# Visual Programming in Cyber Range Training to Improve Skill Development

Magdalena Glas, Manfred Vielberth, Tobias Reittinger, Fabian Böhm, Günther Pernul

► To cite this version:

Magdalena Glas, Manfred Vielberth, Tobias Reittinger, Fabian Böhm, Günther Pernul. Visual Programming in Cyber Range Training to Improve Skill Development. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.3-13, 10.1007/978-3-031-12172-2_1. hal-05324938

HAL Id: hal-05324938

https://inria.hal.science/hal-05324938v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Visual Programming in Cyber Range Training to Improve Skill Development

Magdalena Glas✉, Manfred Vielberth✉, Tobias Reittinger✉, Fabian Böhm✉, and Günther Pernul✉

University of Regensburg, Universitätsstr. 31, 93053 Regensburg, Germany
{magdalena.glas,manfred.vielberth,tobias.reittinger,fabian.boehm,
guenther.pernul}@ur.de
https://go.ur.de/ifs

**Abstract.** Cyber range training is a promising approach to address the shortage of skilled cybersecurity experts in organizations worldwide. Seeking to make the training of those experts as efficacious and efficient as possible, we investigate the potential of visual programming languages (VPLs) for training in cyber ranges. For this matter, we integrate the VPL Blockly into an existing cyber range concept. To evaluate its effect on the learning process of the trainees we conducted a user study with an experimental group using the VPL and a control group using textual programming. The evaluation results demonstrated a positive impact of the VPL on the trainees' learning experience. The trainees in the VPL group achieved equally good learning outcomes as those in the control group but rated the subjective workload as lower and perceived the training as more interesting.

**Keywords:** Visual programming language · Cyber range training · Security operations center · Experiential learning

## 1 Introduction

A strong organizational security workforce is a promising way to address emerging cybersecurity challenges and to protect an organization's assets. However, according to a recent study by ISC² [5], organizations face problems in seizing this potential. 60% of all participants report a shortage of skilled cybersecurity experts in their organizations and, consequently, believe their organizations' security posture is at risk. Globally, the study estimates this skills gap at 3 Million unfilled positions. Investing in organizational training is one approach to overcome this problem [3]. In recent years, cybersecurity training in cyber ranges has gained popularity in this regard. Cyber ranges are virtual environments that enable hands-on cybersecurity training in a highly realistic infrastructure [10]. While this approach holds great promise, cyber range exercises that are customized to the infrastructure of an organization are a costly and time-consuming endeavor [19]. For this reason, it is crucial not only to define the learning content
conveyed in the process but to examine how training can be designed to be as efficacious and efficient as possible.

With the help of visual programming languages (VPLs), users can program using reusable graphical elements instead of producing text-based code [16]. VPLs are largely used in computer science education because they help to reduce often-complex syntax and, thus, facilitate the learners to solve computational problems. In short, the aim is to help learners to focus on *what* they want to express, not *how* they do it. Related studies demonstrate that participants using a VPL achieved better results, showed more interest in the topic and found the process more engaging compared to those using a textual programming language [9, 11]. In organizational cybersecurity, a number of tasks require programming or the use of code-based commands and configurations. For this reason, we investigate the integration of a VPL into cybersecurity learning by addressing the following research question:

**RQ. Can a VPL support trainees in learning code-based cybersecurity skills?**

In detail, we want to investigate if using a VPL can make cyber range training more efficacious and efficient. We define efficacy as the learning outcome and the learning experience in the learning process. The efficiency of the cyber range training is to be improved by shortening the duration of the training - while retaining its learning content.

