"Attackers do not always strike immediately"

In a modern computer network, all sorts of activities are constantly taking place: thousands of devices communicate with one another at lightning speed, employees log in from different locations, cloud applications exchange vast amounts of data, while software is continuously being updated. And somewhere among that immense volume of activity, the first indication of a cyberattack may be hidden. 
Cyberattacks are becoming ever more sophisticated and dangerous. By the time the digital breach is discovered, the entire network is often already compromised. Such an infection starts with a single affected device but spreads covertly throughout the entire system. “They gradually expand their access,step by step, until they are ultimately able to steal sensitive information or sabotage systems,” says Corneliu Cofaru, researcher at the VUB AI Lab.

The European research project aSIEMmetry aims to make that search considerably more efficient. Together with partners from Romania, VUB researchers are developing AI models to detect anomalous network behaviour. Such an anomaly may indicate an attack. It is therefore important to detect it as early as possible. The name of the project refers to the computer term SIEM (Security Information and Event Management). This is a security method that analyses data from different IT systems in order to quickly identify suspicious activities and cyberattacks.

The degree of chaos
Traditional security systems often rely on predefined rules or known attack patterns. However, cybercriminals are constantly devising new techniques, making it impossible to know every potential attack in advance. 
That is why the researchers have chosen a different approach. The central question is not ‘Does the network behave as expected?’, but rather: ‘To what extent does the network’s behaviour change?’ To do this, they turn, perhaps unexpectedly, to a concept from physics: entropy.

This proves to be no simple task, particularly because computer networks themselves are constantly changing. “Networks evolve both over time and across space,” says Corneliu. “New devices are constantly being added, applications communicate in different ways, and users change their behaviour. Nothing remains the same.

"The challenge is to develop AI models that can continuously adapt”

Mathematics put to work
At VUB, the focus lies on developing the mathematical foundations behind the detection models. VUB computer scientist Patrick Van der Spiegel is developing, as part of his doctoral research, a model for detecting anomalies. That model is being used in a variety of research domains, ranging from neuroscience to predictive maintenance of buildings. Within aSIEMmetry, the model is being applied to cybersecurity. 
“The basic idea is actually very simple,” says Corneliu. “We first learn what normal behaviour looks like. We then compare new observations with what we have seen before. When something deviates sufficiently, we know it is worth taking a closer look.”

AI itself is also monitored
One of the most innovative aspects of the research is that entropy is not only applied to network traffic. The researchers also analyse the complexity of the AI models themselves as they adapt to new data. 
“As the network changes, the models must evolve as well,” explains Corneliu. “After each new training round, we analyse the structure of the models. This allows us to track how their internal representation changes.” 
In other words, the researchers monitor not only the network, but also the way in which the AI ‘understands’ that network. This additional analysis should ultimately make the detection models more robust and better able to withstand changing network environments.

Cybersecurity specialists will not be replaced
The project is intended to support so-called Security Operations Centres (SOCs), specialised teams that protect large organisations against cyberattacks. According to Corneliu, these teams are facing increasing pressure today. 
“Technology has not been able to keep pace with the explosive growth in network complexity,” he says. “There is simply too much information to analyse everything manually. Our goal is therefore not to replace security analysts, but to drastically reduce the amount of information they need to review.”

From theory to practice
The project, which started in 2025 and runs until the end of 2027, has now completed an important part of its theoretical research phase. The VUB scientists developed the architecture and the underlying models. In the next phase, these will be tested and refined using real-world data. 
“We have built the skeleton,” concludes Corneliu. “Now the system needs to be fed with real data. This is being done together with our partners, who work with real cyberattacks and large-scale operational networks. Only then will we see how well our models perform outside the laboratory.” 
If the research proves successful, it could help organisations tackle one of the greatest challenges in cybersecurity: detecting that one anomalous signal before it develops into a large-scale security incident.