Gudmund Grov

• Eilertsen, Even; Mavroeidis, Vasileios & Grov, Gudmund (2025). Towards Agentic Investigation of Security Alerts. IEEE International Conference on Big Data (Big Data). ISSN 2639-1589. p. 7793–7802. doi: 10.1109/bigdata66926.2025.11402161. Full text in Research Archive Show summary

  Security analysts are overwhelmed by the volume of alerts and the low context provided by many detection systems. Early-stage investigations typically require manual correlation across multiple log sources, a task that is usually time-consuming. In this paper, we present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries and constrained tool access (structured SQL over Suricata logs and grep-based text search) to automate the first stages of alert investigation. The proposed workflow integrates queries to provide an overview of the available data, and LLM components that selects which queries to use based on the overview results, extracts raw evidence from the query results, and delivers a final verdict of the alert. Our results demonstrate that the LLM-powered workflow can investigate log sources, plan an investigation, and produce a final verdict that has a significantly higher accuracy than a verdict produced by the same LLM without the proposed workflow. By recognizing the inherent limitations of directly applying LLMs to high-volume and unstructured data, we propose combining existing investigation practices of real-world analysts with a structured approach to leverage LLMs as virtual security analysts, thereby assisting and reducing the manual workload.

• Jaber, Aws; Genchev, Angel D.; Grov, Gudmund & Tsonev, Tsvetelin (2025). CyberStack: Deep Reinforcement Learning in Stackelberg Games for Military Network Defense. MILCOM IEEE Military Communications Conference. ISSN 2155-7578. p. 874–875. doi: 10.1109/MILCOM64451.2025.11310030. Full text in Research Archive
• Eckhoff, Magnus Wiik; Halvorsen, Jonas; Hansen, Bjørn Jervell; Eian, Martin; Mavroeidis, Vasileios & Chetwyn, Robert Andrew [Show all 8 contributors for this article] (2025). Experimenting with Neurosymbolic Artificial Intelligence for Defending Against Cyber Attacks. Neurosymbolic Artificial Intelligence. ISSN 2949-8732. 1. doi: 10.1177/29498732251377352. Full text in Research Archive Show summary

  It is generally accepted that all cyber attacks can not be prevented, and it is therefore necessary to have the ability to detect and respond to cyber attacks. Both connectionist and symbolic approaches are currently being employed for this purpose, but far less work has been done on the intersection of the two. This paper argues that the cyber security domain holds significant potential for applying neurosymbolic artificial intelligence (AI). We identify a set of challenges faced in cyber security today, and from this, we propose a set of neurosymbolic use cases that can help address the challenges. Feasibility is demonstrated through multiple experiments that apply neurosymbolic AI to cyber security. We find a significant overlap between the challenges in cyber security and the promises of neurosymbolic techniques, making it an interesting research direction for both the neurosymbolic AI and cyber security communities. This paper is an extended version of a paper published at the NeSy 2024 conference ( Grov et al., 2024 ). The main additional contributions are further experimental evidence for our hypothesis that NeSy offers real benefits in this domain and a more in-depth treatment of knowledge graphs for cyber security.

• Grov, Gudmund; Halvorsen, Jonas; Eckhoff, Magnus Wiik; Hansen, Bjørn Jervell; Eian, Martin & Mavroeidis, Vasileios (2024). On the Use of Neurosymbolic AI for Defending Against Cyber Attacks. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. doi: 10.1007/978-3-031-71167-1_7. Full text in Research Archive
• Kaasen, Andreas Dybvik; Grov, Gudmund; Mancini, Federico & Baksaas, Magnus (2023). Towards data-driven autonomous cyber defence for military unmanned vehicles - threats & attacks. MILCOM IEEE Military Communications Conference. ISSN 2155-7578. doi: 10.1109/MILCOM55135.2022.10017692. Full text in Research Archive Show summary

  Unmanned vehicles with varying degrees of autonomy will likely change the way military operations can be conducted, but they also introduce risks that require new ways of thinking security. In particular, the safety ramifications of cyber attacks should be seen as equally critical as the loss of classified data. Developing a cyber defence capability that can detect and manage these potentially harmful events also without human intervention thus becomes a fundamental requirement. In this paper, we commence such work by exploring how to disrupt the functionality of an actual military unmanned ground vehicle given an internal attacker, and how the resulting data can be used to design an an effective detection capability.

• Asprusten, Markus Leira; Gjerstad, Julie Lidahl; Grov, Gudmund; Kjellstadli, Espen Hammer; Flood, Robert & Clausen, Henry [Show all 7 contributors for this article] (2022). A containerised approach to labelled C&C traffic. Norsk Informasjonssikkerhetskonferanse (NISK). ISSN 1893-6563. Full text in Research Archive Show summary

  A challenge for data-driven methods for intrusion detection is the availability of high quality and realistic data, with ground truth at suitable level of granularity to train machine learning models. Here, we explore a container-based approach for simulating and labelling C&C traffic of real malware through a proof-of-concept implementation.

