mal-toolbox 0.3.11__tar.gz → 1.0.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {mal_toolbox-0.3.11/mal_toolbox.egg-info → mal_toolbox-1.0.0}/PKG-INFO +4 -22
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/README.md +1 -20
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0/mal_toolbox.egg-info}/PKG-INFO +4 -22
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/mal_toolbox.egg-info/SOURCES.txt +1 -4
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/__init__.py +5 -6
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/__main__.py +3 -34
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/attackgraph/__init__.py +7 -1
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/attackgraph/attackgraph.py +51 -192
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/attackgraph/node.py +2 -82
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/file_utils.py +1 -1
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/language/__init__.py +11 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/language/languagegraph.py +631 -369
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/model.py +6 -208
- mal_toolbox-1.0.0/maltoolbox/translators/__init__.py +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/translators/securicad.py +1 -1
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/translators/updater.py +1 -1
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/pyproject.toml +2 -2
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/tests/test_model.py +2 -257
- mal_toolbox-0.3.11/maltoolbox/attackgraph/analyzers/apriori.py +0 -243
- mal_toolbox-0.3.11/maltoolbox/attackgraph/attacker.py +0 -109
- mal_toolbox-0.3.11/maltoolbox/attackgraph/query.py +0 -196
- mal_toolbox-0.3.11/maltoolbox/ingestors/neo4j.py +0 -244
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/AUTHORS +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/LICENSE +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/mal_toolbox.egg-info/dependency_links.txt +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/mal_toolbox.egg-info/entry_points.txt +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/mal_toolbox.egg-info/requires.txt +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/mal_toolbox.egg-info/top_level.txt +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/attackgraph/analyzers/__init__.py +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/exceptions.py +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/ingestors/__init__.py +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/language/compiler/__init__.py +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/language/compiler/mal_lexer.py +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/maltoolbox/language/compiler/mal_parser.py +0 -0
- /mal_toolbox-0.3.11/maltoolbox/translators/__init__.py → /mal_toolbox-1.0.0/maltoolbox/py.typed +0 -0
- {mal_toolbox-0.3.11 → mal_toolbox-1.0.0}/setup.cfg +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
Metadata-Version: 2.
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
2
|
Name: mal-toolbox
|
|
3
|
-
Version: 0.
|
|
3
|
+
Version: 1.0.0
|
|
4
4
|
Summary: A collection of tools used to create MAL models and attack graphs.
|
|
5
5
|
Author-email: Andrei Buhaiu <buhaiu@kth.se>, Joakim Loxdal <loxdal@kth.se>, Nikolaos Kakouros <nkak@kth.se>, Jakob Nyberg <jaknyb@kth.se>, Giuseppe Nebbione <nebbione@kth.se>
|
|
6
6
|
License: Apache Software License
|
|
@@ -23,6 +23,7 @@ Requires-Dist: antlr4-tools
|
|
|
23
23
|
Requires-Dist: antlr4-python3-runtime
|
|
24
24
|
Requires-Dist: docopt
|
|
25
25
|
Requires-Dist: PyYAML
|
|
26
|
+
Dynamic: license-file
|
|
26
27
|
|
|
27
28
|
# MAL Toolbox overview
|
|
28
29
|
|
|
@@ -30,7 +31,6 @@ MAL Toolbox is a collection of python modules to help developers create and work
|
|
|
30
31
|
MAL ([Meta Attack Language](https://mal-lang.org/)) models and attack graphs.
|
|
31
32
|
|
|
32
33
|
Attack graphs can be used to run simulations (see MAL Simulator) or analysis.
|
|
33
|
-
MAL Toolbox also gives the ability to view the AttackGraph/Model graphically in neo4j.
|
|
34
34
|
|
|
35
35
|
[Documentation](https://mal-lang.org/mal-toolbox/index.html)(Work in progress)
|
|
36
36
|
|
|
@@ -53,13 +53,7 @@ With a MAL language a Model (a MAL instance model) can be created either
|
|
|
53
53
|
from a model file or empty.
|
|
54
54
|
|
|
55
55
|
The model class will store all of the relevant information to the MAL
|
|
56
|
-
instance model, most importantly the assets and associations
|
|
57
|
-
|
|
58
|
-
Assets and associations are objects of classes created using the language
|
|
59
|
-
classes factory submodule in runtime. It also allows for `Attacker` objects
|
|
60
|
-
to be created and associated with attack steps on assets in the model.
