Collaborative Project: Puzzle-Based Cybersecurity Learning to Enhance Defensive Skills of Front-Line Technicians

这是一个由杰克逊州立社区学院(应获奖1406992)和孟菲斯大学(应获1406853奖)共同参与的合作项目。确保计算机和信息系统的安全是一个重大挑战。企业、工业和政府需要训练有素的技术人员，他们可以预防、检测和调查网络安全漏洞，而网络威胁的增长产生了对更多拥有适当、特定知识和技能的员工的需求。这个项目的目标是开发创新的“谜题”，使用专门的软件，帮助学生学习网络安全的概念和方法。每天，新的网络攻击模式和漏洞都在不断涌现。被动的网络安全教育方法不足以让学生做好防御快速发展的现实世界威胁的准备。基于谜题的学习的核心思想是提供有趣的挑战，让学生思考解决问题的多种方法。谜题以一种特定的形式表达问题，鼓励学生使用他们的知识和技能，并“跳出框框”思考。该项目团队将为计算机、网络和网络安全知识有限的学生以及具有中等到高级专业水平的学生设计和开发交互式、多层次的谜题。开发的谜题的复杂程度将根据目标受众而有所不同。基于谜题的学习解决了两个问题：(1)它强调培养批判性思维技能，而不是简单地涵盖内容。(2)它促进和培养数学和逻辑推理能力。许多机构已经在其STEM课程中成功地使用了拼图。在计算机科学入门课程中引入了谜题。然而，在将谜题引入网络安全课程方面，还没有做任何重大工作。项目团队将使用逻辑决策树、真值表和有向图设计基于场景的安全谜题，探索一系列主题(例如识别和中和恶意软件、部署安全无线网络和检测电子邮件垃圾邮件)。在每个练习结束时，参与者将能够追溯他们的决策，并分析不正确的决策系统如何导致漏洞的利用，以及正确的操作如何防止它。调查人员将分阶段使用这些谜题，以便：i)研究如何有效地将这种以谜题为基础的学习技术与社区大学课程的教学内容相结合，以提高前线网络捍卫者的技能；以及ii)更好地识别和了解成功发生的情况。该项目团队还将进行一项小规模的功效研究，让学生参加网络“夺旗”比赛，以确定与现有的教学方法相比，新的增强型课件是否能够增加学习。

This is a collaborative project involving Jackson State Community College (Award DUE-1406992) and the University of Memphis (Award DUE-1406853).Keeping computers and information systems secure is a major challenge. Business, industry, and government need well-prepared technicians who can prevent, detect, and investigate cybersecurity breaches, and the growth of cyber-threats has created a need for many more workers who have appropriate, specific knowledge and skills. The objective of this project is to develop innovative "puzzles," using specialized software, to assist students in learning concepts of and approaches to cybersecurity. Every day, new cyber-attack patterns and vulnerabilities are emerging. Passive methods of cybersecurity education do not adequately prepare students to defend against rapidly evolving, real-world threats. The central idea behind puzzle-based learning is to provide interesting challenges that engage students in thinking about multiple approaches to solving a problem. Puzzles formulate a problem in a specific format that encourages students to use their knowledge and skills and to think "outside the box."The project team will design and develop interactive, multi-level puzzles both for students who have limited knowledge of computers, networks, and cybersecurity and for students who have a moderate to high level of expertise. The complexity of the developed puzzles will be varied based on the target audience. Puzzle-based learning addresses two issues: (1) It places emphasis on developing critical thinking skills instead of simply covering content. (2) It promotes and builds mathematical and logical reasoning skills. Many institutions have already used puzzles in their STEM curricula successfully. Puzzles have been introduced in introductory computer science courses. However, no significant work has been done on introducing puzzles into cybersecurity curricula. The project team will design scenario-based security puzzles that explore a range of topics (such as identifying and neutralizing malicious software, deploying a secure wireless network, and detecting e-mail spam) using logical decision trees, truth tables, and directed graphs. At the end of each exercise, participants will be able trace back their decisions and analyze how an incorrect decision stem can lead to the exploitation of a vulnerability and how correct actions can prevent it. The investigators will phase in the use of these puzzles so as to: i) examine how to effectively integrate such puzzle-based learning technology with instructional content of community college courses to improve the skill sets of front line cyber defenders, and ii) better identify and understand the circumstances under which success occurs. The project team will also conduct a small-scale efficacy study by having students participate in cyber "capture-the-flag" competitions to determine if the new enhanced courseware enables increased learning compared to the existing instructional methodology.