A Cramer
email: a.cramer@hzdr.de

V Galindo

M Zennaro

S Eckert

Investigation of the flow driven by an alternating magnetic field

Keywords: Alternating magnetic field, ultrasonic flow measurements, convective pattern, vorticity

The flow induced by a single-phase alternating magnetic field is studied numerically and in a physical model. It is shown that the flow structure depends drastically on the frequency of the field, owing to a changeover of the rotor of the Lorentz force in the corners from a single local maximum to a pair of local maxima, one in close vicinity of another, with different signs of vorticity.

Introduction

During block casting of solar silicon, electrically non conducting contaminating particles such as silicon carbide and silicon oxide may be removed by Leenov-Kolin force (LKF). One possibility to apply such a force is a single-phase alternating magnetic field (AMF), which also drives a flow in the melt. The interaction of that flow with the separation process is discussed controversially in the literature; a too strong flow may inhibit separation completely, whereas some flow is needed to move the particles from the bulk into the regions of influence of the LKF being restricted to the crucible walls. The flow produced by an AMF is believed to be well known, it is a double-toroidal recirculation in the meridional plane with one of the vortices on top of another [1,2,[START_REF] Davidson | 5 th Beer Sheva Int[END_REF]. The AMF induces an eddy current j j j j in the electrically conducting melt, which interacts with the field B B B B that induced it. The interaction results in a Lorentz force = × , the rotational part of which drives convection. Davidson argued that × is not negligible merely in relatively small corner regions [START_REF] Davidson | 5 th Beer Sheva Int[END_REF]. The distribution is skew symmetric, so × has opposite signs in corners facing one another. Most of the streamlines pass through these small forcing regions and recirculate through the core of the fluid. Given the positive signs of × in the upper left and lower right quarter in a meridional section through a cylindrical volume, and negative signs in the lower left and upper right, the convective pattern will be the well believed double-toroidal flow structure (DTFS) with a common inward directed flow at half the height between the vortices. Among many others, the DTFS was observed experimentally in [1,2]. The main flow eddies may oscillate, shrink and expand in time, however, the long-term average reported in almost any work known to the present authors is a DTFS. The investigations in [1,2] were carried out up to relatively high frequencies of the AMF. As increases, B B B B is more and more crowded out from the interior of the electrical conductor by the eddy current it induces. To compare this effect between different geometries and electrically conducting fluids, the shielding parameter is introduced:

= , (1)
where is the permeability, the electrical conductivity, = 2 the angular frequency of the alternating magnetic field, and a characteristic length. It may be said that a conductor is transparent for the magnetic field if is less than unity. The experiments in [1] were done for a frequency corresponding to an in excess of 500. For such a high frequency, it casts some doubt that the flow structure should be basically the same as in the low frequency range. The forcing regions described in [START_REF] Davidson | 5 th Beer Sheva Int[END_REF] become the smaller the higher the shielding. Thereupon, it may be asked whether all streamlines will pass through them. Or, might there be secondary vortices driven by shear imposed from the main flow eddies? That the DTFS is not always realised, in particular not in the parameter range of high frequencies needed for separation, is the main outcome of the present work.

Numerical procedure

For the numerical simulations of the induced electric current j j j j and magnetic induction B B B B in electrically conducting matter, the finite element code OPERA 3d was used. The computational grid was refined near the walls in order to resolve the skin layers and has a total number of 2 million finite elements. The flow in the volume containing the melt was simulated numerically by means of the open source library OpenFOAM solving the Navier-Stokes equation together with the incompressibility condition • = 0 and including an electromagnetic force density term averaged over one period T = 1/f of the AMF

+ ( • ) = -+ !∇ + 〈 × 〉 % . (2)
p and ! in Eq. ( 2) are the pressure and the dynamic viscosity.

The boundary conditions for the flow field are the no-slip condition = 0 at the solid container wall. For the melt surface, stress-free and non-deformable conditions v ) = 0 and ∂v + / / / /∂-= 0 the subscripts n and t denote the normal and the tangential component are applied. A computational grid with up to 227500 volume elements was used.

The discretization scheme for the convective term was of second order. A k-ω SST turbulence model was used for the majority of the computations. The abbreviation SST stands for shear stress transport.

Experimental setup

The flow measurements were carried out in a large Perspex cell reasonably scaled to the task formulation of silicon block casting. To have an according aspect ratio less than unity, the filling level of the 18 cm in diameter cell was adjusted to 12 cm. GaInSn has become the de facto standard for liquid metal model experiments and was chosen as the working fluid also in the present work. According to Eq. ( 1), the large size of the cell supports reaching high shielding at relatively low frequencies. However, they are still high enough so as to render the achievement of a continuously variable frequency a difficult task.

Matching of impedance with a fixed inductance of a coil system is always a compromise if the frequency needs to be varied. With readily available equipment, a big Helmholtz coil and a HERO PFL-2250-28 power amplifier driven by a frequency synthesizer, the coil current was limited to slightly less than 10 A in the upper range towards ≈ 1000. This corresponds to an induction of 0.62 mT, only.

As it is well known that the topology of the flow driven by an AMF does not depend on induction, except for very low velocities, the low induction boils down to the question whether the flow measuring equipment is sensitive enough to reliably resolve the even smaller differences needed for flow mapping on such a low velocity level. The order of magnitude of the velocities to be expected may be estimated by Alfvén's velocity. In the large container, the Reynolds number M = v /N, where N is the kinematic viscosity, is about 800 for v = 3 mm/s. This can be regarded high enough for the flow structure not to depend on induction. The technique of ultrasonic Doppler flow measurements has matured in the, say, last decade. If acquisition speed is not the issue, the resolution of velocities in the mm/s-range is feasible.

