Publication result detail

Visual Analytics for Cybersecurity Education and Training

OŠLEJŠEK, R.

Original Title

Visual Analytics for Cybersecurity Education and Training

English Title

Visual Analytics for Cybersecurity Education and Training

Type

Habilitation thesis

Original Abstract

The increasing number of security threats leads to a growing need to develop new methodsfor their mitigation. Simultaneously, it is necessary to train more and more experts whowould recognize these threats in time. However, comprehension and practical training ofcyber-defense processes is challenging. It is not possible to utilize production infrastructuresas these activities would endanger them. Instead, it is necessary to use isolated environmentsemulating real critical infrastructures. Progress in the development of suitable environmentsoccurred only recently and is associated with the expansion and maturity of cloud technologies. However, the availability of suitable cybersecurity platforms is only one piece of thepuzzle. A deeper understanding of cybersecurity processes requires employing efficient dataanalysis methods capable of providing insight into relationships hidden in the data. In ourresearch, we deal with both interconnected areas. We aim to develop a suitable environment, where security experiments and practical training can be conducted, and relevantdata can be systematically gathered. Simultaneously, we strive to use the data for threatsunderstanding and training mitigation procedures. We use the exploratory, visual-basedapproaches to the data analysis.

In this thesis, I aim to provide the readers with a comprehensive overview of our resultsin the field of cybersecurity training platforms and related analytical visualizations that wereached in the last seven years. The thesis is structured as a collection of relevant papers accompanied by a commentary putting our contributions in the context of the state-of-the-artin the area and summarizing our achievements. The thesis consists of two main parts. In thefirst part, I focus on the different approaches to education and training. Our cloud-basedcyber range is presented. Lessons learned from the utilization of the platform for varioustypes of cyber exercises are discussed. The second part contains our achievements in thefield of visualizations and exploratory data analysis. Conceptual works mapping the possibilities of visual-analysis methods in this new application domain are presented. Particularvisualizations improving the efficiency of hands-on training programs are discussed as well.Our achievements in the forensic investigation of file system metadata are presented alongwith learning analytics results.

English abstract

The increasing number of security threats leads to a growing need to develop new methodsfor their mitigation. Simultaneously, it is necessary to train more and more experts whowould recognize these threats in time. However, comprehension and practical training ofcyber-defense processes is challenging. It is not possible to utilize production infrastructuresas these activities would endanger them. Instead, it is necessary to use isolated environmentsemulating real critical infrastructures. Progress in the development of suitable environmentsoccurred only recently and is associated with the expansion and maturity of cloud technologies. However, the availability of suitable cybersecurity platforms is only one piece of thepuzzle. A deeper understanding of cybersecurity processes requires employing efficient dataanalysis methods capable of providing insight into relationships hidden in the data. In ourresearch, we deal with both interconnected areas. We aim to develop a suitable environment, where security experiments and practical training can be conducted, and relevantdata can be systematically gathered. Simultaneously, we strive to use the data for threatsunderstanding and training mitigation procedures. We use the exploratory, visual-basedapproaches to the data analysis.

In this thesis, I aim to provide the readers with a comprehensive overview of our resultsin the field of cybersecurity training platforms and related analytical visualizations that wereached in the last seven years. The thesis is structured as a collection of relevant papers accompanied by a commentary putting our contributions in the context of the state-of-the-artin the area and summarizing our achievements. The thesis consists of two main parts. In thefirst part, I focus on the different approaches to education and training. Our cloud-basedcyber range is presented. Lessons learned from the utilization of the platform for varioustypes of cyber exercises are discussed. The second part contains our achievements in thefield of visualizations and exploratory data analysis. Conceptual works mapping the possibilities of visual-analysis methods in this new application domain are presented. Particularvisualizations improving the efficiency of hands-on training programs are discussed as well.Our achievements in the forensic investigation of file system metadata are presented alongwith learning analytics results.

Keywords

Cyber security, cyber range, exercise, training, analysis, visual analytics, visualization.

Key words in English

Cyber security, cyber range, exercise, training, analysis, visual analytics, visualization.

Authors

OŠLEJŠEK, R.

Released

07.03.2022

Publisher

Faculty of Information Technology BUT

Location

Brno

Pages count

268

URL

https://www.fit.vut.cz/research/publication/12710/

BibTex

@misc{BUT185113,
  author="Radek {Ošlejšek}",
  title="Visual Analytics for Cybersecurity Education and Training",
  year="2022",
  pages="268",
  publisher="Faculty of Information Technology BUT",
  address="Brno",
  url="https://www.fit.vut.cz/research/publication/12710/"
}

Documents

thesis_habilitation