Applying Process Discovery to Cybersecurity Training: An Experience Report

Investor logo

Warning

This publication doesn't include Faculty of Arts. It includes Faculty of Informatics. Official publication website can be found on muni.cz.
Authors

MACÁK Martin OŠLEJŠEK Radek BÜHNOVÁ Barbora

Year of publication 2022
Type Article in Proceedings
Conference 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)
MU Faculty or unit

Faculty of Informatics

Citation
Web Permalink to the publisher
Doi http://dx.doi.org/10.1109/EuroSPW55150.2022.00047
Keywords cybersecurity; hands-on training; process mining; data analysis; learning analytics
Attached files
Description Quality improvement of practical cybersecurity training is challenging due to the process-oriented nature of this learning domain. Event logs provide only a sparse preview of trainees' behavior in a form that is difficult to analyze. Process mining has great potential in converting events into behavioral graphs that could provide better cognitive features for understanding users' behavior than the raw data. However, practical usability for learning analytics is affected by many aspects. This paper aims to provide an experience report summarizing key features and obstacles in integrating process discovery into cyber ranges. We describe our lessons learned from applying process mining techniques to data captured in a cyber range, which we have been developing and operating for almost ten years. We discuss lessons learned from the whole workflow that covers data preprocessing, data mapping, and the utilization of process models for the post-training analysis of Capture the Flag games. Tactics addressing scalability are explicitly discussed because scalability has proven to be a challenging task. Interactive data mapping and Capture the Flag specific features are used to address this issue.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.