Teaching management system for network security training

Abstract

The invention discloses a teaching management system for network security training, and relates to the field of teaching training. The system comprises a practical operation simulation training multi-step disassembly module, a multi-practical operation step association prompt library construction module, a student practical operation behavior data step-by-step supervision module, a multi-step residence time perception grading prompt module, a practical operation step process aggregation scoring module and a structured data platform. The method comprises the following steps: extracting multi-source knowledge point data of network security practical training, performing step-by-step association matching, classifying knowledge point types to construct a three-layer prompt framework, constructing multi-level prompt contents, constructing a triple prompt binding framework according to states of students in different practical operation steps, and establishing a multi-level prompt binding framework according to the states of the students in different practical operation steps. According to the method, the practical operation process is finely monitored and intelligently prompted, meanwhile, an independent score is set for each practical operation step according to the step prompting level, a procedural multi-step scoring module is further integrated, a comprehensive, three-dimensional and operable student ability model is constructed, and precise teaching is achieved.

Description

Technical Field

[0001] This invention relates to the field of teaching and training, specifically a teaching management system for cybersecurity training. Background Technology

[0002] In the process of practical cybersecurity training, timely and precise intervention is crucial for ensuring learning effectiveness and improving training efficiency. Practical training, as a core component of cultivating cybersecurity talent, directly impacts the quality of the workforce. Existing systems generally operate with fixed learning objectives, failing to accurately perceive the learning status of students. These systems typically only passively record operational results, unable to understand the students' cognitive state during practice. They mostly rely on fixed time thresholds to trigger simple text prompts or depend entirely on instructors' manual monitoring. Due to the lack of effective status awareness, the system's intervention triggering mechanism is often mechanical and passive. This intervention method is severely lagging, and the prompts lack specificity. Existing systems typically provide only a single level of intervention—either a minor prompt or a direct answer—lacking a progressive, step-by-step prompting strategy. At the same time, the assessment system is heavily results-oriented, usually using the achievement of the final goal as the criterion for judgment, which cannot truly reflect the trainees' ability level and cannot obtain in-depth and structured feedback on their knowledge gaps, operational standardization, independent thinking ability, etc.

[0003] This application aims to extract knowledge points from multiple sources in cybersecurity training and perform step-by-step correlation and matching. It also categorizes knowledge point types to construct a three-layer prompting framework, building multi-level prompt content. Based on the student's status at different practical steps, a triple prompt binding framework is constructed for refined monitoring and intelligent prompting of the practical process. Furthermore, independent scores are assigned to each practical step according to the prompt level, with tiered deductions based on prompt level. Finally, a process-oriented multi-step scoring module is integrated to construct a comprehensive, three-dimensional, and operable student competency model, achieving precise teaching. Summary of the Invention

[0004] The purpose of this invention is to provide a teaching and management system for cybersecurity training to solve the problems in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A teaching management system for cybersecurity training includes a multi-step breakdown module for practical simulation training, a module for constructing a multi-step association prompt library, a module for monitoring student practical behavior data step by step, a module for perceiving and grading multi-step dwell time prompts, a module for aggregating and scoring the practical steps, and a structured data platform. The practical simulation training module breaks down the multi-step process to obtain the comprehensive training tasks in the network security practical assessment. It associates the comprehensive training tasks with the core knowledge points of network security, and matches them with the practical steps of the training tasks. It constructs a knowledge point association graph for the practical steps and configures different assessment scores according to the knowledge point weights of different practical steps. The module for constructing a multi-practical step-related prompt library statistically analyzes the core knowledge points corresponding to different practical steps in practical assessments, classifies the core knowledge points into prompt levels, and constructs an operation demonstration database. Based on the expected operation characteristics of the practical steps within the operation demonstration database, it completes the multi-level prompt data for each practical step, thus constructing a multi-step hierarchical prompt framework for cybersecurity practical assessments. The step-by-step monitoring module for trainee practical behavior data captures the operation instructions and operation sequences executed by trainees in the practical steps, while monitoring changes in the practical system environment. It also analyzes the effectiveness of trainees' operations at different operation nodes based on real-time feedback from the operation demonstration database, and analyzes the deviation values ​​of trainees in different practical steps. The multi-step dwell time perception and graded prompt module analyzes the expected dwell time threshold for each practical step in the practical assessment, monitors the timing feedback of the student's dwell time in the practical step in real time, and combines the effectiveness of the student's operation to make prompt judgment and analysis, and triggers a graded prompt strategy. The practical operation process aggregation scoring module performs automated comprehensive evaluation based on the effectiveness of the operation and the triggered graded prompt engine in each practical operation step, and builds a competency profile for different trainees.

