Project ongoing · Cybersecurity
Cyber
We use artificial intelligence to detect cyberattacks. Then we try to fool it.
- of the work done by an AI, in an espionage campaign discovered in 2025
- 80-90%
- alarms are real, if a false alarm goes off every 1,000 events
- 2 in 100
- of the time an LLM carries out instructions hidden in the logs, on average
- 83%
- cyber events handled by CSIRT Italia in 2025
- 2729
For people who come from computer science, engineering, mathematics, psychology, law
Why now
Attackers are already using artificial intelligence. In November 2025 Anthropic described an espionage campaign against about thirty targets: the AI did 80 to 90% of the work, and people stepped in at only a few moments.
The same sources also state the limit. For now AI does not invent new attacks: it runs known attacks faster, and in more places. Defenders have to move at the same speed.
| November 2025 | Anthropic | an espionage campaign carried out 80-90% by AI |
|---|---|---|
| November 2025 | the first malware that asks an LLM what to do while it runs | |
| May 2026 | the first zero-day that, according to Google, was developed with AI | |
| September 2026 | a campaign with AI agents, prepared and carried out in less than six hours | |
| September 2026 | ENISA | in 2026 it is likely that more stages of an attack will be carried out with AI |
IDS, IPS and SIEM
An IDS watches the traffic on a network and warns you when it sees something suspicious. An IPS does the same and also blocks. A SIEM collects the alerts and the logs of all the devices, puts them in order and links them: it is the screen the analyst works at.
NIST, the American standards body, distinguishes three ways of recognising an attack. Its guide on IDS is still the one from 2007: the 2012 revision was never finished.
- 01
Signatures
It compares the traffic with known attacks. It is precise, but it cannot see what it does not know.
- 02
Anomalies
It learns what the normal network looks like and flags whatever moves away from it. This is where machine learning comes in.
- 03
Protocols
It checks that every exchange follows the rules of its protocol.
alert http any any -> $HOME_NET any (msg:"Richiesta a /admin"; http.uri; content:"/admin"; sid:1000001; rev:1;)
alert warns; with drop, in an IPS, it also stops the packet
http the protocol to watch
any any from any address and port
-> $HOME_NET any towards our network
msg the text of the alarm
http.uri where to look: the address requested
content what to look for
sid, rev the number of the rule and its versionThe false alarm problem
A detector that is wrong once in a thousand looks great. It is not. In 2000 Stefan Axelsson did the maths for a network with a million events a day and two attacks of ten events each. Even if the detector sees both attacks, a thousand false alarms go off as well: out of a hundred alarms, only two are real.
People who work in security operations centres know this. In a 2022 study of seven of these centres, an analyst says: we know that 99% of our alarms are false, but we have to look at them anyway. That is why we measure false alarms per day, not accuracy.
The numbers in the chart
| One false alarm | Real alarms out of 100 |
|---|---|
| 1 false in 1,000 events | 2 |
| 1 false in 10,000 | 17 |
| 1 false in 100,000 | 67 |
What the research says
Artificial intelligence for detecting attacks has been studied for almost forty years: the idea of looking for anomalies is Dorothy Denning’s, from 1987. Outside the labs, though, it works less well than the papers promise. Four results that we use as working rules:
- 01
The closed world
Machine learning recognises what looks like what it has already seen. A new attack looks like nothing. Sommer and Paxson, 2010.
- 02
Mistakes in method
Out of 30 papers from the top conferences, every one falls into at least three of ten mistakes. In one case a simple count of packets beats a neural network. Arp et al., 2022.
- 03
Bad data
In the most widely used dataset, CIC-IDS2017, more than one flow in four is a meaningless artefact. Engelen et al., 2021.
- 04
LLMs
A language model classifies traffic almost at random, and it can be fooled: instructions hidden in the logs work 83% of the time on average. Houssel et al., 2024; Karanjai et al., 2026.
The lab
The first lab is a small fake network, entirely ours, inside a few virtual machines. Two sensors watch it: Suricata, which looks for the signatures of attacks, and Zeek, which logs every connection. Wazuh, the SIEM, collects everything.