We tackle the research question by examining the learning process of a particular security skill in a SOC, namely code-based rule creation for a Security Information and Event Management (SIEM) system. As a foundation, we utilize a cyber range training proposed by Vielberth et al. [18], which aims to educate security analysts to learn to create JSON-based SIEM rules. We implement an extension of this concept allowing trainees to create SIEM rules using the VPL Blockly<fnref n="1" />. To investigate whether learners benefit from this approach, we conduct a user study evaluating the following hypotheses:

**H1. Trainees achieve better learning outcomes when using a VPL.**

**H2. Trainees find training more engaging and less stressful when using a VPL.**

**H3. Trainees learn faster when using a VPL.**

The remainder of this work is structured as follows. Section 2 gives an overview of the theoretical background of this research, while Sect. 3 briefly discusses related work. In Sect. 4, we introduce our concept of integrating a VPL into cyber range training. Subsequently, Sect. 5 presents and discusses the evaluation results of the concept’s prototypical implementation in the form of a user study. Finally, Sect. 6 concludes this work and gives an outlook on future research.

## 2 Background

**Security Operations Center (SOC).** SOCs play a central role in modern organization-wide cybersecurity. Their goal is to improve the security posture of

<footnote n="1">¹ https://developers.com/blockly.</footnote>
the organization by identifying security threats and taking appropriate measures. In addition to suitable technologies and processes, people are of central importance for successful SOCs [17], making SOCs dependent on a sufficient number of well-trained security experts. Therefore, it is not surprising that SOCs also suffer from the aforementioned skills gap [12].

**Security Information and Event Management (SIEM).** A SIEM system is the key technology in a SOC correlating security-relevant events from various sources across an organization [2]. Incoming security events are correlated by rules created by security experts within the SOC to detect incidents or at least anomalies. These rules are usually created with domain-specific languages, depending on the SIEM system used. Thus, not only security-related expert knowledge is required to create the rules, but also skills regarding the syntax and semantics of the respective languages. This provides a promising opportunity for cyber range-based training, which can be tailored to the specific corporate infrastructure and the SIEM system in use.

**Cyber Range.** The National Institute of Standards and Technology (NIST) defines cyber ranges as "interactive, simulated platforms and representations of networks, systems, tools, and applications" [10] that provide a safe and legal environment for security training, testing, and research. From a training perspective, this allows trainees to learn and practice offensive and defensive security skills in a training environment that closely resembles an actual digital infrastructure, such as that of a specific organization. The infrastructures replicated in cyber ranges are not limited to information technology (IT) but can also include operational technology (OT), then referred to as cyber-physical range [6]. Cyber ranges with a training purpose usually include a Learning Management System (LMS) that guides the trainees through a training scenario [20]. Typically, a LMS comprises learning material in the form of videos and texts as well as tasks for the trainee to solve during the training, often enhanced with gamification aspects such as a scoring system.

## 3 Related Work

A common application of VPLs is to teach basic programming concepts to first-time coders. In a study by Tsai [16], for example, participants were taught programming concepts over several weeks. During this time, the experimental group attended a class in which VPL was used. The control group attended a conventional computer science class. This study shows that those participants learning with the VPL outperformed the control group.

Beyond that, VPLs can be utilized to facilitate learners to gain domain-specific knowledge that requires programming to some extent. However, the goal is not to teach programming skills but a simpler, better understandable representation of source code. Rao et al. [13] present a VPL-based learning environment for data science and machine learning. The platform is built for learners to understand and apply complex computer-assisted analyses, despite having little programming experience. Lédeczi et al. [8] use a VPL in a networked robotics
environment to introduce learners to networking aspects of cybersecurity. The latter two studies, however, focus on the overall learning environment rather than the specific impact of the VPL on the learning process. This paper aims to apply a VPL to transfer skills and knowledge in cybersecurity and investigate the specific impact of using the VPL on the learning process. For this reason, we perform a comprehensive user study following a two-group experimental design, similar to that of the previously mentioned study by Tsai [16]. This has – to the best of our knowledge – not been attempted in the field of cybersecurity learning yet.

# 4 Integrating a VPL into Cyber Range Training

We integrate a VPL into an existing cyber range concept proposed by Vielberth et al. [18] to investigate the potential of VPLs in cybersecurity training. What follows is a short description of this underlying concept before we describe the integration of the VPL approach.

