Projects | Emmanuele Zambon @ TU/e

LATTICE

Thu, 01 Oct 2026 00:00:00 +0000

Attackers coordinate across borders, while defenders often do not: threat information is shared late, if at all, and many organisations stay out of threat-intelligence sharing altogether because of confidentiality and data protection concerns. LATTICE builds a federated layer that allows organisations to detect, decide and respond to threats together, without relying on a central authority and without disclosing sensitive data.

LATTICE is built around three innovations:

Jury Protocol: a graduated, Byzantine-fault-tolerant consensus mechanism through which federated Security Operations Centres jointly decide on escalating responses, from enhanced monitoring to coordinated investigation and full containment;
Privacy-preserving correlation: secure multi-party computation and zero-knowledge proofs allow organisations to confirm that they are observing the same attack patterns without revealing their detection methods or vulnerable systems;
Federated digital twin network: shared cyber ranges where organisations can safely rehearse and validate responses before deploying them, lowering costs especially for SMEs.

The project, coordinated by the Luxembourg Institute of Science and Technology (LIST) with 14 partners across 9 countries, aims to bring the technology from TRL 4 to TRL 7 and validates it through four pilots on live telemetry in Germany, Greece, the Netherlands and Luxembourg, covering cross-sector threat intelligence, hospital protection, real-time SOC coordination, and national CSIRT vulnerability intelligence. Core components will be released as open source under the EUPL.

DEFRAUDify

Tue, 01 Oct 2019 00:00:00 +0000

DEFRAUDify aims to develop tools that help private businesses to detect fraudulent behaviour on the internet. These tools are partly based on existing tools that have been developed for Law Enforcement. They will be adapted to become relevant for private businesses as well. DEFRAUDify aims at businesses that encounter negative impacts from internet organized fraudulent behaviour. The tools will consist of a set of interoperable tools that jointly analyse suspicious behaviour and provide situational awareness.

INTERSCT

Tue, 01 Jan 2019 00:00:00 +0000

The rhythms and operations of modern society are regulated by IoT devices. On the street, at the office, in the car or in the train, at the airport or at home. IoT systems monitor our buildings, regulate traffic, listen to our conversations, deliver energy to our homes, and automate and operate our factories. Their applications and numbers increase by the hour, and we are quickly heading to a trillion devices deployed worldwide – approximately 150 devices per person on the planet.

Increasingly often, these devices are turned against us: spying on us, launching massive, distributed cyber-attacks, used as bridges to infect networks, employed in sophisticated nation-state attacks targeting our facilities We are losing control of our own infrastructure and soon we will be unable to manage the IoT we created. The sheer number of devices, their heterogeneity, and their varying longevity (days, or decades) represents a huge challenge impacting our personal safety, the security of our data, and our economy.

We are on the verge of losing the capacity of managing IoT: “Classic” constructs we used relatively successfully to manage IT systems, such as trust separation and graceful degradation, are now failing us, as they do not accommodate for the very characteristics and nature of IoT devices. There are several dimensions separating IoT from regular IT. In this context, the “old” IT-based security paradigm, based on ad-hoc solutions developed and deployed specifically for each system, is doomed to fail. In fact, it is already failing, as humans lose sight of the huge complexities characterizing such a heterogeneous, vast environment.

Such a multifaceted problem, needs to be tackled from different yet interrelated perspectives. To structure our approach, we align with the most recent edition of the National Cyber Security Research Agenda and we tackle the problem ‘integrally’ from various different, and complementary, perspectives: “Design”, “Defence”, “Attack”, “Governance”, and “Privacy”.

Design

The state-of-the-art in secure software engineering is exemplified by lists of common security flaws, at the coding level or at the design level, e.g. the OWASP Top 10. There is even already an OWASP IoT Top 10, of things to avoid when building, deploying or managing IoT systems. Such lists, of what not to do, are still a long way off methodologies to get security-by-design. More constructive approaches, suggesting do’s rather than don’ts, include the BSIMM security maturity model and more recently the secure engineering methodology being developed by NIST and community efforts on assurance and certification in AMASS.

We need to move beyond Security-by-Design to Resilience-by-Design, while incorporating the autonomously adaptive security principle in our designs: We should expect systems to be attacked and compromised, in parts or as a whole, and design them to autonomously manage their security while acting selflessly. This means systems should be designed to allow for good monitoring to facilitate defence and to evolve in the face of new attacks, or rather, a better understanding of attacks. Our approach for this should be integrated with the NIST and AMASS initiatives mentioned above.

Unfortunately, it is a well-known tragedy that the same standard security mistakes keep being repeated, and better practices keep being ignored. So we also need to understand why this is the case to make sure that new tools and techniques will not suffer the same fate. Insight into where and how incentives for secure practices are lacking also provides a basis for the perspective Governance.

