Abstract: The evaluation of trainee performance is one of the key points to improve the effectiveness of cyber security exercises,and the study of evaluation method includes two stages:evaluation based on training results and evaluation based on training behavior modeling.The first one cannot figure out the training details,the other can only pre-model some training paths so that it can't determine the correctness of non-preset training path training behavior.In order to solve the problems,a two-layer cyber security exercises trainee behavior description model based on the orientation graph and finite state automatic machine is proposed,and the correctness determination and detail evaluation of non-preset training behavior are realized by combining the characteri-stics of training behavior and training results.An experiment on typical computer network security training scenario shows that,compared with the description model that focuses only on training behavior,the model improves the accuracy of training behavior determination,and realizes the determination of non-preset path training behavior correctness and training details.

Key words: Cyber security exercises, Finite state automatic machine, Oriented graph, Training behavior modeling