EDU: Collaborative: PicoCTF: Teaching Cybersecurity To High School Students through Scalable Challenges

该项目将通过提供可扩展的、有效的、面向众多不同学生群体的“夺旗（CTF）”网络安全竞赛，帮助学生尽早投身网络安全事业。该项目将加强PicoCTF 2013，由首席研究员（PI） Brumley组织，有来自950多所学校的10,000多名学生参加，使其成为有史以来规模最大的网络安全竞赛。拟议的研究旨在利用CTF活动提供一个吸引人的教育环境，向中学生和高中生介绍网络安全的基本思想。此外，拟议的工作将研究新颖的想法，包括自动生成问题和即时教学。比赛将建立在一个开源平台上，使用广泛收集的数据来评估新技术的有效性，并改进PicoCTF的后续版本。这种数据驱动的方法，加上将CTFs整合到课堂中的努力，将有助于扩大当前网络安全教育的规模。安全与可信网络空间（SaTC）项目资助从可信计算系统角度解决网络安全问题的提案；社会、行为和经济科学视角；以及完全专注于网络安全教育的提案。大规模网络安全教育目前主要采取两种形式：具有结构化课程的在线课程和具有特定学习目标的竞赛。大规模在线开放课程（MOOCs）是一种经济有效的大规模教育学生的方式，但最近的研究发现，这些课程的保留率极低，而且主要面向已经完成本科学位的学生。相比之下，大规模的CTFs成功地吸引了学生，但往往不能帮助他们学习新的概念或获得深刻的理解。拟议的工作将侧重于一种综合方法，在这种方法中，CTFs促进最初的鼓励和问题驱动的参与，并辅以整合良好的学习材料。该项目将通过提高美国网络安全教育的质量和规模产生相当大的影响。通过开发一个综合的网络安全课程，拟议的研究将以具有凝聚力的教育经验补充CTF竞赛的参与性。PicoCTF将作为运行独立CTF竞赛的开源平台提供，允许其他人试验他们自己的想法。

This project will help motivate students early to pursue Cybersecurity careers by providing capture-the-flag (CTF) Cybersecurity contest that is scalable, effective, and approachable for a large and diverse group of students. This project will enhance PicoCTF 2013 organized by the Principal Investigator (PI) Brumley with more than 10,000 participating students from over 950 schools, making it the largest Cybersecurity competition ever held. The proposed research seeks to leverage CTF events to provide an engaging education environment that introduces middle and high school students to fundamental ideas in Cybersecurity. In addition, the proposed work will investigate novel ideas, including auto-generated problems and just-in-time teaching. The competition will be built on an open-source platform, using extensive collected data to evaluate the effectiveness of new techniques, and improve subsequent versions of PicoCTF. This data-driven approach, combined with efforts to integrate CTFs into the classroom will help expand the current scale of Cybersecurity education. The Secure and Trustworthy Cyberspace (SaTC) program funds proposals that address Cybersecurity from a Trustworthy Computing Systems perspective; a Social, Behavioral and Economic Sciences perspective; and proposals focusing entirely on Cybersecurity Education.Large-scale Cybersecurity education currently takes predominately two forms: online classes with structured curricula and competitions with ad-hoc learning objectives. Massive open online courses (MOOCs) can be a cost-effective way to educate students at scale, but recent studies have found these courses suffer from extremely low retention rates and mostly serve students who have already completed undergraduate degrees. In contrast, large-scale CTFs succeed at engaging students, but often fail to help them learn new concepts or gain deep understanding. The proposed work will focus on a combined approach where CTFs promote initial encouragement and problem-driven engagement, which is backed-up by well-integrated learning materials. The project will have a considerable impact by improving both the quality and the scale of Cybersecurity education in the United States. By developing an integrated Cybersecurity curriculum, the proposed research will supplement the engaging nature of CTF competitions with a cohesive educational experience. PicoCTF will be provided as an open-source platform for running independent CTF competitions, allowing others to experiment with ideas of their own.