Research & Projects

Privacy-respecting Explainable Assessment and Collection of Threats (PREACT) The project's goal is to research and develop a system for collecting and processing indicators of compromise (e.g., domain name) from computer networks and their usage for improving cyber security. Security improvements will be achieved by creating a central model describing different attacks on different networks and distributing this model back to the monitored networks. This will enable proactive detection of network threats that attackers have not yet attacked. Because threat information may contain sensitive information, privacy-preserving techniques will be used in the project solution. Another research direction will focus on the possibilities of using large language models of the GPT model type to explain detected threats based on historical knowledge.

Combined passive and active network monitoring (INVENTOR) The project aims to allow network administrators to monitor cloud applications in a way that will enable them to detect potential problems in time and respond adequately. Administrator obtains information about the availability and performance of individual cloud applications. When a problem appears, it will be possible to identify whether it is caused by an error in the local network, on the side of the application, or in the service provider network. 

 

Technology for processing and analysis of network data in big data concept Goal of this project is to develop innovative solution for up-to-date services and infrastructure enabling to detect operational and security risks (i.e. attacks, anomalies, failures or decreased service quality). The developed solution will meet customer requirements for processing and analysis of enormous amounts of specific network-related data.

 

Technology for protection of high speed network The project aims to create a device to process and filter traffic on high-speed networks (up to 400 Gbps) with HW and SW support for application analysis of packets. The device will feature modular design allowing to add support for specific application protocols (as plug-ins). Hardware-accelerated network cards will be used to achieve high processing performance. Accelerators will provide Ethernet interface with total throughput of 400 Gbps in both directions.

 

Streamlining cybersecurity incident analyses (SECURIAN) Cybersecurity teams currently use the tools that excel in analytical capabilities but offer only limited support for their procedural documentation. It results in unnecessarily high cognitive demands on analysts, which makes the whole process time-consuming and error-prone. The project aims at providing a drill-down analysis support tool that combines visual querying methods, an analytical provenance concept, and a machine-readable data format to store provenance metadata.

 

Decentralized, cooperative, and privacy-preserving monitoring for trustworthiness DEMONS envisions building a novel cooperative network monitoring and mitigation system based on a completely decentralized, application-aware, privacy-preserving, multi-jurisdictional monitoring infrastructure. Such an infrastructure will provide the detection, reporting and mitigation mechanisms needed to combat not only today’s threats, but also those of tomorrow. DEMONS aims to realize this infrastructure by applying novel distributed systems technologies and leveraging their native scalability and fault tolerance characteristics. In doing this, DEMONS puts special emphasis on privacy, trust, and legal issues arising from collecting and exporting data across operator domains and across multiple jurisdictions.

 

Distributed system for complex monitoring of high-speed networks The aim of the Project is the distributed system for monitoring of 40/100 Gigabit Ethernet networks, consisting of measurement probes with hardware-accelerated functions and software for collecting data from the probes, its centralized storage, visualization and evaluation. Hardware-accelerated data acquisition will be realized by custom FPGA-based board, which will allow the use of firmware equipped with specialized monitoring functions. The design and realization of these functions for 100 Gb/s throughput is a non-trivial research goal.

 

Cyber security competence for research and innovation (CONCORDIA) Europe needs to step up its efforts and strengthen its very own security capacities to secure its digital society, economy, and democracy. The vision for Europe can only be to join forces across Europe’s research, industry and public sector and to include all talents not just those that have representation in the EU mainstream or are within big organizations.

 

Advanced convergent and easily manageable innovative network design (ACEMIND) The goal of ACEMIND project is an applied research in the area of interconnection, configuration and monitoring of hybrid computer networks and devices connected in digital homes and small enterprises. The project outputs include (1) architecture and design of advanced convergent and easily manageable hybrid networks, (2) research and development of tools for management and monitoring of hybrid networks, (3) dissemination, standardization and teaching activities in hybrid networks area.

 

Research and Development of Advanced Analytics Tools (ITOA) The aim of this project is developing tools for network and application performance analysis based on network monitoring and complex event processing of security and performance events. It will employ methods of anomaly detection and behavioral analysis, which will be used to identify performance-related problems of applications in a monitored network.

 

National centre of competence in cybersecurity The emergence of the NCC Centre is a response to strong demand for products and solutions to ensure cybersecurity of critical and noncritical information infrastructures. The Center brings together top research institutes and long-term cybersecurity industries to do collaborative R&D in cybersecurity solutions at the HW and SW level and mechanisms for certifying security features of the products. With its industry partners, the Center will seek to deploy the solutions in the ever-growing cybersecurity market. It will strengthen the Czech industry and research at European and world level.

 

DISTANCE - Packet analysis based network diagnostics The goal of the presented project is to develop a software tool that: i) performs a highly-configurable traffic recording, ii) analyzes network traffic to diagnose network communication problems, performance degradation or security threats, and iii) provides visualization of evidence to network administrators in a simple and readable form. The project’s result will be integrated to existing network monitoring platform and will be sold as a new product.

 

Adaptive control of data collection and analysis in high speed networks (FOKUS) The aim is to create a system that achieves higher threat detection rate and better quality of data acquisition in networks. That will be accomplished using feedback loop from detection systems to probes. Detection systems will, based on data analysis, request probes to perform more detailed analysis of a selected traffic portion. Probes will carry out additional processing, eg. application layer processing or full packet capture. New probe for 400 Gbps processing will be created in the project.

 

Smart ADS This project aims at developing a new generation of attack and network anomaly detection system. Three software results will be developed.

 

Smart sensors for measurement and analysis of cloud environments (MACE) The aim of the project is a development of intelligent sensors for monitoring and analysis of network traffic in a cloud environment. We plan to research novel monitoring approaches focusing on resource optimization, autonomous management, and collection of monitoring infrastructure telemetry. Management and data collection will use secured channels to prevent misuse of the transferred information.

 

Internet of things monitoring and forensics (IRONSTONE) The proposed project will provide novel solution to IoT monitoring and investigation for Industrial IoT and Smart Home IoT implementations. We intentionally restrict the scope of the project to make it practically feasible to produce results targeting the market opportunities of involved commercial partners.

 

Security monitoring of ICS communication in the smart grid (BONNET) The aim of the project to design and implement a system for security and safety of critical infrastructure of the Smart Grids. The system will provide visibility of ICS communication within the Smart Grid and detection of cyber attacks or malfuctioning. The detection system will be based on traffic profiles.

 

FlowTest: testing of network monitoring devices The aim of this project is research and development in the area of testing security network devices with a focus on flow-based monitoring probes. The main goal is to create a testing environment (testbed) where all the outcomes will be deployed and available. These include a test automation orchestration system, a high-speed traffic generator from given network profiles, and a toolset for automatic evaluation of tests. Furthermore, to achieve practical applicability of the testing infrastructure, creating a set of test cases, including traffic samples and a network profile generation tool, are considered. The environment enables the users (or security auditors) to validate selected network devices' functionality before their actual deployment to the target network.

 

Context-based Encrypted Traffic Analysis Using Flow Data (ETA) The goal of the project is to design a new system for threat detection using contextual NetFlow analysis. This analysis is based on revealing the relationships between individual network traffic records without the need to decrypt the traffic to improve the analysis capabilities compared to the classical approach, which is based on the analysis of only individual records in isolation. With the new type of analysis, it is possible to identify threats that are currently hidden due to encryption and, at the same time, provide network administrators additional information to create an overall picture of the state of the network, services, or applications used.