AAG: A Model for Attack Behavior Judgment in CTF-style Cyber Security Training

Capture the Flag (CTF) competitions become popular to engage people with the world of cybersecurity. In CTF-style cybersecurity training, judging trainees’ attack behavior in terms of attack time, methods, and consequences is the key to know trainee ability and thus to provide more targeted training. Previous work focuses on consequences and lacks judgment on attack methods, which cannot provide enough information for trainers to assess trainee ability. To solve this problem, we propose a model called Attack Action Graph (AAG) to help judge trainees’ behavior. By creating AAG, we characterize predictable and unpredictable attack methods and establish an association between attack methods and consequences. Then we update AAG based on feature detection technology to judge attack behavior. In the experiment based on a typical enterprise network, AAG helps us to achieve real-time judgment of all predicted attack behavior. We find that only 5% of the trainees have unpredicted attack behavior. After extracting the characteristics of unpredicted attack behavior and doing offline judgment, we find new attack methods and cheating behavior.