Results and discussion

Since, according to [START_REF] Davidson | 5 th Beer Sheva Int[END_REF], the flow structure depends drastically on the distribution of × , it suggests itself to examine the dependence of that magnitude on frequency. As = P Q , 0, P R and it is axisymmetric, i.e. / φ = 0, the rotor of has only a φ-component. Silicon block casting is done in crucibles of aspect ratio less than unity, however, no experiments on electromagnetic separation have been done in flat containers to the best of our knowledge. Neither directly on silicon, nor on a liquid metal. And also not in such large geometries. The only separation experiment on silicon brought to our attention was carried out in a small crucible 2 cm in radius, which had an aspect ratio (height/diameter) of 1.5. To understand the flow in this experiment, it is worth to consider in that geometry. Figure 1 shows the contours of the vorticity × T for three different frequencies corresponding to = 2.1, 42.7, and 192. The left panel corresponds to the according figure in [START_REF] Davidson | 5 th Beer Sheva Int[END_REF], it represents the low frequency case leading to the DTFS. The experiment in [START_REF] Kadkhodabeigi | [END_REF] was conducted at the frequency in the middle panel, for which the vorticity has basically changed. Instead of one maximum in each corner, there are two. The difference to the highest frequency in the right panel is which of the vorticity maxima in the same corner, those at the top and bottom wall or those at the side wall, have the higher absolute values. For = 42.7 these are the maxima at the top and at the bottom, and for = 192 these are the ones at the side wall. If the altered distribution of vorticity leads to a global change of the flow structure, the convective pattern in the experiment in [START_REF] Kadkhodabeigi | [END_REF] was not a DTFS. Due to limited space, the flow in this configuration is not presented here. It is quite complex, the results are published in [5]. Here, it is sufficient to see that a certain increase in frequency leads to kind of a dissociation of the one maximum of vorticity in the corners to two maxima of opposing sign. As numerical simulations for flatter geometries have shown does this principle behaviour not depend on the aspect ratio. For that reason, the big and flatter cell described in Section "Experimental setup" is returned to. Extended series of measurements and numerical simulations spanning the wide range of shielding parameters from about unity to 1000 were carried out. In general, fair agreement between experiment and calculation can be stated. To relate the investigated range of to the practice of separation in silicon, the shielding parameter in a G3 crucible is about 1400 for 3 kHz. For the measurements, an ultrasonic transducer was put on the melt surface so as to measure downwards. Because a transducer measures the projection of the velocity vector onto the direction of sound propagation along the ultrasonic beam, a section of the vertical velocity component v z along the height was acquired at any instant of time. A usual means of flow mapping of the dynamics of a flow is producing a contour plot of v z on the ordinate over time on the abscissa. To identify the flow structure, time series of velocity sections were recorded in the centre and close to the rim of the container for every investigated. In both measurement and simulation, the expected DTFS was observed at any instant of time for small of up to about 10. Increasingly with increasing from 15 upwards, periods of time were observed in which the convective pattern was not double-toroidal. Typical scenarios were a single cell spanning the entire height, for which the plot of the velocity over the height exhibits a single maximum or even a few maxima, or three vortices one on top of another. The lengths and incidences of such non-DTFS periods increased with , however, averaging over the whole measurement duration still yield a DTFS. As will be exemplarily seen for a higher below, the flow is remarkably unstable for the low velocity readings of a few mm/s also for lower . Four vortices were never observed up to = 50. Fig. 2: The contour plot is composed from a time series (on the abscissa) of the vertical velocity component along the height (on the ordinate). The numerically calculated data sets were taken at a radial coordinate close to the rim of the container. Greyscale colouring from white for negative values to black for positive values covers a range of ±3 mm/s. The calculation was carried out for a shielding parameter of 100.

The numerical simulation in Fig. 2 was carried out for = 100. The plot of the vertical velocity component close to the rim of the container shows, from top to bottom, a down-stream, an up-stream, again a down-stream, and finally another up-stream. At least in the outer regions of the container, there are evidently four vortices one on top of another in the low aspect ratio cell. The upper-and lowermost vortices have the same rolling direction as the two vortices for lower .

Inspection of the data in the centre of the container shows that the quadruple-toroidal flow structure does not necessarily penetrate the whole radius. In the centre and also at half the radius, the flow is, in a manner of speaking, chaotic. That is to say that long-term averaging does not yield a preferred flow direction. Upon examination of various azimuthal positions it may be stated that the flow at the rim is fairly axisymmetric. Figure 3 shows the measurement corresponding to the numerical simulation in Fig. 2. In a qualitative sense, the experiment confirms the numerical simulation. Quantitatively, the biggest difference is the weakness of the uppermost vortex. Its size is not smaller than in the numerical simulation, however, long-term averaging of the experimental and numerical data yields a three times less velocity in the experiment. A satisfactory explanation of this discrepancy cannot be given to date. In any case, extensive and reproducible experiments and numerical simulations agreeing fairly over the whole range of investigated (the agreement is much better for small ) contradict the DTFS published in [1,2] (and many others) qualitatively. Fig. 3: The experimental analogue to Fig. 2. Greyscale colouring with respect to the velocity range is the same as in Fig. 2. Although the uppermost vortex is quite weak compared to the computation, closer examination of the measuring data shows that has about the same size as in the calculation. The flow structure at = 100 is, despite the low aspect ratio, quadruple-toroidal with all vortices one on top of another.

Summary and conclusion

The flow driven by a single-phase alternating magnetic field was numerically simulated and measured in the parameter ranges of aspect ratios and frequencies similar to silicon block casting. Despite the cell was comparably flat (aspect ratio less than unity), the well believed double toroidal flow structure was not realized in the higher frequency range. Instead, a quadruple-toroidal structure with all vortices one on top of another was observed. Due to limited space, the results presented here are a small excerpt of the authors work on the flow in AMFs. The interested reader is referred to [5] for further reading.

Fig. 1 :

 1 Fig. 1: Contours of the φ-component of × from electromagnetic simulation of the configuration investigated in [4]. The frequencies from left to right are 200 Hz, 11 kHz, and 50 kHz. Light grey shading symbolises regions of negative vorticity, those of positive × T are shaded in dark grey.

Acknowledgment

This work was financially supported by the European Commission in the Framework Programme 7 ENV-2013 under the grant agreement number 603-718.


I Grants

G Gerbeth

I Kaldre

A Bojarevičs

M Sarma

Magnetically induced acoustic cavitation for production of metal matrix nano-composites

Keywords: Acoustic cavitation, electromagnetic forces, nanoparticle dispersion

A steady axial magnetic field is applied to a liquid metal zone heated by induction currents. This zone is supported from the top and the bottom by water cooled rods in an evacuated cell. The resulting alternating Lorentz force causes pressure oscillations, that being strong enough lead to cavitation in the molten metal. The onset of cavitation in molten steel is detected by the occurrence of characteristic sub-harmonics in the sound recorded at the surface of the cell. The oscillating magnetic force is applied for dispersion of SiC nanoparticles in aluminium and for mixing ofthe immiscible metals lead and aluminium. Micron-sized lead inclusions are observed in the aluminium matrix.

Introduction

Acoustic cavitation by power ultrasound is widely used for the purpose of nanoparticle dispersion in room temperature liquids. There are also numerous experimental reports demonstrating that power ultrasound facilitates the dispersion of nanoparticles in a molten metal. So far, this property has been applied for the production of metal matrix nanocomposites (MMNC) of light metal alloys [1,2]. Being extremely violent on the micro-scale, the cavitation degrades also the vibrating surface transmitting the ultrasound into the liquid. A contactless technique for cavitation excitation is, therefore, desirable. Combination of induction heating with a steady axial magnetic field offers such an option. This combination creates an alternating radial magnetic body force in a cylinder [3]. The resulting acoustic pressure is proportional to the product of the steady and the alternating magnetic field components [3,4]. Our experiment is designed to maximize the induction currents and, thus, keep the static field moderate. We continue our earlier study [4] by considering the cavitation inception conditions in molten stainless steel. Besides, we investigate effect of magnetically excited ultrasound on the mixing of the immiscible metals lead and aluminium as well as on the SiC nanoparticle dispersion in aluminium.

