Cyber-Zero - Cyber-Zero ：培训网络安全代理，无需

项目说明

Cyber-Zero: Training Cybersecurity Agents without Runtime

<p align="left">
<a href=" src="
</p>

<di="center">
<h2>🎉 Check out our latest work!<br>
<a href=" title="CTF-Dojo: Training Language Model Agents to Find with CTF-Dojo"><img src="
<strong>🚀 First runtime en for cybersecurity agents 🚀<br>
</div>

<p align="left">
🧐&nbsp;<a href="#o">O</a>
| 🏆&nbsp;<a href="#benchmark-suite">Benchmark Suite</a>
| 🚀&nbsp;<a href="#quick-start">Quick Start</a>
| 🏗️&nbsp;<a href="#architecture">Architecture</a>
| ⚙️&nbsp;<a href="#configuration">Configuration</a>
| 📊&nbsp;<a href="#generation">Generation</a>
| 📝&nbsp;<a href="#"></a>
| 📝&nbsp;<a href="#cli-interface">CLI Interface</a>
| 📝&nbsp;<a href="#citation">Citation</a>
</p>

Cyber-Zero is a comprehensi for training cybersecurity agents without requiring runtime execution en.

O

<p align="center">
<img src="asset/tease.svg" alt="Cyber-Zero Teaser" width="800"/>
</p>

Large Language Models (LLMs) ha remarkable success in software engineering tasks when trained with executable runtime en, such en are often una in cybersecurity domains where challenge configurations and execution contexts are ephemeral or restricted. Cyber-Zero addresses this fundamental limitation by le publicly a CTF writeups and employing persona-driven LLM simulation to re runtime behaviors and generate realistic, long-horizon interaction sequences without actual execution en.

The key inno is generating high-quality training trajectories through LLM simulation rather than requiring actual execution en, making it scalable and practical for training cybersecurity agents. Using trajectories synthesized by Cyber-Zero, we train LLM-based agents that achieve up to 13.1% absolute performance gains o models on three prominent CTF benchmarks: InterCode-CTF, NYU CTF Bench, and Cybench.

Benchmark Suite

To democratize the e of cybersecurity agents, we provide three repaired benchmark suites adapted for EnIGMA+ in Cyber-Zero:

All benchmarks have been reformatted to follow the EnIGMA and EnIGMA+ specification, with each challenge including a challenge.json file and docker-compose.yml file (when required).

Our benchmark suite addresses several issues identified in the original benchmarks, pro repaired for reliable e. For detailed information about specific repairs and impro, see the benchmarks/README.md.

EnIGMA+

To facilitate the de of cybersecurity agents, we present EnIGMA+, an enhanced agent scaffolding of EnIGMA that runs hundreds of CTF challenges in _hours_ instead of _days_. EnIGMA+ is built on top of SWE-agent.

Using EnIGMA+, our best model, Cyber-Zero-32B, establishes new state-of-the-art performance among open-weight models, matching the capabilities of proprietary systems like DeepSeek- and Claude-3.5-Sonnet while offering superior cost-effecti, demonstrating that runtime-free trajectory synthesis can effectively democratize the de of state-of-the-art cybersecurity agents.

For detailed information about EnIGMA+, including installation, configuration, and usage instructions, please check the README in the enigma-plus folder.

Installation

From Source

Quick Start

Generate Trajectories

E Quality

Reformat Trajectories

Architecture

The framework follows a modular architecture of Cyber-Zero:

Key Components

Configuration

The framework uses a hierarchical configuration system with centralized model management:

Basic Configuration

Model Configuration

The framework supports multiple LLM pro through litellm. The default model is DeepSeek- as specified in the research paper:

Adding Custom Models

To add custom models for trajectory generation, update the model mappings in cyber_zero/config.py:

Model Parameters

The framework uses research- parameters for optimal trajectory generation:

Generation

TaskMeta

TrajectoryData

The framework includes comprehensi mechanisms to ensure trajectory quality:

Response

Quality Assessment

Rules

CLI Interface

Unified CLI Commands

Direct Script Interface

CLI Options

Citation

If you use this benchmark suite in your research, please cite:

License

This project is licensed under the CC-BY-NC-4.0 - see the LICENSE file for details.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines on how to contribute to this project.

Support

If you need help or ha, please check our SUPPORT.md guide or open an issue on GitHub.

Code of Conduct

This project adheres to the Contributor Co Code of Conduct. Please read CODE_OF_CONDUCT.md for details.

项目信息

开发语言：Python

Star 数：101

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Cyber-Zero: Training Cybersecurity Agents Without Runtime展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。