Applying Process Discovery to Cybersecurity Training: An Experience Report

Logo poskytovatele

Varování

Publikace nespadá pod Ekonomicko-správní fakultu, ale pod Fakultu informatiky. Oficiální stránka publikace je na webu muni.cz.
Autoři

MACÁK Martin OŠLEJŠEK Radek BÜHNOVÁ Barbora

Rok publikování 2022
Druh Článek ve sborníku
Konference 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)
Fakulta / Pracoviště MU

Fakulta informatiky

Citace
www Permalink to the publisher
Doi http://dx.doi.org/10.1109/EuroSPW55150.2022.00047
Klíčová slova cybersecurity; hands-on training; process mining; data analysis; learning analytics
Přiložené soubory
Popis Quality improvement of practical cybersecurity training is challenging due to the process-oriented nature of this learning domain. Event logs provide only a sparse preview of trainees' behavior in a form that is difficult to analyze. Process mining has great potential in converting events into behavioral graphs that could provide better cognitive features for understanding users' behavior than the raw data. However, practical usability for learning analytics is affected by many aspects. This paper aims to provide an experience report summarizing key features and obstacles in integrating process discovery into cyber ranges. We describe our lessons learned from applying process mining techniques to data captured in a cyber range, which we have been developing and operating for almost ten years. We discuss lessons learned from the whole workflow that covers data preprocessing, data mapping, and the utilization of process models for the post-training analysis of Capture the Flag games. Tactics addressing scalability are explicitly discussed because scalability has proven to be a challenging task. Interactive data mapping and Capture the Flag specific features are used to address this issue.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.