Process-driven visual analysis of cybersecurity capture the flag exercises

Hands-on training sessions become a standard way to develop and increase knowledge in cybersecurity. As practical cybersecurity exercises are strongly process-oriented with knowledge-intensive processes, process mining techniques and models can help enhance learning analytics tools. The design of our open-source analytical dashboard is backed by guidelines for visualizing multivariate networks complemented with temporal views and clustering. The design aligns with the requirements for post-training analysis of a special subset of cybersecurity exercises – supervised Capture the Flag games. Usability is demonstrated in a case study using trainees’ engagement measurement to reveal potential flaws in training design or organization. • Practical cybersecurity exercises are strongly process-oriented. • They are characterized by knowledge-intensive processes. • Process graphs that can provide insight into trainees’ behavior and possible exercise suffer from complexity. • Rules for the visualization of multivariate networks are used for generic design decisions. • A sliding window algorithm is used to analyze changes in trainees’ behavior. • Clustering techniques are used to classify individual and collective behavior.