cyber-zero-runtime-free-agent-training

name	cyber-zero-runtime-free-agent-training
title	Cyber-Zero Training Cybersecurity Agents Without Runtime
version	0.0.2
engine	skillxiv-v0.0.2-claude-opus-4.6
license	MIT
url	https://arxiv.org/abs/2508.00910
keywords	["cybersecurity","agent-training","synthetic-data","persona-simulation","runtime-free"]
description	Framework for training cybersecurity agents without access to live environments. Uses CTF writeups and persona-driven LLM simulation to synthesize training trajectories, achieving performance matching proprietary systems like Claude-3.5-Sonnet.

Cyber-Zero: Training Cybersecurity Agents Without Runtime

Cyber-Zero addresses a critical challenge in cybersecurity agent development: the lack of accessible runtime environments for training. Rather than requiring live CTF platforms or complex setups, the system leverages public documentation and persona-driven simulation to create high-quality synthetic training data, enabling agents to match proprietary system performance.

Core Concept

The fundamental insight is that cybersecurity knowledge is extensively documented in CTF (Capture-The-Flag) writeups and solutions. Cyber-Zero:

• Extracts knowledge from public CTF writeups and documentation
• Simulates agent interactions using persona-driven LLM simulation
• Synthesizes trajectories of realistic long-horizon problem-solving
• Trains agents on synthetic data without runtime access
• Achieves parity with systems that have access to live environments

Architecture Overview

The framework consists of:

• CTF Knowledge Extractor: Parses writeups to identify problem types and solutions
• Persona-Driven Simulator: Uses LLMs with specific personas to simulate agent interactions
• Trajectory Synthesizer: Generates plausible multi-step trajectories
• Data Quality Validator: Ensures synthetic trajectories are realistic
• Agent Training Pipeline: Fine-tunes agents on synthesized data

Implementation Steps

Step 1: Extract knowledge from CTF writeups

Parse CTF solutions to identify problem types and solution patterns:

import re
import json
from typing import Dict, List, Tuple, Optional
from dataclasses import dataclass

@dataclass
class CTFProblem:
    """Represents a CTF challenge and its solution"""
    name: str
    category: str  
    description: 
    solution_steps: []
    tools_used: []
    vulnerability_type: 
    difficulty: 

 :
    

     ():
        .problems: [CTFProblem] = []
        .vulnerability_index: [, [CTFProblem]] = {}

     () -> [CTFProblem]:
        
        
        title_match = re.search(, writeup_text, re.MULTILINE)
        title = title_match.group()  title_match  

        
        category = ._detect_category(writeup_text)

        
        description = ._extract_description(writeup_text)

        
        solution_steps = ._extract_solution_steps(writeup_text)

        
        tools = ._identify_tools(writeup_text, solution_steps)

        
        vulnerability = ._extract_vulnerability(writeup_text)

        
        difficulty = ._assess_difficulty(solution_steps)

        problem = CTFProblem(
            name=title,
            category=category,
            description=description,
            solution_steps=solution_steps,
            tools_used=tools,
            vulnerability_type=vulnerability,
            difficulty=difficulty
        )

        .problems.append(problem)

        
         vulnerability   .vulnerability_index:
            .vulnerability_index[vulnerability] = []

        .vulnerability_index[vulnerability].append(problem)

         problem

     () -> :
        

        categories = {
            : [, , , , ],
            : [, , , , ],
            : [, , , ],
            : [, , , , ],
            : [, , , ]
        }

        text_lower = text.lower()

         category, keywords  categories.items():
             (kw  text_lower  kw  keywords):
                 category

         

     () -> :
        

        lines = text.split()
        description_lines = []

        in_description = 

         line  lines:
               line.lower()    line.lower():
                in_description = 
             in_description  line.strip()   line.startswith():
                description_lines.append(line)
             in_description  line.strip().startswith():
                

         .join(description_lines[:])

     () -> []:
        

        steps = []

        
        step_matches = re.findall(
            ,
            text,
            re.DOTALL
        )

         num, step_text  step_matches:
            
            step = step_text.strip()[:]
             step:
                steps.append(step)

        
          steps:
            code_blocks = re.findall(, text, re.DOTALL)
            steps = [b[:]  b  code_blocks[:]]

         steps

     () -> []:
        

        tools = ()

        
        tool_patterns = {
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : 
        }

        full_text = text +  + .join(steps)

         tool, pattern  tool_patterns.items():
             re.search(pattern, full_text, re.IGNORECASE):
                tools.add(tool)

         (tools)

     () -> :
        

        vulnerabilities = [
            , , , ,
            , , 
        ]

        text_lower = text.lower()

         vuln  vulnerabilities:
             vuln.replace(, )  text_lower  vuln  text_lower:
                 vuln

         

     () -> :
        

         (steps) <= :
             
         (steps) <= :
             
        :
             

     () -> [CTFProblem]:
        
         [p  p  .problems  p.category == category]

     () -> [CTFProblem]:
        
         .vulnerability_index.get(vuln_type, [])