Background

Consider an infinite liquid metal cylinder of radius a in a uniform magnetic field with a steady and an alternating component

    . z t i z e r b + B = e B  (1)
The alternating component of the magnetic field induces an azimuthal current, which in combination with the static axial field creates an oscillating radial force. This force is curl-free and, therefore, is balanced by an oscillating pressure field. Suppose the frequency  is high enough to cause a strong skin-effect ( 0 a 2 >> 1, where  and  0 are the electric conductivity and magnetic permeability of the metal, respectively) yet low enough to form a long acoustic wave /s >> 2a, withsbeing the sound speed in the metal. Additionally suppose that the alternating field component is much smaller than the steady one (b A <<B z , where b A =|b(a)|). Under these conditions the alternating magnetic pressure is uniform in the bulk and has the amplitude [4] .

0  A z b B = p ( 2
)
Acoustic cavitation is a recurring non-linear growth and subsequent collapse of small bubbles due to the oscillating pressure field in the liquid.Expansion of small bubbles is hindered by the Laplace pressure 2/R 0 , where R 0 is the bubble initial radius and  is the surface tension.In an ideal liquid, where transientvoids are only created by thermodynamic fluctuations, the critical tension is comparable to the yield strength of metals [START_REF] Brennen | Cavitation and Bubble Dynamics[END_REF][START_REF] Apfel | [END_REF].Such tension is out of reach of power ultrasound. Thus, the observed beneficial effects of power ultrasound in metal casting [1,2] depend on size and density of cavitation nuclei, that is largely unknown and uncontrolled.Inpresence of gaseous bubbles the transient cavitation threshold may be expressed as

[7]   2 / 1 0 0 3 0 3 / 2γ 3 2γ 3 4         R + p R + p = p 0 T , (3)
wherep 0 is the ambient pressure.This expression depends on R 0 that is neither given nor constant as gas bubbles tend to grow in a sound field even from an under-saturated solution (due to rectified diffusion, see [START_REF] Brennen | Cavitation and Bubble Dynamics[END_REF]7]).As bubbles start to cavitate, they emit their own soundcontaining characteristic sub-harmonics f 0 /n, wheref 0 is the drive frequency andn=2,3… [7,8]. We use this property for identification of cavitation inception.

Experimental

The experiment is made in an evacuated cell (p 0 < 400 Pa) shown in Fig. 1.It consists of a quartz tube5 and water cooled copper caps3. The cell is placed in a 82 mm wide vertical gap of an electromagnet. Water cooled copper screens 8are used to protect the ferromagnetic pole shoes9 from the induced currents. The electromagnet provides a magnetic flux density of up to 0.5 T in the experimentalvolume. The maximum inductor current r.m.s value is I AC = 1300 A that corresponds tob A = 0.130 T. Frequency of AC isf 0 = 14.7 kHz. Four piezoelectric sensors4 are glued at thesurface of the bottom cap for the purpose of sound detection. The electric signal from theseelements is acquired by a digital oscilloscope at 3.2 μs temporal resolution in packets of 5000measurements. More details of the setup are given in Ref. [4]. Thesample 1 is placed between two water cooled replaceable vertical supports 2 (diameter 20 mm). This configuration allows to increase the induction current without overheating the sample. Besides, it constrains the sample to the space in between. The induced currents in interaction with the alternating magnetic field itself createa time-averaged magnetic pressure p m = b A 2/4 0 ≈ 3kPaat the maximum induction current [4]. This corresponds to 110 and 38 mm head of liquid aluminium and steel, respectively. Thus, the vertical free surface of the molten sample may be supported by the magnetic forces alone. Though, a refractory side support6 is still needed to accommodate vertical variation of the magnetic pressure and to contain surface instabilities.

Samples of three kinds are used in this study. Two of them consist basically of 99.9% pure aluminium with either a lead lump or SiC nanoparticles added. The third sample consists of commercial non-magnetic stainless steel SAE 304.To investigate the effect of acoustic cavitation on the nanoparticle dispersion these particles first need to be inserted into the liquid metal. For this purpose we alloyed them mechanically with aluminium and then melted the obtained MMNC together with the pure material.Both vertical supports for the aluminium-based samples are compounded of 12 mm copper and 3.5 mm stainless steel discs to adjust the thermal resistance. The liquid metal facing surface is sprayed with boron nitride. Fig. 1(b) displays the assembled cell with the compounded copper-steel supports and the sample consisting of initial SiCMMNC over a pure aluminium disc. In case of steel, the liquid sample is formed as 26 mm long steel supports are partially molten in the middle of the cell.

Results

Figure 2 displays the transient sound spectrum in case of: (a) Al+Pb and (b) steel sample. In both cases the static magnetic field induction was 0.5 T. The inductor current was varied stepwise. In case of Fig. 2(a) it was raised to 1200 A at t=590 s and sustained for about 10 minutes. The first short burst of f 0 /2 sub-harmonic was observed at t=610 s. A continuous cavitation signal with pronounced f 0 /2 and f 0 /4 modes set in after a significant delay at t=850 s. In case of steel (Fig. 2b) the inductor current was raised to 1050 A at t=190 s and sustained at this level until t=290 s. The first signs of cavitation in form of a weak f 0 /2 sub-harmonic was observed at t=210 s. In the following, the intensity of this mode gradually increased until it suddenly disappeared as the inductor current was lowered. Thus, the cavitation in steel started at a lower acoustic pressure (estimated 42kPa) than in case of Al+Pb (48kPa),although the surface tension of steel is much higher than that of aluminium or lead. Apparently, largerinitial bubbles have compensated the larger surface tension of steel in (3). The solidified aluminium-based samples were cut axially and inspected by microscope. Although most of the lead remained segregated, a fraction of it was dispersed in form of micron-sized droplets as displayed in Fig. 3.Similar droplets have also been observed in case of power ultrasound applied during solidification of the aluminium-lead system [9]. A smaller amount of the dispersed lead in our case might be caused by a comparably low intensity of cavitation. That may be improved by increasing both the acoustic and the ambient pressure. For the purpose of nanoparticle insertion in liquid aluminium we used MMNC with an elevated particle concentration prepared by powder metallurgical approach. This material turned out resistant to red-glowing temperatures well above the aluminium melting point. Darker spots in Fig. 4(a) represent fragments of the initial MMNC. A border between such a fragment and the aluminium-rich phase is shown in Fig. 4(b). Results of X-ray fluorescence (XRF) investigation of the lighter part of this sample implieda silicon content about half of that in the particle-rich darker initial MMNC. Though, at least a part of this silicon appears to be dissolved from the particles as evidenced by the formation ofa grain structure in Fig. 4(b).High temperatures reached in this trial provide an additional evidence of dissolved silicon that apparently have reducedthe electric conductivity of the sample.A lower concentration initial MMNC (1% SiC) disintegrated and mixed into liquid aluminium much better with no visible macroscopic nonuniformity. A glowing temperature was not reached in this trial with even a higher inductor current.Micrograph of this sample (Fig. 4c)reveals a different structure of tangled particle-rich filaments as well as dark globules, likely consisting of agglomerated SiCparticles. We have also applied scanning electron microscopy to look for individual nanoparticles. These attempts have not yet delivered conclusive evidence.

