# Minimizing Cognitive Overload in Cybersecurity
## Learning Materials: An Experimental Study Using
### Eye-Tracking

Leon Bernard, Sagar Raina, Blair Taylor, Siddharth Kaza

► To cite this version:

Leon Bernard, Sagar Raina, Blair Taylor, Siddharth Kaza. Minimizing Cognitive Overload in Cybersecurity Learning Materials: An Experimental Study Using Eye-Tracking. 14th IFIP World Conference on Information Security Education (WISE), Jun 2021, Virtual, United States. pp.47-63, 10.1007/978-3-030-80865-5_4. hal-03739156

HAL Id: hal-03739156

https://inria.hal.science/hal-03739156v1

Submitted on 27 Jul 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
Minimizing Cognitive Overload in Cybersecurity
Learning Materials: An Experimental Study using Eye-
tracking

Leon Bernard¹[0000-0001-5270-215X], Sagar Raina²[0000-0001-8539-1570], Blair Taylor¹[0000-0002-4708-5852] and Siddharth Kaza¹[0000-0002-9561-6128]

¹ Department of Computer and Information Sciences, Towson University, Baltimore, USA

² Division of Maths & Information Technology, Mount Saint Mary College, New York, USA

lbernal@students.towson.edu

sagar.raina@msmc.edu

{btaylor,skaza}@towson.edu

**Abstract.** Cybersecurity education is critical in addressing the global cyber crisis. However, cybersecurity is inherently complex and teaching cyber can lead to cognitive overload among students. Cognitive load includes: 1) intrinsic load (IL- due to inherent difficulty of the topic), 2) extraneous (EL- due to presentation of material), and 3) germane (GL- due to extra effort put in for learning). The challenge is to minimize IL and EL and maximize GL. We propose a model to develop cybersecurity learning materials that incorporate both the Bloom's taxonomy cognitive framework and the design principles of content segmentation and interactivity. We conducted a randomized control/treatment group study to test the proposed model by measuring cognitive load using two eye-tracking metrics (fixation duration and pupil size) between two cybersecurity learning modalities – 1) segmented and interactive modules, and 2) traditional-without segmentation and interactivity (control). Nineteen computer science majors in a large comprehensive university participated in the study and completed a learning module focused on integer overflow in a popular programming language. Results indicate that students in the treatment group had significantly less IL (p<0.05), EL (p<0.05), and GL (p < 0.05) as compared to the control group. The results are promising, and we plan to further the work by focusing on increasing the GL. This has interesting potential in designing learning materials in cybersecurity and other computing areas.

**Keywords:** Bloom's taxonomy, cognitive overload, cybersecurity, eye tracking, pupillometry, secure coding, curriculum.

# 1 Introduction

Demand for effective cybersecurity education has led to the increased development of cybersecurity learning materials [1, 2]. Learning complex topics, including cybersecurity, involve the use of higher cognitive resources within learners’ limited working memory [3]. Educational materials that consume too much of limited working memory
can lead to cognitive overload [4]. Therefore, instructional designers need to design and develop learning materials that minimize cognitive overload to enhance learning.

According to the cognitive load theory (CLT), learning materials can impose three types of cognitive loads – intrinsic, extrinsic and germane. Intrinsic load is induced because of the inherent difficulty of the topic due to several interconnected concepts that a learner needs to simultaneously understand [5]; extraneous load is induced because of the way information or tasks are presented to a learner [5]; germane load is desirable and is induced when extra effort is put in a task carried out to construct new learning [6]. Therefore, in order to prevent learners from reaching a state of cognitive overload, instructional designers need to carefully design learning materials to manage the three types of cognitive loads by minimizing intrinsic and extraneous loads, and maximizing germane load [5].

To address this, we propose a theoretical model for developing effective cybersecurity learning materials to minimize cognitive overload in a learner. We test the effectiveness of the model by conducting an experimental study with 19 computer science majors completing cybersecurity learning modules and measuring their cognitive load using an eye-tracker.

## 2 Theoretical Model

The proposed theoretical model incorporates Bloom's taxonomy (remember, understand, apply, analyze, evaluate and create) and the design principles of segmentation and interactivity to develop cybersecurity learning materials. We map these cognitive levels to the cognitive loads as follows -1) remember and understand are mapped to intrinsic load, because inherent difficulty of the topic can be addressed at the first two levels of Bloom's taxonomy; 2) apply, analyze, evaluate, create are mapped to germane load, because learning for long term can be addressed at the last four levels of Bloom's taxonomy [7].

