EDU: Collaborative: PicoCTF: Teaching Cybersecurity To High School Students through Scalable Challenges

EDU：协作：PicoCTF：通过可扩展的挑战向高中生教授网络安全

• 批准号: 1419362
• 负责人: David Brumley
• 金额: $ 22.5万
• 依托单位: Carnegie-Mellon University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-09-01 至 2018-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1419362&HistoricalAwards=false
• 关键词: EDU; Collaborative; PicoCTF; Teaching; Cybersecurity

This project will help motivate students early to pursue Cybersecurity careers by providing capture-the-flag (CTF) Cybersecurity contest that is scalable, effective, and approachable for a large and diverse group of students. This project will enhance PicoCTF 2013 organized by the Principal Investigator (PI) Brumley with more than 10,000 participating students from over 950 schools, making it the largest Cybersecurity competition ever held. The proposed research seeks to leverage CTF events to provide an engaging education environment that introduces middle and high school students to fundamental ideas in Cybersecurity. In addition, the proposed work will investigate novel ideas, including auto-generated problems and just-in-time teaching. The competition will be built on an open-source platform, using extensive collected data to evaluate the effectiveness of new techniques, and improve subsequent versions of PicoCTF. This data-driven approach, combined with efforts to integrate CTFs into the classroom will help expand the current scale of Cybersecurity education. The Secure and Trustworthy Cyberspace (SaTC) program funds proposals that address Cybersecurity from a Trustworthy Computing Systems perspective; a Social, Behavioral and Economic Sciences perspective; and proposals focusing entirely on Cybersecurity Education.Large-scale Cybersecurity education currently takes predominately two forms: online classes with structured curricula and competitions with ad-hoc learning objectives. Massive open online courses (MOOCs) can be a cost-effective way to educate students at scale, but recent studies have found these courses suffer from extremely low retention rates and mostly serve students who have already completed undergraduate degrees. In contrast, large-scale CTFs succeed at engaging students, but often fail to help them learn new concepts or gain deep understanding. The proposed work will focus on a combined approach where CTFs promote initial encouragement and problem-driven engagement, which is backed-up by well-integrated learning materials. The project will have a considerable impact by improving both the quality and the scale of Cybersecurity education in the United States. By developing an integrated Cybersecurity curriculum, the proposed research will supplement the engaging nature of CTF competitions with a cohesive educational experience. PicoCTF will be provided as an open-source platform for running independent CTF competitions, allowing others to experiment with ideas of their own.

该项目将通过提供可扩展，有效和平易近人的大型多元化学生群体的捕获旗帜（CTF）网络安全竞赛，帮助激励学生尽早追求网络安全职业。该项目将加强由首席研究员（PI）Brumley组织的PicoCTF 2013，来自950多所学校的10，000多名学生参加，使其成为有史以来最大的网络安全竞赛。拟议的研究旨在利用CTF活动提供一个引人入胜的教育环境，向初中和高中学生介绍网络安全的基本思想。此外，拟议的工作将调查新的想法，包括自动生成的问题和即时教学。比赛将建立在一个开源平台上，使用广泛收集的数据来评估新技术的有效性，并改进PicoCTF的后续版本。这种数据驱动的方法，加上将CTF整合到课堂的努力，将有助于扩大当前网络安全教育的规模。安全和值得信赖的网络空间（SaTC）计划资助从值得信赖的计算系统角度解决网络安全问题的提案;社会、行为和经济科学角度;以及完全专注于网络安全教育的提案。大规模的网络安全教育目前主要采取两种形式：结构化课程的在线课程和具有特定学习目标的竞赛。大规模开放式在线课程（MOOC）可能是大规模教育学生的一种具有成本效益的方式，但最近的研究发现，这些课程的保留率极低，主要服务于已经完成本科学位的学生。相比之下，大规模的CTF成功地吸引了学生，但往往无法帮助他们学习新概念或获得深刻的理解。拟议的工作将侧重于一种综合办法，即现金信托基金促进初步鼓励和问题驱动的参与，并以综合良好的学习材料为后盾。该项目将通过提高美国网络安全教育的质量和规模产生重大影响。通过开发一个综合的网络安全课程，拟议的研究将补充CTF比赛的吸引力与凝聚力的教育经验。PicoCTF将作为一个开源平台提供，用于运行独立的CTF比赛，允许其他人尝试自己的想法。