Summary

We have continued the experimentalstudy [4] of contact-less electromagnetic cavitation in liquid metals. Acoustic evidence of cavitation in liquid steel in an evacuated cell has been observed at an estimated sound pressure of 40kPa. The electromagnetic cavitation has been applied to stir immiscible lead into aluminium as well to mix SiC nanoparticles into the aluminium matrix. Formation of micron-sized lead inclusions in aluminium has been observed although most lead remained separated. Apparently, the intensity of the observed cavitation regime was insufficient that may be enhanced by increasing both the ambient and the sound pressure. The evidence for nanoparticle dispersion by this method is not yet conclusive. Our trials have revealed difficulties with particle insertion by means of highly loaded aluminium SiC MMNC as this material resisted temperatures well above the aluminium melting point.

Fig. 1 :

 1 Fig. 1: The experimental set-up: (a) Scheme; (b) Photograph with the AC coil and the upper electromagnet pole piece removed: 1sample; 2vertical supports; 3water cooled caps; 4piezoelectric sensors; 5quartz tube; 6side support; 7 -AC coil; 8copper screen; 9electromagnet pole shoes.

Fig. 2 :

 2 Fig. 2: Temporal dependency of the sound power spectrum in case of (a) aluminium with lead; (b) stainless steel. Depth of the logarithmic colour palette is 40 dB.

Fig. 3 :

 3 Fig. 3: Micrographs of aluminium sample with lead droplets dispersed by electromagnetic cavitation. The initial mass ratio of Al and Pb is 0.50.

Fig. 4 :

 4 Fig. 4: Sections of aluminium samples molten together with SiC MMNC under electromagnetic cavitation: (a,b) highly loaded initial MMNC (10%vol.SiC 50 nm, I AC =1050 A, B z =0.5 T); (c) moderately loaded initial MMNC (1%vol.SiC 50 nm, I AC =1250 A, B z =0.5 T)

Acknowledgment

This research was financially supported by the German Helmholtz Association in frameof the Helmholtz-Alliance LIMTECH as well as by Latvian Council of Science under grantNo. 520/2012.


Nam Hoang
email: hoang_nam.ho@univ-lr.fr

Ho

Mourad Rabah
email: mourad.rabah@univ-lr.fr

Samuel Nowakowski
email: samuel.nowakowski@loria.fr

Pascal Estraillier
email: pascal.estraillier@univ-lr.fr

Toward a Trace-Based PROMETHEE II Method to answer "What can teachers do?" in Online Distance Learning Applications

Keywords: Intelligent Tutoring System, PROMETHEE II, traces, situation

In an Online Distance Learning (ODL) application, the learning scenario is a situation chaining from an initial system's state to one of the final states where course's criteria are met. A situation is a contextualized sequence of interactions. Teachers are successively involved in different situations: at the end of one situation, they choose the next one. An Intelligent Tutoring System will be used to support teachers in choosing an appropriate situation. In this paper, we show how to apply a decision method (PROMETHEE II) combining with the system traces analysis to automatically recommend to teachers one situation in order to execute during an e-Learning course. Experimental results of our ODL environment are presented to illustrate our method.

Introduction

Computer science research has been shown to be effective in e-Learning context to increase the students' performance and their motivations. With advancement of artificial intelligence and in cognitive research on human learning, the next generation of computer-based learning moved to develop an Intelligent Tutoring System (ITS). These ITSs are called cognitive tutors that must be able to achieve three main tasks: improve the student's knowledge level, decide what to do next/ adapt instruction accordingly and provide feedback [START_REF] Chakraborty | Development of Knowledge Based Intelligent Tutoring System[END_REF]. Given the promising ITS's performance, we interest in analysing how to integrate ITS into e-learning platform to help teacher and also the students during a course. We have developed a case study from our Online Distance Learning (ODL) environment POLARIS [START_REF] Trillaud | Situation-Based Scenarios for E-learning[END_REF]. POLARIS is an online blended learning adaptive and interactive service platform. It simulates a virtual classroom with teacher and students' roles for online courses. In this context, we propose to handle this type of application with a hypothesis for adapting its execution according to user behaviours and the current context. We rely on the notion of situation [START_REF] Trillaud | Situation-Based Scenarios for E-learning[END_REF] to structure the learning scenario. A learning situation is a component where the teacher and students interact using local resources associated within a common context to achieve one or more identified course's criteria. The learning scenario in POLARIS is contextualized by the following set of situations: Presentation, Individual Work, Group Work, Discussion, Go to the Board and Test. Thus, teachers execute and participate in successive situations until they reach all of the defined criteria. For each course, the teacher also wants to reach two criteria that are: Time (the course must finish on time) and Comprehension (the students' comprehension). Normally, after finishing one situation, teachers have to select another one among a set of available situations to carry on the learning course continuation. However, the fact is that teachers are not able to choose precisely what to do in the next execution. Our goal is to integrate an ITS as a teacher assistant to suggest an optimized situation to execute in increasing some of given criteria. In other words, we try to answer the question "What can teachers do?" and find the suggested hint being suitable for students and teacher in order to reach two defined criteria. This question will rely on the choice that will be based on the heuristic multi-criteria decision. Among the many works on multi-criteria decision, we are particularly interested in the PROMETHEE II method [START_REF] Taillandier | Using the PROMETHEE multi-criteria decision making method to define new exploration strategies for rescue robots[END_REF] that we improve by incorporating a system for analysing the e-learning traces [START_REF] Cordier | Trace-Based Reasoning -Modeling Interaction Traces for Reasoning on Experiences[END_REF] generated during the course session. This is the main method, named Trace-Based PROMETHEE II, which will be integrated into the ITS of POLARIS.

Principle of Trace-Based PROMETHEE II

We present the Trace-Based System (TBS) that aims to manage system execution traces. We start by introducing TBS related concepts used in this paper [START_REF] Cordier | Trace-Based Reasoning -Modeling Interaction Traces for Reasoning on Experiences[END_REF]. A trace is a sequence of data generated by any action regarding an event occurring during system's execution. Each trace can be associated to a model, called trace model that formally represents the corresponding traces. A modelled-trace (called m-trace) is a trace associated with its model. A system, which manages m-traces, is called m-Trace-Based System (m-TBS). The collection phase is devoted to traces collecting. All the m-traces in this phase are called primary traces, defined by PrT = (S, E, Ω, C, F) where S = {si} is a set of executed situations; E ⊆ S × S is a set of the situations transitions; Ω ⊆ 𝑉×𝑆 is the set of the states of the overall system V and the associated executed situation; C is the set of criteria defined by (criterion_name, criteri-on_value) and F is the teacher's feedback about the obtained criteria when he finished a course with F = true (all of criteria are reached), otherwise F = false. The transformation phase selects and transforms the primary traces into new format according to our context. We need a trace that contains a good strategy that means we select all of the primary traces in which the value of F is true. From each obtained primary trace, we have several transformed traces, denoted by TrT = Ω. The analysis phase aims to analyse all of the transformed traces. We then present this phase as the main contribution of Trace-Based PROMETHEE II method.

