Applying Process Discovery to Cybersecurity Training: An Experience Report

Abstract

Quality improvement of practical cybersecurity training is challenging due to the process-oriented nature of this learning domain. Event logs provide only a sparse preview of trainees' behavior in a form that is difficult to analyze. Process mining has great potential in converting events into behavioral graphs that could provide better cognitive features for understanding users' behavior than the raw data. However, practical usability for learning analytics is affected by many aspects. This paper aims to provide an experience report summarizing key features and obstacles in integrating process discovery into cyber ranges. We describe our lessons learned from applying process mining techniques to data captured in a cyber range, which we have been developing and operating for almost ten years. We discuss lessons learned from the whole workflow that covers data preprocessing, data mapping, and the utilization of process models for the post-training analysis of Capture the Flag games. Tactics addressing scalability are explicitly discussed because scalability has proven to be a challenging task. Interactive data mapping and Capture the Flag specific features are used to address this issue.

Using Process Mining to Leverage the Development of a Family of Mobile Applications

“…Such an analysis gives many ideas of how to improve and evolve existing programming courses in more interactive learning facilities. Security training of programmers and users can benefit from user log mining no less than other sub-domains [18], [19]. Let us now consider applications of process mining to software behaviour analysis.…”

Process Mining Analysis of Puzzle-Based Cybersecurity Training

“…If trainees submitted the correct flag after displaying a task solution, they were redirected to the solution page instead of being moved to the next puzzle. More examples of process models can be found in our experience report [16].…”