
+            print(msg)
+            logger.warning(msg)
+
         return model
 
 
@@ -528,12 +326,6 @@ class ModelAsset:
         self._associated_assets: dict[str, set[ModelAsset]] = {}
         self.attack_step_nodes: list = []
 
-        for step in self.lg_asset.attack_steps.values():
-            if step.type == 'defense' and step.name not in self.defenses:
-                self.defenses[step.name] = 1.0 if step.ttc and \
-                    step.ttc['name'] == 'Enabled' else 0.0
-
-
     def _to_dict(self):
         """Get dictionary representation of the asset."""
 
@@ -547,14 +339,8 @@ class ModelAsset:
             'associated_assets': {}
         }
 
-        # Only add non-default values for defenses to improve legibility of
-        # the model format
         for defense, defense_value in self.defenses.items():
-            lg_step = self.lg_asset.attack_steps[defense]
-            default_defval = 1.0 if lg_step.ttc and \
-                    lg_step.ttc['name'] == 'Enabled' else 0.0
-            if defense_value != default_defval:
-                asset_dict['defenses'][defense] = defense_value
+            asset_dict['defenses'][defense] = defense_value
 
         for fieldname, assets in self.associated_assets.items():
             asset_dict['associated_assets'][fieldname] = {asset.id: asset.name

maltoolbox/translators/securicad.py

@@ -9,7 +9,7 @@ import xml.etree.ElementTree as ET
 
 from typing import Optional
 
-from ..model import AttackerAttachment, Model
+from ..model import Model
 from ..language import LanguageGraph
 
 logger = logging.getLogger(__name__)

maltoolbox/translators/updater.py

@@ -82,7 +82,7 @@ def convert_model_dict_from_version_0_0(model_dict: dict) -> dict:
 
     # Meta data and attackers did not change
     new_model_dict['metadata'] = model_dict['metadata']
-    new_model_dict['attackers'] = model_dict['attackers']
+    new_model_dict['attackers'] = model_dict.get('attackers', {})
 
     new_model_dict['assets'] = {}
 

mal_toolbox-0.3.11.dist-info/RECORD

@@ -1,29 +0,0 @@
-maltoolbox/__init__.py,sha256=m3yZVHy12wt-vRUtI-8HnaiRFnuYJxzt_Z5fOH3D77g,2090
-maltoolbox/__main__.py,sha256=PSg8vFS8X-klJBJdSzrg0aLh9ykZgbcoSSEy3DTQoQQ,3499
-maltoolbox/exceptions.py,sha256=0YjPx2v1yYumZ2o7pVZ1s_jS-GAb3Ng979KEFhROSNY,1399
-maltoolbox/file_utils.py,sha256=tBR8Kjl8IoFzAtYaLNHNALuQrdMT3pD1ZpczHm1pu2g,1875
-maltoolbox/model.py,sha256=Y3FKyWyRGPzJlpP92XRrWS52xVeKaz9rgOLoQJvJ808,24008
-maltoolbox/attackgraph/__init__.py,sha256=AHDyX6dAkx3mDic2K56v1xche9N6ofDfbaHkKbdJ2qQ,230
-maltoolbox/attackgraph/attacker.py,sha256=Lq7g_uFDvThU0wah-CiYA6oTshxt1TlgPJfkojlSyRQ,3132
-maltoolbox/attackgraph/attackgraph.py,sha256=QEfWblZDBpvX7o17LL3LHf1gyB080fTGt7uVC8082mM,32537
-maltoolbox/attackgraph/node.py,sha256=Ec67_u_8qf_MgCHaUg4wIbZFC013GWxbIsC8EjoguzE,6465
-maltoolbox/attackgraph/query.py,sha256=iuaLAc3bMnQefgGa1g62re8-3yQrgBW_cS5W_DgWEjY,6835
-maltoolbox/attackgraph/analyzers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-maltoolbox/attackgraph/analyzers/apriori.py,sha256=yERuk5M96Cpv2WyqNEpM_j7sf04SNYXSw_hFoL7UPW4,8986
-maltoolbox/ingestors/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-maltoolbox/ingestors/neo4j.py,sha256=W3AH3nymRQHI9N65HsSyyeQKcETPXmY_SLKc-iB4sBI,8328
-maltoolbox/language/__init__.py,sha256=9p5nvVqDCKEhXbDMIz1MtwZ9GN7x1jmUUXbpjEwuqnw,269
-maltoolbox/language/languagegraph.py,sha256=eBPTyoDpfc01ONEj321-RmIJV3DfVenYfHdVu0TiITo,67856
-maltoolbox/language/compiler/__init__.py,sha256=JQyAgDwJh1pU7AmuOhd1-d2b2PYXpgMVPtxnav8QHVc,15872
-maltoolbox/language/compiler/mal_lexer.py,sha256=BeifykDAt4PloRASOaLzBgWF35ev_zgD8lXMIsSHykc,12063
-maltoolbox/language/compiler/mal_parser.py,sha256=sUoaE43l2VKg-Dou30mk2wlVS1FvdOREwHNIyFe4IkY,114699
-maltoolbox/translators/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-maltoolbox/translators/securicad.py,sha256=PJYjieioWN5tE_oKm83dtgV5UkC8EUH9Vsy3-FxBtUo,7017
-maltoolbox/translators/updater.py,sha256=8bisZnzMWjGaG5tu8jdF-Oq6bPwIjXkVO-_yZDGc6cA,8652
-mal_toolbox-0.3.11.dist-info/AUTHORS,sha256=zxLrLe8EY39WtRKlAY4Oorx4Z2_LHV2ApRvDGZgY7xY,127
-mal_toolbox-0.3.11.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-mal_toolbox-0.3.11.dist-info/METADATA,sha256=OHt2yl_bXfmzSH47-OhHzK6jDADEsSAYh3hqmDc9ZKM,6159
-mal_toolbox-0.3.11.dist-info/WHEEL,sha256=52BFRY2Up02UkjOa29eZOS2VxUrpPORXg1pkohGGUS8,91
-mal_toolbox-0.3.11.dist-info/entry_points.txt,sha256=oqby5O6cUP_OHCm70k_iYPA6UlbTBf7se1i3XwdK3uU,56
-mal_toolbox-0.3.11.dist-info/top_level.txt,sha256=phqRVLRKGdSUgRY03mcpi2cmbbDo5YGjkV4gkqHFFcM,11
-mal_toolbox-0.3.11.dist-info/RECORD,,