The teacher has two criteria to reach during his learning session that are: Time and Comprehension. During the course in POLARIS, we have the state vector V that contains 9 properties such as: remainT (the remained time of the course), presentationT (the executed time of the situation Presentation), indiworkT (the executed time of the situation Individual Work), groupworkT (the executed time of the situation Group Work), discussT (the executed time of the situation Discussion), goboardT (the executed time of the situation Go to the Board), testT (the executed time of the situation Test), questionNum (the number of students' questions), questionStu (the number of students having questions). Our method will analyse after finishing one situation the state vector V to choose the most suitable situation among 6 defined situations.

Each criterion is evaluated by one or several properties in the state vector. We decompose the vector V into two sub-vectors in terms of two criteria:

𝑣 !"#$ = 𝑟𝑒𝑚𝑎𝑖𝑛𝑇, 𝑝𝑟𝑒𝑠𝑒𝑛𝑡𝑎𝑡𝑖𝑜𝑛𝑇, 𝑖𝑛𝑑𝑖𝑤𝑜𝑟𝑘𝑇, 𝑔𝑟𝑜𝑢𝑝𝑤𝑜𝑟𝑘𝑇, 𝑑𝑖𝑠𝑐𝑢𝑠𝑠𝑇, 𝑔𝑜𝑏𝑜𝑎𝑟𝑑𝑇, 𝑡𝑒𝑠𝑡𝑇
and 𝑣 !"#$%&!!"#$%" = q𝑢𝑒𝑠𝑡𝑖𝑜𝑛𝑁𝑢𝑚, 𝑞𝑢𝑒𝑠𝑡𝑖𝑜𝑛𝑆𝑡𝑢 . We consider the transformed traces base TrT in which each transformed trace has the following format: (V, execut-ed_situation). We decompose also the base TrT into two sub-bases in terms of two criteria (𝑇𝑟𝑇 !"#$ and 𝑇𝑟𝑇 !"#$%&!!"#$%" ). For each sub-base (containing q records), we extract in V all of the properties that contribute to evaluate the correspondent criterion. For each criterion, we compute the Euclidian distance between the state subvector and each transformed trace. The value of 𝑑𝑖𝑠 !"#$ ! 𝑠𝑖𝑡𝑢𝑎𝑡𝑖𝑜𝑛 ! represents the distance of the situation i between 𝑣 !"#$ and the 𝑞 !! transformed trace in 𝑇𝑟𝑇 !"#$ . We get for each criterion a matrix of size q × 1 containing all the distances between the current state sub-vector and q records in each transformed traces sub-base. The result is the set of two matrixes that correspond to two criteria. From the two matrices above, we choose the k smallest distances to compute the evaluation of each situation for each criterion, denoted 𝐸 ! 𝑠𝑖𝑡𝑢𝑎𝑡𝑖𝑜𝑛 ! . We choose k smallest distances because it represents k similar states in the past and for each state, teachers have chosen different situation to execute. Among k choices, we compute the probability for each choice in the past. Based on these probabilities, we will obtain the evaluation value of each situation by:

𝐸 ! 𝑠𝑖𝑡𝑢𝑎𝑡𝑖𝑜𝑛 ! = 𝑒 ! 𝑠𝑖𝑡𝑢𝑎𝑡𝑖𝑜𝑛 ! 𝑒 ! 𝑠𝑖𝑡𝑢𝑎𝑡𝑖𝑜𝑛 ! ! 𝑤𝑖𝑡ℎ 𝑒 ! 𝑠𝑖𝑡𝑢𝑎𝑡𝑖𝑜𝑛 ! = 𝑑𝑖𝑠 ! ! 𝑠𝑖𝑡𝑢𝑎𝑡𝑖𝑜𝑛 ! ! !!! , 𝑘 ≤ 𝑞
Once these calculations done for each criterion, the PROMETHEE II process continues to build a priority list of situations. The first situation of this list will be the chosen one and suggest that the teacher continue the course. The result of this method can answer our main question of the article "What can teachers do?"

Results and Discussion

Our experiments focus on two questions. Does Trace-Based PROMETHEE II suggest a situation to execute? Is this choice satisfied the teacher? We now illustrate the test to answer these questions to confirm the performance of our proposed method in POLARIS platform. We have obtained a base of 1024 transformed traces. From this base, we decompose into 2 sub-bases corresponding to 2 criteria (Time and Comprehension). We have tested our method in four cases corresponding to four traces bases as described in Fig. 1. We have four traces bases with different number of traces such as: a base containing 50 traces, 100 traces, 500 traces and 1024 traces.

In this test, we use the number of teachers' feedback to evaluate the effectiveness for each traces base. We have totally observed 76 decisionmakings using our method. We notice that the more the number of traces we have, the more the number of positive feedbacks we get. We can conclude that the combination between traces and decision method establish a new ITS. This one not only suggests that teacher do but also increases the teacher's satisfaction. method has not always obtained the high positive feedbacks from different teachers as the Table 1. We realize that the ITS integration in a course demonstrates its performance in comparison with a course without ITS for the novice teacher. We observe that the number of positive feedbacks for novice teachers is better with ITS integration than without ITS. In contrast, the positive feedback in course without ITS is higher than that is on the course with ITS for the experienced teachers. The reason is that experienced teachers are better trained in the course. Another limitation is that our method supposes the presence of a configured and up-to-date Trace-Based System. We must have enough data to compute the priority situations list to recommend to teachers. Our future work focuses on integrating the recommendation in our current ITS to improve the inconvenient about the effectiveness of experienced teachers.

Fig. 1 .

 1 Fig. 1. Impact of number of traces on the result

Table 1 .

 1 Result of feedbacks between novice and experimented teachers

		Novice teachers	Experienced teachers
		Course with ITS	Course (not ITS)	Course with ITS	Course (not ITS)
	+ feedback	48	11	21	40
	-feedback	2	39	29	10


Melissa Dark
email: dark@purdue.edu

Matt Bishop
email: mabishop@ucdavis.edu

Richard Linger
email: lingerr@ornl.gov

Luanne Goldrich
email: luanne.goldrich@jhuapl.edu

Realism in Teaching Cybersecurity Research: The Agile Research Process

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Abstract. As global threats to information systems continue to increase, the value of effective cybersecurity research has never been greater. There is a pressing need to educate future researchers about the research process itself, which is increasingly unpredictable, multi-disciplinary, multiorganizational, and team-oriented. In addition, there is a growing demand for cybersecurity research that can produce fast, authoritative, and actionable results. In short, speed matters. Organizations conducting cyber defense can benefit from the knowledge and experience of the best minds in order to make effective decisions in difficult and fast moving situations. The Agile Research process is a new approach to provide such rapid, authoritative, applied research. It is designed to be fast, transparent, and iterative, with each iteration producing results that can be applied quickly. Purdue University is employing Agile Research as a teaching vehicle in an innovative, multi-university graduate program with government sponsor participation, as described in this paper. Because it simulates real-world operations and processes, this program is equipping students to become effective contributors to cybersecurity research.