A machine learning model, which runs on our own computer, reads the logs and looks for anomalies: that way the data never leaves the lab. We carry out the attacks ourselves, from a virtual machine running Kali Linux. All the software is open source.
| Tool | What it does | Licence |
|---|---|---|
| Suricata | signature-based IDS and IPS | GPLv2 |
| Zeek | logs every connection | BSD |
| Wazuh | the SIEM: collects, links, displays | GPLv2 and Apache 2.0 |
| Kali Linux | the machine we attack from | free, open source |
| Ubuntu Server | the machine under attack | free, open source |
Three steps
The work goes in three steps, one after the other. At the end, the lab has to notice an attack by itself and stop it.
- 01
AI in every system
We export the logs of the IDS, the IPS and the SIEM and feed them to a machine learning model. The model learns what normal traffic looks like and flags the anomalies.
- 02
A closed loop
We make the three systems work together. What the IDS sees goes to the SIEM, which links it to everything else, and the IPS blocks the connection.
- 03
The attack
From a virtual machine running Kali Linux we attack another virtual machine, an Ubuntu server. On the server, the IDS, the IPS and the SIEM agents are switched on.
Then we look at the SIEM dashboard and ask ourselves three questions. Did the AI recognise the attack and classify it correctly? How long did it take? And did the IPS cut the Kali machine’s connection before it was too late?
The rules
We only attack our own machines. The Italian criminal code punishes anyone who enters a computer system without the right to (article 615-ter) and anyone who intercepts computer communications (article 617-quater): in the lab we capture and attack only our own traffic.
Logs are personal data: an IP address is enough, the Court of Justice of the European Union ruled in 2016. That is why we work on public datasets and on the traffic of our own lab.
Outside the lab, noticing attacks is an obligation. The European NIS2 directive requires the companies and bodies that fall within its rules to manage incidents and to send an early warning within 24 hours. In Italy it is applied by Legislative Decree 138 of 2024.
Where we are
- 2025 and 2026With Cyber Naval we attacked and defended the bridge network of a ship, on the simulator of the University of Genoa.
- October 2026The new project starts. We form the team and set up the first lab.
- TodayWe are looking for people from every field, and we start with the first step: AI in every system.
Support Cyber
€300 towards €3,200
Stage 1 of 3: the lab: a server, the network and the sensors
The fundraiser is split into stages, and each stage is one specific thing to buy. When we reach one, we publish a video of what we bought.
Opens on 15 February
The box comes from Produzioni dal Basso and only loads if you open it.
People on the project
Sources
- Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 2025.
- Google Threat Intelligence Group, GTIG AI Threat Tracker, November 2025, May 2026 and September 2026.
- ENISA Threat Landscape 2026, September 2026.
- ACN, Relazione annuale al Parlamento 2025.
- NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems, 2007.
- Denning, An Intrusion-Detection Model, IEEE Transactions on Software Engineering, 1987.
- Axelsson, The base-rate fallacy and the difficulty of intrusion detection, ACM TISSEC, 2000.
- Alahmadi, Axon and Martinovic, 99% False Positives, USENIX Security 2022.
- Sommer and Paxson, Outside the Closed World, IEEE Symposium on Security and Privacy 2010.
- Arp et al., Dos and Don’ts of Machine Learning in Computer Security, USENIX Security 2022.
- Engelen, Rimmer and Joosen, Troubleshooting an Intrusion Detection Dataset: the CICIDS2017 Case Study, IEEE SPW 2021.
- Houssel et al., Towards Explainable Network Intrusion Detection using Large Language Models, IEEE/ACM BDCAT 2024.
- Kramer et al., Integrating Large Language Models into Security Incident Response, SOUPS 2025.
- Karanjai et al., Context Contamination in LLM Analysis of Network Security Logs, USENIX Security 2026.
- Directive (EU) 2022/2555 (NIS2); Italian Legislative Decree 138/2024; Court of Justice of the EU, case C-582/14, 2016; Italian Criminal Code, articles 615-ter and 617-quater.
- Official documentation of Suricata, Zeek, Wazuh, Kali Linux and Ubuntu Server.
Do you want to work on it?
You do not need experience and you do not need a CV. Write to us: we invite you to the next meeting, where you meet the team.