Segmentation is defined as chunking content and displaying each chunk one at a time, whereas interactivity is the responsiveness to the users' (learner) action on the content. We choose segmentation and the interactivity design principles, because these are known to reduce cognitive load due to the content presentation issues. We measure learner's cognitive load (intrinsic, extraneous and germane) induced while going through a learning material by measuring pupil size and fixation duration using eye-tracker. Applying principles of Bloom's taxonomy to create learning material minimizes intrinsic load and maximizes germane load, and applying the design principles of segmentation and interactivity minimizes extraneous.

Assuming all learning materials incorporate some component of Bloom's taxonomy, the proposed theoretical model (see Figure 1) compares traditional (linear) non-interactive with segmented and interactive learning materials and shows their impact on learner's intrinsic, germane and extraneous cognitive load in the learner's working memory. Using Bloom's taxonomy based segmented and interactive learning material will have a lower intrinsic (--) and extraneous load (--); and, higher germane load (++) compared to traditional (linear) non-interactive learning material.
<figure><img src="image_2.png" /><figcaption>Fig. 1. Proposed Theoretical Model for Cybersecurity Learning Materials</figcaption></figure>

Based on the proposed theoretical model, we answer the following research questions in this paper:

RQ1: Does segmented and interactive cybersecurity learning material induce significantly less cognitive load (intrinsic) as compared to traditional (linear) non-interactive learning material at the remember and understand cognitive levels?

RQ2: Does segmented and interactive cybersecurity learning material induce significantly high cognitive load (germane) as compared to traditional (linear) non-interactive learning material at the apply, analyze, evaluate and create cognitive levels?

RQ3: Does segmented and interactive cybersecurity learning material induce significantly less cognitive load (extraneous) as compared to traditional (linear) non-interactive learning material at all six cognitive levels?

# 3 Literature Review

This section discusses literature related to cognitive load theory, Bloom's taxonomy, design principles of segmentation and interactivity, eye-tracking and cognitive load.

## 3.1 Cognitive Load Theory

Cybersecurity involves problem solving that requires knowledge and skills in many areas, including secure programming, networking security, operating system security, cryptography, and vulnerability analysis [8]. Such computing-based problem solving skills induce excessive cognitive load in learners during the learning process [9, 10]. Extensive research has been conducted to assess cognitive load in computer science
education, specifically with regards to programming. A study by Asai et al. [11] pro-
posed a model that could detect intrinsic and germane load to help teachers adjust their
learning materials. Morrison et al. [12] adapted a previously developed instrument to
measure intrinsic, extraneous and germane load in an introductory programing course.

Excessive cognitive load can cause frustration that may discourage further learning activities [13]. Therefore, in recent years, to address cognitive load issues, there has been growing interest in designing learning materials that follow principles of cognitive load theory to manage intrinsic, extrinsic and germane loads in the working memory [14].

Intrinsic load is imposed when the topic itself is difficult to learn due to several interconnected elements that a learner needs to simultaneously understand [5]. If a learner has a high level of previous knowledge, the intrinsic load imposed will be less compared to a learner who has no previous knowledge [15]. For example, in order to learn the concept of integer overflow, a learner needs to learn other interrelated topics including variables, data types and programming. A learner with a prior knowledge of programming will face less intrinsic load as compared to a learner with no programming knowledge.

Extraneous load (EL) is the load placed on working memory due to presentation of the learning material that does not contribute directly toward the learning [5]. For example, if a learning material presents a text or a diagram or a video and each of these does not explain the integer overflow clearly to a learner. The learning material will impose extraneous load on the learner. The IL and EL are the factors that can be controlled through instructional design [16].

Germane load occurs when a learner requires an effort to learn the complex content for long-term storage [6]. For example, use of working examples to learn about integer overflow will impose germane load. Thus, more germane load contributes towards learning. In order to manage cognitive load during learning, intrinsic and extraneous loads must be minimized. Minimizing intrinsic load will create a space in the working memory to accommodate germane load [5].

