This site loads optional analytics from Google and external analytics providers only if you accept. You can decline and continue using the site normally.
AI and machine learning methods for threat detection, incident management, situational awareness and attack mitigation.
AI for cyberdefense is valuable when it helps analysts detect, interpret and respond to hostile activity. The technical challenge is not only predictive accuracy, but also reliability under noisy telemetry, adversarial pressure and incomplete context.
Cyberdefense data is rarely centralized in a clean, complete and shareable dataset. Distributed learning, federated approaches and privacy-aware collaboration make it possible to learn from multiple environments without exposing all raw traces to one party.
The portfolio connects cyberdefense AI with decentralized federated learning, attack explanation, mitigation recommendation, robust aggregation and applied systems such as aerial reconnaissance, energy anomaly detection and IoT security.
It is the use of machine learning and AI methods to detect threats, prioritize incidents, explain attacker behavior and support mitigation in security operations.
Security teams need to understand why a model raised an alert before they trust it in high-impact response workflows.
Yes, federated and decentralized learning can train or adapt models across different environments while keeping raw telemetry local.
DEFENDIS develops a framework for uniquely identifying IoT devices in a distributed manner while solving security threats through decentralized federated learning.
View ProjectA European research project on methods and proofs of concept for supporting cyber defence incident management.
View ProjectROBUST-6G studies security mechanisms for 6G systems, including monitoring, secure data management, trustworthy AI services, federated learning, and threat response.
View ProjectA cybersecurity framework for Brain-Computer Interface systems in advanced driver assistance scenarios, focused on detecting and preventing attacks across the BCI lifecycle.
View ProjectA practical map of LLM roles in cyberdefense, from threat-intelligence support to alert triage and explanation, with explicit limits and controls.
How to frame autonomous cyberdefense as a bounded control loop with evidence, policies, recovery paths and accountable human intervention.
A design pattern for using language models to explain incidents and compare mitigation options while approved policies retain control of execution.
A grounded introduction to RAG for threat intelligence, incident analysis and cyberdefense, including retrieval quality, provenance and failure modes.
How graph-based retrieval can connect actors, techniques, assets and incidents while preserving a traceable path to source evidence.