Cyber Defense Competition Research Articles

Perlindungan Data Pribadi Mengenai Kebocoran Data Dalam Lingkup Cyber Crime Sebagai Kejahatan Transnasional

In this era of globalization, internet technology is growing rapidly from time to time. The right to privacy data is part of the privacy rights inherent in every individual. Until now the internet can be used as a new tool to commit a crime, especially cyber crime. The network is broad and can break through the barriers of national borders, enabling the occurrence of a cyber crime that can be carried out by crossing national borders or better known as transnational crime. This cyber crime can cause great losses both material and non-material. Moreover, cyber crime that is transnational in nature makes cyber crime require special treatment to handle it. Indonesia carried out two handlings both externally and internally. Externally, Indonesia and the National Police cooperate with the Australian Federal Police. Meanwhile, internally Indonesia formed institutions such as Id-SIRTII, Trust+positive, the birth of the European Union Convention On Cybercrime Bill, Cyber Defense Competition, Development of Cyber Defense. External handling is carried out by the Indonesian government to overcome Cyber crime that is across national borders.

Hands-on Educational Labs for Cyber Defense Competition Training

Cyber Defense Competitions provide students with challenging, hands-on, fun, and close to real world opportunities to learn, practice, and perform tasks that they will be expected to complete as cybersecurity professionals. The current availability of training resources focused on Cyber Defense Competitions is limited. We introduce CYOTEE: CYbersecurity Oriented Training Environment and Exercises. CYOTEE provides a set of nine fully modifiable and freely available hands-on laboratory activities intended to help students gain skills needed to be successful at Cyber Defense Competitions. This article provides details for two of those hands-on labs: (1) Linux Hardening and (2) Windows Active Directory Hardening. CYOTEE lab descriptions and setup scripts may be found on the GitHub repository (https://github.com/CenterForSecureAndDependableSystems/CYOTEE).

LUCID Network Monitoring and Visualization Application

This work presents LUCID Network Monitoring and Visualization Application (LNMVA), a comprehensive visualization software application for cyber security visualization. The application consists of five component types: components for monitoring network traffic, components for reporting various network messages, data storage components plus a visualization component and an automated animation reporting component. LNMVA can serve as an aid in teaching complex concepts in cybersecurity or to visually demonstrate active security events on a network to an audience or participants in the classroom or cyber defense competitions at near real-time speed. Its flexibility enables it to visualize different kinds of cybersecurity concepts, protocols and ideas. LNMVA is a sub-system of LUCID, a visualization and broadcasting system that aims to improve understanding and sense-making to participants or an audience. The system is targeted to intermediary or expert users engaged in cyber security exercises. Preliminary results from subject testing show that LNMVA with embodied virtual commentator provided an engaging environment to improve participants’ understanding and sense-making in active security events.

Team performance in a series of regional and national US cybersecurity defense competitions: Generalizable effects of training and functional role specialization

A critical component to any modern cybersecurity endeavor is effective use of its human resources to secure networks, maintain services and mitigate adversarial events. Despite the importance of the human cyber- analyst and operator to cybersecurity, there has not been a corresponding rise in data-driven analytical approaches for understanding, evaluating, and improving the effectiveness of cybersecurity teams as a whole. Fortunately, cyber defense competitions are well-established and provide a critical window into what makes a cybersecurity team more or less effective. We examined data collected at the national finals and four regional events of the Collegiate Cyber Defense Competition and posited that experience, access to simulation-based training, and functional role composition by the teams would predict team performance on four scoring dimensions relevant to the application of information assurance skills and defensive cyber operations: (a) maintaining services, (b) help-desk customer support, (c) handling scenario injects, and (d) mitigating red team attacks. Bayesian analysis highlighted that experience was a strong predictor of service availability, scenario injects, and red team defense. Simulation training was also associated with good performance along these scoring dimensions. High-performing and experienced teams clustered with one another based on the functional role composition of team skills. These results are discussed within the context of stages of team development, the efficacy of challenge-based learning events, and reinforce previous analytical results from cyber competitions.