## 3.2 Bloom's Taxonomy Cognitive Levels

The use of Bloom's taxonomy is frequently seen in computing related disciplines in-
cluding computer science and cybersecurity [17, 18]. Bloom's learning taxonomy con-
sists of six levels which increase in complexity as the learner moves up through these
levels [7]. The levels include remember, understand, apply, analyze, evaluate and cre-
ate. 'Remember' represents the lowest level of learning in the cognitive level domain.
At this level, the learner is required to rote recall the terms introduced through the learn-
ing material. There is no presumption that the learner has understood the learning ma-
terial. 'Understand' allows the learner to comprehend the material towards the goal of
using this understanding in the future for problem solving and decision making. 'Apply'
allows the learner to apply learned materials in new tasks with a minimum direction.
'Analyze' enables the learner to dissect complex problems into smaller components in
order to better understand the structure. 'Evaluate' enables the learner to assess differ-
ent problem-based scenarios and make a decision using a certain criteria and knowledge
acquired from prior levels. ‘Create’ enables the learner to come up with new ideas based
on his/her knowledge acquired from the prior levels. Bannert, M [19] asserts that the
use of learning taxonomies (Bloom’s) can be used to manipulate intrinsic cognitive load
for novice learners.

3.3 Design principles of segmentation & interactivity

Segmentation implies breaking large content into smaller chunks and presents one chunk at a time on a single screen. Segmentation makes processing, retention and recall of information easier. The design principles of segmentation are known to minimize cognitive load [20]. Interactivity is the “responsiveness to the learner’s actions during learning” [21]. Interactivity can be implemented using dialoging and controlling. The process of a learner answering a question and receiving feedback on his/her input is referred to as dialoguing. Dialoguing improves learning as learners can relate feedback to the current content. Controlling implies that the learner can determine the pace of the presentation. Controlling facilitates learning by allowing students to process information at their own pace. Interactivity has been shown to increase engagement and reduce cognitive load [20]. Extraneous load occurs as a result of how learning material is presented to the learner; therefore, use of segmentation and interactivity may reduce extraneous cognitive load.

3.4 Eye-tracking and Cognitive Load

To measure the effectiveness of learning materials in the context of cognitive load, several studies have used survey-based instruments [12, 22]. While survey-based instruments are easier to administer in a classroom setup, their results may not indicate accurate measure of cognitive load [23]. Some studies have used methods that measure learners’ physiological behavior to measure cognitive load including electroencephalogram (EEG) and eye-tracking [24, 25]. Borys et al. [26] compared data captured using EEGs and eye-tracking to measure cognitive load. The study found that eye-tracking captured the best cognitive load measures as compared to EEG. While several eye-tracking metrics can be used to measure cognitive load including fixation duration, sacades, pupil size and blink rate; fixation duration and pupil size have been found to be the most used eye-tracking metrics to measure cognitive load [27]. Bafna et al uses performance related typing scores and eye tracking metrics such as blink rate and pupil size to measure cognitive load during eye-typing tasks [28].

Fixation refers to a focused state when the eye remains still over a period of time. Fixation duration is the average time for fixations. The levels of cognitive processing affect fixation duration indicating an increased strain on the working memory. Therefore, the higher the fixation duration, the higher the cognitive load [27].

Pupil size refers to the diameter of the pupil in the human eye. Psychologists have observed that pupil size varies with cognitive processing. If the difficulty and the effort to understand the task increases, pupil size increases. Therefore, the higher the pupil size, the higher the cognitive load [27].
# 4 Research Method

In this section, we present learning interventions used in the study followed by research design.

## 4.1 Learning Materials

To test the effectiveness of our proposed theoretical model, we picked two versions of Cyber4All@Towson (SI) cybersecurity learning modules in this study (refers to Figure 2).

<figure><img src="image_3.png" /><figcaption>Fig. 2. Linear (A) vs Segmented and Interactive (B)</figcaption></figure>

Both versions are designed using Bloom's taxonomy. Each version has five sections, including background, code responsibly, laboratory assignment, security checklists and discussion questions. Some of the above sections also have subsections that are outlined in Figure 3. The first version, traditional (linear), is a non-interactive module, implying that the entire learning module (all five sections) is displayed on a single scrollable web page; the second version, is segmented and interactive, where only one section displayed on a web page at a time. In both versions, learners start with the background section, followed by code responsibly, the laboratory assignment section, the security checklist and finally the discussion questions. In segmented and interactive modules - students read content related to the topic in the background and code responsibly sections and answer feedback-based interactive checkpoint questions; in the laboratory assignment section, students complete interactive code checklists and answer interactive text-response questions; and in the discussion section, students answer discussion questions. Students cannot move to the next section until they have answered the checkpoint
questions correctly. In the traditional (linear) module, no checkpoint and feedback-based questions are provided. Figure 3 shows the mapping of Bloom's taxonomy cognitive levels to cognitive load types between traditional (linear) and segmented and interactive SI cybersecurity learning modules.