Defence

In general defence is losing ground against attackers and in IoT specifically, defence is nearly non-existent. IoT offers a huge and heterogeneous attack surface, where standard ICT defence techniques are of limited applicability. Present defence techniques are very labour-intensive and as such they do not scale and cannot cope with the IoT specific dimensions of space, time and structure. Novel defence techniques are needed for IoT, addressing these dimensions while supporting autonomously and adaptive security. These techniques need to cope with the cyber-physical nature of the IoT setting, with potentially hostile environments, and the heterogeneous devices (low resource sensors, edge nodes, and powerful cloud back-ends).

To supervise devices that you do not manage, awareness of their behaviour and status is essential. Monitoring is thus an essential part of IoT defence. Current intrusion detection approaches, however, are not up to the task of efficiently monitoring the plethora of IoT devices and typically do not offer enough insight to make effective decisions, let alone to automate them. Today, we see the first steps in designing adaptive systems that respond to detected situations, however the underlying assumption that one has a full specification of the system, is not realistic in IoT (structure dimension).

Intelligent IoT monitoring is needed, to allow the system to adapt autonomously both on the short term (e.g. a detected attack) and the long term with changing environment and use (time dimension). Monitoring and awareness will also be instrumental to provide indispensable input to other activities: Governance, Design, Attacks and Privacy, by supplying up-to-date evidence regarding attacks methods and activities.

Finally, existing defence mechanisms typically focus on protecting a device, system and its data, without considering how this impacts others. Sharing of security information or sacrificing functionality of a device to protect others (selflessness principle) are essential for IoT security. Collaborative defence approaches are needed.

Attack

How good is a secure design, how strong a defence, and how complete are advances in privacy and governance? To achieve a secure IoT, we need to understand the attack surface. Unfortunately, for IoT this is unprecedentedly large with complex and poorly understood chains of interdependencies between devices and systems. The deployment complexity (trillions of IoT devices), heterogeneity (from smart dust to self-driving cars), and characteristics (physical vs. remote access) immediately translate to a huge, previously unexplored attack surface. In addition, today’s understanding of offensive techniques is not adequate for systems where software is tightly integrated with hardware. Today’s methodology of ad hoc probing of the security of a handful devices is no longer an option; so far however, the community has no idea how to assess the security and find dangerous weaknesses automatically at such an enormous scale, covering so many (systems of) devices but also so many design processes and defences, etc. The primary research challenges are to develop automated techniques to detect vulnerabilities in complex constellations of IoT systems and to guide these efforts by prioritizing the most dangerous weaknesses.

In other words, we need attack prediction models, based on empirical evidence that help security analysts focus on the most important systems and attack vectors (e.g., because they are popular among attackers in general, on the rise, or simply relevant for particular sectors). The analyst will then analyse these systems in terms of fundamental security principles and security properties (single-system properties such as confidentiality, integrity, availability, but also properties for the wider system, such as isolation, abusability, etc.). In addition to vulnerability analysis, the evidence-driven prioritization of what are important attack vectors and modus operandi will provide input and directions to the design, defence, governance and privacy efforts.

Governance

IoT manufacturers already devote far too little attention to develop secure products due to the lack of market incentives. We cannot expect them to follow the selflessness security paradigm in their devices to create autonomously adaptive security for their platforms without governance-based incentives. Instead, we already see interdependence between stakeholders contributing to a blame game between the actors within the IoT supply chain accusing each other of insufficient security efforts. Limited security specifications in IoT products signal a market failure that require regulatory intervention. According to the European Commission, governing the IoT requires rules and processes to drive the way in which powers are exercised, particularly as regards openness, participation, accountability, effectiveness and coherence. To satisfy these “principles of good governance” within the multi-stakeholder IoT landscape, we must revisit traditional governance models.

There are, however, a number of challenges to implementing these governance principles when it comes to cybersecurity. First, there exists a wide array of standards in cybersecurity, ranging from technical specifications for encryption at device level to risk management at the organisational level. Moreover, given the wide application of IoT, standards are being developed within, rather than across, sectoral verticals. Thus, the landscape for privacy and security standards that apply to IoT is increasingly complex, and the market has so far indicated limited convergence towards a core set of standards to support these principles.

In addition, due to the pervasive interconnectivity of IoT devices, determining liability is more difficult than ever. With traditional products, liability mostly falls to the manufacturer/service provider. However, if an IoT product does provide basic cybersecurity measures and an attack occurs, current regulatory frameworks do not always determine who should be held liable.

Privacy

Many IoT business models depend on the large scale processing of personal data for personalised services and generating revenue through advertising creating what has been termed surveillance capitalism. Although consumers benefit from IoT devices and applications, they are also confronted with a sense of diminishing transparency and control. Privacy considerations have played a very limited role in the development of IoT devices inter alia due to economic obstacles, interoperability concerns, and usability concerns. The European regulator has acknowledged the importance of privacy and data protection. The new General Data Protection Regulation (2016/679), enhances transparency and user-control and introduces Privacy-by-Design and Privacy-by-Default (art. 25) as new instruments for data protection.

