SAPPAN | Sharing and Automation for Privacy Preserving Attack Neutralization

Summary
SAPPAN aims to develop a platform for sharing and automation to enable privacy preserving and efficient response and recovery utilizing advanced data analysis and machine learning. SAPPAN will provide a cyber threat intelligence system that decreases the effort required by a security analyst to find optimal responses to and ways to recover from an attack. SAPPAN will enable this within a single organization as well as across organisations through novel models for privacy-preserving data processing and sharing. It will enable utilizing external experts for intrusion detection and sharing of knowledge on response and recovery actions while respecting the privacy and confidentiality requirements of individuals and organizations. SAPPAN will enable a European level perspective on advanced cyber security threats detection, response, and recovery making four key contributions that go beyond existing approaches: (1) privacy-preserving aggregation and data analytics including advanced client-side abstractions; (2) federated threat detection based on sharing of anonymised data and sharing of trained machine learning models; (3) standardisation of knowledge in the context of incident response and recovery to enable reuse and sharing; (4) visual, interactive support for Security Operation Center operators. SAPPAN aims to provide solutions for public international institutions and multinational companies who want to enrich their Situational Awareness by sharing cyber security intelligence as well as solutions for small and midsize companies enabling them to outsource intrusion detection. SAPPAN will be demonstrated in the relevant environments of 2 multinational companies, 1 National Research and Education Network (NREN) and 2 Computer Security Incident Response Teams (CSIRT). The consortium consists of 1 NREN, 3 multinational companies, 3 universities and 1 research institute so as to maximise the technical and societal impact, the dissemination and uptake of the results.
Unfold all
/
Fold all
More information & hyperlinks
Web resources: https://cordis.europa.eu/project/id/833418
Start date: 01-05-2019
End date: 30-04-2022
Total budget - Public funding: 4 700 053,00 Euro - 4 175 070,00 Euro
Cordis data

Original description

SAPPAN aims to develop a platform for sharing and automation to enable privacy preserving and efficient response and recovery utilizing advanced data analysis and machine learning. SAPPAN will provide a cyber threat intelligence system that decreases the effort required by a security analyst to find optimal responses to and ways to recover from an attack. SAPPAN will enable this within a single organization as well as across organisations through novel models for privacy-preserving data processing and sharing. It will enable utilizing external experts for intrusion detection and sharing of knowledge on response and recovery actions while respecting the privacy and confidentiality requirements of individuals and organizations. SAPPAN will enable a European level perspective on advanced cyber security threats detection, response, and recovery making four key contributions that go beyond existing approaches: (1) privacy-preserving aggregation and data analytics including advanced client-side abstractions; (2) federated threat detection based on sharing of anonymised data and sharing of trained machine learning models; (3) standardisation of knowledge in the context of incident response and recovery to enable reuse and sharing; (4) visual, interactive support for Security Operation Center operators. SAPPAN aims to provide solutions for public international institutions and multinational companies who want to enrich their Situational Awareness by sharing cyber security intelligence as well as solutions for small and midsize companies enabling them to outsource intrusion detection. SAPPAN will be demonstrated in the relevant environments of 2 multinational companies, 1 National Research and Education Network (NREN) and 2 Computer Security Incident Response Teams (CSIRT). The consortium consists of 1 NREN, 3 multinational companies, 3 universities and 1 research institute so as to maximise the technical and societal impact, the dissemination and uptake of the results.

Status

CLOSED

Call topic

SU-ICT-01-2018

Update Date

27-10-2022
Images
No images available.
Geographical location(s)
Structured mapping
Unfold all
/
Fold all
Horizon 2020
H2020-EU.2. INDUSTRIAL LEADERSHIP
H2020-EU.2.1. INDUSTRIAL LEADERSHIP - Leadership in enabling and industrial technologies
H2020-EU.2.1.1. INDUSTRIAL LEADERSHIP - Leadership in enabling and industrial technologies - Information and Communication Technologies (ICT)
H2020-EU.2.1.1.0. INDUSTRIAL LEADERSHIP - ICT - Cross-cutting calls
H2020-SU-ICT-2018
SU-ICT-01-2018 Dynamic countering of cyber-attacks