Dont Just Teach, Explain! A Gamified 20Q Recommender for Cybersecurity Education

Abstract

The escalating complexity of modern cyber threats demands innovative approaches to security education that transcend traditional pedagogical methods. Conventional training paradigms often fail to engage learners meaningfully or develop the intuitive reasoning necessary for effective threat recognition. This paper introduces an interactive educational framework that reimagines cybersecurity awareness through the lens of a structured guessing game. Our approach integrates explainable artificial intelligence (XAI) principles with reinforcement learning to create a dynamic learning environment where users discover cybersecurity concepts through guided inquiry. The proposed system employs a policy-based reinforcement learning agent that assumes the role of a knowledgeable questioner, systematically narrowing down user-described security scenarios until it can both identify the underlying threat and provide transparent reasoning for its conclusion. By framing security education as an interactive dialogue, we transform passive knowledge acquisition into active discovery. We present the complete system architecture, detail the underlying algorithmic foundations, and demonstrate practical application through comprehensive case studies examining diverse attack vectors including the Cyber Kill Chain, phishing campaigns, ransomware outbreaks, and web application vulnerabilities. This work represents a significant departure from static security training methodologies, offering a personalized and game-based approach to cybersecurity education.