🤖 AI Summary
This work proposes a dynamic attack path generation framework that integrates large language models (LLMs), white-box system access, and Monte Carlo Tree Search (MCTS) to automatically construct and validate attack paths in real-world vulnerable environments without relying on pre-built vulnerability graphs or exploit databases. Unlike traditional cyber defense exercises that depend on manual path construction by experts, the proposed approach achieves end-to-end attack path generation without prior knowledge of the target environment, thereby shifting the expert’s role from technical validation to scenario design and significantly accelerating development cycles. Evaluated in the CIDeX 2025 exercise involving 46 hosts, the generated paths matched human-crafted scenarios in terms of pedagogical value, engagement, credibility, and challenge level, while reducing scenario development time from months to days.
📝 Abstract
Creating attack paths for cyber defence exercises requires substantial expert effort. Existing automation requires vulnerability graphs or exploit sets curated in advance, limiting where it can be applied. We present AEGIS, a system that generates attack paths using LLMs, white-box access, and Monte Carlo Tree Search over real exploit execution. LLM-based search discovers exploits dynamically without pre-existing vulnerability graphs, while white-box access enables validating exploits in isolation before committing to attack paths. Evaluation at CIDeX 2025, a large-scale exercise spanning 46 IT hosts, showed that AEGIS-generated paths are comparable to human-authored scenarios across four dimensions of training experience (perceived learning, engagement, believability, challenge). Results were measured with a validated questionnaire extensible to general simulation-based training. By automating exploit chain discovery and validation, AEGIS reduces scenario development from months to days, shifting expert effort from technical validation to scenario design.