Cyber Teaming and Role Specialization in a Cyber Security Defense Competition.

A critical requirement for developing a cyber capable workforce is to understand how to challenge, assess, and rapidly develop human cyber skill-sets in realistic cyber operational environments. Fortunately, cyber team competitions make use of simulated operational environments with scoring criteria of task performance that objectively define overall team effectiveness, thus providing the means and context for observation and analysis of cyber teaming. Such competitions allow researchers to address the key determinants that make a cyber defense team more or less effective in responding to and mitigating cyber attacks. For this purpose, we analyzed data collected at the 12th annual Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC, http://www.maccdc.org), where eight teams were evaluated along four independent scoring dimensions: maintaining services, incident response, scenario injects, and thwarting adversarial activities. Data collected from the 13-point OAT (Observational Assessment of Teamwork) instrument by embedded observers and a cyber teamwork survey completed by all participants were used to assess teamwork and leadership behaviors and team composition and work processes, respectively. The scores from the competition were used as an outcome measure in our analysis to extract key features of team process, structure, leadership, and skill-sets in relation to effective cyber defense. We used Bayesian regression to relate scored performance during the competition to team skill composition, team experience level, and an observational construct of team collaboration. Our results indicate that effective collaboration, experience, and functional role-specialization within the teams are important factors that determine the success of these teams in the competition and are important observational predictors of the timely detection and effective mitigation of ongoing cyber attacks. These results support theories of team maturation and the development of functional team cognition applied to mastering cybersecurity.

ADLES: Specifying, deploying, and sharing hands-on cyber-exercises

Hands-on tutorials and exercises are recognized as an effective means for gaining much needed cybersecurity and communication and information technology skills. These exercises must be performed in dedicated and virtually isolated computing environments or laboratories, most of which make use of virtualization technology. Building, modifying, and deploying the virtual environments that enable hands-on instruction is currently very time consuming. A new complete exercise instance must be deployed and configured for each course or module, tutorial or exercise, and student. In addition, efficient sharing and reuse of hands-on exercises between organizations is currently extremely difficult, unless the computing resources and virtualization environment are also shared. ADLES is a specification language and associated deployment system created to address these issues up-front. ADLES enables: (1) the formal specification of hands-on virtual computing, networking, and cybersecurity exercises, (2) the automated deployment of specified exercises, and (3) the efficient sharing of such exercises and their computing environment. In this article, we describe in detail the ADLES specification language and deployment system. We also demonstrate ADLES capabilities using two case studies: a pentesting tutorial and a cyber defense competition. The ADLES system is open source and available for all educators to use and improve.

Sociometrics and observational assessment of teaming and leadership in a cyber security defense competition

Advancing our understanding about the human dynamics of cyber security is a major research challenge. At this point, it is unclear how cyber defense teams are organized and led in coordinating and working together to mount and conduct an effective cyber defense. Therefore, we do not know what makes a cyber defense team more or less effective in responding to and mitigating cyber attacks. Cyber competitions offer an approach to train and evaluate the performance of cyber defense teams; such competitions are now regularly conducted at the high school, college, professional, and military defense levels. These naturalistic exercises of teamwork for cyber defense represent an important source for understanding the way defense teams form, coordinate and organize, and to determine the factors that make teams more or less successful. For this purpose, we participated in data collection at the Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC) to understand the key features of effective team processes defined by outcome measures of scored team success. We collected data from wearable social sensors to assess face-to-face interactions and using a 16-point teamwork instrument called OAT (Observational Assessment of Teamwork) to assess teamwork and leadership behaviors in cyber defense. Importantly, this being a cyber defense competition, the success of these teams is evaluated along three independent scoring dimensions: (a) Maintaining Services, (b) Incidence Response, and (c) Scenario Injects. Our results indicate that the leadership dimension and face-to-face interactions are important factors that determine the success of these teams. Teams with effective leadership were more successful, and face-to-face interactions emerged as a strong negative predictor of success. Thus, functional specialization within a team and well-guided leadership could be important predictors of timely detection and mitigation of ongoing cyber attacks. Future research should address more concrete aspects of team coordination and evaluation in cyber defense teams.