[0006] Further setup: The multi-step breakdown module for practical simulation training includes a sub-module for mapping knowledge points to practical steps in cybersecurity and a sub-module for configuring and analyzing teaching scores for multiple practical steps. The sub-module for mapping knowledge points to practical steps in cybersecurity acquires all core knowledge points in cybersecurity training, associates and matches the core knowledge points for each task step in the cybersecurity practical assessment, extracts and marks all core knowledge points related to the comprehensive training task in the target practical assessment, and performs a two-way mapping between the marked core knowledge points and each step of the practical assessment, counting the number of core knowledge points corresponding to each practical step. The sub-module for configuring and analyzing teaching scores for multiple practical steps acquires the core knowledge points corresponding to each practical step, classifies each core knowledge point into multiple attribute weights, including general knowledge points, intermediate knowledge points, and key knowledge points, manually configures basic weight values ​​for each knowledge point attribute according to the structured data platform, and quantitatively calculates the basic teaching score for each practical step based on the basic weight values ​​of the core knowledge points associated with each practical step, and summarizes and uploads the basic teaching scores for each practical step to the structured data platform.

[0007] Further settings: The multi-practical-step associated prompt library construction module includes a practical teaching knowledge point type decomposition submodule and a multi-step expected operation feature definition submodule. The practical teaching knowledge point type decomposition submodule obtains the core knowledge points corresponding to each practical step, classifies the core knowledge points into theoretical knowledge points, practical strategy knowledge points, and specific operation instruction knowledge points, and constructs a three-layer prompt framework. Theoretical knowledge points are defined as primary prompts, practical strategy knowledge points as intermediate prompts, and specific operation instruction knowledge points as advanced prompts. The knowledge point types within different practical steps are counted, and the basic teaching score of different practical steps is obtained. When the basic teaching score of a practical step is greater than a set threshold, it is screened to see if the step simultaneously contains primary, intermediate, and advanced prompt knowledge points. If the core knowledge point types of a step are less than three prompt levels, the practical step is marked. The multi-step expected operation feature definition submodule acquires each practical step of the cybersecurity practical assessment. It collects complete operation sequences and command parameters corresponding to changes in the network environment state generated by several question setters completing each practical step through a structured data platform, constructing an operation demonstration database. The complete operation sequence generated by each practical step within this database is defined as the expected operation feature of the practical step. The module then screens the marked practical steps, determining the level of missing prompts. If a prompt is missing at the basic level, it is sent to the structured data platform for manual completion. If a prompt is missing at the intermediate level, some tools and technical paths used in the expected operation features of the practical step are selected and used to complete the intermediate prompt. If a prompt is missing at the advanced level, the specific operation instructions and key parameters in the expected operation features of the practical step are used to complete the advanced prompt, thus constructing a multi-step graded prompt framework for cybersecurity practical assessment.

[0008] Further configuration: The step-by-step monitoring module for trainee practical behavior data includes a multi-step key operation status capture and association sub-module and a practical effective operation monitoring sub-module. The multi-step key operation status capture and association sub-module monitors the operation status of each trainee in the current step of the network security practical assessment, and extracts the operation status characteristics of each trainee. The status characteristics include time sequence characteristics, behavioral characteristics, and result characteristics. The time sequence characteristics include the operation time of the trainee in the current step, the behavioral characteristics include the operation data and operation sequence of the trainee in the current step, and the result characteristics include the state change data of the network system triggered by the operation data. The practical effective operation monitoring submodule acquires the operation data of each student in the current step, obtains the expected operation characteristics of the current operation step corresponding to each student from the operation demonstration database, divides the expected operation characteristics of the current operation step into several operation nodes, and compares the student's operation data at each operation node in the current step with the demonstration data corresponding to that operation node within the expected operation characteristics of the practical step. If the operation data and operation sequence of the operation node are the same as the demonstration data, and the state transition data of the network system triggered by the student's operation data at the operation node are the same as the change data of the network environment state corresponding to the demonstration data, if they are the same, the operation node is marked as a valid operation node for the student. If the operation data, operation sequence, and triggered state transition data of the network system at the operation node are all different from the demonstration data of the operation node, the operation node is determined to be an invalid operation node for the student, and the operation node is marked as invalid. The number of invalid operation nodes marked by the student in the current step is summarized, and the number of invalid operation nodes in the current step is set to 1. The total number of operation nodes in the current step is Analyze the student's deviation value in the current step. , The deviation values ​​of the trainees at each step are calculated and summarized.

