Network security tools are indispensable in testing and evaluating the security of computer networks. Existing tools, such as Hping3, however, offer a limited set of options and attack-specific configurations, which restrict their use solely to well-known attack patterns. Although highly parameterizable libraries, such as Scapy, provide more options and scripting capabilities, they require extensive manual setup and often a steep learning curve. The development of powerful AI models, capitalizing on the transformer architecture, has enabled cybersecurity researchers to develop or incorporate these models into existing cyber-defense systems and red-team assessments. Prominent models such as NetGPT, TrafficFormer, and TrafficGPT can be effective, but require extensive computational resources for fine-tuning and a complex setup to adapt to proprietary networking environments and protocols. In this work, we propose AgentRed, a lightweight tool for generating network attack traffic with minimal human configuration and setup. Our tool integrates an AI agent and a large language model with fewer than a billion parameters into the network traffic generation process. Our method creates lightweight Low-Rank Adaptation (LoRA) adapters that can learn specific traffic patterns in a particular network environment. Our agent can autonomously train the LoRA adapters, search online documentation for attack patterns and parameters, and select appropriate adapters to generate network traffic specific to the user’s needs. It utilizes the LoRA adapters to create an intermediate traffic representation that can be parsed and executed by tools such as Scapy to generate malicious traffic in a virtualized test environment. We assess the performance of the proposed approach on six popular network attacks, including flooding attacks, Smurf, Ping-of-Death, and normal ICMP ping traffic. Our results validate the ability of the proposed tool to efficiently generate network packets with 97.9% accuracy using the LoRA adapters, compared to 95.4% accuracy using the base pre-trained Qwen3 0.6B model. When the AI agent performs online searches to enrich the LoRA adapters’ context during traffic generation, our method maintains an accuracy of 96.0% across all tested traffic patterns.

The domain of cybersecurity is rapidly changing as cyber professionals attempt to incorporate Large Language Models (LLMs) and agentic ai technologies into their workflow. New tools such as PentestGPT have the potential to change how penetration testing is conducted. Currently there is a research gap in how as PentestGPT research is limited to solving Capture the Flag (CTF) style problems such as HackTheBox challenges. CTF exercises do not adequately represent the real time nature of network cyber attacks. Our work seeks to test PentestGPT's capabilities in more realistic Red Vs Blue exercises. There is little literature on LLM network forensic analysis. We decided to design and deploy a custom cyber range in Oracle Virtu-alBox. The cyber range consists of a Kali Linux machine with PentestGPT installed to conduct attack campaigns. Furthermore, we deploy a Windows Server 2016 VM with a realistic Active Directory (AD) environment and a domain joined Windows 10 workstation. The Kali VM had internet access to communicate with Claude API while the rest of the range resided on internal VirtualBox interfaces. The range was designed with minimum complexity to increase reducibility and due to severe hardware constraints. Testing was conducted by prompting PentestGPT to conduct a defined Red Team campaign and to follow up with a report. In response, PentestGPT is then prompted to perform a forensic investigation and make a Blue Team report. We evaualuate the quality of Agentic decision making by comparing reports. By evaluating PentestGPT in both offensive and defensive roles within a live Red Vs Blue exercise, these experiments go beyond CTF benchmarks and toward more operationally realistic cybersecurity scenarios.

Industrial Control Systems (ICSs) are the backbone of modern critical infrastructure, such as electric power, water treatment, oil and gas distribution, and manufacturing operations. While the convergence of IT and OT has greatly increased efficiency and observability, it has also greatly expanded the attack surface of these once-isolated systems. High-profile cyber-physical attacks, including Stuxnet (2010), TRITON (2017), and the Colonial Pipeline ransomware attack (2021), have shown that ICS-targeted cyberattacks can cause physical damage, disrupt economic stability, and put public safety at risk. Despite the growing prevalence and intensity of such threats, ICS-based cybersecurity education remains largely under-resourced and underfunded. Traditional ICS training laboratories require highly specialized hardware, vendor-specific tools, and expensive licensing that significantly raise barriers to entry. Traditional labs typically require on-site participation and pose physical safety concerns when cyber-physical attack scenarios are performed. These barriers leave students unable to get necessary security training for ICSs. Therefore, this paper introduces ${\mathrm{AE}}^3$GIS: Agile Emulated Educational Environment for Guided Industrial Security—a fully virtual, lightweight, open-source platform designed to democratize ICS cybersecurity education. Based on the GNS3 network simulation tool, ${\mathrm{AE}}^3$GIS enables rapid deployment of comprehensive ICS environments containing IT and OT systems, industrial communication protocols, control logic, and diverse security tools. ${\mathrm{AE}}^3$GIS is designed to provide practical training for students using realistic ICS cybersecurity scenarios through a local or remote training platform without the cost, safety, or accessibility limitations of hardware-based labs.