Privacy-by-Design and Privacy Enhancing Technologies (PET) have a long history, yet their uptake has been limited due to concerns raised above. There are also concerns regarding the notion of implementing data protection requirements in code. The IoT landscape raises specific challenges due to its spatial, time and structural characteristics. On top of this, it is not clear what the Privacy-by-Design requirements in art. 25 GDPR entail.

Privacy and regulatory compliance are seen as a significant obstacles in the industry. There is a need for guidance with respect to Privacy-by-Design in the secure IoT context, from design patterns, development frameworks and privacy enhancing technologies to secure IoT specific PETs. Our privacy has been designed away, but can also be designed back into it in a new generation of IoT devices and services.

DEPICT

Mon, 01 Jan 2018 00:00:00 +0000

Protecting Industrial Control Systems (ICS) requires solutions that not disturb existing operations, which is essential for large-scale systems and, especially for legacy systems. In this project we aim to create new tools, algorithms, and software to improve the situational awareness of security analysts for control systems. By combining external threat sources with information extraction through network analysis, and semantics-aware network-based monitoring we will build and maintain models of different perspectives of the system to help security analysts and operators better understand their systems and identify threats, and promptly react to mitigate the impact of attacks.

Our final goal is to leverage and -add intelligence to- deep-packet inspection (DPI) tools to extract knowledge of an ICS and build -actionability-, that is, the ability to act upon present (or future) threats, allowing for, (1) Corrective measures, facilitating early incident response by security analysts without a deep knowledge of ICS, and control-room operators without deep knowledge on cyber-security, so they can take care of the first steps of the incident response, thereby greatly increasing the overall resilience of the system, and (2) Preventive measures, performing asset-threat mapping by leveraging deep-packet inspection of industrial networks.

PREEMPTIVE

Sat, 01 Mar 2014 00:00:00 +0000

In recent years, we have witnessed an increase in the number and impact of cyber attacks. A successful attack might affect, or even endanger, daily human activities. Multiple countermeasures have been put in place to prevent Advanced Persistent Threat (APT) attacks, but they failed, allowing the latest generation of APT. The goal of PREEMPTIVE is to provide an innovative solution for enhancing existing methods and conceiving tools to prevent against cyber attacks, that target utility networks.

PREEMPTIVE addresses the prevention of cyber attacks against hardware and software systems such as DCS, SCADA, PLC, networked electronic sensing, and monitoring and diagnostic systems used by the utilities networks. Moreover, the research aims to implement detection tools based on a dual approach comprising low direct detection and process misbehavior detection PREEMPTIVE proposes to:

Enhance existing methodological security and prevention frameworks with the aim of harmonizing Risk and Vulnerability Assessment methods, standard policies, procedures and applicable regulations or recommendations to prevent cyber attacks.
Design and develop prevention and detection tools complaint to the dual approach that takes into account both the industrial process misbehavior analysis (physical domain) and the communication & software anomalies (cyber domain):
- Industrial process misbehavior detection tools.
- Communication & software related threats prevention and detection tools.
Define a taxonomy for classifying the utilities networks taking into account:
- The utility network type and communication technology used
- The utility network exposure to Cyber threats
- The impact to the citizens of services disruption caused by a cyber attack through the utility network.
Define guidelines for improving Critical Infrastructure (CI) surveillance.
Validate the PREEMPTIVE framework and innovative technologies in real scenarios with the support of the utility companies

CRISALIS

Tue, 01 May 2012 00:00:00 +0000

The CRISALIS project aims at providing new means to secure critical infrastructure environments from targeted attacks, carried out by resourceful and motivated individuals. The recent discovery of a malware called Stuxnet, show that these threats are already a reality. Their success in infiltrating Critical Infrastructure environments is calling attention on the ineffectiveness of standard security mechanisms at detecting them. Stuxnet is believed to have been operating undetected for almost one year leveraging multiple vulnerabilities that were previously unknown, and has been discovered only as a consequence to an operational anomaly that triggered the attention of the field operators. This fact clearly shows that our methods to find vulnerabilities and detect ongoing or successful attacks in critical infrastructure environments are not sufficient.

CRISALIS focuses on these two aspects: detection of vulnerabilities and attacks in critical infrastructure environments. We focus on two different, yet interlinked, use cases that are typical for the power grid infrastructure: control systems based on SCADA protocols and the Advanced Metering Infrastructure. CRISALIS leverages the unique characteristics of critical infrastructure environments to produce novel practical mechanisms and techniques for their security assessment and protection. This is achieved by pursuing three main research objectives:

providing new methodologies and techniques to secure critical infrastructure systems;
providing new tools to detect intrusions;
developing new, more effective, techniques to analyze infected systems.

Particular attention is paid to ensure the practical implementation of these techniques in real-world environments, and to minimize the impact on operations, goals which are attainable thanks to the direct involvement in the process of end users and device manufacturers who provide expertise and realistic test environments to validate the proposed methodologies.