|
|
61
|
-
The most relevant methods of the Model are the ones used to add different
|
|
62
|
-
elements to the model, `add_asset`, `add_association`, and `add_attacker`.
|
|
56
|
+
instance model, most importantly the assets and their associations.
|
|
63
57
|
|
|
64
58
|
Model objects can be used to generate attack graphs with the AttackGraph module.
|
|
65
59
|
|
|
@@ -76,11 +70,6 @@ nodes related and the asset field which will contain the object in the model
|
|
|
76
70
|
instance to which this attack step belongs to, if this information is
|
|
77
71
|
available.
|
|
78
72
|
|
|
79
|
-
If it is relevant the `attach_attackers` function can be called on the
|
|
80
|
-
resulting attack graph with the instance model given as a parameter in order
|
|
81
|
-
to create attack step nodes that represent the entry points of the attackers
|
|
82
|
-
and attach them to the attack steps specified in the instance model.
|
|
83
|
-
|
|
84
73
|
## Ingestors Module
|
|
85
74
|
|
|
86
75
|
The ingestors module contains various tools that can make use of the instance
|
|
@@ -131,16 +120,9 @@ Arguments:
|
|
|
131
120
|
<lang_file> Path to .mar or .mal file containing MAL spec.
|
|
132
121
|
<output_file> Path to write the result of the compilation (yml/json).
|
|
133
122
|
|
|
134
|
-
Options:
|
|
135
|
-
--neo4j Ingest attack graph and instance model into a Neo4j instance
|
|
136
|
-
|
|
137
123
|
Notes:
|
|
138
124
|
- <lang_file> can be either a .mar file (generated by the older MAL
|
|
139
125
|
compiler) or a .mal file containing the DSL written in MAL.
|
|
140
|
-
|
|
141
|
-
- If --neo4j is used, the Neo4j instance should be running. The connection
|
|
142
|
-
parameters required for this app to reach the Neo4j instance should be
|
|
143
|
-
defined in the default.conf file.
|
|
144
126
|
```
|
|
145
127
|
|
|
146
128
|
## Code examples / Tutorial
|
|
@@ -4,7 +4,6 @@ MAL Toolbox is a collection of python modules to help developers create and work
|
|
|
4
4
|
MAL ([Meta Attack Language](https://mal-lang.org/)) models and attack graphs.
|
|
5
5
|
|
|
6
6
|
Attack graphs can be used to run simulations (see MAL Simulator) or analysis.
|
|
7
|
-
MAL Toolbox also gives the ability to view the AttackGraph/Model graphically in neo4j.
|
|
8
7
|
|
|
9
8
|
[Documentation](https://mal-lang.org/mal-toolbox/index.html)(Work in progress)
|
|
10
9
|
|
|
@@ -27,13 +26,7 @@ With a MAL language a Model (a MAL instance model) can be created either
|
|
|
27
26
|
from a model file or empty.
|
|
28
27
|
|
|
29
28
|
The model class will store all of the relevant information to the MAL
|
|
30
|
-
instance model, most importantly the assets and associations
|
|
31
|
-
|
|
32
|
-
Assets and associations are objects of classes created using the language
|
|
33
|
-
classes factory submodule in runtime. It also allows for `Attacker` objects
|
|
34
|
-
to be created and associated with attack steps on assets in the model.
|
|
35
|
-
The most relevant methods of the Model are the ones used to add different
|
|
36
|
-
elements to the model, `add_asset`, `add_association`, and `add_attacker`.
|
|
29
|
+
instance model, most importantly the assets and their associations.
|
|
37
30
|
|
|
38
31
|
Model objects can be used to generate attack graphs with the AttackGraph module.
|
|
39
32
|
|
|
@@ -50,11 +43,6 @@ nodes related and the asset field which will contain the object in the model
|
|
|
50
43
|
instance to which this attack step belongs to, if this information is
|
|
51
44
|
available.
|
|
52
45
|
|
|
53
|
-
If it is relevant the `attach_attackers` function can be called on the
|
|
54
|
-
resulting attack graph with the instance model given as a parameter in order
|
|
55
|
-
to create attack step nodes that represent the entry points of the attackers
|
|
56
|
-
and attach them to the attack steps specified in the instance model.
|
|
57
|
-
|
|
58
46
|
## Ingestors Module
|
|
59
47
|
|
|
60
48
|
The ingestors module contains various tools that can make use of the instance
|
|
@@ -105,16 +93,9 @@ Arguments:
|
|
|
105
93
|
<lang_file> Path to .mar or .mal file containing MAL spec.
