发表机构
Beihang University; ELLIS; IQuest Research; Singapore Management University（北京航空航天大学; 欧洲学习与智能系统实验室; 智问研究; 新加坡管理大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究提出开源框架CyberFactory，将真实场景漏洞转化为任务实例以训练安全模型Aegis，该模型在CyberGym上的Pass@1较Qwen~3.5提升22.8个百分点，优于通用主干模型。
AI 中文摘要
随着大语言模型（LLM）在编码能力上不断进步，其在网络安全领域的潜力已引发越来越多的研究关注，闭源LLM（如Mythos）已展现出先进的网络安全能力。然而，现有的开源工作仍存在局限：前沿的开放权重模型未提供可复现的网络安全训练方案，开源训练方案聚焦于孤立任务且缺乏可扩展的智能体数据，而扩展智能体的部署则需要强大的领域先验。本研究中，我们提出CyberFactory，一个统一的开源框架，其涵盖概念验证（PoC）生成、漏洞修复及网络安全问答（CyberQA）的数据构建、轨迹合成与模型训练。CyberFactory将来自真实场景的公开漏洞制品，包括CVE，转化为可执行、可验证的任务实例。它进一步利用可复用的漏洞分析技能指导教师完成源码检查、结合领域先验解决问题及基于证据的验证。由此产生的监督信号具有智能体属性：模型与工具及目标环境交互，并根据执行反馈修正自身解决方案。我们利用这些轨迹训练并发布了\textbf{\textit{Aegis}}（在希腊神话中，Aegis是宙斯与雅典娜的保护之盾，该名称反映了模型防御性、面向安全的目的），该模型内化了技能引导的流程，在推理时无需使用该技能。在CyberGym上，\textit{Aegis}在1小时预算下达到52.4%的Pass@1，较其Qwen~3.5基础模型提升了22.8个百分点，且在相同框架下优于所评估的通用主干模型。
英文摘要
As large language models (LLMs) continue to advance in coding capabilities, their potential in cybersecurity has drawn increasing research attention, with closed-source LLMs (e.g., Mythos) delivering advanced cybersecurity capabilities. However, existing open-source efforts remain limited: frontier open-weight models do not provide reproducible cybersecurity training solutions, open-source training solutions focus on isolated tasks and lack scalable agentic data, and scaling agentic rollouts requires strong domain priors. In this work, we introduce \textbf{CyberFactory}, a unified open-source framework that connects data construction, trajectory synthesis, and model training across proof-of-concept (PoC) generation, vulnerability patching, and cybersecurity question answering (CyberQA). CyberFactory transforms public vulnerability artifacts, including CVEs from the wild, into executable and verifiable task instances. It further uses a reusable vulnerability-analysis skill to guide the teacher through source inspection, problem solving with domain prior, and evidence-based validation. The resulting supervision is agentic: the model interacts with tools and target environments and revises its solutions according to execution feedback. Using these trajectories, we train and release \modelname\footnote{\emph{Aegis} is, in Greek mythology, the protective shield of Zeus and Athena; the name reflects the model's defensive, security-oriented purpose.}, which internalizes the skill-guided procedure without requiring the skill at inference time. On CyberGym, \modelname reaches 52.4% Pass@1 under a one-hour budget, improving over its Qwen~3.5 base model by +22.8 points and outperforming the evaluated general-purpose backbones under the same scaffold.
CommentsWe updated scores with models trained on updated agentic data
