Collaborative Project: Puzzle-Based Cybersecurity Learning to Enhance Defensive Skills of Front-Line Technicians

合作项目：基于谜题的网络安全学习，以增强一线技术人员的防御技能

• 批准号: 1406853
• 负责人: Dipankar Dasgupta
• 金额: $ 36.49万
• 依托单位: University of Memphis
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-09-01 至 2018-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1406853&HistoricalAwards=false
• 关键词: Collaborative; Project; Puzzle; Based; Cybersecurity

This is a collaborative project involving Jackson State Community College (Award DUE-1406992) and the University of Memphis (Award DUE-1406853).Keeping computers and information systems secure is a major challenge. Business, industry, and government need well-prepared technicians who can prevent, detect, and investigate cybersecurity breaches, and the growth of cyber-threats has created a need for many more workers who have appropriate, specific knowledge and skills. The objective of this project is to develop innovative "puzzles," using specialized software, to assist students in learning concepts of and approaches to cybersecurity. Every day, new cyber-attack patterns and vulnerabilities are emerging. Passive methods of cybersecurity education do not adequately prepare students to defend against rapidly evolving, real-world threats. The central idea behind puzzle-based learning is to provide interesting challenges that engage students in thinking about multiple approaches to solving a problem. Puzzles formulate a problem in a specific format that encourages students to use their knowledge and skills and to think "outside the box."The project team will design and develop interactive, multi-level puzzles both for students who have limited knowledge of computers, networks, and cybersecurity and for students who have a moderate to high level of expertise. The complexity of the developed puzzles will be varied based on the target audience. Puzzle-based learning addresses two issues: (1) It places emphasis on developing critical thinking skills instead of simply covering content. (2) It promotes and builds mathematical and logical reasoning skills. Many institutions have already used puzzles in their STEM curricula successfully. Puzzles have been introduced in introductory computer science courses. However, no significant work has been done on introducing puzzles into cybersecurity curricula. The project team will design scenario-based security puzzles that explore a range of topics (such as identifying and neutralizing malicious software, deploying a secure wireless network, and detecting e-mail spam) using logical decision trees, truth tables, and directed graphs. At the end of each exercise, participants will be able trace back their decisions and analyze how an incorrect decision stem can lead to the exploitation of a vulnerability and how correct actions can prevent it. The investigators will phase in the use of these puzzles so as to: i) examine how to effectively integrate such puzzle-based learning technology with instructional content of community college courses to improve the skill sets of front line cyber defenders, and ii) better identify and understand the circumstances under which success occurs. The project team will also conduct a small-scale efficacy study by having students participate in cyber "capture-the-flag" competitions to determine if the new enhanced courseware enables increased learning compared to the existing instructional methodology.

这是一个合作项目，涉及杰克逊州立社区学院（Award DUE-1406992）和孟菲斯大学（Award DUE-1406853）。保持计算机和信息系统的安全是一个重大挑战。企业、工业和政府需要准备充分的技术人员，他们可以预防、检测和调查网络安全漏洞，而网络威胁的增长也需要更多拥有适当、特定知识和技能的工作人员。该项目的目标是利用专门软件开发创新的“谜题”，以帮助学生学习网络安全的概念和方法。每天都有新的网络攻击模式和漏洞出现。被动的网络安全教育方法不能使学生充分准备好抵御快速发展的现实威胁。基于谜题的学习背后的中心思想是提供有趣的挑战，让学生思考解决问题的多种方法。谜题以一种特定的形式提出一个问题，鼓励学生运用他们的知识和技能，并“跳出框框”思考。“项目团队将为计算机、网络和网络安全知识有限的学生以及具有中等到高等专业知识的学生设计和开发交互式、多层次的谜题。开发的谜题的复杂性将根据目标受众而有所不同。基于谜题的学习解决了两个问题：（1）它强调培养批判性思维技能，而不是简单地涵盖内容。(2)它促进和建立数学和逻辑推理能力。许多机构已经成功地在他们的STEM课程中使用了谜题。在计算机科学入门课程中已经引入了谜题。然而，在将谜题引入网络安全课程方面没有做任何重大工作。该项目团队将设计基于网络的安全谜题，使用逻辑决策树、真值表和有向图探索一系列主题（如识别和中和恶意软件、部署安全无线网络和检测电子邮件垃圾邮件）。在每个练习结束时，参与者将能够追溯他们的决策，并分析错误的决策如何导致漏洞的利用，以及正确的行动如何防止漏洞的利用。调查人员将逐步使用这些谜题，以便：i）研究如何有效地整合这些难题-基于社区大学课程教学内容的学习技术，以提高前线网络防御者的技能，以及ii）更好地识别和理解成功发生的情况。项目小组还将进行一项小规模的功效研究，让学生参加网上“夺旗”比赛，以确定新的增强型课件与现有的教学方法相比是否能增加学习。