## 4.1 Cyber Range Concept

The cyber range concept by Vielberth et al. [18] aims to train future SOC analysts. The virtual environment of the training is a simulation of an industrial control system against which a simulated attacker performs various attacks. The simulation produces live log data that is transferred to a SIEM system. In the web-based front end of the cyber range, the trainees interact with the SIEM system and a LMS, which provides information about the scenario and includes the tasks the trainees need to solve. For each attack, the trainees first need to manually detect the attack by analyzing the log data in the SIEM system. Leveraging this knowledge, they learn how to create correlation rules with which the respective attacks can be detected automatically by the SIEM system. The syntax of the rules of the SIEM system in use is JSON-based. After a first task, that serves as an introduction to the topic (Task 0), the trainees create increasingly complex SIEM rules in two different task types. In Tasks 1, 2 and 3, large parts of the rule are given and the trainees only fill out missing gaps (Cloze Task). In Tasks 4 and 5, the trainees create entire rules themselves, only using a text editor to create the rules in actual JSON (Editor Task). One SIEM rule the trainees create is shown in Fig. 1b. This rule triggers an alarm for every incoming security event "Firewall Warning". For a deeper insight into the cyber range scenario and technical implementation of the prototype, please refer to the original paper [18]. Based on this concept, we want to investigate whether trainees can learn better to create code-based SIEM rules when using a VPL. The integration of this approach in the existing cyber range is described in the following subsection.

## 4.2 SIEM Rule Creation with Blockly

For our study, we seek to integrate a VPL in Tasks 1–5 of the original cyber range. The introduction task (Task 0) remains unchanged. As a VPL we use the
open-source library Blockly which fulfills essential requirements to successfully integrate it into the cyber range proposed by Vielberth et al. [18]. First of all, it is web-based and, therefore, can be directly used within the existing front-end. Additionally, Blockly is highly dynamic and allows the creation of custom blocks, which is necessary to map the domain-specific SIEM language used within the cyber range.

Blockly leverages graphical blocks to display concepts of the underlying domain-specific language (e.g., a programming language or a language to describe SIEM rules) without knowing the syntax of this language. With the Blockfactory<fnref n="2" />, Blockly offers a simple way to define custom blocks for a specific language. Figure 1a illustrates the two custom blocks we defined for the integration into the cyber range: the green header block and the blue rule block. Comparing this Blockly-based rule with the JSON-based description of the same rule (Fig. 1b) highlights that Blockly allows for a more compact representation and does not contain syntax-specific characteristics. The full integration is publicly available on GitHub<fnref n="3" />.

<figure><img src="image_3.png" /><figcaption>(a) Blockly-based SIEM rule.</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>(b) JSON-based SIEM rule.</figcaption></figure>

<caption>**Fig. 1.** Comparison of the JSON-based and Blockly-based SIEM rules.</caption>

<footnote n="2">² https://blockly-demospot.com/static/demos/blockfactory/index.html.</footnote>

<footnote n="3">³ https://github.com/BlocklyCyberRange.</footnote>
# 5 Evaluation

To evaluate the impact of the VPL on the cyber range training, we formulate three hypotheses in the introduction to this paper, regarding the improvement of learning outcome (H1), learning experience (H2), and efficiency (H3) of the training. In the following, we illuminate the method and procedure of the evaluation before presenting the retrieved results.

## 5.1 Method and Procedure

To test our hypotheses, we conducted a Randomized Controlled Trial (RCT) [15] with $N = 30$ participants. While the experimental group ($n = 15$) used Blockly to create the SIEM rules, the control group ($n = 15$) created the rules in JSON. Each group had to solve both task types described in Sect. 4.1. As intended by the RCT experiment design, participants were randomly assigned to one of the two groups prior to training. Participants were students from undergraduate and graduate cybersecurity classes within business informatics curricula. Hereafter, we elaborate on the different aspects of the evaluation. The overall procedure of the user study in connection with the hypotheses is illustrated in Fig. 2.

