OPTIMA · Organization sPecific Threat Intelligence Mining and sharing

Organization sPecific Threat Intelligence Mining and sharing

Digitalisation is creating new opportunities in finance, healthcare, industrial control systems, network security, and AI-driven cybersecurity, but it also introduces critical risks. These include cyber threats, adversarial AI attacks, privacy concerns, and regulatory challenges. To maximize the benefits while mitigating risks, organisations must adopt explainable AI, privacy-preserving federated learning, secure blockchain integration, and proactive cyber threat intelligence mechanisms. Strengthening cybersecurity frameworks with robust attack detection, secure data-sharing, and adversarial resilience is essential to ensure a secure digital future. Thus, the OPTIMA project (Organization sPecific Threat Intelligence Mining and sharing) aimed to design techniques and tools for the extraction of Threat Intelligence targeted to organizations using ML algorithms, and effectively share attack records using privacy-preserving methods. The Research & Innovation Objectives (RIO) of the project are as follows: 1. RIO1-To develop techniques for automatic extraction of threat intelligence using OSINT data for multiple institutions (eg., health care, finance, IoT, education) using deep learning approaches. 2. RIO2-To create a novel automated system to derive Indicator of Compromise (IOC) based on word embedding and syntactic dependencies of words to identify unseen IOCs. Utilizing the extracted IOCs a threat index will be estimated to define the impact of threat and attack trends across individual organizations; 3. RIO3-To build a system by integrating cryptographic tools and Federated learning which will enable an organization to anonymously share threat logs with different parties in a privacy-preserving manner. The OPTIMA project (Organization-sPecific Threat Intelligence Mining and shAring) developed advanced AI-driven tools and frameworks to generate, analyze, and securely share cyber threat intelligence (CTI) tailored to organizational needs. The core outcome, OSTIS, enables organization-specific CTI generation through a dedicated crawler and NLP pipeline that extracts threat data from reliable sources, classifies it by domain (e.g., healthcare, finance), and visualizes attack patterns via knowledge graphs. Explainable AI tools like SHAP were integrated to interpret threat predictions and support trust in automation. Complementing OSTIS, we proposed SeCTIS, a privacy-preserving CTI sharing framework using Blockchain and Swarm Learning. SeCTIS ensures secure collaboration and verifiable trust among participants through Zero-Knowledge Proofs. The MoRSE and IntellBot systems advanced AI-based CTI delivery by deploying Retrieval-Augmented Generation (RAG) models to provide accurate, real-time cybersecurity insights. Additionally, our efforts in darknet traffic analysis, malware visualization, and multi-modal threat detection delivered interpretable models using SHAP, GradCAM, and LIME. In parallel, we addressed security in federated learning (FL) with tools like DLShield, SecDefender, and LFGuard, which detect low-quality or poisoned models and improve global accuracy while preserving privacy. Through these contributions, OPTIMA has enhanced both the granularity and trustworthiness of CTI across diverse domains, enabling proactive, explainable, and collaborative cybersecurity defense.

Текст от CORDIS, на английски · Данни: CORDIS, © Европейски съюз