About

IT systems are growing in complexity and the threat from cyberattacks is increasing. Threat modeling is a process that can be used to analyze potential attacks to IT systems in order to facilitate secure design.

This wiki is the description and hands-on manual of the Meta Attack Language (MAL), which is a threat modeling language framework for the creation of domain specific languages (DSL). In brief, MAL combines probabilistic attack defense graphs with object oriented modeling. By using MAL it is possible to automate the security analysis of modeled systems. MAL is developed at KTH Royal Institute of Technology. Several domain specific languages have been built in MAL serving as examples of how a language can be built. In addition to the documentation found here, two academic papers ([1] and [2]) also describes MAL. (Moreover, there exist a large number of other papers describing MAL-related work.)