EDU: A Capture-the-Flag Service for Computer Security Courses

EDU：计算机安全课程的夺旗服务

• 批准号: 1623400
• 负责人: Wu-chang Feng
• 金额: $ 29.83万
• 依托单位: Portland State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-09-01 至 2020-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1623400&HistoricalAwards=false
• 关键词: EDU; Capture; Flag; Service; Computer

Security games such as Capture-the-Flag (CTF) competitions tap into and cultivate the intrinsic motivation in people to solve puzzles. Such games provide a compelling experience for security practitioners looking to test their skills. Given the level of engagement these games produce, there have been efforts to bring the format into the classroom. While CTFs are ideal for measuring the level of expertise of its participants, there are significant issues that must be overcome before the format can be used in the classroom. Specifically, CTF challenges are often targeted towards experts, consist of static problems with static solutions, are difficult to customize, and require significant time and resources to deploy.We are currently addressing these issues by building open CTF software and services to support scaffolded, metamorphic challenges in a manner that is easily configured and deployed by instructors across the country to teach their courses. Specifically, the content and difficulty of our CTFs are carefully scaffolded in order to quickly develop confidence and competence in students rather than boredom or frustration. Challenges are generated metamorphically so that each student receives a unique set of challenges in order to deter cheating and to better ensure that every student learns the material. The CTFs are configurable to allow instructors to add and remove challenges based on the topics they wish to cover in their courses. Finally, the CTFs are freely available to instructors in a variety of formats that can be deployed readily.

诸如夺旗（CTF）竞​​赛之类的安全游戏可以挖掘并培养人们解决谜题的内在动力。此类游戏为希望测试其技能的安全从业者提供了引人入胜的体验。 考虑到这些游戏的参与度，人们一直在努力将这种形式带入课堂。 虽然 CTF 非常适合衡量参与者的专业水平，但在课堂上使用该格式之前，必须克服一些重大问题。 具体来说，CTF 挑战通常针对专家，由静态解决方案组成的静态问题组成，难以定制，并且需要大量时间和资源来部署。我们目前正在通过构建开放的 CTF 软件和服务来支持脚手架、变质来解决这些问题。全国各地的教师可以轻松配置和部署挑战来教授课程。具体来说，我们的 CTF 的内容和难度都经过精心设计，以便快速培养学生的信心和能力，而不是感到无聊或沮丧。 挑战是变形产生的，以便每个学生都会收到一组独特的挑战，以阻止作弊并更好地确保每个学生都学习材料。 CTF 是可配置的，允许教师根据他们希望在课程中涵盖的主题添加和删除挑战。 最后，CTF 可以以各种易于部署的格式免费提供给教师。