The main purpose of this paper is to draw attention to some facts and ideas that perhaps can help to identify problems or fields for development and research within the evaluation of training. Topics for group discussion are preceded by material on some basic concepts of evaluation and educational measurement. The ratio scale, the interval scale, the ordinal scale, and the nominal scale are given as examples of kinds of scales used in educational measurement; the problem of norms is discussed; potential purposes of evaluation or educational measurement are outlined; and some characteristics of a good measuring instrument are explained. The author also defends the inclusion of evaluation as an Integral part of a model for planning and carrying out educational programs. (BW) *********************************************************************** Documents acquired by ERIC include many informal unpublished * materials not available from other sources. ERIC makes every effort * * to obtain the best copy available. Nevertheless, items of marginal * * reproducibility are often encountered and this affects the quality * of the microfiche and hardcopy reproductions ERIC makes available * * via the ERIC Document Reproduction Service (EDRS). EDRS is not * responsible for the quality of the original document. Reproductions * * supplied by EDRS are the best that can be made from the original. *********************************************************************** U S DEPARTMENT OF HEALTH, EDUCATION &WELFARE NATIONAL INSTITUTE OF EDUCATION EVALUATION OF TRAINING

/pdf/evaluation-of-training-4s7htqhxas.pdf

Evaluation of Training.

Anomaly detection is an important problem that has been well-studied within diverse research areas and application domains. The aim of this survey is two-fold, firstly we present a structured and comprehensive overview of research methods in deep learning-based anomaly detection. Furthermore, we review the adoption of these methods for anomaly across various application domains and assess their effectiveness. We have grouped state-of-the-art research techniques into different categories based on the underlying assumptions and approach adopted. Within each category we outline the basic anomaly detection technique, along with its variants and present key assumptions, to differentiate between normal and anomalous behavior. For each category, we present we also present the advantages and limitations and discuss the computational complexity of the techniques in real application domains. Finally, we outline open issues in research and challenges faced while adopting these techniques.

Deep Learning for Anomaly Detection: A Survey.

Deep learning has exploded in the public consciousness, primarily as predictive and analytical products suffuse our world, in the form of numerous human-centered smart-world systems, including targeted advertisements, natural language assistants and interpreters, and prototype self-driving vehicle systems. Yet to most, the underlying mechanisms that enable such human-centered smart products remain obscure. In contrast, researchers across disciplines have been incorporating deep learning into their research to solve problems that could not have been approached before. In this paper, we seek to provide a thorough investigation of deep learning in its applications and mechanisms. Specifically, as a categorical collection of state of the art in deep learning research, we hope to provide a broad reference for those seeking a primer on deep learning and its various implementations, platforms, algorithms, and uses in a variety of smart-world systems. Furthermore, we hope to outline recent key advancements in the technology, and provide insight into areas, in which deep learning can improve investigation, as well as highlight new areas of research that have yet to see the application of deep learning, but could nonetheless benefit immensely. We hope this survey provides a valuable reference for new deep learning practitioners, as well as those seeking to innovate in the application of deep learning.

https://ieeexplore.ieee.org/ielaam/6287639/8274985/8351898-aam.pdf

A Survey of Deep Learning: Platforms, Applications and Emerging Research Trends

The rapid developments of the Internet of Things (IoT) and smart mobile devices in recent years have been dramatically incentivizing the advancement of edge computing. On the one hand, edge computing has provided a great assistance for lightweight devices to accomplish complicated tasks in an efficient way; on the other hand, its hasty development leads to the neglection of security threats to a large extent in edge computing platforms and their enabled applications. In this paper, we provide a comprehensive survey on the most influential and basic attacks as well as the corresponding defense mechanisms that have edge computing specific characteristics and can be practically applied to real-world edge computing systems. More specifically, we focus on the following four types of attacks that account for 82% of the edge computing attacks recently reported by Statista: distributed denial of service attacks, side-channel attacks, malware injection attacks, and authentication and authorization attacks. We also analyze the root causes of these attacks, present the status quo and grand challenges in edge computing security, and propose future research directions.

https://ieeexplore.ieee.org/ielaam/5/8789751/8741060-aam.pdf

Edge Computing Security: State of the Art and Challenges

Pervasive growth and usage of the Internet and mobile applications have expanded cyberspace. The cyberspace has become more vulnerable to automated and prolonged cyberattacks. Cyber security techniques provide enhancements in security measures to detect and react against cyberattacks. The previously used security systems are no longer sufficient because cybercriminals are smart enough to evade conventional security systems. Conventional security systems lack efficiency in detecting previously unseen and polymorphic security attacks. Machine learning (ML) techniques are playing a vital role in numerous applications of cyber security. However, despite the ongoing success, there are significant challenges in ensuring the trustworthiness of ML systems. There are incentivized malicious adversaries present in the cyberspace that are willing to game and exploit such ML vulnerabilities. This paper aims to provide a comprehensive overview of the challenges that ML techniques face in protecting cyberspace against attacks, by presenting a literature on ML techniques for cyber security including intrusion detection, spam detection, and malware detection on computer networks and mobile networks in the last decade. It also provides brief descriptions of each ML method, frequently used security datasets, essential ML tools, and evaluation metrics to evaluate a classification model. It finally discusses the challenges of using ML techniques in cyber security. This paper provides the latest extensive bibliography and the current trends of ML in cyber security.

