Students who solve cybersecurity tasks in interactive training environments generate activity data in the form of command-line histories and training event logs. These data enable the potential to predict early in the training whether the student will be able to finish the tasks. A timely recognition of students who are at the risk of failing helps the instructor to focus on individual help to struggling students.

The goal of this thesis is to research the following question: What features derived from student activity data can predict student success or failure?

The theoretical part of the work will compare the existing approaches to classification and review related research. In the practical part, the author will (1) employ an existing dataset of more than 26,000 commands from 250+ training sessions conducted in the KYPO Cyber Range Platform, (2) extract features from the data, and (3) train a suitable classifier using a Python library such as scikit-learn (https://scikit-learn.org/stable/index.html). Finally, the predictive power of the classifier will be evaluated and the results discussed.