Cybersecurity Training and Analysis

Current research in the Laboratory of Software Architectures and Information Systems, Lasaris, at the Faculty of Informatics, Masaryk University, is focused on data analysis in the cybersecurity domain.

As operational networks are not suitable for building and studying knowledge of cyber threats and training responses to them, we have developed the KYPO Cyber Range Platform – the first open-source virtual environment where hands-on cybersecurity training can be organized. From the very beginning, we put emphasis on user experience, user-centered design of user interfaces, and the support of learning and visual analytics. Data collected from training sessions are analyzed in order to continuously improve the quality of training sessions and increase the impact on the trainees. Our research aims to provide visual situational awareness, insight into the abstract cybersecurity processes and threats, storytelling, and advanced analytical tools. This research is conducted in close cooperation with CSIRT team (Computer Security Incident Response Team) of Masaryk University.

The CSIRT team is also responsible for the investigation of suspicious computers connected to the university network. Together with them, we develop advanced exploratory techniques to support the forensic investigation of real incidents.

Related projects:

2020 – 2022

Research of New Technologies to Increase the Capabilities of Cybersecurity Experts (KYPOLAB)

My role: Member of the research team, leader of the work package „SW for the evaluation of cybersecurity training“.

2018 – 2023

CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence (C4e)

My role: Member of implementation team (academic staff).

2016 – 2019

Simulation, detection, and mitigation of cyber threats endangering critical infrastructure (KYPO II )

My role: Co-investigator (leader at FI MU, software architect, head of the “visualization” research team).

2013 – 2015

Cybernetic Proving Ground (KYPO)

My role: Co-investigator (leader at FI MU, head of the “visualization” research team).

The project was awarded by the Ministry of Interior for its exceptional results in the field of security research.

Software:

The KYPO Analyst – a prototype implementation of the analytical dashboard for post-training analysis of data gathered from the KYPO Cyber Range Platform. The tool is based on principles of visual analytics, utilizing process mining techniques, metrics-based behavioral analysis, and ML-based clustering of trainees.

The KYPO Cyber Range Platform is used as a training platform for the regular education of students of Masaryk University as well as for the organization of the biggest cyber defense exercise in the Czech Republic called Cyber Czech (in cooperation with the Czech NSA). In 2021 released as open-source.

Awards:

2015: Ministry of Interior of the Czech Republic for exceptional security research results.
2021: European Commission’s Innovation Radar Prize for Innovation in Disruptive Tech.

The FIMETIS (FIlesystem METadata analysIS) tool is developed in cooperation with the CSIRT (Computer Security Incident Response Team) team of Masaryk University, which is responsible for the investigation of cybersecurity incidents in the university network. Together with them, we develop advanced visual and exploratory techniques to support the forensic investigation processes. We primarily focus on the analysis of file systems using user-centered design and visual techniques.