|
|
106
94
|
<output_file> Path to write the result of the compilation (yml/json).
|
|
107
95
|
|
|
108
|
-
Options:
|
|
109
|
-
--neo4j Ingest attack graph and instance model into a Neo4j instance
|
|
110
|
-
|
|
111
96
|
Notes:
|
|
112
97
|
- <lang_file> can be either a .mar file (generated by the older MAL
|
|
113
98
|
compiler) or a .mal file containing the DSL written in MAL.
|
|
114
|
-
|
|
115
|
-
- If --neo4j is used, the Neo4j instance should be running. The connection
|
|
116
|
-
parameters required for this app to reach the Neo4j instance should be
|
|
117
|
-
defined in the default.conf file.
|
|
118
99
|
```
|
|
119
100
|
|
|
120
101
|
## Code examples / Tutorial
|
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
Metadata-Version: 2.
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
2
|
Name: mal-toolbox
|
|
3
|
-
Version: 0.
|
|
3
|
+
Version: 1.0.0
|
|
4
4
|
Summary: A collection of tools used to create MAL models and attack graphs.
|
|
5
5
|
Author-email: Andrei Buhaiu <buhaiu@kth.se>, Joakim Loxdal <loxdal@kth.se>, Nikolaos Kakouros <nkak@kth.se>, Jakob Nyberg <jaknyb@kth.se>, Giuseppe Nebbione <nebbione@kth.se>
|
|
6
6
|
License: Apache Software License
|
|
@@ -23,6 +23,7 @@ Requires-Dist: antlr4-tools
|
|
|
23
23
|
Requires-Dist: antlr4-python3-runtime
|
|
24
24
|
Requires-Dist: docopt
|
|
25
25
|
Requires-Dist: PyYAML
|
|
26
|
+
Dynamic: license-file
|
|
26
27
|
|
|
27
28
|
# MAL Toolbox overview
|
|
28
29
|
|
|
@@ -30,7 +31,6 @@ MAL Toolbox is a collection of python modules to help developers create and work
|
|
|
30
31
|
MAL ([Meta Attack Language](https://mal-lang.org/)) models and attack graphs.
|
|
31
32
|
|
|
32
33
|
Attack graphs can be used to run simulations (see MAL Simulator) or analysis.
|
|
33
|
-
MAL Toolbox also gives the ability to view the AttackGraph/Model graphically in neo4j.
|
|
34
34
|
|
|
35
35
|
[Documentation](https://mal-lang.org/mal-toolbox/index.html)(Work in progress)
|
|
36
36
|
|
|
@@ -53,13 +53,7 @@ With a MAL language a Model (a MAL instance model) can be created either
|
|
|
53
53
|
from a model file or empty.
|
|
54
54
|
|
|
55
55
|
The model class will store all of the relevant information to the MAL
|
|
56
|
-
instance model, most importantly the assets and associations
|
|
57
|
-
|
|
58
|
-
Assets and associations are objects of classes created using the language
|
|
59
|
-
classes factory submodule in runtime. It also allows for `Attacker` objects
|
|
60
|
-
to be created and associated with attack steps on assets in the model.
|
|
61
|
-
The most relevant methods of the Model are the ones used to add different
|
|
62
|
-
elements to the model, `add_asset`, `add_association`, and `add_attacker`.
|
|
56
|
+
instance model, most importantly the assets and their associations.
|
|
63
57
|
|
|
64
58
|
Model objects can be used to generate attack graphs with the AttackGraph module.
|
|
65
59
|
|
|
@@ -76,11 +70,6 @@ nodes related and the asset field which will contain the object in the model
|
|
|
76
70
|
instance to which this attack step belongs to, if this information is
|
|
77
71
|
available.
|
|
78
72
|
|
|
79
|
-
If it is relevant the `attach_attackers` function can be called on the
|
|
80
|
-
resulting attack graph with the instance model given as a parameter in order
|
|
81
|
-
to create attack step nodes that represent the entry points of the attackers
|
|
82
|
-
and attach them to the attack steps specified in the instance model.
|
|
83
|
-
|
|
84
73
|
## Ingestors Module
|
|
85
74
|
|
|
86
75
|
The ingestors module contains various tools that can make use of the instance
|
|
@@ -131,16 +120,9 @@ Arguments:
|
|
|
131
120
|
<lang_file> Path to .mar or .mal file containing MAL spec.
|
|
132
121
|
<output_file> Path to write the result of the compilation (yml/json).
