Cyber defense simulators stop hard-coding the network: swap the modeling language, train attackers and defenders in one environment
Synopsis
The KTH team released the MAL Simulator, which builds cyber attack and defense simulation on the Meta Attack Language so a new target domain can be modeled without changing simulator source code. Across 30 scenarios derived from the ADS-24 network in the CRATE cyber range, a trained reinforcement-learning attacker returned −301±10.3 on 15 unseen test scenarios, better than breadth-first, depth-first and random search, and a defender trained under 1% false and missed alerts returned −60355±945 against −61653±914 for a heuristic defender. Against the reinforcement-learning attacker, every defender's return dropped markedly.
Interpretation
A cyber operations simulator can now be built around an attack modeling language, so asset types, attack steps and defense steps of a target system are described in that language rather than written into simulator code. Earlier attack and defense simulators let users add or remove entities in a scenario but offered no method for adding new entity types or attributes, and modifying core attack path logic was not a trivial task. The simulator generates attack graphs from the Meta Attack Language, and the same core transition logic carries over when the language changes, so a defensive reinforcement-learning agent architecture can move to computer networks, cloud environments and operational technology systems.
The simulator treats attack and defense steps in the attack graph as state variables, forming a partially observable Markov decision process in which both roles share state but have separate observations, actions and objectives. MAL attack graphs had previously served static risk analysis; here they drive a discrete event-driven simulation and game. A scenario can configure time-to-compromise distributions, false positives and false negatives, observability and actionability, and numeric costs on attack and defense steps, each defining a new decision process.
Two case studies train an offensive agent and a defensive agent and compare each with manually designed baselines. The comparison baselines were breadth-first, depth-first and random search attackers, plus a do-nothing defender and a heuristic that enables a defense as soon as an associated attack step is observed. The attacker was evaluated for 10 episodes on each of 15 unseen test scenarios, returning −301±10.3 against −717±12.8 for breadth-first, −736±12.6 for random and −797±15.4 for depth-first; defender tests ran 100 episodes per attacker variant on the full ADS-24 model.
Perspective
The demonstrated scope stays inside the simulator: the target system is the ADS-24 network implemented in the CRATE cyber range, the 30 scenarios are generated from host inventory data collected with Osquery, and agents are evaluated only in the simulator, not outside it.
The authors state that they do not evaluate the predictive capability of the simulation model and do not systematically compare simulator output with cyber range output; the assumption that false positive rates are evenly distributed across attack steps and hosts is not accurate, with higher alert frequency for assets in the user section. Defender returns dropped significantly against the reinforcement-learning attacker, which the authors attribute to that attacker preferring a software vulnerability path with fewer observable steps and a smaller overall time to compromise.