Abstract:
Cybersecurity education faces a persistent gap between conceptual knowledge and the applied, decision-making skills that practitioners actually need. Conventional lectures and multiple-choice assessments rarely place learners in the position of investigating an incident, reasoning about evidence, and choosing a defensible response under realistic constraints. This thesis presents CyberQuest, a gamified and story-driven web platform designed to develop practical cybersecurity skills through a sequence of narrative missions that place the learner inside plausible security scenarios such as an intrusion into a smart-city power grid, a compromised smart-home network, a phishing campaign, weak-credential exploitation, an attack on an autonomous vehicle, and a multi-vector distributed denial-of-service (DDoS) incident. The platform is implemented as an ASP.NET Core 8 Model-View-Controller (MVC) application backed by a Microsoft SQL Server relational database, in which all mission content, progression rules, achievements, and learner telemetry are stored rather than hard-coded. Each mission is decomposed into ordered stages that the learner clears by investigating evidence through a simulated command-line terminal and submitting a captured “flag.” A progression system awards experience points, advances the learner through named levels, and unlocks achievement badges, while a progressive hint mechanism and a lightweight adaptive-difficulty component aim to keep learners within a productive challenge range. A global leaderboard and personal dashboard provide feedback and social motivation. The system was developed iteratively and validated through functional testing of its authentication, mission-play, scoring, and persistence workflows, together with a structured walkthrough of each mission to confirm that its intended learning outcome is reachable. The resulting platform demonstrates that a database-driven, gamified design can deliver a coherent, extensible, and engaging environment for hands-on cybersecurity practice, and it provides a foundation on which richer adaptive and analytics-driven features can be built in future work. Keywords: cybersecurity education, gamification, serious games, capture-the-flag, adaptive learning, ASP.NET Core, web application, DDoS defens