• Grov, Gudmund; Ireland, Andrew & Llano, Maria Teresa (2021). Reasoned Modelling: Harnessing the Synergies Between Reasoning and Modelling. In Michaelson, Gregory (Eds.), Mathematical Reasoning: The History and Impact of the DReaM Group. Springer Nature. ISSN 9783030778798. p. 105–127. doi: 10.1007/978-3-030-77879-8_6. Full text in Research Archive Show summary

  Conventional formal modelling requires a designer to have expertise in formal reasoning as well as design. We describe an approach to formal modelling called reasoned modelling that aims to allow the designer to focus on their design, with the low-level formal reasoning hidden from view. The approach builds directly upon the ideas of proof plans in that we make explicit use of modelling knowledge and patterns. This enables us to harness the synergies that exist between modelling and reasoning. A number of aspects of reasoned modelling have been investigated. Here we summarise the key contributions that have been previously published. First, when faced with low-level reasoning failures, we illustrate how modelling knowledge can be used to constrain the search for high-level design guidance. Second, we describe how common patterns of refinement can be used to help guide a designer. Third, we outline how common patterns of modelling can be used in suggesting design abstractions. Finally, as is the case with proof plans, reasoned modelling requires a mechanism for instantiating patterns. We describe how automated theory formation was used to instantiate patterns that arose within reasoned modelling.

• Clausen, Henry; Grov, Gudmund; Sabate, Marc & Aspinall, David (2021). Better Anomaly Detection for Access Attacks Using Deep Bidirectional LSTMs. In Renault, Eric; Boumerdassi, Selma & Mühlethaler, Paul (Ed.), Machine Learning for Networking Third International Conference, MLN 2020, Paris, France, November 24–26, 2020, Revised Selected Papers. Springer. ISSN 9783030708665. p. 1–18. doi: 10.1007/978-3-030-70866-5_1. Full text in Research Archive Show summary

  Recent evaluations show that the current anomaly-based network intrusion detection methods fail to detect remote access attacks reliably [10]. Here, we present a deep bidirectional LSTM approach that is designed specifically to detect such attacks as contextual network anomalies. The model efficiently learns short-term sequential patterns in network flows as conditional event probabilities to identify contextual anomalies. To verify our improvements on current detection rates, we re-implemented and evaluated three state-of-the-art methods in the field. We compared results on an assembly of datasets that provides both representative network access attacks as well as real normal traffic over a long timespan, which we contend is closer to a potential deployment environment than current NIDS benchmark datasets. We show that by building a deep model, we are able to reduce the false positive rate to 0.16% while detecting effectively, which is significantly lower than the operational range of other methods. Furthermore, we reduce overall misclassification by more than 100% from the next best method.

• Clausen, Henry; Grov, Gudmund & Aspinall, David (2021). CBAM: A Contextual Model for Network Anomaly Detection. Computers. doi: 10.3390/computers10060079. Full text in Research Archive Show summary

  Anomaly-based intrusion detection methods aim to combat the increasing rate of zero-day attacks, however, their success is currently restricted to the detection of high-volume attacks using aggregated traffic features. Recent evaluations show that the current anomaly-based network intrusion detection methods fail to reliably detect remote access attacks. These are smaller in volume and often only stand out when compared to their surroundings. Currently, anomaly methods try to detect access attack events mainly as point anomalies and neglect the context they appear in. We present and examine a contextual bidirectional anomaly model (CBAM) based on deep LSTM-networks that is specifically designed to detect such attacks as contextual network anomalies. The model efficiently learns short-term sequential patterns in network flows as conditional event probabilities. Access attacks frequently break these patterns when exploiting vulnerabilities, and can thus be detected as contextual anomalies. We evaluated CBAM on an assembly of three datasets that provide both representative network access attacks, real-life traffic over a long timespan, and traffic from a real-world red-team attack. We contend that this assembly is closer to a potential deployment environment than current NIDS benchmark datasets. We show that, by building a deep model, we are able to reduce the false positive rate to 0.16% while effectively detecting six out of seven access attacks, which is significantly lower than the operational range of other methods. We further demonstrate that short-term flow structures remain stable over long periods of time, making the CBAM robust against concept drift.