A New Approach to Teaching Cybersecurity Research

Graduate programs in computer security emphasize research. Students who pursue a masters degree by writing a thesis or a doctoral degree by writing a dissertation are expected to do research that contributes to the body of knowledge. This dedicated study of a research problem requires students to be motivated and interested in the problem, and to understand the context in which the problem arises. The obvious way to do this is to study a particular facet of the problem in an applied circumstance. The student can then understand the constraints and available mechanisms, and attempt to develop a methodology or theory that will solve the problem in this specific instance. This leads to a good masters thesis. Doctoral students can then generalize the problem by relaxing the constraints and examining the broader problem in other contexts. This leads to a traditional research problem, and hence to the dissertation.

Unfortunately, graduate students are often not exposed to research until they begin their thesis or dissertation work. The goal of the work described in this paper is to provide this exposure by integrating research into the curriculum. Specifically, it focuses on obtaining applied research problems from sponsors, and having the students apply research processes to the problems under the guidance of both faculty and sponsors. This assures the results will be of interest to, and usable by, the sponsors. It also leads to broader, more traditional research work that stems from the application.

This work aims to enhance students' ability to plan, organize, and carry out research, especially as a member of a team, under the combined mentorship of faculty and sponsors. Additionally, it provides a basis for educational institutions to give students research opportunities that bridge theory to practice by focusing on real-world problems with real-world applications. It does so through the mechanism of a class on computer security research, run in conjunction with industry and government sponsors.

Because of the limited duration of the class, the students cannot complete a full, long-term research project. But they can begin or continue one, and so the research must be organized in a way that produces deliverables of some sort for the sponsor within the time constraints of the class. Further, the students must carry out and document their work in such a way that a completely different team of students can pick up where the original students left off, and continue the work. A new research methodology called Agile Research [START_REF] Linger | Agile research for cybersecurity[END_REF] provides an ideal way to do this. This paper describes this work. The next section discusses the basis for the class, its organization, and how the work proceeds. Then we present a review of Agile Research, and follow up with a description of how the class implements the phases of that research methodology. We conclude with plans for the future.

Applied Research Class Organization

One of the focal activities of the INSuRE (Information Security Research and Education) project [1] is an applied research class. INSuRE is a consortium of 10 universities (Purdue University is the lead institution, and the other participants are Carnegie Mellon University, Dakota State University, Iowa State University, Mississippi State University, Northeastern University, Stevens Institute of Technology, the University of California Davis, the University of Maryland Baltimore County, and the University of Texas Dallas), plus the U. S. Department of Defense, Sandia National Laboratory, Pacific Northwest National Laboratory, Oak Ridge National Laboratory, the Indiana Office of Technology, and Hewlett-Packard. INSuRE aims to develop a partnership among sponsors that perform cybersecurity research and need the results to perform their missions, and cybersecurity researchers who conduct the research and produce results, including students and faculty at Centers of Academic Excellence in Information Assurance Research (CAE-R). INSuRE aims to become an agile, self-organizing, cooperative, multi-disciplinary, multi-institutional, and multi-level collaborative research project that can include both unclassified and classified research problems in cybersecurity. Currently, students from these 10 universities work on cybersecurity problems through coursework, directed independent study, and theses or dissertations.

The INSuRE applied research class provides an opportunity for students to work on problems provided by sponsors, as well as to be mentored by practitioners in the real world, rather than working solely on faculty-led research. More pressing and urgent problems are addressed, allowing the students to also benefit from the guidance of multiple and interdisciplinary research faculty from several institutions. The student-led research may in fact provide solutions for pressing national problems [START_REF] Maugham | The need for a national cybersecurity research and development agenda[END_REF]. To facilitate scientific discovery, learning, and collaboration we use an open source software platform called HUBzero R . HUBzero includes a powerful content management system built to support scientific activities. Users on a hub can write blog entries and participate in discussion groups, but it is possible to do so much more. They can work together on projects, publish datasets and computational tools with Digital Object Identifiers (DOIs), and make these publications available for others to usenot as dusty downloads, but as live, interactive digital resources. Simulation/modeling tools published on a hub can be accessed with the click of a button. They run on cloud computing resources, campus clusters, and other national high-performance computing (HPC) facilities and serve up compelling visualizations.

Prior to the class, faculty solicit research proposals from external organizations in government and industry. These proposals are a paragraph or two in length, and describe a research problem in fairly general terms. For example, a proposal to examine biometric systems of authentication might be as follows:

Title: Security of Biometric Authentication Biometric devices provide information about people that is often used to authenticate their identity. This information must be associated with other data that is used to match up the data from the device to the user. This raises two questions. First, how easily can the biometric device be fooled into reporting incorrect measurements? And second, can the user change the comparison data on the system? This project explores the second question by determining how to change the comparison data for a given biometric device. Sponsor : John Oldman References:

-"Biometric Security", http://example.com/bio-security -Jacob Marley, "Attacking a Biometric System," Journal of Christmas Past 3(1) pp. 1-20 (Jan. 1951).

This Spring, the list includes projects on forensics, using code variation as a defense, an analysis of the proposed TCPcrypt protocol, machine-assisted semantic understanding of code, profiling industrial control system nodes, and the impact of known vulnerabilities upon layered solutions. The list is compiled and made available to faculty immediately and to students on the first day of the semester/quarter.

Obtaining sponsor interest has thus far been very successful; indeed, typically there are more proposed projects than there are students. Faculty members have solicited projects from people they know and, in many cases, have worked with. Most projects have come from government groups, but industrial firms and organizations have also proposed several. Interestingly, the latter typically take longer to prepare and get approval for projects than do the government organizations. For example, at least two companies were hoping to propose projects for the Spring term, but were unable to obtain the necessary approvals in time.

Whether students can propose their own projects is up to the faculty member teaching the class. Some faculty allow this if the projects are substantial enough and deal with a current topic, on the basis that the students are best motivated when they are working on a project that they feel strongly enough about to propose. Other faculty members prefer that students select from the sponsor projects. As the proposed projects are typically broad, the students and sponsors have had no trouble narrowing down the projects to be of interest (sometimes enthusiastically so) to the students.