<figure><img src="image_5.png" /><figcaption>Fig. 2. Procedure of the evaluation.</figcaption></figure>

**H1 (Learning Outcome).** The participants' skills and knowledge were assessed before and after the training to evaluate the learning outcome. In this way, each participant's learning outcome can be objectively determined to compare the average increase among the two groups subsequently. The assessment was conducted with a multiple-choice quiz consisting of twelve questions in four categories: *Non security-related knowledge*, *Attack-related knowledge*, *SIEM-related knowledge*, and *SIEM rule-related knowledge*.

**H2 (Learning Experience).** To evaluate the participants' perception of the learning process, the participants were assessed after each task during the training and in a post-training feedback survey. As outlined in Subsect. 4.1, the cyber range training entails tasks of increasing difficulty in two different task types. Evaluating H2 for each of these tasks makes it possible to distinguish precisely at which stages of the training the VPL subjectively improved the learning experience and where it did not. For this purpose, we utilize the NASA Task Load Index (TLX) [1] to assess the trainees' perceived workload.
The TLX was originally designed to measure subjective workload for opera-
tors interacting with a human-machine interface. The TLX consists of six sub-
scales representing sources of workload: *Mental Demand (MD)*, *Physical Demand (PD)*, *Temporal Demand (TD)*, *Performance (PE)*, *Effort (EF)*, and *Frustration Level (FL)*. Participants are asked to rate each subscale for each task. These rat-
ings are then combined to determine the TLX for the respective task. Today,
the TLX is considered a common method for workload assessment in various
application areas [4]. In this regard, the TLX is also used to capture purely cog-
nitive workload, e.g., to evaluate the usability of web applications [14]. To fit
our purpose, we exclude the subscales *Physical Demand* and *Effort*. The former
because the training does not include any physical aspects, the latter because –
in our case – this subscale is equivalent to *Mental Demand*. This results in a set
of four TLX-specific questions, one for each remaining subscale.

- MD: How mentally demanding was the task?

- TD: How hurried or rushed was the pace of the task?

- PE: How successful were you in accomplishing what you were asked to do?

- FL: How insecure, discouraged, irritated, stressed, or annoyed were you?

To simplify the scoring for participants, we chose a Likert scale from 1 to 5 (*low* to *high* for MD, TD, and FL, respectively, *good* to *poor* for PE) instead of the original TLX scale from 1 to 100. We integrate a TLX-module in the LMS of the existing cyber range. The TLX-module is displayed each time a participant completes a task. To assess the participants’ engagement in the training, we constructed a post-training feedback survey. The survey is based on the four conditions *Attention, Relevance, Confidence*, and *Satisfaction* as proposed within the ARCS model by Keller [7]. The model presumes that intrinsic motivation can be achieved when a learning process meets these conditions. We evaluate each condition with two statements, which the participants assess on a Likert scale from 1 (fully disagree) to 5 (fully agree).

**H3 (Learning Efficiency).** To measure the efficiency of the VPL used in the cyber range training (H3), we recorded the timestamp at the beginning of the training and whenever a participant started or completed a task during the training. This allows us to determine how long it takes a participant to complete each task.

5.2 Results and Discussion

In this section, we present the results of the RCT and discuss them with respect
to our hypotheses. The data set and the SPSS outputs are published GitHub<fnref n="4" />.

**H1 (Learning Outcome).** We performed a paired t-test across all knowledge categories to investigate learning efficacy, comparing the mean rate of correctly answered questions in pre and post assessment. For both groups, the average rate of correctly answered questions increased significantly from pre assessment

<footnote n="4">⁴ https://github.com/BlocklyCyberRange/userStudy.</footnote>
(Blockly: *M* = .66, *SD* = .15; JSON: *M* = .52, *SD* = .13) to post assessment (Blockly: *M* = .87, *SD* = .10; JSON: *M* = .77, *SD* = .17), *t*(14) = -5.43, *p* < .001 for Blockly and *t*(14) = -4.61, *p* < .001 for JSON. To compare the two groups, we examined the change in their performance, that is, the difference in the percentage of correctly answered questions between pre and post assessment. This variable was investigated with an unpaired t-test comparing the two groups for each knowledge category and across all categories, as shown in Table 1.

