-
Notifications
You must be signed in to change notification settings - Fork 3
API documentation
Defines the in-memory representation of a compiled MAL language. It models asset types, attack steps, associations, and expression chains used when building attack graphs.
Description: Central representation of a MAL language specification.
Important Methods
init(lang) — Initialize from parsed language structure.
from_mal_spec(mal_spec_file) — Build language graph from a MAL source file.
from_mar_archive(mar_archive) — Load from compiled MAR archive.
associations() — Return all defined associations.
save_to_file(filename) — Serialize language graph to disk.
load_from_file(filename) — Load serialized language graph.
save_language_specification_to_json(filename) — Export spec as JSON.
process_attack_step_expression(target_asset, step_expression) — Entry point for resolving attack step expressions.
process_step_expression(target_asset, expr_chain, step_expression) — Core recursive expression resolver.
reverse_expr_chain(expr_chain, reverse_chain) — Reverse traversal logic for expressions.
regenerate_graph() — Recompute internal graph structures.
Description: Represents an asset type in the MAL language.
Important Methods
to_dict() — Serialize asset definition.
is_subasset_of(target_asset) — Check inheritance relationship.
sub_assets() — Get all subtypes.
super_assets() — Get all supertypes.
associations_to(asset_type) — Associations toward another asset.
associations() — All associations involving this asset.
variables() — Asset variables defined in MAL.
get_all_common_superassets(other) — Shared ancestors.
Description: Defines an association between asset types.
Important Methods
to_dict() — Serialize association.
full_name() — Fully qualified association name.
get_field(fieldname) — Retrieve a specific association field.
contains_fieldname(fieldname) — Check if field exists.
contains_asset(asset) — Check if asset participates.
get_opposite_fieldname(fieldname) — Get reverse field.
Description: Represents an attack step defined on an asset.
Important Methods
children() — Steps reachable from this step.
parents() — Steps leading to this step.
full_name() — Fully qualified step name.
to_dict() — Serialize attack step.
requires() — Preconditions for the step.
Description: Internal structure representing parsed attack step expressions.
Important Methods
init(type, left_link, right_link, sub_link, fieldname, association, subtype)
to_dict() — Serialize expression chain.
Description: Represents a detector definition in MAL.
Important Methods
to_dict()
Description: Detector context wrapper.
Important Methods
init(context)
to_dict()
Implements the MAL language compiler pipeline: parsing, semantic analysis, and transformation into the LanguageGraph.
Description: Base visitor for traversing the MAL parse tree.
Important Methods
compile(malfile) — Compile MAL source.
visit(cursor, params) — Generic dispatch.
visit_source_file(cursor)
visit_comment(cursor, params)
skip() — Skip nodes.
Description: Converts MAL parse tree into internal language structures.
Important Methods
visit_asset_declaration(cursor, category)
visit_asset_definition(cursor)
visit_attack_step(cursor)
visit_association(cursor)
visit_define_declaration(cursor)
visit_category_declaration(cursor)
visit_include_declaration(cursor)
visit_meta(cursor)
visit_detector(cursor)
visit_ttc(cursor)
visit_preconditions(cursor)
visit_reaching(cursor)
visit_asset_expr(cursor)
visit_multiplicity(cursor)
Description: Performs semantic validation on parsed MAL.
Important Methods
has_error()
has_warning()
check_source_file(node)
check_asset_declaration(node, asset)
check_attack_step(node, step)
check_association(node, association)
check_asset_variable(node, var)
Description: Validates TTC distribution definitions.
Important Methods
validate(distribution_name, params)
Distribution Types
Each provides:
validate(params)
Classes:
Bernoulli
Binomial
Exponential
Gamma
LogNormal
Pareto
TruncatedNormal
Uniform
Combination
Represents an instance model built from a MAL language. Contains assets and their associations.
Key Classes
Description: Top-level container for assets and relationships.
Important Methods
init(name, lang_graph, mt_version)
add_asset(asset_type, name, asset_id, defenses, extras, allow_duplicate_names)
remove_asset(asset)
get_asset_by_id(asset_id)
get_asset_by_name(asset_name)
to_dict() — Serialize model.
save_to_file(filename)
load_from_file(filename, lang_graph)
Description: Instance of a MAL asset type.
Important Methods
init(name, asset_id, lg_asset, defenses, extras)
associations_with(b)
has_association_with(b, assoc_name)
validate_associated_assets(fieldname, assets_to_add)
add_associated_assets(fieldname, assets)
remove_associated_assets(fieldname, assets)
associated_assets()
id()
Builds and manages attack graphs derived from a model and language.
Important Methods
init(lang_graph, model)
regenerate_graph() — Rebuild graph from model.
add_node(lg_attack_step, node_id, model_asset, ttc_dist, existence_status, full_name)
remove_node(node)
get_node_by_full_name(full_name)
save_to_file(filename)
load_from_file(filename, lang_graph, model)
Description: Node representing a concrete attack step instance.
Important Methods
init(node_id, lg_attack_step, model_asset, ttc_dist, existence_status, full_name)
to_dict() — Serialize node.
full_name() — Unique identifier.
info() — Human-readable summary.
Pattern matching utilities for searching attack graphs.
Important Methods
init(conditions)
find_matches(graph) — Return matching subgraphs.
Important Methods
ANY(_)
can_match_again(num_matches)
must_match_again(num_matches)
Helpers for reading/writing structured files.
save_dict_to_json_file(filename, serialized_object)
save_dict_to_yaml_file(filename, serialized_object)
load_dict_from_yaml_file(filename)
load_dict_from_json_file(filename)
save_dict_to_file(filename, dictionary)
Custom exception hierarchy.
MalToolboxException
LanguageGraphException
LanguageGraphAssociationError
LanguageGraphStepExpressionError
AttackGraphException
AttackGraphStepExpressionError
ModelException
ModelAssociationException
DuplicateModelAssociationError
Conversion utilities between MAL Toolbox structures and external formats.
updater.py
Handles migration of stored models/graphs between MAL Toolbox versions.
networkx.py
Exports attack graphs into NetworkX graph structures for analysis and visualization.