search

mal-lang / mal-toolbox

Apache License 2.0
4 stars 2 forks source link

Use the LanguageGraph to generate the AttackGraph #11

Open nkakouros opened 7 months ago

nkakouros commented 7 months ago

Currently, the AttackGraph is generated using a lang dict and a model dict. The lang dict is the JSON representation of the mal spec as produced by the compiler. If, instead, the LanguageGraph object that corresponds to the lang dict was used, the code would be simplified. To make this look nice, some changes in the LanguageGraph would also be required, mainly converting lists to dicts. But I believe it would result in a nicer API to work with.

For example, in the following lines:

https://github.com/mal-lang/mal-toolbox/blob/48faad5c1849afa0118b513e5c7caff819283e6f/maltoolbox/attackgraph/attackgraph.py#L370-L375

the get_attacks_for_class function could be removed completely, and instead we could do the following:

attack_steps = lang_graph.assets[asset].attack_steps

Having the language graph available in the attack graph would also facilitate the implementation of things like obtaining each node's asset type (which can still be done now but in a rigid way; through looping the lang dict, not having fully-qualified attack names, etc.).

andrewbwm commented 7 months ago

We absolutely want to do this, I didn't even realize we didn't have an issue open for this already.

andrewbwm commented 5 months ago

There are two components to this work. Step 1 would be to have the Language Graph be used for the attack graph generation and language classes factory.

Step 2 would be to have the compiler directly generate the Language Graph instead of the language specification.