Peer Instruction for Digital Forensics

Peer Instruction for Digital Forensics

Peer Instruction for Digital Forensics William Johnson, Irfan Ahmed,∗ Vassil Roussev Cynthia B. Lee Department of Computer Science Computer Science Department University of New Orleans Stanford University [email protected], {irfan,vassil}@cs.uno.edu [email protected] Abstract are effective for students who have a good understanding of individual forensic concepts relating to the lab task, Digital forensics can be a difficult discipline to teach ef- and are able to integrate them into a broader view of a fectively because of its interdisciplinary nature, closely forensic investigative scenario. integrating law and computer science. Prior research in Unfortunately, the traditional lecture-centric approach Physics and Computer Science has shown that the tradi- is often inadequate in providing the conceptual prepara- tional lecture approach is inadequate for the task of pro- tion for hands-on labs and exercises. Commonly, lectures voking students’ thought-processes and systematically fail to motivate students to study before class, and there- engaging them in problem-solving during class. Peer in- fore the in-class learning experience is less effective than struction is an established pedagogy for addressing some it could be. The traditional lecture also lacks a reliable of the challenges of traditional lectures. For this paper, in-class mechanism to help an instructor ensure that stu- we developed 108 peer instruction questions for a dig- dents understand the concepts being taught. Although ital forensics curriculum, and evaluated a selection of the instructor may ask ad-hoc questions to stimulate dis- the questions by holding a condensed computer forensics cussion, this usually engages a few students and does not workshop for university students. The evaluation results provide feedback about every student in class. show that peer instruction helps students understand the targeted digital forensics concepts, and that 91% of stu- Peer instruction has emerged as a promising solution dents would recommend that other instructors use peer to enrich the in-class experience such that it yields bet- instruction. ter outcomes. It was first introduced by Eric Mazur in physics classrooms at Harvard University [2]. With peer 1 Introduction instruction, a lecture consists of a series of multiple- choice questions (a.k.a. ConcepTests) that are designed Digital forensics is defined as the application of scien- to provoke deep conceptual thinking in students and en- tific tools and methods to identify, collect, and analyze gage them in a meaningful discussion. Students are re- digital artifacts in support of legal proceedings [11]. It quired to study some reading material before coming to is a challenging field to teach effectively because of its class, which helps them to find correct answers to the positioning at the intersection of law and computer sci- peer instruction questions. Peer instruction has shown ence. For instance, the data acquired from a suspect com- to be effective in physics, computer science, and biology puter (a.k.a digital evidence) without a search warrant classrooms [7]. In particular in computer science, it has may prevent the evidence from being admitted in court. halved failure rates in four courses [7] and increased stu- Students need to achieve a clear understanding of im- dent retention in the computer science major [10]. portant principles of performing a forensic investigation Previously, peer instruction has not been explored as within the constraints put forth by state and federal law. a means for delivering a digital forensics curriculum. Often, forensic instructors combine traditional lectures We have developed 108 peer instruction questions for an with hands-on lab exercises to improve the student learn- introductory course on computer forensics. This paper ing outcomes. Typical exercises include solving cyber- discusses some of these questions as examples and ana- crime cases such as theft of credit card data and malware lyzes classifies with respect to two basic criteria. First, attacks. In our experience, forensic hands-on exercises what are the elements used in the questions to trigger ∗Corresponding author conceptual thinking processes of students such as “com- This work was supported by the NSF grant # 1500101 pare and contrast,” “deliberate ambiguity” and “trolling for misconception”? We use Beatty et al.’s concept trig- • The instructor then poses the same question to the gers [1] for the analysis. Second, how are the questions students again; the students reply to the question. presented, such as in a scenario, example, or diagram. • Depending on the answers, the instructor would The paper also presents the results of a digital foren- have the option to discuss the concept in further de- sic workshop utilizing peer instruction methodology and tail with the students to ensure a better understand- questions. The evaluation results show that most of the ing; or, if the students clearly understand the con- students find the use of clickers beneficial and the group cept at this point, the instructor may choose to con- discussion for a peer question helps the students under- tinue to the next question. stand a target concept. 