What question did this study set out to answer?

This research aims to streamline threat modeling in critical infrastructure by automating the transformation of incident reports into the Meta Attack Language.

May 15, 2026Open Access

Mal-LLM

Key Points

This research aims to streamline threat modeling in critical infrastructure by automating the transformation of incident reports into the Meta Attack Language.
Developed a web-based application, MAL-LLM, to operationalize automated threat modeling.
Utilized Google’s Gemini Pro 3.0 and a RAG pipeline for generation based on CAPEC.
Implemented Pydantic schemas and a compiler-in-the-loop validation process to ensure syntactical accuracy.
Successfully transformed unstructured incident reports into compilable MAL languages.
Achieved a significant reduction in labor required for threat modeling tasks.
Improved accuracy in generated threat models by minimizing syntax errors common in traditional outputs.

Abstract

The increasing complexity of critical infrastructure necessitates precise threat modeling, yet creating Domain-Specific Languages (DSLs) using the Meta Attack Language (MAL) framework remains a labor-intensive bottleneck requiring dual expertise in domain security and formal grammar. This paper introduces and showcases MAL-LLM, a web-based application designed to operationalize automated threat modeling by transforming unstructured incident reports into syntactically accurate, compilable MAL languages. Leveraging a scalable architecture, the system utilizes Google’s Gemini Pro 3.0 combined with a Retrieval-Augmented Generation (RAG) pipeline to ground generation in standardized security knowledge (CAPEC). A key innovation is the enforcement of structural constraints via Pydantic schemas and a ’compiler-in-the-loop’ validation process, which checks for syntax errors common in traditional Large Language Model outputs.

KI fragen

Bookmark

View Full Paper