<table><caption>**Fig. 3.** Mapping of Bloom's taxonomy cognitive levels to cognitive load types between traditional (linear) and segmented & interactive learning modules</caption><thead><tr><th rowspan="3">Bloom's Taxonomy</th><th rowspan="3">SI Module Sections</th><th rowspan="3">SI Module Subsections</th><th rowspan="3">Traditional (Linear) Non-Interactive SI Module</th><th rowspan="3">Segmented, Interactive SI Module</th><th colspan="4">Traditional (Linear) Non-Interactive Module</th><th colspan="3">Segmented & Interactive Module</th></tr><tr><th colspan="3">Cognitive Theory</th><th colspan="3">Load Theory</th></tr><tr><th>IL</th><th>EL</th><th>GL</th><th>IL*</th><th>EL*</th><th>GL*</th></tr></thead><tbody><tr><td rowspan="10">Remember</td><td rowspan="5">Background</td><td>Summary</td><td>✓</td><td>✓</td><td rowspan="10">-</td><td rowspan="10">-</td><td rowspan="5">NA</td><td rowspan="5">-</td><td rowspan="5">-</td><td rowspan="5">NA</td></tr><tr><td>Description</td><td>✓</td><td>✓</td></tr><tr><td>Risk</td><td>✓</td><td>✓</td></tr><tr><td>Real-world Examples</td><td>✓</td><td>✓</td></tr><tr><td>Interactive Check Point Questions</td><td>✓</td><td>✓</td></tr><tr><td rowspan="2">Code Responsibly</td><td>How can it happen?</td><td>✓</td><td>✓</td></tr><tr><td>Interactive Checkpoint Questions</td><td>✓</td><td>✓</td></tr><tr><td rowspan="2">Understand</td><td rowspan="2">Lab Assignment</td><td>Type and run the Code</td><td>✓</td><td>✓</td><td rowspan="2">NA</td><td rowspan="2">+</td><td rowspan="2">NA</td><td rowspan="2">+</td><td rowspan="2">++</td></tr><tr><td>Answer the Questions</td><td>Text based Non-Interactive (paper based)</td><td>MCQs with Interactivity & feedback</td></tr><tr><td>Apply</td><td>Security Checklist</td><td>Identify vulnerability in a code</td><td>Paper based</td><td>Interactivity with feedback</td><td rowspan="4">NA</td><td rowspan="4">+</td><td rowspan="4">NA</td><td rowspan="4">+</td><td rowspan="4">++</td></tr><tr><td>Analyze</td><td>Discussion Question</td><td></td><td>Paper based</td><td>Text-based with interactivity</td></tr><tr><td>Evaluate</td><td>Discussion Question</td><td></td><td>Paper based</td><td>Text-based with interactivity</td></tr><tr><td>Create</td><td></td><td></td><td></td><td></td></tr></tbody><tfoot><tr><td colspan="12" style="text-align: left;">*significant compared to traditional (linear) SI module</td></tr></tfoot></table>

## 4.2 Research Design

An experimental study was conducted in the human computer interaction (HCI) laboratory at a large comprehensive university, using a control-group treatment-group design. A total of 19 (6 females, 13 males) computer science undergraduate students participated in the study. To avoid selection bias, participants were randomly assigned to two groups: control (n=10) and treatment (n=9). Randomization of the samples were done using drawing of paper chits from a box container. The container box included an equal number of chits stating which version of the security injection modules students should use. The paper chit also includes the URL for the module the students should complete. The control group completed an integer error module using traditional (linear) format and the treatment group completed the same module presented in a segmented and interactive format. Each participant was allocated different time slots (one hour each) due to the availability of a single eye-tracking device. For each participant,
the experiment involved three steps -1) eye calibration; 2) a demographics survey and
3) completing the module.

