Cybersecurity education incorporates a variety of teaching methods such as traditional lectures, lectures combined with hands-on exercises, and concept maps. One of the most well-known instructional methods is the use of lectures supplemented by hands-on activities. However, often these exercises either lack a strong connect with the lecture material or invariably lead students step-by-step in predetermined tasks, thereby hindering critical thinking and problem-solving skills. Hence, the instructional method falls short on providing students with a comprehensive understanding of complex and often associated cybersecurity concepts as encountered in real-world security incidents. The authors propose that a problem-based learning (PBL) approach can effectively address these gaps and improve cybersecurity education learning outcomes. This paper presents an application of PBL approach for teaching cybersecurity and ethical hacking in community colleges that play a crucial role in meeting the demand for cybersecurity professionals, but often face several challenges to effectively introduce cybersecurity concepts in their curriculum. Through this research, an existing course on ethical hacking is redesigned using the PBL pedagogy and offered to community college students. The course involves several PBL modules that are developed to cover all key aspects of ethical hacking and implemented using open-source software's. Each PBL module is based on a real-world cybersecurity incident and mapped to the MITRE ATT&CK framework. An external independent evaluation is conducted to assess the effectiveness of the proposed teaching methodology. Overall, the obtained results positively impact students' critical thinking, problem-solving, and communication skills, along with facilitating their understanding of key cybersecurity concepts. 100% of students reported that they enjoyed the PBL exercises. 75% of the students believed that PBL enhanced their learning of key concepts to a great extent, and remaining 25% believed that their learning of key concepts was somewhat enhanced.

Cybersecurity education domain comprises of different curriculum design and teaching methods such as traditional lecture-based instruction, lectures coupled with lab exercises, peer instruction teaching, and concept maps. Traditional lectures combined with hands-on exercises is often the instructional de facto in this discipline. However, these narrowly-focused hands-on exercises such as NDG Netlabs, are typically designed in a hand holding fashion where students are instructed to follow a step-by-step approach to complete a series of tasks associated to the topic. A key missing piece in this pedagogy is the absence of problem solving & critical thinking skills. Hence, the approach fails short in providing students with an opportunity to develop a deeper understanding of often complex and invariably intertwined cybersecurity concepts - a norm in the real world cybersecurity incidents. The authors believe that problem-based learning (PBL) pedagogy holds substantial promise in addressing these shortcomings and improving student learning in cybersecurity education. The project proposes a PBL approach for a ethical hacking and network defense curriculum.

The Internet of Things (IoT) has grown exponentially due to usage via smart apps. The IoT resource constraints are sometimes the reason for susceptibility. Distributed Denial-of-Service (DDoS) attacks have time and again been responsible for the Internet snip-off by exploiting the resources or saturating the bandwidth. Such attacks have turned catastrophic in recent times. Distributed Denial of Service (DDoS) attacks pose an extensive threat to networks, especially the Software-Defined Networking (SDN). The proposed paper reviews the related work that targets DDoS mitigation strategies in SDN. Based on evaluation of parameters and insights gained from the comparative analysis, the paper proposed a learning-based detection and mitigation using extreme machine learning. Our proposal is an inventive approach to detect and mitigate DDoS attacks, leveraging a semi-supervised machine learning method. We conducted a thorough evaluation of our proposed method within a controlled test-bed environment that featured an emulated network topology. The evaluation is conducted on Mininet and Ryu controllers, and relevant datasets are employed for rigorous testing and analysis. We achieved a 91.28% accuracy when compared to the outcomes of our method, better than the existing state-of-the-art.

There are currently over one billion people living with some form of disability worldwide. The continuous increase in new technologies in today's society comes with an increased risk in security. A fundamental knowledge of cybersecurity should be a basic right available to all users of technology. A review of literature in the fields of cybersecurity, STEM, and computer science (CS) has revealed existent gaps regarding educational methods for teaching cybersecurity to students with disabilities (SWD's). To date, SWD's are largely left without equitable access to cybersecurity education. Our goal is to identify current educational methods being used to teach SWD's concepts of cybersecurity, evaluate these methods, and classify the observed trends.