[0009] Further configuration: The multi-step dwell time perception and tiered prompt module includes a sub-module for configuring the estimated dwell time for each step and a sub-module for tiered prompt trigger discrimination and analysis. The sub-module for configuring the estimated dwell time for each step obtains each practical step of the cybersecurity practical assessment and its corresponding basic teaching score. Based on the basic teaching score of each practical step, it calculates the relative teaching weight of each practical step and sets the basic teaching score of a certain practical step as follows. The total score for all steps in the cybersecurity practical assessment is [score missing]. The weight of this practical step is . The weight of this practical step is compared with a pre-defined multi-level weight interval. A structured data platform is used to pre-set thresholds for high-weight intervals, medium-weight intervals, and low-weight intervals. The high-weight interval threshold is set to... The threshold of the medium weight interval is The threshold for the low-weight interval is , All settings are determined by the user, and The weight values ​​calculated in this practical step are compared with the high-weight interval threshold, medium-weight interval threshold, and low-weight interval threshold, respectively. The high-weight interval threshold, medium-weight interval threshold, and low-weight interval threshold are set to correspond to the weight adjustment factors of the practical step, respectively. The completion time for the demonstration of the corresponding practical steps in the data collection operation demonstration database is [time]. Calculate the estimated dwell time for different practical steps. According to the formula: The estimated time spent on each step of the cybersecurity skills assessment is uploaded to the structured data platform.

[0010] Further settings: The tiered prompt trigger discriminant analysis submodule obtains the student's deviation value and dwell time in the current practical step. When the student's dwell time in the current step exceeds the expected dwell time, and the deviation value of the current practical step exceeds the baseline threshold, a primary prompt is triggered. The structured data platform sends the primary prompt uploaded for that step to the student's end. After the primary prompt is triggered, the dwell time for that step is immediately updated to zero, and a primary time reduction factor is introduced. The threshold for the initial step dwell time after triggering the initial signal is set to... , = ; When a student's dwell time in the current step exceeds the threshold for dwell time in the beginner step, and the deviation value of the current practical step exceeds the set beginner threshold, an intermediate prompt is triggered. The structured data platform sends the intermediate prompt uploaded for that step to the student's end. Upon triggering the intermediate prompt, the dwell time for that step is immediately updated to zero, and an intermediate time reduction factor is introduced. Set the threshold for the dwell time in the intermediate step after triggering the intermediate signal to be [value]. , = ; When a student's dwell time in the current step exceeds the dwell time threshold for intermediate steps, and the deviation value of the current practical step exceeds the set intermediate threshold, an advanced prompt is triggered. The structured data platform sends the advanced prompt uploaded for that step to the student's end. Upon triggering the advanced prompt, the dwell time for that step is immediately updated to zero, and an advanced time reduction factor is introduced. Set the threshold for the advanced step dwell time after triggering the advanced signal to be [value]. , = ; If a student spends more time in the current step than the advanced step's time threshold, and the deviation from the current practical step exceeds the set advanced threshold, the step will be marked as an invalid response, and the student will skip the step and proceed to the next practical step. Among them, the baseline threshold, primary threshold, intermediate threshold, and advanced threshold are set manually, and the thresholds decrease one by one. The primary time reduction factor... Intermediate time reduction factor Advanced time reduction factor It is set by humans. ; Further settings: The practical operation process aggregation scoring module includes a sub-module for generating comprehensive scores for practical operation processes and a sub-module for constructing multi-dimensional student competency profiles. The sub-module for generating comprehensive scores for practical operation processes obtains each practical operation step in the cybersecurity practical operation assessment and its corresponding basic teaching score, and sets the basic teaching score for different practical operation steps as follows: If a student does not trigger any prompts during a practical step, the score for that step is determined as the basic teaching score for that step. When a trainee triggers a basic prompt during a certain practical step, an impact coefficient for the basic prompt is introduced. Calculate the student's score in the current step. When a trainee triggers an intermediate-level prompt during a certain practical step, the influence coefficient of the basic-level prompt is introduced. Calculate the student's score in the current step. When a trainee triggers an advanced prompt during a certain practical step, the influence coefficient of the basic prompt is introduced. Calculate the student's score in the current step. If a student marks an invalid response in a certain practical step, the student will receive a score of 0 for that step. The scores of different students in different practical steps will be summarized to obtain the total score of different students in the cybersecurity practical assessment. The multi-dimensional student competency profile construction submodule obtains the total score of different students in the cybersecurity practical assessment, the score details of each practical step, the highest prompt level triggered by each practical step, and the practical steps marked as invalid answers. It then aggregates the data to construct student competency profiles and marks and provides feedback on the knowledge points corresponding to each student's weak steps.