While this indicates equally good learning outcomes in both groups, the results could not prove that using Blockly led to a significantly different learning outcome. For this reason, H1 is rejected.

<table><caption>**Table 1.** Results of H1 (Learning Outcome).</caption><thead><tr><th rowspan="2">Know. category</th><th colspan="2">Blockly</th><th colspan="2">JSON</th><th rowspan="2">t</th><th rowspan="2">df</th><th rowspan="2">Sig.</th></tr><tr><th>M</th><th>SD</th><th>M</th><th>SD</th></tr></thead><tbody><tr><td>Non-sec.-related</td><td>.16</td><td>.33</td><td>.18</td><td>.28</td><td>-.20</td><td>27.21</td><td>.843</td></tr><tr><td>Attack-related</td><td>.13</td><td>.17</td><td>.16</td><td>.28</td><td>.27</td><td>23.11</td><td>.794</td></tr><tr><td>SIEM-related</td><td>.04</td><td>.17</td><td>.11</td><td>.30</td><td>-.75</td><td>22.32</td><td>.463</td></tr><tr><td>SIEM rule-related</td><td>.51</td><td>.49</td><td>.53</td><td>.33</td><td>-.15</td><td>24.59</td><td>.885</td></tr><tr><td>Overall</td><td>.21</td><td>.15</td><td>.24</td><td>.21</td><td>-.51</td><td>25.69</td><td>.616</td></tr></tbody></table>

<figure><img src="image_6.png" /><figcaption>(a) Learning Experience based on TLX.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>(b) Learning Experience based on ARCS.</figcaption></figure>

<caption>**Fig. 3.** Graphical representation of H2 (Learning Experience) results.</caption>

**H2 (Learning Experience).** For H2, an unpaired t-test was performed to compare the TLX workload for the two groups (cf. Table 2 and Fig. 3a). The measured mean workload was lower for four of the five tasks in the Blockly group. This difference was particularly noticeable in Task 1 and Task 5, which could indicate that Blockly offers an advantage, especially in unfamiliar tasks (Task 1) and particularly complex tasks (Task 5).

Likewise, an unpaired t-test for the four conditions of the ARCS model was conducted (cf. Table 3 and Fig. 3b). While *Confidence* and *Satisfaction* were
higher among the control group, *Attention* was higher in the Blockly group. The mean rating of *Relevance* was about the same in both groups. A possible explanation for this result is that the participants all had some prior experience in textual programming due to their study background. When solving the tasks with Blockly the participants had to engage with something new. Thus, the Blockly participants were less satisfied and confident than the JSON participants, yet found the learning process more interesting (*Attention*).

These results are consistent with the verbal feedback from participants, in which the Blockly approach was rated very positively overall. For this reason, we conclude that the use of Blockly has the potential to improve the learning experience to some extent. Although this cannot be shown to be significant in our user study, partly because of the relatively small number of participants, we consider the results to be a good indicator and therefore accept H2.

<table><caption>**Table 2.** Results of Learning Experience (H2): TLX assessment.</caption><thead><tr><th rowspan="2">Task</th><th colspan="2">Blockly</th><th colspan="2">JSON</th><th rowspan="2">t</th><th rowspan="2">df</th><th rowspan="2">Sig.</th></tr><tr><th>M</th><th>SD</th><th>M</th><th>SD</th></tr></thead><tbody><tr><td>Task 1</td><td>2.25</td><td>0.93</td><td>2.53</td><td>0.90</td><td>-0.85</td><td>27.97</td><td>.404</td></tr><tr><td>Task 2</td><td>1.78</td><td>0.83</td><td>1.88</td><td>0.68</td><td>-0.36</td><td>26.98</td><td>.721</td></tr><tr><td>Task 3</td><td>2.67</td><td>1.06</td><td>2.45</td><td>0.91</td><td>0.60</td><td>27.36</td><td>.552</td></tr><tr><td>Task 4</td><td>2.57</td><td>1.06</td><td>2.58</td><td>0.98</td><td>-0.04</td><td>27.80</td><td>.965</td></tr><tr><td>Task 5</td><td>2.35</td><td>1.01</td><td>2.62</td><td>0.85</td><td>-0.78</td><td>27.24</td><td>.442</td></tr></tbody></table>

