Instrumenting Competition-Based Exercises to Evaluate Cyber Defender Situation Awareness
Instrumenting Competition-Based Exercises to Evaluate Cyber Defender Situation Awareness
复制标题
通过基于竞赛的练习来评估网络防御者的态势感知
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
Austin Silva
中科院分区：
文献类型：
--
作者：
Theodore Reed;Kevin Nauer;Austin Silva
网络防御演习创建模拟攻击和防御场景，用于培训和评估事件响应者。最普遍的基于竞赛的练习形式由危险式挑战组成，这些挑战与虚构的网络安全事件相辅相成。多个比赛被用来收集每次挑战的使用统计数据。比赛使用研究人员开发的挑战，其中包含20多种攻击技术，这些技术可以产生法医证据和可观察到的二阶效应。研究结果表明：（1）一组辩护者的表现要优于一个人;（2）对虚构事件的情境意识是可以衡量的;（3）挑战的复杂性并不意味着困难。本研究介绍了一种新的应用程序的系统仪表的竞争为基础的练习，并描述了一个练习开发方法，有效的挑战和竞争的创造。有效的挑战正确地代表了难度，并通过客观点和可选的取证线索奖励竞争对手。有效的比赛符合训练目标，并适当提高竞争对手的知识和技能。
Cyber defense exercises create simulated attack and defense scenarios used to train and evaluate incident responders. The most pervasive form of competition-based exercise is comprised of jeopardy-style challenges, which compliment a fictional cyber-security event. Multiple competitions were instrumented to collect usage statistics on a per-challenge basis. The competitions use researcher-developed challenges containing over twenty attack techniques, which generate forensic evidence and observable second-order effects. The following observations were made: (1) a group of defenders performs better than an individual; (2) situation awareness of the fictional event may be measured; (3) challenge complexity does not imply difficulty. This research introduces a novel application of system instrumentation on competition-based exercises and describes an exercise development methodology for effective challenge and competition creation. Effective challenges correctly represent difficulty and reward competitors with objective points and optional forensic clues. Effective competitions compliment training goals and appropriately improve the knowledge and skill of a competitor.