Complicating project selection is that different universities have different rules about working with sensitive projects. For example, the University of California at Davis does not allow any classified work to be done on campus, because that would restrict the ability of the researchers to publish (among other reasons). But other universities do. Proprietary work for industry has similar but different constraints. Thus, all sponsors must agree that, should the results and the work merit publication, the research from any project they propose can be published. As of now, this has not been a barrier to obtaining interesting projects.

The students prepare bids on at least two projects. First, the sponsors make a brief presentation to clarify their research needs and goals. Then the students engage in exercises to identify the knowledge, skills, and competencies required to work on the projects they are interested in. Each bid has four key components: a personal statement of interest, a description of the research problem (the most substantive section), the expected outcomes, and a description of student's skills, knowledge, and abilities relevant to the problem. Based on the students' bids, the faculty and research sponsors move quickly to form research teams.

Critical to the success of the project, of course, is that the team members work well together. In some cases, faculty and sponsors select the students that make up each team, which requires judging how amenable the members are to one another. The rationale for pairing students in teams can be based on student interest, expertise, and/or work style. In other cases, the students organize their own teams; the faculty and sponsor must accept the membership. Having students organize their own teams provides them with an opportunity to consider the factors that will constitute a research team, which is a valuable lesson. This ensures that the teams are balanced. Sometimes team membership changes after the initial formation. For example, at the University of California at Davis, a team of three members was reduced to two because one of the students became more interested in a different project, and so moved to the other team. However, all the students knew one another to some degree, and there were no problems with the change. The project has also started forming crossinstitutional teams for the first time in Spring 2015. There is a three-person team with students from Purdue University and Mississippi State University, and another two-person team with a student from Dakota State University and one from Purdue University.

These teams next prepare a proposal, the contents of which are similar to that which would go into a National Science Foundation proposal (but with much less detail). The key components of the proposal are the review and analysis of previous work, and the statement of the specific aims of the project. The proposal also contains a schedule of milestones that the students believe they can meet, a plan describing how the students will approach solving the problem, and a bibliography. It also requires a realistic schedule and budget, a list of deliverables, and a discussion of any foreseeable difficulties and anticipated plans to overcome them. When writing the proposals, the students interact iteratively with sponsors and faculty to define the scope of the problem and near-term action steps to be taken. This step is critical in helping students assume the research problem as theirs as opposed to a work for hire, where the sponsors have "dictated" the scope of work and the students are simply following directions.

Once the proposal is approved, the students begin their research. As a first step, the students conduct a thorough literature review. This augments the quick literature reviews done earlier. Those reviews are simply aimed to show that the project has not been done earlier, and that it is substantial enough to advance the state of cybersecurity in some way. This literature review is structured around an argument or arguments. Typically, these arguments point out critical gaps in the existing literature, or how the work in that literature might be extended. If the goal of the research is to validate or correct a published result, the argument would explain the context of the work to be validated or corrected, why it is important, and what would happen if the prior results were incorrect or not corrected. The literature review is of sufficient importance that it is treated as an assignment and is weighted as much as the proposal is weighted.

Following that, the students begin acting on the plan laid out in the proposal. However, the teams are not left on their own to simply execute a 10-week project plan. Instead, teams meet every week with faculty and sponsors to report progress, the challenges encountered, how they are dealing with those challenges, and the next weeks goals. The goals sometimes change based on the challenges encountered. The rapid, successive iterations permit sponsors to modify incremental research goals and apply results based on intermediate findings as the work progresses (the principle of incremental management within a semester or quarter), and allows students to experience first hand the truly iterative and fast-paced nature of cybersecurity research.

The class requires students to prepare a midterm progress report that is delivered as a formal presentation to all classes across the universities via teleconference, and a final project presentation that also incudes a written report and poster. At the end of the semester, all students present the results of their research. For those on a semester system, this is a final presentation and report. For those on a quarter system, this occurs in the middle of the second quarter, and so is a penultimate presentation and report. Finally, those on the quarter system do a final project report and presentation at the end of the second quarter. The sponsor and the faculty member then evaluate the project.

One critical aspect of the final assignment is to document the progress made in a manner that allows the sponsor to iterate the next increment, and allows a team (at the same university or a different university) to pick the project up the next semester/quarter and continue the research, also in an agile, iterative manner. The specific manifestations of this differ based on the nature of the project. In some instances it includes a theoretical model that is sufficiently explained to allow a new team of student researchers to simulate and test the model. Another instance might be curating a dataset in a manner such that it is available for reuse and preservation. This type of documentation is essential to enabling the sponsor and faculty to incrementally manage research projects across semesters or quarters, and across institutions.

The sequence below summarizes the steps that the students follow [START_REF]Ecs 289m spring quarter 2015[END_REF]:

1. Project bid 2. Project proposal 3. Literature review 4. Progress report and presentation 5. Final report and presentation for schools on semester system; penultimate report and presentation for schools on quarter system 6. Final report and presentation for schools on quarter system Given that the class uses a non-traditional model of research, specifically one with a much tighter time-line than traditional research, a new model is needed. Fortunately, such a model has been developed: the Agile Research process.

Agile Research

Traditional, long-term research often involves extensive requirements definitions, comprehensive proposals, competitive awards, distributed organizational structures, complex funding protocols, and long-term performance that can extend for years. When the scope and scale of research requirements are large, these traditional processes and their management procedures are essential to maintaining control across collaborating organizations and reducing risks of overruns and non-performance. As such, they serve a vital role in conducting large-scale, long-term research projects to achieve national goals [START_REF] Branscomb | Between invention and innovation an analysis of funding for early-stage technology development[END_REF][START_REF] Maugham | The need for a national cybersecurity research and development agenda[END_REF].

But events occur in cybersecurity areas that require fast and decisive responses in order to protect national well-being and even survival [START_REF] Fonash | Cybersecurity: From months to milliseconds[END_REF]. These responses would benefit from rapid and authoritative analysis by the best minds and organizations. The traditional research infrastructure was never intended for this level of fast engagement and immediate application, and is not well suited for these situations.

The Agile Research process [START_REF] Linger | Agile research for cybersecurity[END_REF][START_REF] Linger | Agile research for cybersecurity: Creating authoritative, actionable knowledge when speed matters[END_REF] was developed to address the need for fast and effective researcher participation in situations where speed is an overarching requirement. When attempts have been made to apply traditional methods in these situations, the research results are often too late to be of use in the current cybersecurity event, and wind up sitting on a shelf, unused and forgotten.

Agile Research is organized around sponsors, who pose research questions to be answered, and researchers, who conduct the research and produce results. Sponsors and researchers may be in the same or different organizations, and may be organized in any number of ways provided the following principles are satisfied [START_REF] Linger | Agile research for cybersecurity[END_REF][START_REF] Linger | Agile research for cybersecurity: Creating authoritative, actionable knowledge when speed matters[END_REF].