|
|
133
122
|
|
|
134
|
-
Options:
|
|
135
|
-
--neo4j Ingest attack graph and instance model into a Neo4j instance
|
|
136
|
-
|
|
137
123
|
Notes:
|
|
138
124
|
- <lang_file> can be either a .mar file (generated by the older MAL
|
|
139
125
|
compiler) or a .mal file containing the DSL written in MAL.
|
|
140
|
-
|
|
141
|
-
- If --neo4j is used, the Neo4j instance should be running. The connection
|
|
142
|
-
parameters required for this app to reach the Neo4j instance should be
|
|
143
|
-
defined in the default.conf file.
|
|
144
126
|
```
|
|
145
127
|
|
|
146
128
|
## Code examples / Tutorial
|
|
@@ -13,15 +13,12 @@ maltoolbox/__main__.py
|
|
|
13
13
|
maltoolbox/exceptions.py
|
|
14
14
|
maltoolbox/file_utils.py
|
|
15
15
|
maltoolbox/model.py
|
|
16
|
+
maltoolbox/py.typed
|
|
16
17
|
maltoolbox/attackgraph/__init__.py
|
|
17
|
-
maltoolbox/attackgraph/attacker.py
|
|
18
18
|
maltoolbox/attackgraph/attackgraph.py
|
|
19
19
|
maltoolbox/attackgraph/node.py
|
|
20
|
-
maltoolbox/attackgraph/query.py
|
|
21
20
|
maltoolbox/attackgraph/analyzers/__init__.py
|
|
22
|
-
maltoolbox/attackgraph/analyzers/apriori.py
|
|
23
21
|
maltoolbox/ingestors/__init__.py
|
|
24
|
-
maltoolbox/ingestors/neo4j.py
|
|
25
22
|
maltoolbox/language/__init__.py
|
|
26
23
|
maltoolbox/language/languagegraph.py
|
|
27
24
|
maltoolbox/language/compiler/__init__.py
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
# -*- encoding: utf-8 -*-
|
|
2
|
-
# MAL Toolbox
|
|
2
|
+
# MAL Toolbox v1.0.0
|
|
3
3
|
# Copyright 2025, Andrei Buhaiu.
|
|
4
4
|
#
|
|
5
5
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
@@ -21,7 +21,7 @@ MAL-Toolbox Framework
|
|
|
21
21
|
"""
|
|
22
22
|
|
|
23
23
|
__title__ = "maltoolbox"
|
|
24
|
-
__version__ = "0.
|
|
24
|
+
__version__ = "1.0.0"
|
|
25
25
|
__authors__ = [
|
|
26
26
|
"Andrei Buhaiu",
|
|
27
27
|
"Giuseppe Nebbione",
|
|
@@ -45,9 +45,9 @@ config: dict[str, Any] = {
|
|
|
45
45
|
"log_file": "logs/log.txt",
|
|
46
46
|
"attackgraph_file": "logs/attackgraph.yml",
|
|
47
47
|
"model_file": "logs/model.yml",
|
|
48
|
-
"langspec_file": "logs/langspec_file.
|
|
48
|
+
"langspec_file": "logs/langspec_file.json",
|
|
49
|
+
"langgraph_file": "logs/langgraph.yml",
|
|
49
50
|
},
|
|
50
|
-
"neo4j": {"uri": None, "username": None, "password": None, "dbname": None},
|
|
51
51
|
}
|
|
52
52
|
|
|
53
53
|
config_file = os.getenv("MALTOOLBOX_CONFIG", "maltoolbox.yml")
|
|
@@ -56,8 +56,7 @@ if os.path.exists(config_file):
|
|
|
56
56
|
with open(config_file) as f:
|
|
57
57
|
config |= yaml.safe_load(f)
|
|
58
58
|
|
|
59
|
-
log_configs
|
|
60
|
-
|
|
59
|
+
log_configs = config['logging']
|
|
61
60
|
os.makedirs(os.path.dirname(log_configs["log_file"]), exist_ok=True)
|
|
62
61
|
|
|
63
62
|
formatter = logging.Formatter(
|
|
@@ -11,26 +11,18 @@ Arguments:
|
|
|
11
11
|
<lang_file> Path to .mar or .mal file containing MAL spec.
|
|
12
12
|
<output_file> Path to write the result of the compilation (yml/json).
|
|
13
13
|
|
|
14
|
-
Options:
|
|
15
|
-
--neo4j Ingest attack graph and instance model into a Neo4j instance
|
|
16
|
-
|
|
17
14
|
Notes:
|
|
18
15
|
- <lang_file> can be either a .mar file (generated by the older MAL
|
|
19
16
|
compiler) or a .mal file containing the DSL written in MAL.
