SCORPION

SCORPION is a cybersecurity training cyber range for the civilian sector (universities and companies), the civilian version of COBRA, developed at CyberDataLab, University of Murcia. It combines microservice orchestration with infrastructure as code, gamification and learning analytics.

My master's thesis (9.4/10), "Real-Time Analysis and Monitoring of Microservices Based Applications", proposes a real-time observability framework for cyber ranges and validates it on SCORPION. The goal: turn every cyber exercise into useful information.

• Real-time tracking of every command students run, to verify their progress, troubleshoot and detect suspicious behaviour or cheating.
• Learning analytics and gamification: progress, attempts and hints per student, and detection of behavioural patterns.
• Adaptive orchestration (MAPE-K loop) that adjusts the exercise to how each student performs.
• A basis for discovering, from aggregated traces, solution paths that were not anticipated when the exercise was designed.
• Technology-agnostic reference architecture: system and user telemetry unified over Kafka, implemented with Terraform, vSphere, Ansible, Fluent Bit, Loki and Grafana, with minimal performance overhead.