-Predefined Infrastructure Principle: Resources and logistics must be predefined and allocated before research needs emerge, to permit immediate deployment for fast engagement when needed. Agreements between sponsors and researchers regarding organizational roles, research capabilities, and contracting, funding, and intellectual property must be in place and ready to be instantiated in unforeseen circumstances with no delays. This "load-and-go" approach permits fast reaction by pre-positioned resources to unpredictable research needs unburdened by logistical constraints. -Incremental Research Principle: Agile Research is structured into iterative, short-term, accumulating increments that each produces actionable results. Increments must first focus on understanding the problem, progress to solution strategies, and then to incremental solutions. Understanding how to organize research into a series of accumulating, referentially transparent increments requires careful planning. Early increments must provide a framework for inserting and composing later increments such that results accumulate with little or no revision of prior work. -Incremental Management Principle: The incremental research process provides built-in, short-term checkpoints for sponsors to understand researcher progress, and to direct subsequent work based on incremental findings. Agile Research projects can be quickly refocused based on changes in both fastpaced problem environments and on intermediate shortfalls and windfalls in the research. Visibility, transparency, and clear communication between researchers and sponsors are essential for informed management decisionmaking. -Transferability Principle: Agile Research projects may be carried out by one group of researchers, but ready transfer of results from one group to another must be possible if necessary. As research increments are completed and changes in direction are made, mechanisms for quickly repositioning the research and resources to a new team must be in place. This includes knowing where the research expertise exists for the next increment, as well as providing supporting documentation that permits a new team to pick up the work seamlessly and rapidly.

Agile Research projects proceed through up to four stages, each culminating in researchers delivering results, either through briefings, white papers, tools, or a combination of these. At the completion of each stage, the sponsor decides whether and how to proceed. This process is summarized in Figure 1. In the first stage of the class, the students do background work to prepare their bids and begin to scope the project. The sponsor starts the process by proposing a rather general research problem. Then each student makes a preliminary exploration of related work and decides on a view of the research project that he or she would like to explore. These recommendations will form a foundation for the research should the bid be accepted. In addition, the student identifies the competencies necessary by explaining why he or she is qualified to carry out the research.

This matches the QuickLook Stage of the Agile Research process almost exactly. The single difference is in the identification of the subject-matter experts. Rather than identifying others who are already these experts, the students explain why they should be considered, or will become, the subject-matter experts.

In a non-class setting, the subject-matter experts may well not be the people performing the QuickLook stage. The timing also matches. The bidding process for the class takes between 1 and 3 weeks; the controlling factor is the availability of the sponsors. In a non-class setting, the QuickLook would take about the same amount of time, again the availability of the sponsors being a critical factor.

The DeepLook Stage corresponds to the preparation of the proposal. Based on the bids, the students, faculty, and sponsors form the research teams. The teams then prepare proposals, as described above. The proposals present the goals of the research project, just as the DeepLook requires an answer to the question of what the research can be expected to accomplish. It contains a plan, saying how the research is to be done. Thus, it matches the DeepLook phase exactly.

The research itself instantiates the Incremental Research Stage of the Agile Research process. As noted above, the students meet with the sponsor weekly, with specific goals being set each week, and based on the results of each weeks progress, the sponsor can modify the research goals. Further, the sponsor can apply intermediate results from the teams work. This matches the goals and design of the Incremental Research Stage.

The design and implementation of the class reflects the principles of Agile Research. Of particular note is the transferability principle, which says that the results of one group must be transferable to another group. This is exactly how each team wraps up its results at the end of the class, because another team, possibly from another university or even split across multiple universities, may choose to pick up where the research was left off. Similarly, the incremental management principle requires that the research progress be incremental, with checkpoints for the sponsor and team to confer and determine how best to proceed; the sponsor will also receive actionable results at each increment. Again, this is reflected in the weekly meetings between the team and the sponsor.

Conclusion

The INSuRE program was begin over a year ago. Initially four universities were involved; the success of that initial year encouraged six more universities to join, and more organizations to propose problems. The Agile Research model was developed for a different purpose. However, it very closely mimics the desired approach used in the class, so applying the model provides a framework to support the effectiveness of the research process used in the class.

The use of Agile Research in this context raises some interesting questions. The work performed here is public (not classified nor proprietary), because some of the universities require that any research conducted must be publishable. How would this model work in a non-public arena? Would the proprietary or governmental constraints interfere with the educational benefits of applying the Agile Research model? Another question is measuring how effective this approach is in training the students in research methodology. Can the techniques they learn here help them conduct the more traditional, long-term research needed for a doctoral dissertation? The intuitive answer is yes, because the structure of planning the research to produce publishable intermediate results will provide the students with a strong publication record when they complete their dissertation research, and the intermediate results may cause them to refocus the research if those results indicate the expected results will not hold or cannot be done. But the nature of the research-applied vs. pure-may pose a clash in the two approaches. Agile Research begins as a very applied research methodology, but traditional academic research is intended to extend the body of knowledge in ways that may not be immediately applicable. As an example, Riemannian geometry was developed in the 19th century as a demonstration that Euclid-s fifth postulate was in fact an axiom and not a provable proposition. It had no realistic applications until the 20th century, when the geometry of the universe was found to be Riemannian and not Euclidean. Were the goal of the research to develop a useful geometry, Riemannian geometry might never have been developed.

There is of course a place for both applied and pure research-indeed, pure research often provides the tools upon which applied research builds, and applied research often motivates the questions that guide pure research. Agile Research, with its emphasis on actionable results, is more applied, but leads to the fundamental questions that students can examine in their dissertations. Thus, it fills an important niche, and when used in an educational setting such as the INSuRE class described here, provides a firm foundation for students to begin a successful cybersecurity education and career.

Fig. 1 .

 1 Fig. 1. The Agile Research process

4

  Putting the Class and Agile Research Together The Agile Research model is well suited for the INSuRE class. Its structure corresponds closely to the first three phases of that model: the QuickLook Stage, the DeepLook Stage, and the Incremental Research Stage. Figure 2 depicts integration of the Agile Research process with the applied research class and the sponsoring organizations.

Fig. 2 .

 2 Fig. 2. Integration of Agile Research and applied research class

Acknowledgements: Melissa Dark and Matt Bishop were supported by the National Science Foundation Grant Number DUE-1344369 to Purdue University, and by a subcontract from Purdue University to the University of California funded by that grant. Matt Bishop was also supported by the National Science Foundation Grant Number OCI-1246061 to the University of California at Davis. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation, Purdue University, or the University of California.

Richard Linger worked on this manuscript as an employee of UT-Battelle, LLC, under Contract No. DE-AC05-00OR22725 with the U.S. Department of Energy. The United States Government retains and the publisher, by accepting the article for publication, acknowledges that the United States Government retains a non-exclusive, paid-up, irrevocable, world-wide license to publish or reproduce the published form of this manuscript, or allow others to do so, for United States Government purposes. This submission was written by the author(s) acting in their own independent capacity and not on behalf of UT-Battelle, LLC, or its affiliates or successors.