Collaborative Research: SaTC: EDU: Dual-track Role-based Learning for Cybersecurity Analysts and Engineers for Effective Defense Operation with Data Analytics

网络安全防御行动(Cyber-Ops)迫切需要为实践专业人员提供有效和快速的学习程序，以便将数据分析(即数据科学、人工智能和机器学习)融入他们的日常任务。为了应对不断变化的威胁格局，有效的网络运营通常涉及一支拥有互补专业知识的网络安全分析师和工程师团队。分析师需要由工程师开发或与工程师合作开发的有效、可用且可能定制的数据分析。目前，对需要使用数据分析进行网络运营的网络安全分析师和工程师的在职培训有限。现有的任何计划都不能满足发展有效合作所必需的协作思维和实践的需要。该项目旨在为工作中的网络安全分析师和工程师开发一个创新的双轨学习计划，该计划利用模拟组织中的角色扮演，涉及特定于每个小组的任务以及他们需要作为团队合作的任务。这一创新的设计将有助于促进协作，同时还将加强对特定数据分析知识和技能的学习，这些知识和技能是每种类型的专业人员在现实工作环境中所需的。该计划结合了远程学习模块和任务、团队教练会议以及基于团队的事件响应练习。随着分配给作为模拟组织成员的参与者的网络操作任务的规模和复杂性逐渐增加，对数据分析的学习将逐渐深入。该项目是与教育研究人员合作设计的。设计受到教育理论和原则的启发，包括认同理论、基于项目的设计、设计的理解和通用的学习设计。该计划的设计还将建立在以前成功经验的基础上，入门级网络安全训练营使用模拟、网络安全竞赛，以及教授和部署网络行动的研究进展。该计划将按照基于设计的研究方法进行三次迭代，其效果由外部评估团队进行评估。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Cybersecurity defense operations (cyber-ops) are in dire need of effective and expedited learning programs for practicing professionals to infuse data analytics (i.e., data science, artificial intelligence, and machine learning) into their day-to-day tasks. To combat the evolving threat landscape, effective cyber-ops often involve a team of cybersecurity analysts and engineers with complementary expertise. The analysts need effective, usable, and potentially customized data analytics, which are developed by or in collaboration with the engineers. Currently, in-service training for cybersecurity analysts and engineers who need to use data analytics for cyber-ops are limited. No existing program addresses the need to develop the collaborative mindsets and practices that are necessary to work effectively together. This project aims to develop an innovative dual-track learning program for working cybersecurity analysts and engineers that leverages role-playing within a simulated organization and involves tasks that are specific to each group as well as tasks where they need to work together as a team. This innovative design will help promote collaboration while also enhancing learning of specific data analytic knowledge and skills needed by each type of professional in a realistic work environment. The program features a combination of remote learning modules and tasks, team coach sessions, and team-based incident response exercises. Progressively deeper learning about data analytics will occur as the scale and complexity of the cyber-op tasks assigned to the participants, as members of a simulated organization, are gradually increased. The program was designed in collaboration with education researchers. The design is informed by education theories and principles, including Identity Theory, Project-based Design, Understanding by Design, and Universal Design for Learning. The program’s design will also build on prior successful experiences with entry-level cybersecurity bootcamps employing simulations, cybersecurity competitions, and teaching and deployment of research advances for cyber-ops. The program will be refined through three iterations following a Design-based Research approach, and its effects evaluated by an external evaluation team.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.