I-tee

We present an Intelligent Training Exercise Environment (i-tee), a fully automated Cyber Defense Competition platform. The main features of i-tee are: automated attacks, automated scoring with immediate feedback using a scoreboard, and background traffic generation. The main advantage of this platform is easy integration into existing curricula and suitability for continuous education as well as on-site training at companies. This platform implements a modular approach called learning spaces for implementing different competitions and hands-on labs. The platform is highly automated to enable execution with up to 30 teams by one person using a single server. The platform is publicly available under MIT license.

LUCID

In this article, we discuss LUCID, a visualization and broadcast system targeted to improving a spectator's ability to understand and make sense of cyber defense competitions. The system aims to engage the spectator by presenting information pertinent to understanding the real-time events of the competition as they unfold. It accomplishes this through a combination of techniques, including real-time network security visualization, live video and audio monitoring, animation, computer graphics, user profiling, and commentary. We examine, specifically, how the LUCID system enables the audience to make sense of ongoing activities in a cyber defense competition.

A League of Our Own: The Future of Cyber Defense Competitions

Numerous cyber defense competitions exist today for individuals and teams to test their cyber security skills where each team has to “win or go home.” What is missing from these competitions is a league allowing head to head competitions over the course of a season, much like a sport. Teams playing several hours every week during a ten-week season have the opportunity to improve their cyber security skills. This paper provides an overview of cyber security competitions, and how a National Cyber League can greatly expand the number of and participants in these competitions at a much lower cost leveraging virtual technologies.

Human perspective to anomaly detection for cybersecurity

Traditionally signature-based network Intrusion Detection Systems (IDS) rely on inputs from domain experts and can only identify the attacks if they occur as individual event. IDS generate large number of alerts and it becomes very difficult for human users to go through each message. Previous researches have proposed analytics based approaches to analyze IDS alert patterns based on anomaly detection models, multi-steps models or probabilistic approaches. However, due to the complexities of network intrusions, it is impossible to develop all possible attack patterns or to avoid false positives. With the advance in technologies and popularity of networks in our daily life, it is becoming more and more difficult to detect network intrusions. However, no matter how rapid the technologies change, the human behaviors behind the cyber attacks stay relatively constant. This provides us an opportunity to develop an improved system to detect the unusual cyber attacks. In this paper, we developed four network intrusion models based on consideration of human factors. We then tested these models on ITOC Cyber Defense Competition (CDX) 2009 data. Our results are encouraging. These Models are not only able to recognize most network attacks identified by SNORT log alerts, they are also able to distinguish the non-attack network traffic that was potentially missed by SNORT as indicated by ground truth validation of the data.

Setting up and using a cyber security lab for education purposes

An indispensable component of cyber security education is hands-on activities carried out in a lab to enable students to understand both offense and defense aspects of the cyber space. We describe our design and implementation of this course, and a resulting student organization Cyber Defense Club (CDC), at Kansas State University. Our 1.5-year experience in teaching this course and advising the CDC activities, including taking a team to compete in the regional Cyber Defense Competition (CCDC), shows that cyber security is very attractive to students especially when they have an environment dedicated for this type of activities.

The CyberPatriot National High School Cyber Defense Competition

The chief technology officer at Microsoft's Institute for Advanced Technology in Governments, has stated that the need for talented cybersecurity professionals is quickly outpacing the numbers produced by the educational systems.

Experiences During a Collegiate Cyber Defense Competition

The objective of this article is to encourage schools to participate in the Collegiate Cyber Defense Competition (CCDC) and to ease their entry by providing information about the event and describing the experiences of both the student participants and the educators. This article focuses mainly on the recent experience of a University of North Texas student team at the Southwest Regional CCDC 2008 hosted by Del Mar College in Corpus Christi, Texas. It describes the entire process of participating in the CCDC, including announcements, team formation, task assignments, preparations, and actual team experience during the competition and provides suggestions on strategies for future competitions.