INTERconnected Security OperatIon Centres

ongoing

INTERSOC envisions to improve disruption preparedness, resilience of digital infrastructures, and capacity building, through advanced threat forecasting, cyber-incident detection and response capabilities, at national and EU level, and dedicated training sessions in digital infrastructure security, while respecting privacy and other fundamental rights. To achieve this, INTERSOC will design and develop a user-centric intelligent threat defence and decision support platform by uniquely combining: 1. Highly sophisticated network and system behavioural monitoring, towards identification of anomalies caused by novel multi-faceted attacks. This would be achieved by enhancing the traditional SIEMs and IDS with behavioural and decisional Artificial Intelligence (AI) algorithms. 2. A low-code approach to security orchestration and incident management automation. 3. Decentralised, confidential Cyber Threat Information (CTI) sharing based on peer-to-peer networks and in compliance with the EU regulatory framework, 4. Trust models and trustworthy technology fine-tuned to address trust relationships when sharing information over the internet. 5. Risk and threat analysis, impact assessment and risk treatment to identify, analyse and eliminate security threats and vulnerabilities of the pilot systems. 6. Enhanced penetration tools and methodologies tackling emerging vulnerabilities. The tools will be used to actively test and attack the security of SOCs on the pilot systems. 7. Cutting-edge Trustworthy AI algorithms will be meticulously developed, taking into account the current evolving EU regulatory framework (e.g. proposal for AI act) and standard working groups (e.g. CEN/CLC JTC21 WG4). 8. The utilization of a cyber-range-type Virtualization Platform will facilitate the deployment and hosting of advanced red/blue team exercises, fostering capacity building and enhancing user awareness. Three diverse sectors (banking, energy, CSIRT training) over a set of use-cases.