[0011] Compared with existing technologies, the beneficial effects of this invention are: it aims to extract knowledge point data from multiple sources in network security training and then perform step-by-step association and matching. At the same time, it classifies knowledge point types to construct a three-layer prompting framework, builds multi-level prompting content, and constructs a triple prompt binding framework based on the student's status in different practical steps. This enables refined monitoring and intelligent prompting of the practical process. In addition, it assigns independent scores to each practical step according to the prompting level, and applies graded deductions according to the prompting level. Furthermore, it integrates a process-oriented multi-step scoring module to construct a comprehensive, three-dimensional, and operable student ability model, thereby achieving precise teaching. Attached Figure Description

[0012] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0013] Figure 1 This is a schematic diagram of the module implementation process of a teaching management system for cybersecurity training according to the present invention; Figure 2 This is a schematic diagram of the specific module structure of a teaching management system for cybersecurity training according to the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Please see Figures 1-2 In the embodiments of the present invention, such as Figure 1 and Figure 2 As shown, a teaching management system for cybersecurity training includes a multi-step breakdown module for practical simulation training, a multi-step associated prompt library construction module, a step-by-step monitoring module for student practical behavior data, a multi-step dwell time perception and graded prompt module, a practical step process aggregation scoring module, and a structured data platform. The practical simulation training module breaks down the multi-step process to obtain the comprehensive training tasks in the network security practical assessment. It associates the comprehensive training tasks with the core knowledge points of network security, and matches them with the practical steps of the training tasks. It constructs a knowledge point association graph for the practical steps and configures different assessment scores according to the knowledge point weights of different practical steps. Further explanation is needed. The multi-step breakdown module for practical simulation training includes a sub-module for mapping knowledge points to practical steps in cybersecurity and a sub-module for configuring and analyzing teaching scores for multiple practical steps. The sub-module for mapping knowledge points to practical steps in cybersecurity acquires all core knowledge points in cybersecurity training, associates and matches the core knowledge points of each task step in the cybersecurity practical assessment, extracts and marks all core knowledge points related to the comprehensive training task in the target practical assessment, and performs a two-way mapping between the marked core knowledge points and each step of the practical assessment, counting the number of core knowledge points corresponding to each practical step. The sub-module for configuring and analyzing teaching scores for multiple practical steps acquires the core knowledge points corresponding to each practical step, classifies each core knowledge point into multiple attribute weights, including general knowledge points, intermediate knowledge points, and key knowledge points, manually configures basic weight values ​​for each knowledge point attribute according to the structured data platform, and quantitatively calculates the basic teaching score for each practical step based on the basic weight values ​​of the core knowledge points associated with each practical step. The basic teaching scores for each practical step are then summarized and uploaded to the structured data platform.

[0016] The module for constructing a multi-practical step-related prompt library statistically analyzes the core knowledge points corresponding to different practical steps in practical assessments, classifies the core knowledge points into prompt levels, and constructs an operation demonstration database. Based on the expected operation characteristics of the practical steps within the operation demonstration database, it completes the multi-level prompt data for each practical step, thus constructing a multi-step hierarchical prompt framework for cybersecurity practical assessments. Further explanation is needed: The multi-practical-step associated prompt library construction module includes a practical teaching knowledge point type decomposition submodule and a multi-step expected operation feature definition submodule. The practical teaching knowledge point type decomposition submodule obtains the core knowledge points corresponding to each practical step, classifies the core knowledge points into theoretical knowledge points, practical strategy knowledge points, and specific operation instruction knowledge points, and constructs a three-layer prompt framework. Theoretical knowledge points are defined as primary prompts, practical strategy knowledge points as intermediate prompts, and specific operation instruction knowledge points as advanced prompts. The knowledge point types within different practical steps are counted, and the basic teaching score of different practical steps is obtained. When the basic teaching score of a practical step is greater than a set threshold, it is screened to see if the step simultaneously contains primary, intermediate, and advanced prompt knowledge points. If the core knowledge point types of a step are less than three prompt levels, the practical step is marked. The multi-step expected operation feature definition submodule acquires each practical step of the cybersecurity practical assessment. It collects complete operation sequences and command parameters corresponding to changes in the network environment state generated by several question setters completing each practical step through a structured data platform, constructing an operation demonstration database. The complete operation sequence generated by each practical step within this database is defined as the expected operation feature of the practical step. The module then screens the marked practical steps, determining the level of missing prompts. If a prompt is missing at the basic level, it is sent to the structured data platform for manual completion. If a prompt is missing at the intermediate level, some tools and technical paths used in the expected operation features of the practical step are selected and used to complete the intermediate prompt. If a prompt is missing at the advanced level, the specific operation instructions and key parameters in the expected operation features of the practical step are used to complete the advanced prompt, thus constructing a multi-step graded prompt framework for cybersecurity practical assessment.

