STRIATUM-CTF: 一种基于协议的代理框架用于通用CTF求解
STRIATUM-CTF: A Protocol-Driven Agentic Framework for General-Purpose CTF Solving
AI总结：
本文提出STRIATUM-CTF框架，通过Model Context Protocol标准化工具接口，提升CTF求解的自主性和适应性，在真实竞赛中取得第一名。
摘要：
大型语言模型（LLMs）在代码生成方面表现出潜力，但在需要多步骤、状态性推理的进攻性网络安全操作中表现不佳。现有研究多依赖静态基准，无法捕捉真实世界漏洞的动态特性。本文引入STRIATUM-CTF（一种基于搜索的测试时推理代理，用于网络安全战术效用最大化），该框架基于Model Context Protocol（MCP）构建。通过标准化系统 introspection、decompilation 和运行时调试的工具接口，STRIATUM-CTF使代理能够在扩展的漏洞利用轨迹中保持一致的上下文窗口。我们不仅在合成数据集上验证了这种方法，还在实时竞争环境中测试。我们的系统参加了2025年大学举办的Capture-the-Flag（CTF）竞赛，其中它自主识别并利用漏洞。STRIATUM-CTF获得第一名，优于21支人类队伍，展示了在动态问题解决环境中的强大适应性。我们分析代理的决策日志，显示基于MCP的工具抽象显著减少了幻觉现象，相较于简单提示策略。这些结果表明，标准化的上下文协议是构建稳健自主网络安全推理系统的关键路径。
英文摘要：
Large Language Models (LLMs) have demonstrated potential in code generation, yet they struggle with the multi-step, stateful reasoning required for offensive cybersecurity operations. Existing research often relies on static benchmarks that fail to capture the dynamic nature of real-world vulnerabilities. In this work, we introduce STRIATUM-CTF (A Search-based Test-time Reasoning Inference Agent for Tactical Utility Maximization in Cybersecurity), a modular agentic framework built upon the Model Context Protocol (MCP). By standardizing tool interfaces for system introspection, decompilation, and runtime debugging, STRIATUM-CTF enables the agent to maintain a coherent context window across extended exploit trajectories. We validate this approach not merely on synthetic datasets, but in a live competitive environment. Our system participated in a university-hosted Capture-the-Flag (CTF) competition in late 2025, where it operated autonomously to identify and exploit vulnerabilities in real-time. STRIATUM-CTF secured First Place, outperforming 21 human teams and demonstrating strong adaptability in a dynamic problem-solving setting. We analyze the agent's decision-making logs to show how MCP-based tool abstraction significantly reduces hallucination compared to naive prompting strategies. These results suggest that standardized context protocols are a critical path toward robust autonomous cyber-reasoning systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
