An intrusion-detection environment for information-security instruction

The authors have developed a versatile tutor for intrusion detection on computer systems. Their tutor is intended for basic training of system administrators and security managers, analogously to an aircraft simulator: It exposes them to important but infrequent crisis situations that are good justifications for computer-assisted training simulators. Their IDTUTOR system has two parts: a simulator of a set of computer-system users that generates audit records for their activities, and an intelligent tutor that assists the student to remediate security problems apparent in the audit records. They modeled Unix systems since there is good documentation about intrusions on them and appropriate responses. The prototype of their system runs on Sun Sparcstations and is implemented in Quintus Prolog. They have used the tutor several times in their introductory computer security course; even with its preliminary version, posttests showed that students learned more about intrusion detection from it than from an equivalent amount of classroom lecture time.