Apparatus. The eye movements of each participant were recorded using a Tobii T60 eye tracker with Tobii studio 3.0 software package. The eye-tracker was installed on a Windows 7 operating system with 64 GB memory, 3 GHz processor and 1 TB hard drive. The device was placed on the bottom frame of a 17 inch LCD monitor with a resolution of 1280 * 1020 pixels and 60 Hz frequency. The eye fixations were detected using Tobii's I-VT filter fixation detection algorithm. A second monitor, connected to the eye-tracking computer and kept at a distance in the same room, was used to monitor participants' eye-track status.

<figure><img src="image_4.png" /><figcaption>**Fig. 4.** Experiment Setup</figcaption></figure>

**Procedure.** Each participant showed up in their allocated one-hour time slot in the HCI laboratory. Participants were given brief introductions about the experiment, shown the IRB protocols, followed by eye calibration.

**Eye Calibration.** The eye calibration includes a three-step process - 1) eye detection, 2) calibration, and 3) result acceptance (Refer Fig. 5). In eye-detection, participants were asked to sit on a chair in a comfortable position in front of the eye-tracker and look at the monitor. The participants' positions were adjusted until eyes were detected at the center of the eye-track status window to be able to capture eye-movements accurately with high precision. The allowable distance of the participants' position from the monitor was 50 cm - 80 cm. In calibration, participants were asked to look at the center point of a moving ball on a 9-point calibration view. In result acceptance, the calibration results are presented with an option to accept the calibration or re-calibrate. The calibration was accepted only when green dots were within each 9-point circle, otherwise re-calibration was performed. After calibration, participants completed the demographics survey, the integer error module, and the usability survey in sequence.
<figure><img src="image_5.png" /><figcaption>Fig. 5. Eye Calibration</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Fig. 6. Participants Eye Gaze</figcaption></figure>

**Data Processing.** In order to compare students' fixation duration and pupil size for each section of the content, we process the raw data from Tobii T60 eye-tracker that involved the following steps:
<figure><img src="image_7.png" /><figcaption>Fig. 7. Data Processing</figcaption></figure>

*Data Export.* The eye movement data from the eye-tracker was exported for each participant in tab separated values (tsv) format using Tobii Studio 3.0.

*Data Import.* Each participants’ gaze data was extracted from the tsv file and stored in a SQL database using the SSIS package. The SSIS package includes three main tasks; 1) read tsv files from the input folder; 2) insert data in SQL data table and 3) move files to the processed folder. Participants’ start and end recording times for each section of the content were manually taken from the recorded videos. These times were also stored in SQL data tables.

*Computing Mean Pupil Size.* Tobii T60 eye tracker output pupil size information for each eye together with each gaze point through the Tobii Pro Studio. The pupil size data is provided for the left and the right eye individually and is an estimate of the pupil size in millimeters. We only include pupil size where both left and right validity code is 0 as this means that the eye tracker is certain that it has recorded all relevant data for both left and right eye. We compute mean pupil size per section for each participant for both treatment and control group (Refer Fig. 8).

```sql
select GMS.ParticipantName, ContentType, 'Background' as Section
,AVG(PupilLeft) as DiameterPupilLeftEye, AVG(PupilRight) as DiameterPupilRightEye
,AVG((PupilLeft + PupilRight)/2) as DiameterPupil
from [dbo].[ParticipantGazeData] t
inner join [dbo].[ParticipantGazeSectionMS] GMS on t.[ParticipantName] = GMS.[ParticipantName]
Inner join [dbo].[ParticipantSurvey] PS on PS.[Participants] = GMS.[ParticipantName]
WHERE RecordingTimestamp between [BG_Start] and [BG_STOP]
and GazeType = 'Fixation'
AND PupilLeft is not null and PupilRight is not null and ValidityLeft = 0 and ValidityRight = 0
GROUP BY GMS.ParticipantName, ContentType
```