<table><caption>**Table 3.** Results of Learning Experience (H2): ARCS assessment.</caption><thead><tr><th rowspan="2">Condition</th><th colspan="2">Blockly</th><th colspan="2">JSON</th><th rowspan="2">t</th><th rowspan="2">df</th><th rowspan="2">Sig.</th></tr><tr><th>M</th><th>SD</th><th>M</th><th>SD</th></tr></thead><tbody><tr><td>Attention</td><td>4.67</td><td>0.41</td><td>4.43</td><td>0.65</td><td>1.18</td><td>23.54</td><td>.251</td></tr><tr><td>Relevance</td><td>4.03</td><td>0.55</td><td>4.07</td><td>0.56</td><td>-0.16</td><td>27.99</td><td>.871</td></tr><tr><td>Confidence</td><td>4.00</td><td>0.98</td><td>4.30</td><td>0.53</td><td>-1.04</td><td>21.47</td><td>.309</td></tr><tr><td>Satisfaction</td><td>3.67</td><td>0.96</td><td>4.00</td><td>0.57</td><td>-1.16</td><td>22.74</td><td>.258</td></tr></tbody></table>

**H3 (Learning Efficiency).** For the third hypothesis, an unpaired t-test was performed to compare the average time it took the participants to solve each task for the two groups (H3). The total training duration (in minutes) ($M = 52:33$, $SD = 12:52$ for Blockly, $M = 52:16$, $SD = 11:23$ for JSON) was very close in the two groups, $t(27.59) = 0.06, p = .950$. Task 1 and Task 6 were completed faster
by the Blockly group, Tasks 2, 3, and 4 were completed faster by the control group. For the full results, we refer to the aforementioned GitHub repository.

While conducting the evaluation, we realized that the duration for solving the tasks has more factors than the sheer modality of the task. Participants told us, e.g., that they interrupted the training for short breaks or were facing technical issues such as a weak internet connection. This is also shown by the high number of outliers and the associated poor significance. For this reason, we do not consider the results of the time recording to be meaningful and can therefore neither accept nor reject H3.

# 6 Conclusion

In this work, we integrated a VPL into an existing cyber range training and evaluated its effects on learning outcome, learning experience, and learning efficiency in a Randomized Controlled Trial. The study indicates an equally good learning outcome for the experimental group (using the VPL) and the control group (using text-based programming). While a successful learning outcome is considered the primary goal of cyber range training, it is also highly desirable to raise trainees' engagement. If trainees enjoy the training, it might raise their interest in the topic and thus be an incentive for further learning. Our experiments indicate that the use of VPL can improve the learning experience, as participants found the learning process more enjoyable. Due to the promising results of the conducted user study, the potential of VPL usage for other domains appears encouraging. However, further experiments are necessary to validate the statistical significance of our results and to determine the effectiveness of the training in terms of its long-term impact in the real world context of an organization. In addition, the aspects of ethicality and elegance of the VPL approach should also be investigated in an extended future evaluation.

**Acknowledgment.** This work is partly performed under the INSIST project, which is supported under contract by the Bavarian Ministry of Economic Affairs, Regional Development and Energy (DIK0338/01).

