Various complexities involved in organizing and assessing computer science (CS) capstone programs are well-documented. We explore how student learning can be improved by studying the role of instructors and external industry professionals (''clients'') as project mentors in a two-semester capstone program. Three mentoring models are studied: the instructor mentors teams in both semesters (I-I), a client is the mentor in both semesters (C-C), and a hybrid model where the mentor is the instructor in the first semester and a client in the second semester (I-C). The study included 287 unique participants in a two-semester capstone sequence (574 total observations) across three academic years at Washington State University, a public university. Collected data included aggregated grade values for assessing individual student performance in a course, student evaluations of a course, and self-rated student perceptions regarding their own career readiness. Analysis of the data indicated that the hybrid (I-C) mentoring model produced higher values in the course performance and career readiness categories. Qualitative data in the form of anonymous student comments are discussed. The study's implications and possible limitations for replication are highlighted.

Computing educators face many challenges when teaching capstone courses. We examine what impact capstone project type has on student performance, career readiness and course evaluation by considering three project types: Academic, Industry, and Service Learning. We studied data from 139 unique participants, each for two semesters (total 278 observations), over three years of a capstone program at Washington State University. We studied data for individual student performance in the course, student evaluation of the course, and self-rated student perceptions regarding career readiness. Analysis of data indicated that Industry projects with a full-stack application resulted in higher values for course evaluations and career readiness scores. Ranked & pairwise correlation analyses were conducted, revealing pairwise correlations between career readiness and course evaluations (strong-negative) and student performance and course evaluations (moderate-negative); possible implications are discussed. Qualitative data in the form of anonymous student comments via course evaluation surveys indicate some students appreciated working on business-grade applications while other students found amount of documentation involved excessive. The study's implications and possible limitations for replication are addressed, including capstone program length, cohort size, project recruitment, and project variance.

In undergraduate computing degree programs, students typically participate in team-based capstone projects to develop real-world software products. While these projects can provide students with authentic learning experiences involving various aspects of software development, project management, and teamwork, individual contributions are rarely assessed. Instead, instructors typically evaluate all members of a team together using a set of traditional deliverables as the basis for grading. This approach is deficient in that it deprives students of opportunities to focus on specific aspects of software development, to obtain and provide feedback, and to reflect on individual learning experiences. In this Position & Curricula Initiative (PCI) paper, we propose a pedagogy to facilitate students' ability to choose, document and reflect on individual project contributions, receive feedback specific to those contributions, and assess peer contributions. A novel framework of performance indicators—based around ABET's student learning outcomes for undergraduate computing and engineering degree programs—is presented that describes measurable achievements and provides evidence of attaining student learning outcomes. Portfolio creation and assessment activities are outlined, including the use of a software tool to help streamline the process for instructors and students alike. This structured pedagogical framework allows students the ability to engage more directly in the set of software development and project management skills they are most interested in, thus increasing their motivation to succeed and ultimately their preparation for careers in the software profession.

The electric power grid, as a critical national infrastructure, is under constant threat from cyber-attacks. State estimation (SE) is at the foundation of a series of critical control processes in a power transmission system. A false data injection (FDI) attack against SE can disrupt these control processes, crippling a power system and wreaking havoc in a region. With knowledge of the system topology, a cyber-attacker can formulate and execute stealthy FDI attacks that are very difficult to detect. Statistical and, more recently, machine learning approaches have been undertaken to detect FDI attacks on SE of the power grid. In this paper, we propose a Deep Learning (DL) based method to accurately detect stealthy FDI attacks on the SE of power grid. We compare the performance of the DL method with three popular machine learning algorithms, which are: gradient boosting machines (GBM), generalized linear modelings (GLM) and distributed random forests (DRF). All four algorithms analyze a dataset simulating the IEEE 14-bus system. The results demonstrate that these algorithms perform well in accurately and precisely detecting stealthy FDI attacks on the smart grid, with the DL-based approach showing best results.

Due to the characteristics and connectivity of today's Cyber-Physical Control Systems (CPCS) and critical infrastructures, cyber-attacks on these systems are currently difficult to prevent in an efficient and sustainable manner. Prevention and mitigation need accurate identification and evaluation of: system vulnerabilities, likely threats and attacks, and applicable hardening measures. Furthermore, the ability to prioritize hardening measures based on accurate assessments of threat risk and consequence and mitigation availability, applicability, and cost is also needed. To address this challenge we created HESTIA: High-level and Extensible System for Training and Infrastructure risk Assessment. In this paper, we describe the latest architecture and working principles of HESTIA. When fully developed, the HESTIA process and tool-set will enable CPCS engineers to, iteratively: 1) specify a CPCS, 2) select applicable attacks and hardening measures from a library, 3) check specifications for consistency and applicability, and 4) merge attack and hardening specifications into a new CPCS model. In addition, we add support for device specification templates. HESTIA enables the discovery of attack-defend scenarios through simulation and the design of optimal hardening strategies for a given CPCS. This paper is a shortened and updated version of a journal article entitled An architecture for HESTIA to appear in the International Journal of Internet of Things and Cyber-Assurance.

Cyber-attacks and intrusions in cyber-physical control systems are, currently, difficult to reliably prevent. Knowing a system's vulnerabilities and implementing static mitigations is not enough, since threats are advancing faster than the pace at which static cyber solutions can counteract. Accordingly, the practice of cybersecurity needs to ensure that intrusion and compromise do not result in system or environment damage or loss. In a previous paper [2], we described the Cyberspace Security Econometrics System (CSES), which is a stakeholder-aware and economics-based risk assessment method for cybersecurity. CSES allows an analyst to assess a system in terms of estimated loss resulting from security breakdowns. In this paper, we describe two new related contributions: 1) We map the Cyberspace Security Econometrics System (CSES) method to the evaluation and mitigation steps described by the NIST Guide to Industrial Control Systems (ICS) Security, Special Publication 800-82r2. Hence, presenting an economics-based and stakeholder-aware risk evaluation method for the implementation of the NIST-SP-800-82 guide; and 2) We describe the application of this tailored method through the use of a fictitious example of a critical infrastructure system of an electric and gas utility.