AI 中文总结
该研究基于MITRE ATT&CK网络威胁情报，利用大语言模型构建全自动端到端对手模拟框架，统一剧本生成、执行与故障恢复流程，经多模型评估，Claude Sonnet 4.5效果最佳，故障恢复机制提升了执行成功率。
AI 中文摘要
本文提出了一个基于MITRE ATT&CK对齐的网络威胁情报报告，使用大语言模型实现全自动端到端对手模拟的框架。与之前的工作不同，我们的框架将剧本生成、执行和故障恢复统一在一个工作流程中。通过故障类型感知恢复机制对失败的能力进行修订。在11份CTI报告上进行评估，该框架在Claude Sonnet 4.5上取得了最佳结果。故障恢复机制在所有评估的大语言模型中持续提高了执行成功率。在从AURORA数据集中选择的10份CTI报告上，该机制进一步提高了最终执行成功率，超过了代表当前最先进对手模拟系统的AURORA。
英文摘要
This paper presents a fully automated end-to-end framework for adversary emulation from MITRE ATT&CK-aligned CTI reports using LLMs. Unlike prior work, which either executes prewritten playbooks or partially automates playbook generation, our framework unifies playbook generation, execution, and failure recovery in a single workflow. In particular, although AURORA, the most recent prior study, generates playbooks from CTI reports, it still requires partial manual intervention and does not revise playbooks based on execution failures. Our framework generates Caldera playbooks from CTI reports, executes them automatically, and revises failed Abilities through a failure-type-aware recovery mechanism. Evaluated on 11 CTI reports with Claude Sonnet 4.5, GPT-4o, Gemini 2.5 Pro, and Grok 4 Fast, the framework achieved its best results with Claude Sonnet 4.5: 27.3 Abilities per playbook, 84.22% execution success after revision, and CTI Precision, Recall, and F1 of 73.95%, 52.48%, and 60.50%, respectively. The failure recovery mechanism consistently improved execution success across all evaluated LLM models by 14.59%p to 17.23%p. On the 10 CTI reports selected from AURORA's dataset, this mechanism further increased the final execution success rate, surpassing that of AURORA, which represents the state-of-the-art adversary emulation system.