Recent global demand for cybersecurity professionals is promising, with the U.S. job growth rate at 28%, three times the national average. Lacking qualified applicants, many organizations struggle to fill open positions. In a global survey, 2,300 security managers reported that 59% of their security positions were unfilled, although 82% anticipated cyberattacks to their systems. At the same time, the cybersecurity field is broadening, not only in technical concepts but also in human factors, business processes, and international law. The field has not become culturally diversified, however. Professionals hired in 2018 included only 24.9% women, 12.3% African Americans, and 6.8% Latinos. These facts create an opportunity for higher education: diversify the profession while increasing the numbers of skilled computer scientists. New and integrated methods of attracting student populations in the field of cybersecurity are needed. The working group goal is to evaluate the effectiveness of approaches used in higher education to diversify the cybersecurity field through literature review, analysis of the findings, and a survey on techniques used for diversification of the cybersecurity field.

Modeling spreading processes for infections has been a widely researched area owing to its application in variety of domains especially epidemic spread and worm propagation. Until recently, infection propagation models usually inspired by epidemic spreading, solely relied upon the underlying network properties without taking into account the variation in node specific properties, such as its ability to spread infection or recover from an infection. Owing to this fact, these models have been agnostic to the effects such node heterogeneity might have in the overall infection (or immunization) process. In this paper, we incorporate node properties in a well-known ac[SIRS] model for infection propagation, and propose new heuristics to curb the spread of infection in heterogeneous networks. The proposed heuristics are validated against various network topologies, including a real-world example of an email exchange network.

A Flash Event (FE) represents a period of time when a web-server experiences a dramatic increase in incoming traffic, either following a newsworthy event that has prompted users to locate and access it, or as a result of redirection from other popular web or social media sites. This usually leads to network congestion and Quality-of-Service (QoS) degradation. These events can be mistaken for Distributed Denial-of-Service (DDoS) attacks aimed at disrupting the server. Accurate detection of FEs and their distinction from DDoS attacks is important, since different actions need to be undertaken by network administrators in these two cases. However, lack of public domain FE datasets hinders research in this area. In this paper we present a detailed study of flash events and classify them into three broad categories. In addition, the paper describes FEs in terms of three key components: the volume of incoming traffic, the related source IP-addresses, and the resources being accessed. We present such a FE model with minimal parameters and use publicly available datasets to analyse and validate our proposed model. The model can be used to generate different types of FE traffic, closely approximating real-world scenarios, in order to facilitate research into distinguishing FEs from DDoS attacks.

This work-in-progress paper presents an ensemble-based model for detecting and mitigating Distributed Denial-of-Service (DDoS) attacks, and its partial implementation. The model utilises network traffic analysis and MIB (Management Information Base) server load analysis features for detecting a wide range of network and application layer DDoS attacks and distinguishing them from Flash Events. The proposed model will be evaluated against realistic synthetic network traffic generated using a software-based traffic generator that we have developed as part of this research. In this paper, we summarise our previous work, highlight the current work being undertaken along with preliminary results obtained and outline the future directions of our work.

Distributed Denial-of-Service (DDoS) attacks continue to be one of the most pernicious threats to the delivery of services over the Internet. Not only are DDoS attacks present in many guises, they are also continuously evolving as new vulnerabilities are exploited. Hence accurate detection of these attacks still remains a challenging problem and a necessity for ensuring high-end network security. An intrinsic challenge in addressing this problem is to effectively distinguish these Denial-of-Service attacks from similar looking Flash Events (FEs) created by legitimate clients. A considerable overlap between the general characteristics of FEs and DDoS attacks makes it difficult to precisely separate these two classes of Internet activity. In this paper we propose parameters which can be used to explicitly distinguish FEs from DDoS attacks and analyse two real-world publicly available datasets to validate our proposal. Our analysis shows that even though FEs appear very similar to DDoS attacks, there are several subtle dissimilarities which can be exploited to separate these two classes of events.