AI4Cyber

AI4Cyber is Tinexta Defence’s center of excellence dedicated to research and application ofArtificial Intelligence in the field of cybersecurity.

Our specialists with different expertise collaborate to address the challenges of the cyber threat landscape, support clients in adopting AI within their business processes, and share research activities with the technical-scientific community.

The team manages the entire lifecycle of AI-based systems: from data collection and pre-processing, to model training and validation, to deployment in production and continuous performance monitoring.

The solutions are based on advanced technologies such as Machine Learning, Deep Learning and Large Language Models, and can be customized according to the client’s specific needs.

The AI Team is constantly engaged in research and experimentation, with particular focus to ethical aspects, transparency (XAI – Explainable AI) and privacy protection, aiming to deliver innovative solutions aligned with principles of fairness, inclusivity, and respect for fundamental rights.

Research and Development Areas

The AI4Cyber center focuses on developing intelligent solutions to strengthen defense capabilities and anticipate the evolution of threats. Our research aims to transform raw security data into actionable intelligence, automating analysis and decision-making processes to make cybersecurity more proactive, predictive, and resilient.

Activities

Threat Detection & Anomaly Detection: development of Machine Learning and Deep Learning models for real-time identification of known threats, zero-day attacks, and anomalous behaviors in network traffic and on endpoints.
User and Entity Behavior Analytics (UEBA): creation of behavioral baselines for users and systems to detect significant deviations that may indicate an ongoing attack or an insider threat.
Incident Response Automation: design of intelligent systems (enhanced SOAR) capable of orchestrating and automating containment, eradication, and recovery actions following an incident.
Natural Language Processing (NLP) for Threat Intelligence: automated analysis of large volumes of unstructured data (intelligence reports, articles, underground forums) to extract Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs).
Predictive Vulnerability Assessment: use of predictive models to analyze vulnerabilities and prioritize patching interventions based on actual risk and likelihood of exploitation.
Analysis and Defence by Adversarial AI: research on techniques attackers use to evade or deceive AI models (e.g., evasion, poisoning) and development of countermeasures to make systems more robust.
AI for Digital Forensics: development of tools that assist forensic analysts in processing large datasets, identifying relevant artifacts, and reconstructing events.

Tools and Technologies

ML/DL Platforms: TensorFlow, PyTorch, Keras, Scikit-learn for building and training models.
Data Analysis Libraries: Pandas, NumPy, and Dask for large-scale dataset manipulation and analysis.
Big Data platforms: Apache Spark and Hadoop ecosystem for processing massive data streams from SIEM systems and network sensors.
LLM Frameworks: development and fine-tuning of Large Language Models for code analysis, report generation, and analyst assistance through conversational interfaces.
Network Analysis Tools: integration with Zeek, Suricata, and other network probes for telemetry data collection.
Explainable AI (XAI) Frameworks: use of libraries such as SHAP and LIME to interpret model decisions and ensure transparency.
Computing Infrastructure: on-premise GPU clusters and cloud platforms (AWS, Azure, GCP) for training complex models.