EDU: A Capture-the-Flag Service for Computer Security Courses

安全游戏，如夺旗（CTF）竞赛，挖掘并培养人们解决谜题的内在动机。这样的游戏为希望测试自己技能的安全从业人员提供了令人信服的体验。考虑到这些游戏所产生的参与度，人们一直在努力将这种形式引入课堂。虽然CTFs是衡量参与者专业知识水平的理想方法，但在将这种形式用于课堂之前，必须克服一些重大问题。具体来说，CTF挑战通常针对专家，由静态问题和静态解决方案组成，难以定制，并且需要大量的时间和资源来部署。我们目前正在通过构建开放的CTF软件和服务来解决这些问题，以一种易于配置和部署的方式支持脚手架，蜕变的挑战，由全国各地的教师来教授他们的课程。具体来说，我们的CTFs的内容和难度都是精心设计的，目的是为了快速培养学生的信心和能力，而不是让他们感到无聊或沮丧。挑战是变形的，所以每个学生都收到了一套独特的挑战，以防止作弊，并更好地确保每个学生都掌握了材料。CTFs是可配置的，允许教师根据他们希望在课程中涵盖的主题添加和删除挑战。最后，CTFs以各种格式免费提供给教师，可以随时部署。

Security games such as Capture-the-Flag (CTF) competitions tap into and cultivate the intrinsic motivation in people to solve puzzles. Such games provide a compelling experience for security practitioners looking to test their skills. Given the level of engagement these games produce, there have been efforts to bring the format into the classroom. While CTFs are ideal for measuring the level of expertise of its participants, there are significant issues that must be overcome before the format can be used in the classroom. Specifically, CTF challenges are often targeted towards experts, consist of static problems with static solutions, are difficult to customize, and require significant time and resources to deploy.We are currently addressing these issues by building open CTF software and services to support scaffolded, metamorphic challenges in a manner that is easily configured and deployed by instructors across the country to teach their courses. Specifically, the content and difficulty of our CTFs are carefully scaffolded in order to quickly develop confidence and competence in students rather than boredom or frustration. Challenges are generated metamorphically so that each student receives a unique set of challenges in order to deter cheating and to better ensure that every student learns the material. The CTFs are configurable to allow instructors to add and remove challenges based on the topics they wish to cover in their courses. Finally, the CTFs are freely available to instructors in a variety of formats that can be deployed readily.