Threat2Traffic: Multi-Agent Environment Synthesis for Malware Traffic Generation from Threat Intelligence

Data-driven cybersecurity research is fundamentally constrained by the scarcity of labeled datasets, yet acquiring authentic, large-scale malware traffic remains bottlenecked by obsolescent public datasets, unscalable manual construction, and inflexible sandboxes that fail to satisfy the sample-specific dependencies required for malware to exhibit malicious behavior. Threat intelligence documents these dependencies, and LLM agents offer a path to extract them for environment construction, yet directly applying such agents faces two challenges: input-side ambiguity and output-side fragility. In this paper, we propose Threat2Traffic, a multi-agent framework that extracts sample-specific dependencies from threat intelligence, reconstructs tailored environments, and captures malware traffic. To address input-side ambiguity, it formulates dependency extraction as structured multi-agent deliberation over an evidence graph. To overcome output-side fragility, it incorporates invariant-guided synthesis with dual-layer validation under syntactic and semantic constraints. Evaluated on 1,077 samples across eight malware families, Threat2Traffic achieves 83.1\% reproduction success, highlighting its effectiveness for scalable and realistic malware traffic generation. We release the core source code and traffic dataset at https://github.com/apos3637/Threat2Traffic

Training deep learning models to detect cyberattacks requires vast collections of malware traffic, but the most widely used public datasets are now 5 to 25 years out of date. Collecting fresh data is hard because modern malware is environment-aware: before doing anything malicious, it first inspects where it is running, and if the surroundings don't match its expectations, it stays dormant or perform like normal software. To make a sample reveal its true behavior, security researchers must analyze it and reconstruct the environment it expects, few samples at a time — painstaking work that has so far required human experts. Our work, Threat2Traffic, is the first attempt to hand this task over to a team of AI agents. The agents collaboratively read open-source security analyst reports, infer what environment each sample needs, and resolve disagreements between their judgments through a debate mechanism. The system then automatically generates configuration code, checks it in two stages to ensure it will actually run, reconstructs the environment in the cloud, and captures network traffic. In tests on 1,077 real malware samples, our method successfully reproduced 83% of them, far exceeding what existing static sandbox tools achieve. This means work that previously took experts substantial manual effort per sample can now be automated at scale and low cost, freeing up expert time for the broader security research community.