maltoolbox/attackgraph/analyzers/apriori.py

@@ -1,243 +0,0 @@
-"""
-MAL-Toolbox Attack Graph Apriori Analyzer Submodule
-
-This submodule contains analyzers that are relevant before attackers are even
-connected to the attack graph.
-Currently these are:
-- Viability = Determine if a node can be traversed under any circumstances or
-  if the model structure makes it unviable.
-- Necessity = Determine if a node is necessary for the attacker or if the
-  model structure means it is not needed(it behaves as if it were already
-  compromised) to compromise children attack steps.
-"""
-
-from __future__ import annotations
-from typing import Optional, TYPE_CHECKING
-import logging
-
-if TYPE_CHECKING:
-    from ..attackgraph import AttackGraph
-    from ..node import AttackGraphNode
-
-logger = logging.getLogger(__name__)
-
-def propagate_viability_from_node(node: AttackGraphNode) -> None:
-    """
-    Arguments:
-    node        - the attack graph node from which to propagate the viable
-                  status
-    """
-    logger.debug(
-        'Propagate viability from "%s"(%d) with viability status %s.',
-        node.full_name, node.id, node.is_viable
-    )
-    for child in node.children:
-        original_value = child.is_viable
-        if child.type == 'or':
-            child.is_viable = False
-            for parent in child.parents:
-                child.is_viable = child.is_viable or parent.is_viable
-        if child.type == 'and':
-            child.is_viable = False
-
-        if child.is_viable != original_value:
-            propagate_viability_from_node(child)
-
-
-def propagate_necessity_from_node(node: AttackGraphNode) -> None:
-    """
-    Arguments:
-    node        - the attack graph node from which to propagate the necessary
-                  status
-    """
-    logger.debug(
-        'Propagate necessity from "%s"(%d) with necessity status %s.',
-        node.full_name, node.id, node.is_necessary
-    )
-
-    for child in node.children:
-        if child.ttc and child.ttc.get('name', None) not in ['Enabled',
-                'Disabled', 'Instant']:
-            # Do not propagate unnecessary state from nodes that have a TTC
-            # probability distribution associated with them.
-            # TODO: Evaluate this more carefully, how do we want to have TTCs
-            # impact necessity and viability.
-            # TODO: Have this condition be any probability that has a
-            # Bernoulli component
-            continue
-        original_value = child.is_necessary
-        if child.type == 'or':
-            child.is_necessary = False
-        if child.type == 'and':
-            child.is_necessary = False
-            for parent in child.parents:
-                child.is_necessary = child.is_necessary or parent.is_necessary
-
-        # TODO: Update TTC for child attack step before if it is not necessary
-        # before propagating it further.
-        if child.is_necessary != original_value:
-            propagate_necessity_from_node(child)
-
-
-def evaluate_viability(node: AttackGraphNode) -> None:
-    """
-    Arguments:
-    graph       - the node to evaluate viability for.
-    """
-    match (node.type):
-        case 'exist':
-            assert isinstance(node.existence_status, bool), \
-                f'Existence status not defined for {node.full_name}.'
-            node.is_viable = node.existence_status
-        case 'notExist':
-            assert isinstance(node.existence_status, bool), \
-                f'Existence status not defined for {node.full_name}.'
-            node.is_viable = not node.existence_status
-        case 'defense':
-            assert node.defense_status is not None and \
-                   0.0 <= node.defense_status <= 1.0, \
-                f'{node.full_name} defense status invalid: {node.defense_status}.'
-            node.is_viable = node.defense_status != 1.0
-        case 'or':
-            node.is_viable = False
-            for parent in node.parents:
-                node.is_viable = node.is_viable or parent.is_viable
-        case 'and':
-            node.is_viable = True
-            for parent in node.parents:
-                node.is_viable = node.is_viable and parent.is_viable
-        case _:
-            msg = ('Evaluate viability was provided node "%s"(%d) which '
-                   'is of unknown type "%s"')
-            logger.error(msg, node.full_name, node.id, node.type)
-            raise ValueError(msg % (node.full_name, node.id, node.type))
-
-
-def evaluate_necessity(node: AttackGraphNode) -> None:
-    """
-    Arguments:
-    graph       - the node to evaluate necessity for.
-    """
-    match (node.type):
-        case 'exist':
-            assert isinstance(node.existence_status, bool), \
-                f'Existence status not defined for {node.full_name}.'
-            node.is_necessary = not node.existence_status
-        case 'notExist':
-            assert isinstance(node.existence_status, bool), \
-                f'Existence status not defined for {node.full_name}.'
-            node.is_necessary = bool(node.existence_status)
-        case 'defense':
-            assert node.defense_status is not None and \
-                   0.0 <= node.defense_status <= 1.0, \
-                f'{node.full_name} defense status invalid: {node.defense_status}.'
-            node.is_necessary = node.defense_status != 0.0
-        case 'or':
-            node.is_necessary = True
-            for parent in node.parents:
-                node.is_necessary = node.is_necessary and parent.is_necessary
-        case 'and':
-            node.is_necessary = False
-            for parent in node.parents:
-                node.is_necessary = node.is_necessary or parent.is_necessary
-        case _:
-            msg = ('Evaluate necessity was provided node "%s"(%d) which '
-                   'is of unknown type "%s"')
-            logger.error(msg, node.full_name, node.id, node.type)
-            raise ValueError(msg % (node.full_name, node.id, node.type))
-
-
-def evaluate_viability_and_necessity(node: AttackGraphNode) -> None:
-    """
-    Arguments:
-    graph       - the node to evaluate viability and necessity for.
-    """
-    evaluate_viability(node)
-    evaluate_necessity(node)
-
-
-def calculate_viability_and_necessity(graph: AttackGraph) -> None:
-    """
-    Arguments:
-    graph       - the attack graph for which we wish to determine the
-                  viability and necessity statuses for the nodes.
-    """
-    for node in graph.nodes.values():
-        if node.type in ['exist', 'notExist', 'defense']:
-            evaluate_viability_and_necessity(node)
-            if not node.is_viable:
-                propagate_viability_from_node(node)
-            if not node.is_necessary:
-                propagate_necessity_from_node(node)
-
-
-def prune_unviable_and_unnecessary_nodes(graph: AttackGraph) -> None:
-    """
-    Arguments:
-    graph       - the attack graph for which we wish to remove the
-                  the nodes which are not viable or necessary.
-    """
-    logger.debug(
-        'Prune unviable and unnecessary nodes from the attack graph.')
-
-    nodes_to_remove = set()
-    for node in graph.nodes.values():
-        if node.type in ('or', 'and') and \
-            (not node.is_viable or not node.is_necessary):
-            nodes_to_remove.add(node)
-
-    # Do the removal separatly so we don't remove
-    # nodes from a set we are looping over
-    for node in nodes_to_remove:
-        graph.remove_node(node)
-
-
-def propagate_viability_from_unviable_node(
-        unviable_node: AttackGraphNode,
-    ) -> set[AttackGraphNode]:
-    """
-    Update viability of nodes affected by newly enabled defense
-    `unviable_node` in the graph and return any attack steps
-    that are no longer viable because of it.
-
-    Propagate recursively via children as long as changes occur.
-
-    Arguments:
-    unviable_node               - the node to propagate viability from
-
-    Returns:
-    attack_steps_made_unviable  - set of the attack steps that have been
-                                  made unviable by a defense enabled in the
-                                  current step. Builds up recursively.
-    """
-
-    attack_steps_made_unviable = set()
-
-    logger.debug(
-        'Update viability for node "%s"(%d)',
-        unviable_node.full_name,
-        unviable_node.id
-    )
-
-    assert not unviable_node.is_viable, (
-        "propagate_viability_from_unviable_node should not be called"
-       f" on viable node {unviable_node.full_name}"
-    )
-
-    if unviable_node.type in ('and', 'or'):
-        attack_steps_made_unviable.add(unviable_node)
-
-    for child in unviable_node.children:
-        original_value = child.is_viable
-        if child.type == 'or':
-            child.is_viable = False
-            for parent in child.parents:
-                child.is_viable = child.is_viable or parent.is_viable
-        if child.type == 'and':
-            child.is_viable = False
-
-        if child.is_viable != original_value:
-            attack_steps_made_unviable |= \
-                propagate_viability_from_unviable_node(child)
-
-    return attack_steps_made_unviable