Applying Process Discovery to Cybersecurity Training: An Experience Report
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F22%3A00125678" target="_blank" >RIV/00216224:14330/22:00125678 - isvavai.cz</a>
Result on the web
<a href="https://ieeexplore.ieee.org/document/9799415" target="_blank" >https://ieeexplore.ieee.org/document/9799415</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/EuroSPW55150.2022.00047" target="_blank" >10.1109/EuroSPW55150.2022.00047</a>
Alternative languages
Result language
angličtina
Original language name
Applying Process Discovery to Cybersecurity Training: An Experience Report
Original language description
Quality improvement of practical cybersecurity training is challenging due to the process-oriented nature of this learning domain. Event logs provide only a sparse preview of trainees' behavior in a form that is difficult to analyze. Process mining has great potential in converting events into behavioral graphs that could provide better cognitive features for understanding users' behavior than the raw data. However, practical usability for learning analytics is affected by many aspects. This paper aims to provide an experience report summarizing key features and obstacles in integrating process discovery into cyber ranges. We describe our lessons learned from applying process mining techniques to data captured in a cyber range, which we have been developing and operating for almost ten years. We discuss lessons learned from the whole workflow that covers data preprocessing, data mapping, and the utilization of process models for the post-training analysis of Capture the Flag games. Tactics addressing scalability are explicitly discussed because scalability has proven to be a challenging task. Interactive data mapping and Capture the Flag specific features are used to address this issue.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach
Others
Publication year
2022
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)
ISBN
9781665495608
ISSN
—
e-ISSN
—
Number of pages
9
Pages from-to
394-402
Publisher name
IEEE
Place of publication
Neuveden
Event location
Genoa, Italy
Event date
Jan 1, 2022
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
000853211100040