This site loads optional analytics from Google and external analytics providers only if you accept. You can decline and continue using the site normally.
Use of LLMs as a support layer for attack explanation, mitigation recommendation and human-in-the-loop incident analysis.
LLMs can help translate low-level security signals into explanations, response options and investigation hypotheses. In cyberdefense, the useful role is not autonomous decision-making, but bounded support that improves analyst understanding and response speed.
Security use cases require stronger controls than general-purpose assistants. Outputs need provenance, grounding in observed evidence, traceable recommendations and safeguards against hallucinated mitigations or overconfident explanations.
LLM-assisted cyberdefense overlaps with explainability, evaluation, human factors and accountable AI. The research question is how to make these systems useful without increasing operational risk.
In high-impact settings, LLMs are better positioned as advisory systems. They can explain and suggest, while humans and controlled playbooks approve actions.
The main risk is producing plausible but unsupported explanations or mitigations. Grounding, evaluation and human review are essential.
They are useful for summarizing evidence, explaining alerts, comparing response options and documenting incident reasoning.
DEFENDIS develops a framework for uniquely identifying IoT devices in a distributed manner while solving security threats through decentralized federated learning.
View ProjectA European research project on methods and proofs of concept for supporting cyber defence incident management.
View ProjectROBUST-6G studies security mechanisms for 6G systems, including monitoring, secure data management, trustworthy AI services, federated learning, and threat response.
View ProjectA cybersecurity framework for Brain-Computer Interface systems in advanced driver assistance scenarios, focused on detecting and preventing attacks across the BCI lifecycle.
View ProjectA practical map of LLM roles in cyberdefense, from threat-intelligence support to alert triage and explanation, with explicit limits and controls.
How to frame autonomous cyberdefense as a bounded control loop with evidence, policies, recovery paths and accountable human intervention.
A design pattern for using language models to explain incidents and compare mitigation options while approved policies retain control of execution.
A grounded introduction to RAG for threat intelligence, incident analysis and cyberdefense, including retrieval quality, provenance and failure modes.
How graph-based retrieval can connect actors, techniques, assets and incidents while preserving a traceable path to source evidence.