• Grov, Gudmund; Sabate, Marc; Cheng, Wei & Aspinall, David (2019). Towards Intelligible Robust Anomaly Detection by Learning Interpretable Behavioural Models. Norsk Informasjonssikkerhetskonferanse (NISK). ISSN 1893-6563. Full text in Research Archive
• Grov, Gudmund; Mancini, Federico & Mestl, Elsie Margrethe (2019). Challenges for Risk and Security Modelling in Enterprise Architecture. Lecture Notes in Business Information Processing. ISSN 1865-1348. doi: 10.1007/978-3-030-35151-9_14. Full text in Research Archive Show summary

  From our experience cooperating with the Norwegian Armed Forces, we outline two interconnected challenges for modelling risk and security in an enterprise architecture: (1) modelling what is protected and why it is protected with sufficient detail whilst being simple enough to facilitate analysis; and (2) establishing automated support for analysing and reasoning about the security models, something we deem crucial to exploit the full potential of an enterprise security architecture. In addition, we sketch out our approach to tackle these challenges and outline our future direction of work.

• Lin, Yuhui; Bundy, Alan; Grov, Gudmund & Maclean, Ewen (2019). Automating Event-B invariant proofs by rippling and proof patching. Formal Aspects of Computing. ISSN 0934-5043. doi: 10.1007/s00165-018-00476-7. Full text in Research Archive Show summary

  The use of formal method techniques can contribute to the production of more reliable and dependable systems. However, a common bottleneck for industrial adoption of such techniques is the needs for interactive proofs. We use a popular formal method, called Event-B, as our working domain, and set invariant preservation (INV) proofs as targets, because INV proofs can account for a significant proportion of the proofs requiring human interactions. We apply an inductive theorem proving technique, called rippling, for Event-B INV proofs. Rippling automates proofs using meta-level guidance. The guidance is in particular useful to develop proof patches to recover failed proof attempts. We are interested in the case when a missing lemma is required. We combine a scheme-based theory-exploration system, called IsaScheme [MRMDB10], with rippling to develop a proof patch via lemma discovery. We also develop two new proof patches to unfold operator definitions and to suggest case-splits, respectively. The combined use of rippling with these three proof patches as a proof method significantly improves the proof automation for our evaluation set.

View all works in NVA

• Rustad, Simen; Torvik, Håkon Olav & Grov, Gudmund (2025). Utfordringer og anbefalinger for sikker bruk av store språkmodeller. Full text in Research Archive Show summary

  I kjølvannet av at det kinesiske firmaet DeepSeek lanserte sine store språkmodeller DeekSeep V3 og R1, ble det i februar 2025 et økt fokus på sikkerhetsutfordringer knyttet til bruk av store språkmodeller. Fremstillingen i media skilte i liten grad mellom utfordringer knyttet til store språkmodeller, mobilapplikasjoner og nettjenester. Dette notatet forsøker å rydde opp i disse sammenblandingene og peke på viktige momenter knyttet til bruk av store språkmodeller. Vi konkluderer med at opphavet til en språkmodell, altså hvem som har utviklet den, ikke er det viktigste aspektet når det gjelder om en språkmodell kan brukes til en gitt oppgave. Fokus må være på hvordan informasjon behandles i prosessen, på samme måte som for andre informasjonssikkerhetsvurderinger. Derimot kan en språkmodells opphav være et relevant moment når man skal vurdere hvilke oppgaver det er. hensiktsmessig å bruke språkmodellen til.

• Masouros, Dimosthenis; Soudris, Dimitrios; Gardikis, Georgios; Katsarou, Victoria; Christopoulou, Maria & Xilouris, George [Show all 25 contributors for this article] (2023). Towards Privacy-First Security Enablers for 6G Networks: The PRIVATEER Approach. doi: 10.1007/978-3-031-46077-7_25. Full text in Research Archive Show summary

  The advent of 6G networks is anticipated to introduce a myriad of new technology enablers, including heterogeneous radio, RAN softwarization, multi-vendor deployments, and AI-driven network management, which is expected to broaden the existing threat landscape, demanding for more sophisticated security controls. At the same time, privacy forms a fundamental pillar in the EU development activities for 6G. This decentralized and globally connected environment necessitates robust privacy provisions that encompass all layers of the network stack. In this paper, we present PRIVATEER’s approach for enabling “privacy-first” security enablers for 6G networks. PRIVATEER aims to tackle four major privacy challenges associated with 6G security enablers, i.e., i) processing of infrastructure and network usage data, ii) security-aware orchestration, iii) infrastructure and service attestation and iv) cyber threat intelligence sharing. PRIVATEER addresses the above by introducing several innovations, including decentralised robust security analytics, privacy-aware techniques for network slicing and service orchestration and distributed infrastructure and service attestation mechanisms.

