发表机构
University of South Florida（南佛罗里达大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究提出“非易腐烂知识”概念，通过基于真实事件的场景训练，结合民族志方法，探索培养安全分析师独立于工具的调查性思维技能，并识别影响学习的关键因素。
AI 中文摘要
安全运营中心（SOCs）通常依赖于在职培训，重点关注SOC所使用的特定工具和程序。工具的复杂性可能掩盖底层推理过程，阻碍分析师学习调查技能的能力。我们提出了“非易腐烂知识”的概念，该概念对应于独立于工具的调查性思维技能。我们开发了一种场景驱动的训练方法，以理解这种非易腐烂知识是否可以通过专门设计的突发事件场景来传授，在场景中受训者以不依赖工具的方式面对并解决调查挑战。我们基于真实世界事件设计了两个这样的场景。从大学学生群体中招募了人类受试者进行民族志研究，以了解受训者如何接受这种训练方法以及他们在这些任务上的表现。我们收集了来自五个会话中25名受训者的20小时有记录的培训数据。使用扎根理论，我们分析了数据，并揭示了抑制或促进调查性思维技能学习的因素。我们的研究结合了基于场景的训练、民族志研究和技术分析，以检验如何最好地培养学生掌握行业认为对SOCs至关重要的推理技能。
英文摘要
Security Operations Centers (SOCs) often rely upon on-the-job training focusing on the specific tools and procedures a SOC utilizes. The complexity in tooling can overshadow the underlying reasoning process, hindering an analyst's ability to learn investigative skills. We formulate the concept of "non-perishable knowledge" which corresponds to investigative thinking skills independent of tools. We developed a scenario-driven training method to understand whether such non-perishable knowledge can be imparted through specially designed incident scenarios, where trainees are presented with and solve investigative challenges in a tool-agnostic manner. We designed two such scenarios based on real-world incidents. Human subjects were recruited from a university's student body for ethnographic study to understand how this training method is received by the subjects and how they perform on such tasks. We collected data from 20 hours of documented training with 25 trainees spread across five sessions. Using grounded-theory, we analyzed the data and uncovered factors that inhibit or promote learning of the investigative thinking skills. Our research combines scenario-based training, ethnographic research, and technical analysis to examine how to best train students in the reasoning skills that industry deems vital to SOCs.
Comments14 pages, 3 figures
