Creating attack paths for cyber defence exercises requires substantial expert effort. Existing automation requires vulnerability graphs or exploit sets curated in advance, limiting where it can be applied. We present AEGIS, a system that generates attack paths using LLMs, white-box access, and Monte Carlo Tree Search over real exploit execution. LLM-based search discovers exploits dynamically without pre-existing vulnerability graphs, while white-box access enables validating exploits in isolation before committing to attack paths. Evaluation at CIDeX 2025, a large-scale exercise spanning 46 IT hosts, showed that AEGIS-generated paths are comparable to human-authored scenarios across four dimensions of training experience (perceived learning, engagement, believability, challenge). Results were measured with a validated questionnaire extensible to general simulation-based training. By automating exploit chain discovery and validation, AEGIS reduces scenario development from months to days, shifting expert effort from technical validation to scenario design.

翻译：为网络防御演练创建攻击路径需要耗费大量专家精力。现有自动化方法需预先构建漏洞图或利用程序集，限制了其应用范围。本文提出AEGIS系统，该系统利用大语言模型、白盒访问权限及基于真实漏洞利用执行的蒙特卡洛树搜索来生成攻击路径。基于LLM的搜索能够动态发现漏洞利用方式，无需预先存在的漏洞图；而白盒访问权限则支持在确定攻击路径前对单个漏洞利用进行独立验证。在涵盖46台IT主机的大规模演练CIDeX 2025中的评估表明，AEGIS生成的攻击路径在训练体验的四个维度（感知学习效果、参与度、可信度、挑战性）上均与人工编写的场景相当。结果通过经验证的问卷进行测量，该问卷可扩展至基于仿真的通用训练场景。通过自动化漏洞利用链发现与验证流程，AEGIS将场景开发周期从数月缩短至数日，使专家精力从技术验证转向场景设计。