IRIS: A platform to assess, detect and respond to vulnerabilities and threats in ICT networks

The esCERT cybersecurity team of inLab FIB is participating in the Intelligence Threat Reporting and Incident Response System (IRIS) project. The project’s aim is to develop a unique platform for the IoT, which, through artificial intelligence, will support centres that respond to IT emergencies (CERT and CSIRT). The platform will help to assess, detect, respond to and share information on threats and vulnerabilities in TIC systems. This support for European CERT and CSIRT networks will also enable a coordinated response to be provided to large-scale cross-border incidents. At the end of the project, the IRIS platform will be available, free of charge, to the European CERT and CSIRT.

The concept that IRIS works on is an that of federated threat intelligence architecture that establishes three technological components. First, there is a collaborative threat intelligence module, which forms the nexus of the project and improves the platform that currently exists (MeliCERTes) with a module to support data protection and proactive responsibility. Secondly, a threat analytics module will be developed, which collects and supplies threats and vulnerabilities, responds to the intelligence received and initiates autonomous response and self-recovery procedures. Finally, a module called gamma virtual cyber, based on the cloud, will be developed that offers an immersive virtual environment for collaborative CERT/CSIRT training based on real-world environmental platforms (digital twins).