[0017] The step-by-step monitoring module for trainee practical behavior data captures the operation instructions and operation sequences executed by trainees in the practical steps, while monitoring changes in the practical system environment. It also analyzes the effectiveness of trainees' operations at different operation nodes based on real-time feedback from the operation demonstration database, and analyzes the deviation values ​​of trainees in different practical steps. It should be further explained that the step-by-step monitoring module for trainee practical behavior data includes a multi-step key operation status capture and association sub-module and a practical effective operation monitoring sub-module. The multi-step key operation status capture and association sub-module monitors the operation status of each trainee in the current step of the network security practical assessment and extracts the operation status characteristics of each trainee. The status characteristics include time sequence characteristics, behavioral characteristics, and result characteristics. The time sequence characteristics include the operation time of the trainee in the current step, the behavioral characteristics include the operation data and operation sequence of the trainee in the current step, and the result characteristics include the state change data of the network system triggered by the operation data. The practical effective operation monitoring submodule acquires the operation data of each student in the current step, obtains the expected operation characteristics of the current operation step corresponding to each student from the operation demonstration database, divides the expected operation characteristics of the current operation step into several operation nodes, and compares the student's operation data at each operation node in the current step with the demonstration data corresponding to that operation node within the expected operation characteristics of the practical step. If the operation data and operation sequence of the operation node are the same as the demonstration data, and the state transition data of the network system triggered by the student's operation data at the operation node are the same as the change data of the network environment state corresponding to the demonstration data, if they are the same, the operation node is marked as a valid operation node for the student. If the operation data, operation sequence, and triggered state transition data of the network system at the operation node are all different from the demonstration data of the operation node, the operation node is determined to be an invalid operation node for the student, and the operation node is marked as invalid. The number of invalid operation nodes marked by the student in the current step is summarized, and the number of invalid operation nodes in the current step is set to 1. The total number of operation nodes in the current step is Analyze the student's deviation value in the current step. , The deviation values ​​of the trainees at each step are calculated and summarized.

[0018] The multi-step dwell time perception and graded prompt module analyzes the expected dwell time threshold for each practical step in the practical assessment, monitors the timing feedback of the student's dwell time in the practical step in real time, and combines the effectiveness of the student's operation to make prompt judgment and analysis, and triggers a graded prompt strategy. Further explanation is needed: the multi-step dwell time perception and tiered prompt module includes a step-by-step estimated dwell time configuration submodule and a tiered prompt trigger discrimination analysis submodule. The step-by-step estimated dwell time configuration submodule obtains each practical step of the cybersecurity practical assessment and its corresponding basic teaching score. Based on the basic teaching score of each practical step, it calculates the relative teaching weight of each practical step and sets the basic teaching score of a certain practical step as follows: The total score for all steps in the cybersecurity practical assessment is [score missing]. The weight of this practical step is . The weight of this practical step is compared with a pre-defined multi-level weight interval. A structured data platform is used to pre-set thresholds for high-weight intervals, medium-weight intervals, and low-weight intervals. The high-weight interval threshold is set to... The threshold of the medium weight interval is The threshold for the low-weight interval is , All settings are determined by the user, and The weight values ​​calculated in this practical step are compared with the high-weight interval threshold, medium-weight interval threshold, and low-weight interval threshold, respectively. The high-weight interval threshold, medium-weight interval threshold, and low-weight interval threshold are set to correspond to the weight adjustment factors of the practical step, respectively. The completion time for the demonstration of the corresponding practical steps in the data collection operation demonstration database is [time]. Calculate the estimated dwell time for different practical steps. According to the formula: The estimated time spent on each step of the cybersecurity skills assessment is uploaded to the structured data platform.

