EDU: A Capture-the-Flag Service for Computer Security Courses

安全游戏，如夺旗（CTF）比赛挖掘和培养人们解决难题的内在动机。这些游戏为希望测试自己技能的安全从业人员提供了令人信服的体验。 鉴于这些游戏产生的参与程度，人们一直在努力将这种形式带入课堂。 虽然CTF是衡量其参与者的专业知识水平的理想选择，但在课堂上使用该格式之前，必须克服一些重大问题。 具体来说，CTF挑战通常针对专家，由静态问题和静态解决方案组成，难以定制，需要大量的时间和资源来部署。我们目前正在通过构建开放的CTF软件和服务来解决这些问题，以支持脚手架，变形挑战，其方式易于配置和部署，由全国各地的教师教授他们的课程。具体来说，我们的CTF的内容和难度都经过精心设计，以快速培养学生的信心和能力，而不是无聊或沮丧。 挑战是以变形方式生成的，因此每个学生都会收到一组独特的挑战，以阻止作弊并更好地确保每个学生都能学习材料。 CTF是可配置的，允许教师根据他们希望在课程中涵盖的主题添加和删除挑战。 最后，教师可以免费使用各种格式的CTF，这些格式可以很容易地部署。

Security games such as Capture-the-Flag (CTF) competitions tap into and cultivate the intrinsic motivation in people to solve puzzles. Such games provide a compelling experience for security practitioners looking to test their skills. Given the level of engagement these games produce, there have been efforts to bring the format into the classroom. While CTFs are ideal for measuring the level of expertise of its participants, there are significant issues that must be overcome before the format can be used in the classroom. Specifically, CTF challenges are often targeted towards experts, consist of static problems with static solutions, are difficult to customize, and require significant time and resources to deploy.We are currently addressing these issues by building open CTF software and services to support scaffolded, metamorphic challenges in a manner that is easily configured and deployed by instructors across the country to teach their courses. Specifically, the content and difficulty of our CTFs are carefully scaffolded in order to quickly develop confidence and competence in students rather than boredom or frustration. Challenges are generated metamorphically so that each student receives a unique set of challenges in order to deter cheating and to better ensure that every student learns the material. The CTFs are configurable to allow instructors to add and remove challenges based on the topics they wish to cover in their courses. Finally, the CTFs are freely available to instructors in a variety of formats that can be deployed readily.