<caption>Fig. 8. Average pupil size code snippet</caption>

*Computing Mean Fixation Duration.* Fixation duration is the elapsed time between the first gaze point and the last gaze point in the sequence of gaze points that makes up the fixation. Fixations were classified using Tobii's I-VT fixation filter algorithm. We compute mean fixation duration per section for each participant's for both treatment and control groups (Refer Fig. 9).
```sql
select GMS.ParticipantName, ContentType, 'Background' as Section,
AVG([GazeEventDuration] as FixationDuration
from [dbo].[ParticipantGazeData] t
inner join [dbo].[ParticipantGazeSectionMS] GMS on t.[ParticipantName] = GMS.[ParticipantName]
Inner join [dbo].[ParticipantSurvey] PS on PS.[Participants] = GMS.[ParticipantName]
WHERE RecordingTimestamp between [BG_Start] and [BG_STOP]
and GazeType = 'Fixation'
AND [GazeEventDuration] > 0
GROUP BY GMS.ParticipantName, ContentType
```

<caption>**Fig. 9.** Average fixation duration code snippet</caption>

## 4.3 Research Design

RQ1, RQ2 and RQ3 were tested using independent sample t- tests to compare mean pupil size and mean fixation duration between the control (linear module) and the treatment (segmented and interactive module) groups. We picked independent sample t-tests because: 1) data for the groups was found to be normally distributed using kolmogorov-smirnov and shapiro-wilk test (p > 0.05), and 2) the two groups were independent samples.

**Pupil size as a function of time.** An example of participant pupil size as a function of time for Linear and Segmented content types for each of the sections is displayed in Figure 10 below. Participants spend more time in the laboratory assignment section for both content types.

<figure><img src="image_8.png" /><figcaption>**Fig. 10.** A participant's average pupil size by content sections</figcaption></figure>

**Pupil size changes as a function of time.** An example of participant changes in pupil size as a function of time for linear and segmented content is displayed in Figure 11 below. Linear content type displays larger changes in pupil size than Segmented. Changes in pupil size are associated with changes in cognitive state [29].
<figure><img src="image_9.png" /><figcaption>Fig. 11. A participant's average change in pupil size by content sections</figcaption></figure>

**Average pupil size as a function of average fixation duration.** Participants average pupil size as a function of average fixation duration for linear and segmented content is displayed in Figure 12 below. Linear content type has longer fixation durations and higher pupil size when compared to Segmented content type.

<figure><img src="image_10.png" /><figcaption>Fig. 12. Average pupil size as a function of average fixation duration by content type</figcaption></figure>

**Comparison for mean pupil size and mean fixation duration in the control and treatment group for Intrinsic Load.** The mean pupil size for the treatment group
(2.61) was lower than the mean pupil size for the control group (2.88) at the remember, apply cognitive levels of Bloom's taxonomy and this difference was found to be statistically significant at the 95% level (p <= .05, p = 0.05). The mean fixation duration for the treatment group (213) was lower than the mean fixation duration for the control group (288) at the remember, apply cognitive levels of Bloom's taxonomy and this difference was found to be statistically significant at the 95% level (p < .05, p = 0.028). This implies segmented and interactive learning modules induce less average intrinsic load (IL) on students than traditional (linear) non-interactive learning modules. This answers RQ1 (refer to Figures 13 and 14.).

<figure><img src="image_11.png" /><figcaption>Fig. 13. IL - Average pupil size in control and treatment groups for intrinsic load</figcaption></figure>

<figure><img src="image_12.png" /><figcaption>Fig. 14. IL - Average fixation duration in control and treatment groups for intrinsic load</figcaption></figure>
**Comparison for mean pupil size and mean fixation duration in the control and treatment group for Germane Load.** The mean pupil size for the treatment group (2.58) was lower than the mean pupil size for the control group (2.98) at the apply, analyze, evaluate cognitive levels of Bloom's taxonomy, and this difference was found to be statistically significant at the 95% level (p < .05, p = 0.03). The mean fixation duration for the treatment group (194) was lower than the mean fixation duration for the control group (339) at the apply, analyze, evaluate cognitive levels of Bloom's taxonomy, and this difference was found to be statistically significant at the 95% level (p < .05, p = 0.001). This implies that segmented and interactive learning modules induce less average germane load (GL) on students than traditional (linear) non-interactive learning modules. This is because the treatment group completed interactive modules and received feedback for each task, requiring less cognitive effort as compared to the traditional (linear) non-interactive learning module, where students did not receive any hint/feedback to answer questions, which requires more cognitive effort. Van Merriënboer et al [30] concluded that only limited guidance and feedback should be provided to increase germane load. This answers RQ2 (refer Figures 15 and 16.).