• Eriksson, Håkon Svee & Grov, Gudmund (2023). Towards XAI in the SOC – a user centric study of explainable alerts with SHAP and LIME. doi: 10.1109/BigData55660.2022.10020248. Full text in Research Archive Show summary

  Many studies of the adoption of machine learning(ML) in Security Operation Centres (SOCs) have pointed toa lack of transparency and explanation – and thus trust –as a barrier to ML adoption, and have suggested eXplainableArtificial Intelligence (XAI) as a possible solution. However, thereis a lack of studies addressing to which degree XAI indeedhelps SOC analysts. Focusing on two XAI-techniques, SHAP andLIME, we have interviewed several SOC analysts to understandhow XAI can be used and adapted to explain ML-generatedalerts. The results show that XAI can provide valuable insightsfor the analyst by highlighting features and information deemedimportant for a given alert. As far as we are aware, we are thefirst to conduct such a user study of XAI usage in a SOC andthis short paper provides our initial findings.Index Terms—Interpretability, explainability, artificial intelligence, machine learning, security operation center, intrusiondetection system, explainable artificial intelligence, user studies

• Gjerstad, Julie Lidahl; Kadiric, Fikret; Grov, Gudmund; Lund, Espen Kjellstadli & Asprusten, Markus Leira (2023). LADEMU: a modular & continuous approach for generating labelled APT datasets from emulations. doi: 10.1109/BigData55660.2022.10020549. Full text in Research Archive Show summary

  Development and evaluation of data-driven capabilities for both threat hunting and intrusion detection require high-quality and up-to-date datasets. The generation of such datasets poses multiple challenges, which has led to a general lack of suitable datasets for this domain.One such difficulty is the ability to correctly label each datapoint at a suitable level of granularity. In this paper, we argue that the challenges faced when labelling datasets can to some degree be decoupled from realistic emulations of up-to-date attacks and benign behaviours. We propose a modular labelling approach that can be combined with existing emulation platforms that provide the necessary details used for labelling. A proof-of-concept implementation is provided with our LADEMU (Labelled Apt Datasets from EMUlations) tool, which is integrated with the Mitre CALDERA emulation platform and uses the GHOSTS framework for benign behaviour. LADEMU captures both host and network logs and labels them at a sufficient level of detail to separate the various attack steps. This provides dataset support for the development of data-driven APT, multi-step and kill-chain capabilities. As a case, LADEMU is used to generate a labelled dataset from an intelligence-driven emulation plan of an advanced persistent threat (APT) group.

• Thuv, Aasmund; Enemo, Geir; Mancini, Federico; Endregard, Monica; Grov, Gudmund & Wurzenberger, Markus [Show all 40 contributors for this article] (2025). AInception scenario and storylines. Forsvarets forskningsinstitutt . Full text in Research Archive Show summary

  Modern military operations across the entire spectrum of war are highly dependent on Information and communication technology (ICT) infrastructures and services. This dependency is also a target for adversary state and non-state actors who are developing advanced offensive cyber capabilities. These capabilities pose a serious and constant threat to friendly military operations and place a great demand on the defending side to hinder, stop or mitigate advanced adversarial activities. Techniques for incident management, detection and response using Artificial Intelligence (AI) are particularly promising for enhancing defensive capabilities, with sophisticated detection and response that can learn and adapt to dynamic changes in the cyber environment. The EDF project AInception seeks to exploit such approaches, conducting research and development of novel AI-based tools and techniques for cyber defence of military operations. The project covers three fundamental areas: establishment of a military context to ensure sufficient realism and relevance; development of novel AI-based tools and techniques; and simulation and collection of data required to develop and evaluate the tools and techniques. This report documents the core work in AInception related to the scenario-based aspects of the military context. Its purpose is to provide an unclassified, publicly available source for this material to support future work. The content has been extracted from AInception deliverables without significant modifications. The material includes: • A scenario consisting of the geopolitical strategic situation of multiple countries on a synthetic (artificial) continent. One set of countries are designated Blue (friendly) and others Red (adversary or opposing). • A story focusing on two specific countries and their partners, with a main timeline split into different phases ranging from peacetime to crisis and armed conflict. • Six storylines covering the use of military forces in one or more tactical situations, with their own internal logic and dynamic, set along the main timeline. The storylines have military operations or activities taking place across the air, land and maritime domains. The storylines cover the strategic intent and military objectives of Red and Blue forces, the Blue order of battle, the Blue IT/OT/IoT infrastructure in use and Red cyber operations. Discussions of possible cyber incidents and simulation aspects are also included. Taken together, this material can serve multiple purposes in research and development. For instance, it can function as a tool for engaging with military experts and eliciting information and assessments; provide operational settings for the development of tools and techniques; and in general inform a recognizable, realistic and relevant context for military users and experts.

View all works in NVA