Project Details
Layman's description
This PhD is oriented towards the study of the application of process mining in the domain of cybersecurity for the detection of cyber attacks. This approach, whose exploration is very limited in the literature, would facilitate real-time detection and recognition of attacks, and com-prehensive explainability of the system's behavior.
The field of cybersecurity employs a variety of methodologies, including rules-based systems and artificial intelligence (AI), to identify potential attacks. However, these approaches have limitations in accurately modeling and understanding the behavior of attacks. This can cause some mistakes and many false positives.
Process mining is a series of techniques that are used to build, monitor, and enhance models of processes as they evolve over time. In the context of the abundance of data available for analysis, process mining emerges as a particularly effective tool for comprehending the underlying dynamics of processes. This method is extensively used, with applications in a variety of fields including business, healthcare, and finance. Its primary function is to enhance operational efficiency in these sectors.
Streaming process mining has been demonstrated to indicate that all these analyses are performed, at least for the decision phase, in real-time, which is essential in the context of detecting attacks while they are occurring so they can be stopped. Ideally, this can also prevent the creation of false alerts, which have become a significant concern for security teams. At the same time, it would ensure the detection of all actual cyber attacks.
This PhD is part of an alliance project with another program, which is focused on the continual learning component. This is a technique employed by many AI models to ensure continued improvement as processes evolve and change over time, eliminating the need for complete retraining. Consequently, a significant aspect of the program entails the integration of process mining and continual learning methodologies for the purpose of detecting cyber attacks.
The field of cybersecurity employs a variety of methodologies, including rules-based systems and artificial intelligence (AI), to identify potential attacks. However, these approaches have limitations in accurately modeling and understanding the behavior of attacks. This can cause some mistakes and many false positives.
Process mining is a series of techniques that are used to build, monitor, and enhance models of processes as they evolve over time. In the context of the abundance of data available for analysis, process mining emerges as a particularly effective tool for comprehending the underlying dynamics of processes. This method is extensively used, with applications in a variety of fields including business, healthcare, and finance. Its primary function is to enhance operational efficiency in these sectors.
Streaming process mining has been demonstrated to indicate that all these analyses are performed, at least for the decision phase, in real-time, which is essential in the context of detecting attacks while they are occurring so they can be stopped. Ideally, this can also prevent the creation of false alerts, which have become a significant concern for security teams. At the same time, it would ensure the detection of all actual cyber attacks.
This PhD is part of an alliance project with another program, which is focused on the continual learning component. This is a technique employed by many AI models to ensure continued improvement as processes evolve and change over time, eliminating the need for complete retraining. Consequently, a significant aspect of the program entails the integration of process mining and continual learning methodologies for the purpose of detecting cyber attacks.
| Status | Active |
|---|---|
| Effective start/end date | 01/01/2026 → 31/12/2028 |
Fingerprint
Explore the research topics touched on by this project. These labels are generated based on the underlying awards/grants. Together they form a unique fingerprint.