<figure><img src="image_13.png" /><figcaption>**Fig. 15.** GL - Average pupil size in control and treatment groups</figcaption></figure>
<figure><img src="image_14.png" /><figcaption>Fig. 16. GL - Average fixation duration in control and treatment groups</figcaption></figure>

**Comparison for mean pupil size and mean fixation duration in control and treatment group for Extraneous Load.** The mean pupil size for the treatment group (2.62) was lower than the mean pupil size for the control group (2.91) at all cognitive levels of Bloom's taxonomy, and this difference was found to be statistically significant at the 95% level (p < .05, p = 0.03). The mean fixation duration for the treatment group (214.19) was lower than the mean fixation duration for the control group (299.34) at all cognitive levels of Bloom's taxonomy, and this difference was found to be statistically significant at the 95% level (p < .05, p = 0.006). This implies that the segmented and interactive learning modules induce less average extraneous load (EL) on students than traditional (linear) non-interactive learning modules. This answers RQ3 (refer Figures 17 and 18.).

<figure><img src="image_15.png" /></figure>
<figure><img src="image_16.png" /><figcaption>**Fig. 18.** EL - Average fixation duration in control and treatment groups</figcaption></figure>

# 5 Conclusion and Future Work

We proposed a theoretical model for developing effective cybersecurity learning materials to minimize intrinsic and extraneous cognitive load and maximize germane load among learners. The model incorporated Bloom's taxonomy and the design principles of segmentation and interactivity. We conducted a study to test the effectiveness of the model. The results indicate that the intrinsic and extraneous loads are significantly minimized using segmented and interactive modules. However, we also found germane load to be significantly less in the segmented and interactive modules, compared to the traditional (linear) modules. Van Merrienboer et al [30] suggest that, because the interactive modules provide feedback, students are able to progress through content more quickly with less effort on learning. In the future, we plan to further expand the study to investigate the three types of cognitive load on the novice and expert learners. However, this model and methodology provides uses eye-tracking in a novel way to influence design of learning materials and cybersecurity and other computing disciplines.

# References

1. Dark, M., Kaza, S., LaFountain, S., Taylor B. (2018), "The Cyber Cube: A Multifaceted Approach for a Living Cybersecurity Curriculum Library," The 22nd Colloquium for Information Systems Security Education (CISSE), New Orleans, LA

2. Kaza, S. (2018), "A Cyber Security Library – The need, the distinctions, and some open questions," New Approaches to Cyber Security Education (NACE) Workshop, New Orleans, LA.
3. Manson, D. and Pike, R. 2014. The case for depth in cybersecurity education. ACM Inroads. 5, 1 (Mar. 2014), 47–52. DOI:https://doi.org/10.1145/2568195.2568212

4. Kirsh, D. 2000. A Few Thoughts on Cognitive Overload.

5. Paas, F. and van Merriënboer, J.J.G. 2020. Cognitive-Load Theory: Methods to Manage Working Memory Load in the Learning of Complex Tasks. Current Directions in Psychological Science. 29, 4 (Aug. 2020), 394–398. DOI:https://doi.org/10.1177/0963721420922183.

6. Debue, N. and van de Leemput, C. 2014. What does germane load mean? An empirical contribution to the cognitive load theory. Frontiers in Psychology. 5, SEP (2014). DOI:https://doi.org/10.3389/fpsyg.2014.01099.

7. Krathwohl, D.R. 2002. A Revision of Bloom's Taxonomy: An Overview. THEORY INTO PRACTICE. 41, 4 (2002), 212–218

8. Speelman, C. et al. 2019. Towards a method for examining the effects of cognitive load on the performance of cyber first responders. Proceedings of the International Conference on Security and Management (SAM). (Jan. 2019).

9. Knorr, E.M. 2020. Worked examples, cognitive load, and exam assessments in a senior database course. Annual Conference on Innovation and Technology in Computer Science Education, ITiCSE (New York, NY, USA, Feb. 2020), 612–618.

10. Shaffer, D. et al. 2003. Applying Cognitive Load Theory to Computer Science Education.

11. Asai, S. et al. 2019. Predicting cognitive load in acquisition of programming abilities. International Journal of Electrical and Computer Engineering. 9, 4 (Aug. 2019), 3262–3271. DOI:https://doi.org/10.11591/ijece.v9i4.pp3262-3271.

