Collaborative Project: Puzzle-Based Cybersecurity Learning to Enhance Defensive Skills of Front-Line Technicians

合作项目：基于谜题的网络安全学习，以增强一线技术人员的防御技能

• 批准号: 1406853
• 负责人: Dipankar Dasgupta
• 金额: $ 36.49万
• 依托单位: University of Memphis
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-09-01 至 2018-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1406853&HistoricalAwards=false
• 关键词: Collaborative; Project; Puzzle; Based; Cybersecurity

This is a collaborative project involving Jackson State Community College (Award DUE-1406992) and the University of Memphis (Award DUE-1406853).Keeping computers and information systems secure is a major challenge. Business, industry, and government need well-prepared technicians who can prevent, detect, and investigate cybersecurity breaches, and the growth of cyber-threats has created a need for many more workers who have appropriate, specific knowledge and skills. The objective of this project is to develop innovative "puzzles," using specialized software, to assist students in learning concepts of and approaches to cybersecurity. Every day, new cyber-attack patterns and vulnerabilities are emerging. Passive methods of cybersecurity education do not adequately prepare students to defend against rapidly evolving, real-world threats. The central idea behind puzzle-based learning is to provide interesting challenges that engage students in thinking about multiple approaches to solving a problem. Puzzles formulate a problem in a specific format that encourages students to use their knowledge and skills and to think "outside the box."The project team will design and develop interactive, multi-level puzzles both for students who have limited knowledge of computers, networks, and cybersecurity and for students who have a moderate to high level of expertise. The complexity of the developed puzzles will be varied based on the target audience. Puzzle-based learning addresses two issues: (1) It places emphasis on developing critical thinking skills instead of simply covering content. (2) It promotes and builds mathematical and logical reasoning skills. Many institutions have already used puzzles in their STEM curricula successfully. Puzzles have been introduced in introductory computer science courses. However, no significant work has been done on introducing puzzles into cybersecurity curricula. The project team will design scenario-based security puzzles that explore a range of topics (such as identifying and neutralizing malicious software, deploying a secure wireless network, and detecting e-mail spam) using logical decision trees, truth tables, and directed graphs. At the end of each exercise, participants will be able trace back their decisions and analyze how an incorrect decision stem can lead to the exploitation of a vulnerability and how correct actions can prevent it. The investigators will phase in the use of these puzzles so as to: i) examine how to effectively integrate such puzzle-based learning technology with instructional content of community college courses to improve the skill sets of front line cyber defenders, and ii) better identify and understand the circumstances under which success occurs. The project team will also conduct a small-scale efficacy study by having students participate in cyber "capture-the-flag" competitions to determine if the new enhanced courseware enables increased learning compared to the existing instructional methodology.

这是一个涉及杰克逊州立社区学院（奖励DUE-1406992）和孟菲斯大学（奖励DUE-1406853）的合作项目。保持计算机和信息系统的安全是一项重大挑战。商业、工业和政府都需要准备充分的技术人员，他们可以预防、检测和调查网络安全漏洞，而网络威胁的增长也创造了对更多拥有适当、特定知识和技能的工人的需求。该项目的目标是利用专门的软件开发创新的“谜题”，以帮助学生学习网络安全的概念和方法。每天都有新的网络攻击模式和漏洞出现。被动的网络安全教育方法不能让学生充分准备好抵御快速发展的现实世界的威胁。基于谜题的学习背后的核心思想是提供有趣的挑战，让学生思考解决问题的多种方法。拼图以一种特定的形式提出一个问题，鼓励学生运用他们的知识和技能，并“跳出框框”思考。项目团队将为计算机、网络和网络安全知识有限的学生和具有中等到高级专业知识的学生设计和开发交互式的多层次谜题。根据目标用户的不同，谜题的复杂程度也会有所不同。基于谜题的学习解决了两个问题：(1)它强调培养批判性思维技能，而不是简单地覆盖内容。(2)促进和培养数学和逻辑推理能力。许多机构已经成功地在STEM课程中使用了谜题。在计算机科学入门课程中已经引入了谜题。然而，在将谜题引入网络安全课程方面还没有做过重要的工作。项目团队将设计基于场景的安全谜题，使用逻辑决策树、真值表和有向图来探索一系列主题（例如识别和消除恶意软件、部署安全无线网络和检测电子邮件垃圾）。在每个练习结束时，参与者将能够追溯他们的决策，并分析不正确的决策系统如何导致漏洞的利用，以及正确的操作如何防止它。调查人员将分阶段使用这些谜题，以便：i)研究如何有效地将这种基于谜题的学习技术与社区大学课程的教学内容相结合，以提高前线网络防御者的技能，以及ii)更好地识别和理解成功发生的情况。项目团队还将通过让学生参加网络“夺旗”竞赛来进行一项小规模的有效性研究，以确定与现有的教学方法相比，新的增强课件是否能提高学习效果。