  The escalating battles between attackers and defenders in cybersecurity make
it imperative to test and evaluate defense capabilities from the attackers'
perspective. However, constructing full-life-cycle cyberattacks and performing
red team emulations requires significant time and domain knowledge from
security experts. Existing cyberattack simulation frameworks face challenges
such as limited technical coverage, inability to conduct full-life-cycle
attacks, and the need for manual infrastructure building. These limitations
hinder the quality and diversity of the constructed attacks. In this paper, we
leveraged the capabilities of Large Language Models (LLMs) in summarizing
knowledge from existing attack intelligence and generating executable machine
code based on human knowledge. we proposed AURORA, an automatic end-to-end
cyberattack construction and emulation framework. AURORA can autonomously build
multi-stage cyberattack plans based on Cyber Threat Intelligence (CTI) reports,
construct the emulation infrastructures, and execute the attack procedures. We
also developed an attack procedure knowledge graph to integrate knowledge about
attack techniques throughout the full life cycle of advanced cyberattacks from
various sources. We constructed and evaluated more than 20 full-life-cycle
cyberattacks based on existing CTI reports. Compared to previous attack
simulation frameworks, AURORA can construct multi-step attacks and the
infrastructures in several minutes without human intervention. Furthermore,
AURORA incorporates a wider range (40% more) of attack techniques into the
constructed attacks in a more efficient way than the professional red teams. To
benefit further research, we open-sourced the dataset containing the execution
files and infrastructures of 20 emulated cyberattacks.