# References

1. Development of NASA-TLX (Task Load Index): Results of Empirical and Theoretical Research. In: Hancock, P.A., Meshkati, N. (eds.) Human Mental Workload, Advances in Psychology, vol. 52, pp. 139–183. North-Holland (1988)

2. Bhatt, S., Manadhata, P.K., Zomlot, L.: The operational role of security information and event management systems. IEEE Secur. Priv. **12**(5), 35–41 (2014)

3. Furnell, S., Fischer, P., Finch, A.: Can’t get the staff? The growing need for cybersecurity skills. Comput. Fraud Secur. **2017**(2), 5–10 (2017)

4. Hart, S.G.: NASA-task load index (NASA-TLX); 20 years later. In: Proceedings of the Human Factors and Ergonomics Society Annual Meeting, vol. 50, pp. 904–908 (2006)
5. ISC²: A resilient cybersecurity profession charts the path forward - ISC² cybersecurity workforce study 2021. Technical report, International Information System Security Certification Consortium (2021)

6. Kavallieratos, G., Katsikas, S.K., Gkioulos, V.: Towards a cyber-physical range. In: Proceedings of the 5th on Cyber-Physical System Security Workshop, pp. 25–34 (2019)

7. Keller, J.M.: Development and use of the ARCS model of instructional design. J. Instr. Dev. **10**(3), 2–10 (1987)

8. Lédeczi, Á., et al.: Teaching cybersecurity with networked robots. In: Proceedings of the 50th ACM Technical Symposium on Computer Science Education, pp. 885–891 (2019)

9. Lye, S.Y., Koh, J.H.L.: Review on teaching and learning of computational thinking through programming: what is next for K-12? Comput. Hum. Behav. **41**, 51–61 (2014)

10. National Initiative for Cybersecurity Education (NICE): The Cyber Range: A Guide. Technical report, National Initiative for Cybersecurity Education (NICE) (2020)

11. Ouahbi, I., Kaddari, F., Darhmaoui, H., Elachqar, A., Lahmine, S.: Learning basic programming concepts by creating games with scratch programming environment. Proc. Soc. Behav. Sci. **191**, 1479–1482 (2015)

12. Pescatore, J., Filkins, B.: Closing the critical skills gap for modern and effective security operations centers (SOCs). SANS Institute (2020)

13. Rao, A., Bihani, A., Nair, M.: Milo: a visual programming environment for data science education. In: 2018 IEEE Symposium on Visual Languages and Human-Centric Computing (VL/HCC), pp. 211–215 (2018)

14. Schmutz, P., Heinz, S., Métrailler, Y., Opwis, K.: Cognitive load in eCommerce applications-measurement and effects on user satisfaction. Adv. Hum.-Comput. Interact. **2009**, 1–9 (2009)

15. Torgerson, C.J., Torgerson, D.J.: The need for randomised controlled trials in educational research. Br. J. Educ. Stud. **49**, 316–328 (2001)

16. Tsai, C.Y.: Improving students’ understanding of basic programming concepts through visual programming language: the role of self-efficacy. Comput. Hum. Behav. **95**, 224–232 (2019)

17. Vielberth, M., Bohm, F., Fichtinger, I., Pernul, G.: Security operations center: a systematic study and open challenges. IEEE Access **8**, 227756–227779 (2020)

18. Vielberth, M., Glas, M., Dietz, M., Karagiannis, S., Magkos, E., Pernul, G.: A digital twin-based cyber range for SOC analysts. In: Barker, K., Ghazinour, K. (eds.) DBSec 2021. LNCS, vol. 12840, pp. 293–311. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-81242-3_17

19. Vykopal, J., Vizvary, M., Oslejsek, R., Celeda, P., Tovarnak, D.: Lessons learned from complex hands-on defence exercises in a cyber range. In: Proceedings - Frontiers in Education Conference, FIE, pp. 1–8 (2017)

20. Yamin, M.M., Katt, B., Gkioulos, V.: Cyber ranges and security testbeds: scenarios, functions, tools and architecture. Comput. Secur. **88**, 101636 (2020)