The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs

A domain-adaptable simulator for training offensive and defensive cyber agents using Meta Attack Language and reinforcement learning

Jakob Nyberg; Sandor Berglund; Andrei Buhaiu; Joakim Loxdal; Pontus Johnson; Mathias Ekstedt· 2026· DOI 10.48550/arXiv.2609.16563

The core problem

Cyber operations simulation is critical for system analysis and the development of automated agents. Existing simulators often lack adaptability across domains or require code changes to model new attack scenarios. The authors introduce the MAL Simulator, built on the Meta Attack Language (MAL), which allows domain-specific attack and defense modeling without modifying the simulator's source code. The simulator is designed for decision-driven cyber attack and defense simulations, supporting system analysis and the training of automated agents. The work addresses the need for a flexible, extensible platform that can be used to train both offensive and defensive agents, and to evaluate their performance under realistic conditions. The authors ground their experiments using data from an emulated network implemented in the cyber range CRATE.

The experiments yielded three key findings. First, the trained attacker policy reached designated targets more efficiently than compared search methods, demonstrating the effectiveness of RL for offensive cyber operations. Second, the trained defender agent induced lower costs than a naive heuristic agent under noisy alert conditions, indicating that RL can improve defensive decision-making. Third, when testing the RL attacker against the RL defender, the performance of the defenders dropped significantly. This suggests that defenders trained against non-adaptive attackers may not generalize to intelligent adversaries. The results highlight the importance of co-evolutionary training and the need for simulators that support both offensive and defensive agent development. Quantitative metrics included success rate, path length, and cumulative cost, though specific numbers are not provided in the abstract.

Cyber operations simulation is critical for system analysis and the development of automated agents. Existing simulators often lack adaptability across domains or require code changes to model new attack scenarios. The authors introduce the MAL Simulator, built on the Meta Attack Language (MAL), which allows domain-specific attack and defense modeling without modifying the simulator's source code. The simulator is designed for decision-driven cyber attack and defense simulations, supporting system analysis and the training of automated agents. The work addresses the need for a flexible, extensible platform that can be used to train both offensive and defensive agents, and to evaluate their performance under realistic conditions. The authors ground their experiments using data from an emulated network implemented in the cyber range CRATE.

The MAL Simulator is architected around MAL, a probabilistic attack modeling language. MAL models consist of assets, attack steps, and defenses, connected via attack-defense graphs. The simulator provides common interfaces for compatibility with existing machine learning frameworks, enabling reinforcement learning (RL) agents to interact with the environment. The authors conducted two case studies: one training an offensive agent and one training a defensive agent. The offensive agent's goal is to reach designated targets, while the defensive agent aims to minimize costs under noisy alert conditions. The environment is based on an emulated network in the CRATE cyber range, providing realistic data. The RL agents are trained using standard algorithms, and their performance is compared against search methods (for the attacker) and a naive heuristic (for the defender). The simulator's architecture is illustrated below:

The MAL Simulator's domain-agnostic design, enabled by MAL, allows it to be adapted to various cyber domains without code changes, making it a versatile tool for cyber operations research. The finding that RL defenders struggle against RL attackers underscores the adversarial nature of cybersecurity and the necessity of training defenders against adaptive threats. The simulator's public availability and compatibility with ML frameworks facilitate reproducibility and further research. Limitations include the reliance on emulated network data and the specific scenarios tested; future work could explore more complex domains and multi-agent interactions. The authors emphasize that simulators like MAL are essential for developing robust automated cyber agents. The work contributes to the taxonomy of Architecture, Cybersecurity, Network, and Cryptography by providing a foundational platform for simulating and analyzing cyber attack and defense strategies.

CS practitioners and researchers

Opening member content…