A Survey of Cyber Range Training Exercise Scenario Description, Generation, and Execution

Cyber ranges enable hands-on cybersecurity training. Yet many exercises remain static and labor-intensive, with limited use of current Cyber Threat Intelligence (CTI). This survey takes an end-to-end, three-layer view of the problem as (i) Cyber Range Training Exercise (CyRaTrEx) Scenario Description Languages (SDLs) that formally specify topologies, narratives, and objectives, (ii) CTI-driven scenario generation pipelines that transform threat data into executable content, and (iii) Scenario Execution Platforms that instantiate and operate scenarios. Following a PRISMA methodology, we surveyed 107 publications published between 2010 and 2025, and organized the space into a unified taxonomy. We conduct a comparative evaluation spanning across layers (primarily, SDL, CTI pipeline, execution platform, and cross-layer). This research identified 7 key challenges as (C1) Formal Semantics and Verification, (C2) Behavioural Fidelity, (C3) Trustworthiness of CTI Data, (C4) Continual Scenario Evolution, (C5) API-Driven Scenario Ingestion, (C6) Scalable Telemetry and Observability, and (C7) Reproducibility and Benchmarking, highlighting where the current solutions succeed and where they fall short. Our main contributions are (1) a holistic survey unifying SDLs, CTI pipelines, and cyber range platforms, (2) a taxonomy of representative solutions, (3) a cross-layer gap analysis exposing shortfalls in interoperability, automation, and realism, and (4) a research roadmap toward scalable, realistic, and cyber threat-informed training.