Repository navigation
Detectors
Detectors are a way to define log triggers in MAL-language that generate logs when the attack steps are compromised. A detector is part of an attack step and can have a name, a context, a type and a true/false positive rate. The context defines which assets the generated log message should contain.
Example:
An attack step Computer:exploit has a detector called 'logExploit'. It has a context which is (userOnComputer.authenticate user)
so the log message generated from the detector should contain the name of the detector and the context (an authenticated user connected to the exploited computer through fieldname 'userOnComputer')
The syntax for detectors is to write ! <detector_name>? <detector_context> <detector_type>? <detector_tpr_fpr>? in a language just after an attack step has been defined.
-
detector_nameis the name given to the detector and will be part of the generated log message. -
detector_contextcontains a list of comma separated fieldnames + identifiers which will be part of the generated log message. -
detector_typeoptional type, e.g. 'log' or 'alert' (up to the user) -
detector_tpr_fpris an optional true positive and/or false positive rate in format{tpr: float, fpr: float}. tpr and fpr must be between 0.0 and 1.0.
Parsing of detectors happens in the MAL compiler.
See the test language detector_lang for an example of how to define detectors in a MAL language.
Detectors are stored in the language graph as a dataclass that belongs to language graph attack steps.
After creating an AttackGraph, detectors are stored in the AttackGraphNode under AttackGraphNode.detectors.
When a node with detectors is compromised by an attacker, logs are generated for defenders to observe.
In this test file you can see the whole chain from generating an attack graph to the defender observing detector logs.
To learn more about the simulator read the mal-simulator Wiki: https://github.com/mal-lang/mal-simulator/wiki