GSS EU Science Funding Gateway

On a technical level, proposals should provide proof-of-concept solutions for AI-based incident management and cyber defence, including detection, mitigation and response. Proposals must not seek to further the analysis capabilities of IDS alone, but in the context of an automated or semi-automated system for handling incidents. In additional to purely technical solutions, processes and actors of selected enterprises may need to be mapped, modelled and understood. Proposals are further expected to consider the interaction between human operators, analysts and decision makers and the automated or semi-automated incident management and response system.

 A suitable methodology for building contextual understanding is expected through case studies of selected processes, incidents and cyber-attacks of selected enterprises, and case studies of successful detection approaches and resilience oriented success stories where technical and non-technical challenges can be studied and addressed at different levels. An appropriate development approach, which includes user and stakeholder involvement, should be leveraged.

 All proposed activities ultimately support the creation of fit-for-purpose proof-of-concept prototypes of an automated or semi-automated incident management and cyber defence system, for select phases in the incident management cycle including detection and response. The prototypes may support human operators, analysts and decision-makers at all levels (technical, tactical, operational, strategic and political) and are expected to contribute to enhanced cyber situational awareness, increased military infrastructure resilience and improved protection against advanced cyber threats.

 The activities are sorted into three types of tasks:

• Enhancing contextual knowledge of the enterprises, processes and decision-making where AI should be utilised.
• Developing AI-based techniques supporting specific human operator/analyst tasks.
• Exploring and developing AI as a decision-maker given limited authority in incident management and cyber defence.

 Feasibility studies drawing upon real-world scenarios should be utilised to ensure that developed proof-of-concepts and techniques are fit-for-purpose. It may also be necessary to create reference systems and appropriate tests cases to generate training data and evaluate the efficacy of different solutions.