|
|
20
|
-
|
|
21
|
-
- If --neo4j is used, the Neo4j instance should be running. The connection
|
|
22
|
-
parameters required for this app to reach the Neo4j instance should be
|
|
23
|
-
defined in the default.conf file.
|
|
24
17
|
"""
|
|
25
18
|
|
|
26
19
|
import logging
|
|
27
20
|
import json
|
|
28
21
|
import docopt
|
|
29
22
|
|
|
30
|
-
from . import log_configs
|
|
23
|
+
from . import log_configs
|
|
31
24
|
from .attackgraph import create_attack_graph
|
|
32
25
|
from .language.compiler import MalCompiler
|
|
33
|
-
from .ingestors import neo4j
|
|
34
26
|
from .language.languagegraph import LanguageGraph
|
|
35
27
|
from .translators.updater import load_model_from_older_version
|
|
36
28
|
|
|
@@ -39,14 +31,12 @@ logger = logging.getLogger(__name__)
|
|
|
39
31
|
def generate_attack_graph(
|
|
40
32
|
model_file: str,
|
|
41
33
|
lang_file: str,
|
|
42
|
-
send_to_neo4j: bool
|
|
43
34
|
) -> None:
|
|
44
|
-
"""Create an attack graph
|
|
35
|
+
"""Create an attack graph
|
|
45
36
|
|
|
46
37
|
Args:
|
|
47
38
|
model_file - path to the model file
|
|
48
39
|
lang_file - path to the language file
|
|
49
|
-
send_to_neo4j - whether to ingest into neo4j or not
|
|
50
40
|
"""
|
|
51
41
|
attack_graph = create_attack_graph(lang_file, model_file)
|
|
52
42
|
if log_configs['attackgraph_file']:
|
|
@@ -54,27 +44,6 @@ def generate_attack_graph(
|
|
|
54
44
|
log_configs['attackgraph_file']
|
|
55
45
|
)
|
|
56
46
|
|
|
57
|
-
if send_to_neo4j:
|
|
58
|
-
logger.debug('Ingest model graph into Neo4J database.')
|
|
59
|
-
neo4j.ingest_model(
|
|
60
|
-
attack_graph.model,
|
|
61
|
-
neo4j_configs['uri'],
|
|
62
|
-
neo4j_configs['username'],
|
|
63
|
-
neo4j_configs['password'],
|
|
64
|
-
neo4j_configs['dbname'],
|
|
65
|
-
delete=True
|
|
66
|
-
)
|
|
67
|
-
logger.debug('Ingest attack graph into Neo4J database.')
|
|
68
|
-
neo4j.ingest_attack_graph(
|
|
69
|
-
attack_graph,
|
|
70
|
-
neo4j_configs['uri'],
|
|
71
|
-
neo4j_configs['username'],
|
|
72
|
-
neo4j_configs['password'],
|
|
73
|
-
neo4j_configs['dbname'],
|
|
74
|
-
delete=False
|
|
75
|
-
)
|
|
76
|
-
|
|
77
|
-
|
|
78
47
|
def compile(lang_file: str, output_file: str) -> None:
|
|
79
48
|
"""Compile language and dump into output file"""
|
|
80
49
|
compiler = MalCompiler()
|
|
@@ -97,7 +66,7 @@ def main():
|
|
|
97
66
|
|
|
98
67
|
if args['attack-graph'] and args['generate']:
|
|
99
68
|
generate_attack_graph(
|
|
100
|
-
args['<model_file>'], args['<lang_file>']
|
|
69
|
+
args['<model_file>'], args['<lang_file>']
|
|
101
70
|
)
|
|
102
71
|
elif args['compile']:
|
|
103
72
|
compile(
|
|
@@ -3,6 +3,12 @@ Contains tools used to generate attack graphs from MAL instance
|
|
|
3
3
|
models and analyze attack graphs.
|
|
4
4
|
"""
|
|
5
5
|
|
|
6
|
-
from .attacker import Attacker
|
|
7
6
|
from .attackgraph import AttackGraph, create_attack_graph
|
|
8
7
|
from .node import AttackGraphNode
|
|
8
|
+
|
|
9
|
+
__all__ = [
|
|
10
|
+
"Attacker",
|
|
11
|
+
"AttackGraph",
|
|
12
|
+
"AttackGraphNode",
|
|
13
|
+
"create_attack_graph"
|
|
14
|
+
]
|