## 3 Materials and Methods
### Dataset Description and Characterization
\begin{table}
\begin{tabular}{l l l l} \hline
**ID** & **Team** & **Team Subnet** & **Server to Defend** \\ \hline
1 & Plaid Parliament of Pwning (PPP) & 10.5.1.0/24 & 10.5.1.2 \\
2 & 9447 & 10.5.2.0/24 & 10.5.2.2 \\
3 & Reckless Abandon & 10.5.3.0/24 & 10.5.3.2 \\
4 & Routards & 10.5.4.0/24 & 10.5.4.2 \\
5 & raon\_ASRT & 10.5.5.0/24 & 10.5.5.2 \\
6 & KAIST GoN & 10.5.6.0/24 & 10.5.6.2 \\
7 & shellplish & 10.5.7.0/24 & 10.5.7.2 \\
8 & CodeRed & 10.5.8.0/24 & 10.5.8.2 \\
9 & HITCON & 10.5.9.0/24 & 10.5.9.2 \\
10 & Blue-Lotus & 10.5.10.0/24 & 10.5.10.2 \\
11 & HackingForChiMac & 10.5.11.0/24 & 10.5.11.2 \\
12 & (Mostly) Men in Black Hats (mmibh) & 10.5.12.0/24 & 10.5.12.2 \\
13 & w3 stormz & 10.5.13.0/24 & 10.5.13.2 \\
14 & More Smoked Leet Chicken (mslc) & 10.5.14.0/24 & 10.5.14.2 \\
15 & Dragon Sector & 10.5.15.0/24 & 10.5.15.2 \\
16 & [SEWorks] penthackon & 10.5.16.0/24 & 10.5.16.2 \\
17 & Stratum Auhuur & 10.5.17.0/24 & 10.5.17.2 \\
18 & Gallopsled & 10.5.18.0/24 & 10.5.18.2 \\
19 & BalalaikaCr3w & 10.5.19.0/24 & 10.5.19.2 \\
20 & Binja & 10.5.20.0/24 & 10.5.20.2 \\ \hline \end{tabular}
\end{table} 
Table 1: Summary of teams, subnets, and servers to defend in DEFCON CTF 22.  
to patch their services before round 224, whereas four of the bottom five teams only completed patching after round 265. A strong correlation was observed between service uptime and final ranking; the top-ranked teams kept their services operational over 90% of the time throughout the competition. Token exfiltration methods--whether via reusing open connections, targeting specific service ports (e.g., 143, 4444, 6969, 8888), or establishing new callback channels--did not show a significant correlation with final success. Notably, most tokens were extracted from traffic without sophisticated obfuscation, suggesting that stealth in exfiltration was not a decisive factor. Additional strategic patterns emerged from the analysis. Early offensive action was critical: teams that took less time to develop and deploy initial exploits generally achieved higher rankings, revealing a strong negative correlation between time-to-exploit and performance. Moreover, offensive dominance appeared more consequential than balanced strategies, as final rankings were more strongly associated with the number of tokens captured than with tokens lost. The widespread reuse of exploits among teams further indicated that the protection of offensive tools was less effective than the timely development of new attack vectors. Overall, the most successful teams displayed greater strategic flexibility and responsiveness to the evolving dynamics of the competition. To convert raw traffic data into a structured format suitable for analysis, the PCAP files were processed using the IDS Snort intrusion detection system [21], following the methodology outlined by [PERSON] and [PERSON] [22]. This process applies a predefined set of detection rules to network packets, generating alerts whenever a rule associated with suspicious or malicious behavior is triggered. Each alert includes essential metadata such as timestamps, source and destination IP addresses, and, most importantly, a unique alert_id corresponding to the specific rule match. Table 2 summarizes the alert identifiers (alert_id) obtained through this methodology, along with their respective frequencies and brief descriptions. In total, 5,537,232 alerts were generated, covering 30 distinct event types. These alerts formed the basis for reconstructing attack sequences and conducting higher-level analyses such as pattern extraction and attacker attribution, effectively transforming raw network traffic into structured, actionable intelligence for cybersecurity research. Building on this foundation, the alert sequences generated by each attacking team against a specific victim team were grouped by competition round. For each round, we defined an MSNA as an ordered sequence of alerts issued by an attacker targeting a victim.