AI and machine learning methods for threat detection, incident management, situational awareness and attack mitigation.
AI for cyberdefense is valuable when it helps analysts detect, interpret and respond to hostile activity. The technical challenge is not only predictive accuracy, but also reliability under noisy telemetry, adversarial pressure and incomplete context.
Cyberdefense data is rarely centralized in a clean, complete and shareable dataset. Distributed learning, federated approaches and privacy-aware collaboration make it possible to learn from multiple environments without exposing all raw traces to one party.
The portfolio connects cyberdefense AI with decentralized federated learning, attack explanation, mitigation recommendation, robust aggregation and applied systems such as aerial reconnaissance, energy anomaly detection and IoT security.
It is the use of machine learning and AI methods to detect threats, prioritize incidents, explain attacker behavior and support mitigation in security operations.
Security teams need to understand why a model raised an alert before they trust it in high-impact response workflows.
Yes, federated and decentralized learning can train or adapt models across different environments while keeping raw telemetry local.
DEFENDIS develops a framework for uniquely identifying IoT devices in a distributed manner while solving security threats through decentralized federated learning.
View ProjectA European research project on methods and proofs of concept for supporting cyber defence incident management.
View ProjectROBUST-6G studies security mechanisms for 6G systems, including monitoring, secure data management, trustworthy AI services, federated learning, and threat response.
View ProjectA cybersecurity framework for Brain-Computer Interface systems in advanced driver assistance scenarios, focused on detecting and preventing attacks across the BCI lifecycle.
View ProjectMove from foundations to design and evaluation. Each note addresses a different question.
Connect telemetry, federated learning, alerts and LLM-assisted mitigation with traceable evidence, validation and reviewed feedback.
Build cyberdefense situational awareness with DFL: provenance, coverage, uncertainty and shared context for operational decisions.
LLM-assisted mitigation: playbooks, evidence, permissions, idempotency and recovery. Turn recommendations into verifiable actions.
LLM and RAG metrics: retrieval recall, citations, unsafe actions, calibration, latency and uncertainty. Define fair comparisons.
This site loads optional analytics from Google and external analytics providers only if you accept. You can decline and continue using the site normally.