[0019] The tiered prompt triggering analysis submodule obtains the deviation value and dwell time of the trainee in the current practical step. When the trainee's dwell time in the current step exceeds the expected dwell time, and the deviation value of the current practical step exceeds the baseline threshold, a primary prompt is triggered. The structured data platform sends the primary prompt uploaded for that step to the trainee's end. After the primary prompt is triggered, the dwell time for that step is immediately updated to zero, and a primary time reduction factor is introduced. The threshold for the initial step dwell time after triggering the initial signal is set to... , = ; When a student's dwell time in the current step exceeds the threshold for dwell time in the beginner step, and the deviation value of the current practical step exceeds the set beginner threshold, an intermediate prompt is triggered. The structured data platform sends the intermediate prompt uploaded for that step to the student's end. Upon triggering the intermediate prompt, the dwell time for that step is immediately updated to zero, and an intermediate time reduction factor is introduced. Set the threshold for the dwell time in the intermediate step after triggering the intermediate signal to be [value]. , = ; When a student's dwell time in the current step exceeds the dwell time threshold for intermediate steps, and the deviation value of the current practical step exceeds the set intermediate threshold, an advanced prompt is triggered. The structured data platform sends the advanced prompt uploaded for that step to the student's end. Upon triggering the advanced prompt, the dwell time for that step is immediately updated to zero, and an advanced time reduction factor is introduced. Set the threshold for the advanced step dwell time after triggering the advanced signal to be [value]. , = ; If a student spends more time in the current step than the advanced step's time threshold, and the deviation from the current practical step exceeds the set advanced threshold, the step will be marked as an invalid response, and the student will skip the step and proceed to the next practical step. Among them, the baseline threshold, primary threshold, intermediate threshold, and advanced threshold are set manually, and the thresholds decrease one by one. The primary time reduction factor... Intermediate time reduction factor Advanced time reduction factor It is set by humans. ; The practical operation process aggregation scoring module performs automated comprehensive evaluation based on the effectiveness of the operation and the triggered graded prompt engine in each practical operation step, and builds a competency profile for different trainees.

[0020] It should be further explained that the practical operation process aggregation scoring module includes a sub-module for generating comprehensive scores for practical operation processes and a sub-module for constructing multi-dimensional student competency profiles. The sub-module for generating comprehensive scores for practical operation processes obtains each practical operation step in the cybersecurity practical operation assessment and its corresponding basic teaching score, and sets the basic teaching score for different practical operation steps as follows: If a student does not trigger any prompts during a practical step, the score for that step is determined as the basic teaching score for that step. When a trainee triggers a basic prompt during a certain practical step, an impact coefficient for the basic prompt is introduced. Calculate the student's score in the current step. When a trainee triggers an intermediate-level prompt during a certain practical step, the influence coefficient of the basic-level prompt is introduced. Calculate the student's score in the current step. When a trainee triggers an advanced prompt during a certain practical step, the influence coefficient of the basic prompt is introduced. Calculate the student's score in the current step. If a student marks an invalid response in a certain practical step, the student will receive a score of 0 for that step. The scores of different students in different practical steps will be summarized to obtain the total score of different students in the cybersecurity practical assessment. The multi-dimensional student competency profile construction submodule obtains the total score of different students in the cybersecurity practical assessment, the score details of each practical step, the highest prompt level triggered by each practical step, and the practical steps marked as invalid answers. It then aggregates the data to construct student competency profiles and marks and provides feedback on the knowledge points corresponding to each student's weak steps.

[0021] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A teaching management system for cyber security training, characterized by: The system comprises a practical simulation training multi-step disassembly module, a multi-practical step association prompt library construction module, a student practical behavior data step-by-step supervision module, a multi-step stay time perception grading prompt module, a practical step process aggregation scoring module and a structured data platform. The practical simulation training multi-step disassembly module obtains a comprehensive practical training task in network security practical operation evaluation, associates the comprehensive practical training task with network security core knowledge points, corresponds to the practical training task steps, constructs a practical step knowledge point association graph, and configures different evaluation scores according to the knowledge point weights of different practical steps. The multi-practical step association prompt library construction module counts the core knowledge points corresponding to different practical steps in practical evaluation, classifies the core knowledge points in prompt levels, simultaneously constructs an operation demonstration database, and completes the multi-level prompt data of each practical step according to the expected operation characteristics of the practical steps in the operation demonstration library, to construct a multi-step grading prompt framework for network security practical evaluation. The student practical behavior data step-by-step supervision module captures the operation instructions and operation sequences executed by the student in the practical step, simultaneously monitors the changes of the practical system environment, and analyzes the operation effectiveness of the student at different operation nodes in real time according to the operation demonstration database to distinguish and analyze the deviation value of the student at different practical steps. The multi-step stay time perception grading prompt module analyzes the expected stay time threshold of each practical step in practical evaluation, monitors the timing feedback of the student's stay time in the practical step in real time, combines the operation effectiveness of the student's operation to perform prompt discriminant analysis, and triggers the prompt strategy in stages. The practical step process aggregation scoring module performs automatic evaluation comprehensive scoring according to the operation effectiveness in each practical step and the triggered grading prompt engine, and constructs the ability portrait of different students.

