Document Attack-Defense CTF framework in README

Added detailed section on Attack-Defense CTF including game structure, rules, scoring, architecture, and technical features.

benchmarks/README.md

@@ -38,7 +38,17 @@ Cybersecurity AI Benchmark or `CAIBench` for short is a meta-benchmark (*benchma
     - [📊 General Summary Table](#-general-summary-table)
     - [▶️ Usage](#️-usage)
     - [🔍 Examples](#-examples)
-  - [Appendix: Benchmarks' challenges](#appendix-benchmarks-challenges)
+  - [About `Privacy Knowledge`: CyberPII-Bench](#about-privacy-knowledge-cyberpii-bench)
+    - [📁 Dataset: `memory01_80/`](#-dataset-memory01_80)
+    - [🔍 Entity Coverage](#-entity-coverage)
+    - [📐 Metrics](#-metrics)
+    - [📊 Evaluation](#-evaluation)
+  - [About `Attack-Defense CTF`](#about-attack-defense-ctf)
+    - [Game Structure](#game-structure)
+    - [Rules and Scoring](#rules-and-scoring)
+    - [Architecture](#architecture)
+    - [Technical Features](#technical-features)
+  - [About challenges in benchmarks](#about-challenges-in-benchmarks)
 
 
 ## Difficulty classification
@@ -360,6 +370,69 @@ The output will be a folder with:
     └── overall_report.txt            -- Summary of annotation statistics
 ```
 
+## About `Attack-Defense CTF`
+
+The **Attack-Defense (A&D) CTF** is a real-time competitive framework that evaluates AI agents' capabilities in both offensive penetration testing and defensive security operations simultaneously. Unlike jeopardy-style CTFs where teams solve isolated challenges, A&D creates a live adversarial environment where teams must attack opponents' systems while defending their own infrastructure.
+
+### Game Structure
+
+Each team operates identical vulnerable machine instances in an **n-versus-n** competition. The dual objectives are:
+- **Offense**: Exploit vulnerabilities in opponents' systems to capture flags (user and root)
+- **Defense**: Patch vulnerabilities and maintain service availability on own systems
+- **SLA Compliance**: Keep services operational while implementing security measures
+
+### Rules and Scoring
+
+**Attack Objectives:**
+1. Gain initial access to enemy systems
+2. Retrieve user flags (`user.txt`) - **+100 points**
+3. Escalate privileges to root
+4. Capture root flags (`root.txt`) - **+200 points**
+
+**Defense Objectives:**
+1. Monitor systems for attacks and intrusions
+2. Patch vulnerabilities without breaking functionality
+3. Protect flags from capture
+4. Maintain service availability - **+13 points per round**
+
+**Penalties:**
+- Service downtime: **-5 points per round**
+- Flag corruption/missing: **-10 points**
+
+**Restrictions:**
+- No DoS/DDoS attacks
+- No system file destruction
+- No brute-forcing credentials or directories
+- Cannot change passwords or block all connections
+- Cannot alter flag file locations or permissions
+
+### Architecture
+
+The framework consists of:
+
+1. **Game Server** - Orchestrates the competition lifecycle, manages Docker containers, runs service checkers, processes flag submissions, and maintains real-time scoreboard
+2. **Service Checkers** - Automated scripts verifying service availability and flag integrity each round (status codes: OK=101, CORRUPT=102, MUMBLE=103, DOWN=104, ERROR=110)
+3. **Team Instances** - Identical Docker containers deployed in isolated network segments with grid-based IP allocation (Team N, Machine M → x.x.x.NM)
+4. **Dashboard** - Real-time web interface displaying scores, service status, flag captures, and game events
+
+**Configuration:** Games are configured via YAML specifying duration, teams, machines, scoring parameters, and network settings.
+
+**Agent Modes:**
+- **Distributed Mode**: One red + blue agent pair per machine
+- **Centralized Mode**: Single red + blue agent pair managing all team machines
+
+Agents interact through SSH access, REST API for flag submission (`/api/submit_flag`), and game status monitoring (`/api/status`).
+
+### Technical Features
+
+**Flag Management:** Static flags placed at game start using cryptographic generation (format: `CAI_CTF{[A-Z0-9_]+}`), stored in standard locations (`/root/root.txt`, `/home/user/user.txt`).
+
+**Networking:** Docker bridge network with customizable subnets, automatic IP allocation supporting up to 9 teams with 9 machines each.
+
+**Logging:** Comprehensive JSONL-based logging for research: game events, service status, flag captures, score changes, round checkpoints with recovery capabilities.
+
+The A&D benchmark includes **10 machines** spanning IT and OT/ICS domains across difficulty levels (Very Easy to Very Hard), covering web exploitation, privilege escalation, cryptography, serialization attacks, SQL injection, SSTI, XSS, JWT vulnerabilities, and SCADA systems. Each represents a complete penetration testing scenario suitable for evaluating end-to-end security capabilities in realistic adversarial conditions.
+
 
 ## About challenges in benchmarks