Sequential pattern mining on Cyber Ranges for a computer-based diagnostic of cybersecurity skills

Abstract

This chapter investigates the use of data mining techniques to analyze student strategies in cybersecurity exercises, combining theoretical analysis with empirical data from real-world datasets. The study begins by preprocessing data and extracting both frequent and maximal command sequences using computer-based mining algorithms. By comparing these extracted patterns to expected solutions, the research uncovers areas where students struggle, such as inefficient tool usage and conceptual misunderstandings. These insights provide a deeper understanding of student behavior, helping instructors identify key areas for improvement in their teaching strategies. The chapter also explores the broader educational value of data mining in cybersecurity trainings by demonstrating its applicability in identifying general knowledge gaps, adjusting lesson difficulty, and addressing specific instructional challenges. Future directions include enhancing the dataset with attributes such as real-time help requests and the development of a real-time visual interface to provide instructors with actionable insights. The research emphasizes the significant potential of data mining to improve both cybersecurity education and the overall quality of instruction by making learning more adaptive and efficient.