2. The teaching management system for cyber security training of claim 1, wherein The practical simulation training multi-step disassembly module comprises a network security practical step knowledge point corresponding submodule and a multi-practical step teaching score configuration analysis submodule. The network security practical step knowledge point corresponding submodule obtains all core knowledge points in network security training, associates and matches each task step in network security practical evaluation with core knowledge points, extracts all core knowledge points related to the comprehensive practical training task in the target practical evaluation, marks the extracted core knowledge points, bi-directionally maps the marked core knowledge points with each step in practical evaluation, counts the number of core knowledge points corresponding to each practical step, and the multi-practical step teaching score configuration analysis submodule obtains the core knowledge points corresponding to each practical step, classifies each core knowledge point in multiple attribute weights, the multiple attribute classification comprises general knowledge points, intermediate knowledge points and key knowledge points, configures a basic weight value for each knowledge point attribute according to the structured data platform, quantitatively calculates the basic teaching score of each practical step according to the basic weight value of the core knowledge points associated with each practical step, and uploads the basic teaching score of each practical step to the structured data platform.

3. The teaching management system for cyber security training of claim 1, wherein The multi-step operation step association prompt library construction module comprises a real operation teaching knowledge point type decomposition submodule and a multi-step expected operation characteristic definition submodule. The real operation teaching knowledge point type decomposition submodule obtains core knowledge points corresponding to each real operation step, classifies the core knowledge points into theoretical knowledge points, real operation strategy knowledge points and specific operation instruction knowledge points, constructs a three-layer prompt framework, defines the theoretical knowledge points as primary prompts, the real operation strategy knowledge points as intermediate prompts and the specific operation instruction knowledge points as advanced prompts, counts the knowledge point types in different real operation steps, obtains the basic teaching scores of different real operation steps, and marks the real operation step when the basic teaching score of the real operation step is greater than a set threshold value. The multi-step expected operation characteristic definition submodule obtains each real operation step of the network security real operation examination, collects, through a structured data platform, complete operation sequences, command parameter corresponding network environment state change data generated by a plurality of question setters completing each real operation step, constructs an operation demonstration database, defines the complete operation sequences generated by each real operation step in the operation demonstration database as real operation step expected operation characteristics, screens the marked real operation step, judges the missing prompt level, sends to the structured data platform for manual completion if the missing prompt level is a primary prompt level, screens part of the tools and technology paths used in the real operation step expected operation characteristics to complete the intermediate prompts if the missing prompt level is an intermediate prompt level, and completes the specific operation instructions and key parameters in the real operation step expected operation characteristics to the advanced prompts if the missing prompt level is an advanced prompt level, to construct a multi-step hierarchical prompt framework for the network security real operation examination.

4. The teaching management system for cyber security training of claim 1, wherein The student real operation behavior data step-by-step monitoring module comprises a multi-step key operation state capture association submodule and a real operation effective operation monitoring submodule. The multi-step key operation state capture association submodule monitors the operation state of each student in the current step of the network security real operation examination, extracts the operation state characteristics of each student, and the state characteristics comprise time sequence characteristics, behavior characteristics and result characteristics. The time sequence characteristics comprise the operation time of the student in the current step, the behavior characteristics comprise the operation data and operation sequence of the student in the current step, and the result characteristics comprise the state transition data of the network system triggered by the operation data. The real operation effective operation monitoring submodule obtains the operation data of each student at the current step, obtains the real operation step expected operation characteristics of the operation demonstration database corresponding to the current operation step of each student, divides the real operation step expected operation characteristics of the current step into a plurality of operation nodes, compares the operation data of each student at each operation node in the current step with the demonstration data corresponding to the operation node inside the real operation step expected operation characteristics, if the operation data and operation sequence of the operation node are the same as the demonstration data, and if the state transition data of the network system triggered by the operation data of the student is the same as the change data of the corresponding network environment state of the demonstration data, if the same, mark the operation node as a student effective operation node, if the operation data, operation sequence and triggered state transition data of the network system of the operation node are all different from the demonstration data of the operation node, determine that the operation node is a student invalid operation node, mark the operation node as invalid, and summarize the invalid operation nodes marked by the student in the current step, set the number of invalid operation nodes in the current step as , the number of all operation nodes in the current step is , the deviation value of the student in the current step is , , and the deviation value of the student in each step is calculated and summarized.