12. Morrison, B.B. et al. 2014. Measuring Cognitive Load in Introductory CS: Adaptation of an Instrument. (2014). DOI:https://doi.org/10.1145/2632320.2632348.

13. Kalyuga, S. 2011. Cognitive Load Theory: Implications for Affective Computing. Undergraduate (2011).

14. Andrzejewska, M. and Skawińska, A. 2020. Examining Students' Intrinsic Cognitive Load During Program Comprehension - An Eye Tracking Approach. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (2020), 25–30.

15. Curum, B. and Khedo, K.K. 2020. Cognitive load management in mobile learning systems: principles and theories. Journal of Computers in Education. (2020), 1. DOI:https://doi.org/10.1007/s40692-020-00173-6.

16. Paas, F. et al. 2003. Cognitive load theory and instructional design: Recent developments. Educational Psychologist (2003), 1–4.

17. Masapanta-Carrión, S. and Velázquez-Iturbide, J.Á. 2018. A systematic review of the use of Bloom's taxonomy in computer science education. SIGCSE 2018 - Proceedings of the 49th ACM Technical Symposium on Computer Science Education. 2018-Janua, (2018), 441–446. DOI:https://doi.org/10.1145/3159450.3159491

18. van Niekerk, J. and von Solms, R. 2013. Using Bloom's taxonomy for information security education. IFIP Advances in Information and Communication Technology. 406, (2013), 280–287. DOI:https://doi.org/10.1007/978-3-642-39377-8_33.

19. Bannert, M. 2002. Managing cognitive load - Recent trends in Cognitive Load Theory. Learning and Instruction. 12, 1 (2002), 139–146. DOI:https://doi.org/10.1016/S0959-4752(01)00021-4.

20. Mayer, R.E. and Moreno, R. 2003. Nine ways to reduce cognitive load in multimedia learning. Educational Psychologist. 38, 1 (2003), 43–52.
21. Raina, S. et al. 2016. Security Injections 2.0: Increasing Ability to Apply Secure Coding Knowledge using Segmented and Interactive Modules in CS0. (2016). DOI:https://doi.org/10.1145/2839509.2844609.

22. Skulmowski, A. and Rey, G.D. 2017. Measuring Cognitive Load in Embodied Learning Settings. Frontiers in Psychology. 8, AUG (Aug. 2017), 1191. DOI:https://doi.org/10.3389/fpsyg.2017.01191.

23. Skulmowski, A. and Rey, G.D. 2020. Subjective cognitive load surveys lead to divergent results for interactive learning media. Human Behavior and Emerging Technologies. 2, 2 (Apr. 2020), 149–157. DOI:https://doi.org/10.1002/hbe2.184.

24. Jerčić, P. et al. 2020. Modeling cognitive load and physiological arousal through pupil diameter and heart rate. Multimedia Tools and Applications. 79, 5–6 (Feb. 2020), 3145–3159. DOI:https://doi.org/10.1007/s11042-018-6518-z.

25. Larmuseau, C. et al. 2020. Multimodal learning analytics to investigate cognitive load during online problem solving. British Journal of Educational Technology. (May 2020), bjet.12958. DOI:https://doi.org/10.1111/bjet.12958

26. Borys, M. et al. 2017. An analysis of eye-tracking and electroencephalography data for cognitive load measurement during arithmetic tasks. 2017 10th International Symposium on Advanced Topics in Electrical Engineering, ATEE 2017 (Apr. 2017), 287–292.

27. Holmqvist, K. et al. 2011. Eye Tracking: A comprehensive guide to methods and measures. OUP Oxford.

28. Bafna, T. et al. 2020. Cognitive load during eye-typing. Eye Tracking Research and Applications Symposium (ETRA) (New York, NY, USA, Feb. 2020), 1–8.

29. Venkata, N. et al. 2020. Towards inferring cognitive state changes from pupil size variations in real world conditions. (2020). DOI:https://doi.org/10.1145/3379155.3391319.

30. Van Merriënboer, J.J.G. et al. 2006. Teaching complex rather than simple tasks: Balancing intrinsic and germane load to enhance transfer of learning. Applied Cognitive Psychology. 20, 3 (Apr. 2006), 343–352. DOI:https://doi.org/10.1002/acp.1250.