Customizing MulVAL for attack graph generation

Abstract

This report focuses on the enhancement of the MulVAL tool, which is used to create attack graphs that highlight potential security vulnerabilities in network systems. The primary aim of this project was to modernize MulVAL by updating outdated components and making it more user-friendly with current technologies. The switch from the old XML format to the more modern JSON format for handling vulnerability data was implemented. Additionally, the MySQL controllers were updated to be compatible with newer versions of the database, and the old Java modules were replaced with more efficient Python scripts. To further improve MulVAL, the Autopentest-DRL repository was integrated. This integration aimed to enhance the process of generating inputs for MulVAL by using Nmap, a powerful tool for detailed network scanning and vulnerability assessment. A user-friendly interface was developed as a key part of this project. A web server and scanner using Flask for backend processing, along with a simple launcher using Tkinter, were created. This new interface allows for the easy uploading of scan results, the generation of attack graphs, and their viewing through a web browser, making complex security analyses more accessible and practical. These improvements have significantly modernized MulVAL, ensuring its relevance and effectiveness for contemporary cybersecurity challenges. Detailed and automated security analyses can now be performed by the updated tool, providing robust and versatile resources for cybersecurity professionals. Future work will focus on further automating the input generation process, incorporating additional security tools, and enhancing the user interface to cater to a wider range of use cases and user skill levels. Overall, the necessity of continuously updating cybersecurity tools to keep pace with evolving threats is emphasized by this project. The enhancements made to MulVAL demonstrate its increased robustness and versatility, making it a valuable tool for advanced security analysis.