/pdf/a-survey-on-machine-learning-techniques-for-cyber-security-i849l0zme0.pdf

A Survey on Machine Learning Techniques for Cyber Security in the Last Decade

Attacks against web servers and web-based applications remain a serious global network security threat. Attackers are able to compromise web services, collect confidential information from web data bases, interrupt or completely paralyze web servers. In this study, we consider the analysis of HTTP logs for the detection of network intrusions. First, a training set of HTTP requests which does not contain any attacks is analyzed. When all relevant information has been extracted from the logs, several clustering and anomaly detection algorithms are employed to describe the model of normal users behavior. This model is then used to detect network attacks as deviations from the norms in an online mode. The simulation results presented show that, compared to other data mining algorithms, the method results in a higher accuracy rate.

Analysis of HTTP Requests for Anomaly Detection of Web Attacks

Nowadays, zero-day Denial-of-Service (DoS) attacks become frighteningly common in high-speed networks due to constantly increasing number of vulnerabilities. Moreover, these attacks become more sophisticated, and, therefore, they are hard to detect before they damage several networks and hosts. Due to these reasons, real-time monitoring, processing and network anomaly detection must be among key features of a modern DoS prevention system. In this paper, we present a method which allows us to timely detect various denial-of-service attacks against a computer or a network system. We focus on detection of application-layer DoS attacks that utilize encrypted protocols by applying an anomaly-detection-based approach to statistics extracted from network packets. Since network traffic decryption can violate ethical norms and regulations on privacy, the detection scheme proposed analyzes network traffic without its decryption. The scheme includes the analysis of conversations between a web server and its clients, the construction of a model of normal user behavior by dividing these conversations into clusters and the examination of distribution of these conversations among the resulting clusters with the help of the stacked auto-encoder which belongs to a class of deep learning algorithms. Conversations of clients that deviate from those normal patterns are classified as anomalous. The proposed technique is tested on the data obtained with the help of a realistic cyber environment.

Increasing web service availability by detecting application-layer DDoS attacks in encrypted traffic

Cyber security exercises (CSE) are complex learning experiences aimed at developing expert knowledge and competence through simulation. In this paper we examine pedagogical issues relating to CES, from exercise design to training results and evaluation. In addition, we present a Deliberate Practice -oriented view on expert and competence development for CSEs. We use data gathered from multiple CSE cases, where we have collected field notes, observations, questionnaire results, and other documentary data while organizing these training events. Based on our observations and analysis, integrating pedagogical knowledge and focus with each phase in the CSE lifecycle, i.e. planning, implementation, and feedback phases, the training effectiveness can be improved. We also note that CSE evaluation requires systematic measurements of change ranging from customer experience to organizational change. We also outline avenues for further work relating to various aspects of expert knowledge development and training evaluation in the context of CSEs.

/pdf/pedagogical-aspects-of-cyber-security-exercises-scsjcgsu65.pdf

Pedagogical Aspects of Cyber Security Exercises

Exchanging of Situation Awareness information is extremely important for organizations in order to survive as part of the cyber domain. The situation Awareness is required for decision making and for an early warning of upcoming threats. Situation Awareness and the security information in the cyber domain differ from the kinetic domain. Because of that, Situation Awareness has different requirements and use cases, for example when considering time or geographical distances. There is always a risk when sharing security information due to the classified nature of the information. It might contain information of weaknesses or vulnerabilities of the organization, and if used wrongly it jeopardizes the continuity of the business or mission. The model introduced in this paper for creating information sharing topologies enables sharing of classified security related information between multiple organizations with the lowest possible risks levels.

Model for sharing the information of cyber security situation awareness between organizations

Denial of Service attacks remain one of the most serious threats to the Internet nowadays. In this study, we propose an algorithm for detection of Denial of Service attacks that utilize SSL/TLS protocol. These protocols encrypt the data of network connections on the application layer which makes it impossible to detect attackers activity based on the analysis of packet payload. For this reason, we concentrate on statistics that can be extracted from packet headers. Based on these statistics, we build a model of normal user behavior by using several data mining algorithms. Once the model has been built, it is used to detect DoS attacks. The proposed framework is tested on the data obtained with the help of a realistic cyber environment that enables one to construct real attack vectors. The simulations show that the proposed method results in a higher accuracy rate when compared to other intrusion detection techniques.

Tero Kokkonen

Papers

Analysis of HTTP Requests for Anomaly Detection of Web Attacks

Increasing web service availability by detecting application-layer DDoS attacks in encrypted traffic

Pedagogical Aspects of Cyber Security Exercises

Model for sharing the information of cyber security situation awareness between organizations

Data Mining Approach for Detection of DDoS Attacks Utilizing SSL/TLS Protocol