Gamification - Learning IT-Security aspects

Thesis by: Markus Wesemann
Advisor: Gudrun Klinker
Supervision by: Andreas Dippon
Due date: 2017/03/15

Abstract

Information security is important in today's society, knowing simple aspects about this field is crucial for better awareness. The problem today is the lacking knowledge on these security aspects, which often leads to misunderstanding or wrong usage. The goal of this thesis is to evaluate the possibility of combining gamification and information security in a game-based concept, in order to improve the user knowledge in specific aspects. For this the theoretical fields of gamification and information security will be observed, to get a better understanding in combining both areas. Based on this a game concept about information security is defined and a prototype is implemented in order to prove the assumption. A conducted final user study with 32 participants from different age and profession areas proves the assumption of game-based learning. The results showed that an improvement is possible, but in general lower than expected often because people did not understand what the benefit of some game elements were. The assumption of lacking feedback and motivating elements in the game is made from feedback on the user study and could be improved in further research. The work in this thesis should be interesting for people in both computer science or educational fields.

Overview

This work describes the possibility of combining gamification elements in the fields of information security. The goal of this thesis was to prove if it is possible to increase the knowledge in different security aspects with a game-based concept. In order to understand how a game-based learning approach is possible, the theory behind gamification is analyzed. Based on the knowledge about important game elements in gamification, a concept was developed and then evaluated in a user study.

Theory

• Analyze meta studies in order to prove that game-based learning is effective
• Evaluate important game elements for gamification
• Why is information security important?
• Combination of gamification and information security

Game Concept

• Player plays a security expert
• Different companys are publishing contracts for the player
• Each contract has different requirements in security and trade-offs
• Trade-offs are trades for more security, for example a decrease in comfort for better security
• The player can buy items (aspects) and use them to secure the system
• Each item has different security and trade-off attributes
• Rewards are based on how well the contract requirement is fullfilled
• Repeating each action should lead to internalise important aspects

Gamification Elements

• Player is Explorer and Achiever
• Items are getting better with every use (Experience System)
  • Abstraction of real world aspect where a system is configured better if a person is using it more often
  • Intrinsic motivated, because the experience is rewared independent of how well the player fulfiled the contract requirement
• Reward is based on the contract requirement and level of the contract
  • Extrinsic motivated, because more money is rewared if the player uses better items and combinations
• Achievements are rewarded for repeating different actions, like installing one item five times or finishing five contracts

User Study

• Limesurvey was used, online user survey
• Two question groups (Personal questions, technical questions)
• The user plays the game for 15 minutes in the survey
• Participant needs to answer the technical question two times, one time before and one time after the game
• Differences in the answers is then evaluated

Implementation

The game was implemented in Unity3D and published as a WebGL game, in order to implement it in the online survey. The game was separated in five important elements, the context system, shop system, contract system, secure system and menu handler:

Context system

• MainContext and GameContext
  • The MainContext saves all user stats
• The GameContext is the main game loop
  • Handles all game states (game, menu and tutorial states)
  • Shows the tutorial
  • Handles user feedback
  • Saves all important game values (security power, trade-offs, etc..)
  • Communication between the other systems

Shop and Contract system

• The shop and contract system are based on the same structure
  • A handler class, which initializes the system
  • A system class, which implements static methods to interact with the manager class
  • A manager class, which inherits a inner class to define the item (shop or contract item)
  • The manager class also defines methods to manipulate the items or give information

Secure system

• Handles the secure process
• Installing items and tweaking the system
• Calculates the experience and reward
• Notifies game context about every attribute update

Menu handler

• Each system has an own menu handler
• Handles all menu events (like button press, mouse over, etc...)
• Notifies game context and system about event changes

Evaluation

To prove the statement of the thesis a online user study with the game was conducted. For this a survey was designed which ask the user to answer some personal and technical questions with a point system to evaluate the answers to the technical part. The technical questions are asked two times, one time before the game session and again after it, to compare the outcome in order to evaluate the improvement. So the task for the user is to answer some personal questions for group evaluation, then answer technical questions about information security. After the technical part, the user plays the game for 15 minutes. Every participant only has 15 minutes playtime, the survey continues automatically after that. The final part is answering the same technical questions again, with the gained knowledge of the game.

The game itself logs every action the player does, in order to see possible correlations and which elements have a positive effect and which a negative or no effect at all.

Subjects

• 32 Participants
• 19 male and 13 female
• Age range from 20 to 68 (Average 32, SD 15)
• 16 Students, 13 employes and three self employed

Results

Positive Result:

• In every technical question is a improvment measurable
• The game logs shows that repeating task and a longer playtime improves the answers
• Using a item more often increases the understanding of this item

Negative Result:

• Overall improvement not high enough
• Some questions are not clear defined
• The game should describe things more clear (for example: real time scenarios for each aspect)

Overall the user study had a good outcome to prove that it is possible to learn different aspects with a game-based concept.

Future Work

For the short time only a early alpha concept could be developed and tested, but with more time and a more detailed concept the overall result could be much better:

• Integrating the quiz into the game
• More detailed descriptions
• A more interactive secure process (not only installing, but a different task for each aspect)
• Comparing the game-based concept against traditional learning methods
• More feedback throughout the game

Pictures

Game Architecture
Architecture diagram	AM-System class diagram	Menu flow automat	Player use-case
Final Game
Office Scene	Conttract Detail View	Shop Item Detail View	Secure Start Menu
Install Stage	Tweak View	Item Experience	Contract Result
Shop Menu	Contract Menu
User Study
User study subjects	User study results

Resources

Game Engine: Unity3D Engine
User Study Software: Limesurvey
Gamification Book: K. M. Kapp. The Gamification of Learning and Instruction: Game-based Methods and Strategies for Training and Education. John Wiley & Sons, 2012