5. The teaching management system for cyber security training of claim 1, wherein The multi-step stay time-aware hierarchical prompting module comprises a sub-module for configuring step-by-step estimated stay time and a sub-module for hierarchical prompting trigger discriminant analysis. The sub-module for configuring step-by-step estimated stay time obtains the network security practical operation examination of each practical operation step and its corresponding different basic teaching scores, calculates the relative teaching weight of each practical operation step according to the basic teaching score of each practical operation step, sets the basic teaching score of a certain practical operation step as , wherein the total sum of the network security practical operation examination of all step teaching scores is , wherein the weight of the practical operation step is , the weight of the practical operation step is compared with the pre-set multi-level weight interval, the high weight interval threshold, the medium weight interval threshold and the low weight interval threshold are pre-set through the structured data platform, the high weight interval threshold is set as , the medium weight interval threshold is set as , and the low weight interval threshold is set as , are all set by thinking, and , the weight value calculated for the practical operation step is compared with the high weight interval threshold, the medium weight interval threshold and the low weight interval threshold, wherein the high weight interval threshold, the medium weight interval threshold and the low weight interval threshold correspond to the practical operation step weight adjustment factor respectively, which are set as , the demonstration completion time corresponding to the practical operation step in the operation demonstration database is collected as , the estimated stay time of different practical operation steps is calculated as , according to the formula: The expected residence time of each real operation step of the network security real operation examination is counted and uploaded to the structured data platform.

6. The teaching management system for cyber security training of claim 5, wherein The hierarchical prompt trigger discriminant analysis submodule respectively acquires the deviation value of the student at the current operation step and the time of stay, when the time of stay of the student at the current step is greater than the expected time of stay, and the deviation value of the current operation step is greater than the reference set threshold value, it is determined that the primary prompt is triggered, the structured data platform sends the primary prompt uploaded by the step to the student end, after triggering the primary prompt, the time of stay of the step is updated immediately, the time of stay of the step is reset to zero, and a primary time reduction factor is introduced , the primary step time threshold value after triggering the primary signal is set as , = ; When the learner's stay time in the current step is greater than the primary step stay time threshold value, and the deviation value of the current practical step is greater than the set primary threshold value, it is determined that the intermediate prompt is triggered, and the structured data platform sends the uploaded intermediate prompt of the step to the learner end, after triggering the intermediate prompt, the stay time of the step is updated immediately, the stay time of the step is reset to zero, and an intermediate time reduction factor is introduced , The intermediate step stay time threshold value after triggering the intermediate signal is , = ; When the learner's stay time in the current step is greater than the intermediate step stay time threshold value, and the deviation value of the current practical step is greater than the set intermediate threshold value, it is determined that the advanced prompt is triggered, and the structured data platform sends the uploaded advanced prompt of the step to the learner end, after triggering the advanced prompt, the stay time of the step is updated immediately, the stay time of the step is reset to zero, and an advanced time reduction factor is introduced , the advanced step stay time threshold value after triggering the advanced signal is , = ; When the residence time of the student in the current step is greater than the high-level step residence time threshold value, and the deviation value of the current real operation step is greater than a set high-level threshold value, the step is marked as an invalid reply, and the next real operation step is directly skipped for reply. Wherein, the reference setting threshold, the primary threshold, the intermediate threshold and the high threshold are set by human, and the thresholds are reduced one by one, the primary time reduction factor , the intermediate time reduction factor , the high time reduction factor are set by human, .

7. The teaching management system for cyber security training of claim 1, wherein The practical operation step process aggregation scoring module comprises a practical operation step process scoring comprehensive generation submodule and a multi-dimensional student ability image construction submodule, the practical operation step process scoring comprehensive generation submodule acquires each practical operation step of network security practical operation examination and corresponding different basic teaching scores, and sets the basic teaching scores of different practical operation steps as When the student triggers any prompt in a certain practical operation step, the score of the current step is determined as the basic teaching score of the step When the student triggers the primary prompt in a certain practical operation step, the primary prompt influence coefficient is introduced The score of the student in the current step is calculated as When the student triggers the intermediate prompt in a certain practical operation step, the primary prompt influence coefficient is introduced The score of the student in the current step is calculated as When the student triggers the advanced prompt in a certain practical operation step, the primary prompt influence coefficient is introduced The score of the student in the current step is calculated as If the student marks an invalid reply in a certain practical operation step, the score of the student in the current step is 0, the scores of different students in different practical operation steps are collected, and the total scores of different students in the network security practical operation examination are obtained. The multi-dimensional student ability portrait construction submodule aggregates data of total scores of different students in network security operation evaluation, score details of each operation step, the highest prompt level triggered by each operation step, and the operation step marked as invalid reply, constructs a student ability portrait, and feeds back the knowledge points corresponding to the weak steps of each student.

Images