91% students would recommend other instructors use peer instruction. The results also show a clear evidence of improvement in student learn- 2.2 Related Work ing that is measured through quizzes taken before and Peer instruction has not been widely adopted in the cy- after a topic is covered and peer instruction questions bersecurity classroom. Recently, Johnson et al. [4] de- replied to by the students before and after peer discus- veloped peer instruction questions for two courses: in- sions. troduction to computer security, and network penetration The rest of the discussion is organized as follows. Sec- testing. They developed a set of 172 peer instruction tion 2 discusses the peer instruction methodology and re- questions; however, these were not evaluated in a class- lated work. Section 3 presents the elements of a peer room setting. instruction question (i.e. concept triggers and question More broadly, there have been a number of prior ef- presentation) along with the steps to create a peer ques- forts to use peer instruction in the computer science tion. Section 4 discusses four examples of peer instruc- classroom. Porter et al. [8] perform a multi-institutional tion questions and identifies their concept triggers and study of the usage of peer instruction in seven instruc- question presentation types, followed by section 5 that tors’ introductory programming courses. Considering presents an analysis of 108 peer instruction questions re- instructors’ prior experience (or lack thereof) utilizing cently developed by the authors. Sections 6, 7, and 8 peer instruction, they primarily focus on student percep- present the peer instruction implementation in a digital tion of peer instruction using measurements such as per- forensic workshop, a list of peer instruction questions ceived question difficulty, question time allowed, discus- used in the workshop, and evaluation results, followed sion time allowed, and content difficulty. They obtain by conclusion in section 9. participants’ responses using surveys and note that at least 71% of students would recommend other instruc- 2 Background/Related Work tors to use peer instruction. 2.1 Peer Instruction Methodology Similarly, Porter et al. conduct a measurement of peer instruction across multiple small liberal arts colleges to Peer instruction pedagogy could be categorized under the measure the effectiveness of peer instruction in smaller general umbrella of a“flipped classroom” approach, but classes, using data from five instructors at three institu- the term “peer instruction” describes a specific protocol, tions [9]. They notice normalized gains in the same range and does not mean generally any use of peer discussion that of larger universities with students generally approv- or clickers. The protocol has three important elements. ing of the method and their performances. First, it divides a class lecture into a series of multiple- Esper [3] utilizes peer instruction in a software engi- choice conceptual questions. The questions focus on the neering course that has 189 students. She makes a modi- primary concepts an instructor wishes to teach. Second, fication in the standard peer instruction process in which it divides the students in class into a number of small a clicker question is initially shown without answers and groups for discussions. Third, it requires students to read both the students and instructor propose potential answer some material before coming to class. The material is choices with discussions of those answers. It is worth related to the topic covered in the class and enables the noting that the instructor does not mention whether an students to find answers of the questions. answer suggestion is correct or incorrect. The evaluation For each question, the following steps are involved: results show that 72% of the students would recommend the course instructor, with 28% not recommending due • A peer instruction question is posed to students. to the reasons such as correct answers are not given and The students use clickers to reply. clicker questions are unclear. • The instructor is able to view the results. If the Liao et al. [6] create models of in-class clicker ques- answers are mostly incorrect, the instructor then tions to predict low-performing students early in the encourages the students to discuss their answer term. They use a linear regression model to predict fi- choices with their group members. nal exam scores with approximately 70% accuracy in a twelve-week introductory computer science course. A peer instruction question on this concept can be cre- Lee et al. [5] examine the effectiveness of peer instruc- ated as follows: In order to access a file from a FAT tion in two upper-level computer science courses: The- file system, what information is absolutely necessary? a) ory of Computation and Computer Architecture and find Name and ending address of file content; b) Name, file the average normalized learning gains of 39%.

View Full Text

Details

  • File Type
    pdf
  • Upload Time
    -
  • Content Languages
    English
  • Upload User
    Anonymous/Not logged-in
  • File Pages
    10 Page
  • File Size
    -

Download

Channel Download Status
Express Download Enable

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

  • Not to be reproduced or distributed without explicit permission.
  • Not used for commercial purposes outside of approved use cases.
  • Not used to infringe on the rights of the original creators.
  • If you believe any content infringes your copyright, please contact us immediately.

Support

For help with questions, suggestions, or problems, please contact us