This site loads optional analytics from Google and external analytics providers only if you accept. You can decline and continue using the site normally.
Use of LLMs as a support layer for attack explanation, mitigation recommendation and human-in-the-loop incident analysis.
LLMs can help translate low-level security signals into explanations, response options and investigation hypotheses. In cyberdefense, the useful role is not autonomous decision-making, but bounded support that improves analyst understanding and response speed.
Security use cases require stronger controls than general-purpose assistants. Outputs need provenance, grounding in observed evidence, traceable recommendations and safeguards against hallucinated mitigations or overconfident explanations.
LLM-assisted cyberdefense overlaps with explainability, evaluation, human factors and accountable AI. The research question is how to make these systems useful without increasing operational risk.
In high-impact settings, LLMs are better positioned as advisory systems. They can explain and suggest, while humans and controlled playbooks approve actions.
The main risk is producing plausible but unsupported explanations or mitigations. Grounding, evaluation and human review are essential.
They are useful for summarizing evidence, explaining alerts, comparing response options and documenting incident reasoning.
DEFENDIS develops a framework for uniquely identifying IoT devices in a distributed manner while solving security threats through decentralized federated learning.
View ProjectA European research project on methods and proofs of concept for supporting cyber defence incident management.
View ProjectROBUST-6G studies security mechanisms for 6G systems, including monitoring, secure data management, trustworthy AI services, federated learning, and threat response.
View ProjectA comprehensive cybersecurity framework for Brain-Computer Interface systems in advanced driver assistance scenarios, focusing on detecting and preventing cyberattacks on the BCI lifecycle.
View ProjectA practical note on how distributed monitoring, DFL models, alert evidence and LLM-based support can fit into a cyberdefense workflow.
A research note on using DFL to turn distributed telemetry, anomalies and trust signals into cyberdefense situational awareness.
A technical note on how drone fleets can use DFL to collaborate on detection models without exposing mission telemetry.
A focused research note on median, trimmed mean and trust-weighted aggregation for peer-to-peer federations under poisoning and unreliable clients.
A research note on edge training, secure aggregation and adaptive privacy budgets for IoT security monitoring.