AgentCyTE: Leveraging Agentic AI to Generate Cybersecurity Training & Experimentation Scenarios

2025-10-29

AI Summary

Current cybersecurity red-blue team exercise construction heavily relies on manual effort, while automated approaches often fail due to poor executability and verifiability. To address this, we propose an end-to-end adaptive threat scenario generation framework that synergistically integrates large language models’ (LLMs) semantic reasoning capabilities with a deterministic network simulation environment. We design an agent-based feedback loop enabling iterative “generate–execute–verify–optimize” cycles. Furthermore, we introduce pattern-constrained configuration generation and automated validation techniques to ensure structural validity and runtime reliability of generated scenarios. The framework supports data-driven, scalable training environment construction, preserving generative flexibility while significantly enhancing scenario authenticity, logical consistency, and reproducibility. Experimental evaluation demonstrates substantial improvements in scenario fidelity and operational robustness compared to baseline methods. This work establishes a novel paradigm for trustworthy threat modeling and adaptive security training.

Technology Category

• Natural Language Processing: Generation
• Multiagent Systems: Adversarial Agents
• Planning, Routing, and Scheduling: Planning with Language Models

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Web data generation and simulation
• Social Networks and Social Media: Generative AI / large language models and their impact on social systems

Abstract

Designing realistic and adaptive networked threat scenarios remains a core challenge in cybersecurity research and training, still requiring substantial manual effort. While large language models (LLMs) show promise for automated synthesis, unconstrained generation often yields configurations that fail validation or execution. We present AgentCyTE, a framework integrating LLM-based reasoning with deterministic, schema-constrained network emulation to generate and refine executable threat environments. Through an agentic feedback loop, AgentCyTE observes scenario outcomes, validates correctness, and iteratively enhances realism and consistency. This hybrid approach preserves LLM flexibility while enforcing structural validity, enabling scalable, data-driven experimentation and reliable scenario generation for threat modeling and adaptive cybersecurity training. Our framework can be accessed at: https://github.com/AnantaaKotal/AgentCyTE

Problem

• Automating realistic cybersecurity training scenarios with minimal manual effort
• Ensuring generated threat scenarios are executable and structurally valid
• Integrating AI flexibility with deterministic validation for scalable experimentation

Innovation

• Integrates LLM reasoning with network emulation
• Uses agentic feedback loop for validation
• Combines flexibility with structural validity