Effective defense requires insight into the capabilities and intentions of the adversary. Without it, we run the risk to not allocate defenses where they matter most, and thus remain vulnerable or waste precious resources.
The cyber threat intelligence lab at HPI develops methods to collect information about adversaries, their tactics, and ways to securely share this information, because as defenders we can only be successful by working together.
Christian DoerrPrincipal Investigator of the CTI Lab
Current defense focus mostly on low-level indicators of compromise, which adversaries can trivially change to avoid detection. We develop AI algorithms and fingerprinting techniques to track attackers and their techniques for sustainable detection success.
In order to successfully customize a defense portfolio, organizations need threat intelligence. We develop mechanisms to extract actionable intelligence from data already present in organizations, and design algorithms so that intelligence can be shared while maintaining users' privacy.
How large are attacks? How are adversaries trying to break in? Using our network telescope and distributed sensor infrastructure, we are estimating the size and impact of attacks, and measure the resilience of the Internet ecosystem.
To address advanced and evolving threats, advanced and adaptive countermeasures are needed. Our lab designs algorithms that can sense minor anomalies, but require only minimal training effort to provide effective and cost effective mitigation.
Coming week, the ENISA Summer School on Network and Information Security will take place in Heraklion, Greece, including a two day training on Cyber Threat Intelligence. Our entire team will be there, join us for our introduction on CTI fundamentals or have some ice-cold drink with us afterwards.
This week, the first International Workshop on Cyber Threat Intelligence (WCTI) has taken place in Hamburg, Germany. 40 attendees had an engaging discussion on the latest innovations, big challenges and future directions in CTI. Read More
Finally, our new website is live. Over the coming months, you will be able to read more about the emerging field of cyber threat intelligence here.
This year, we have a busy summer and are showcasing our work at three summer schools: the National Cyber Security Summer School, the Indo-Dutch Summer School and the Risk Management Summer Course. Great to see so much multidisciplinary interest into cybersecurity!
Our two BSc students Stijn Pletinckx and Cyril Trap have won the award for the best honors thesis of the TU Delft. Congratulations!