Vasileios Mavroeidis

• Eilertsen, Even; Mavroeidis, Vasileios & Grov, Gudmund (2025). Towards Agentic Investigation of Security Alerts. IEEE International Conference on Big Data (Big Data). ISSN 2639-1589. p. 7793–7802. doi: 10.1109/bigdata66926.2025.11402161. Full text in Research Archive Show summary

  Security analysts are overwhelmed by the volume of alerts and the low context provided by many detection systems. Early-stage investigations typically require manual correlation across multiple log sources, a task that is usually time-consuming. In this paper, we present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries and constrained tool access (structured SQL over Suricata logs and grep-based text search) to automate the first stages of alert investigation. The proposed workflow integrates queries to provide an overview of the available data, and LLM components that selects which queries to use based on the overview results, extracts raw evidence from the query results, and delivers a final verdict of the alert. Our results demonstrate that the LLM-powered workflow can investigate log sources, plan an investigation, and produce a final verdict that has a significantly higher accuracy than a verdict produced by the same LLM without the proposed workflow. By recognizing the inherent limitations of directly applying LLMs to high-volume and unstructured data, we propose combining existing investigation practices of real-world analysts with a structured approach to leverage LLMs as virtual security analysts, thereby assisting and reducing the manual workload.

• Bisztray, Tamas; Cherif, Bilel; Dubniczky, Richard A.; Gruschka, Nils; Borsos, Bertalan & Ferrag, Mohamed Amine [Show all 9 contributors for this article] (2025). I Know Which LLM Wrote Your Code Last Summer: LLM generated Code Stylometry for Authorship Attribution. In Pintor, Maura; Jagielski, Matthew & Jia, @@ruoxi (Ed.), AISec '25: Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security. Association for Computing Machinery (ACM). ISSN 9798400718953. p. 28–39. doi: 10.1145/3733799.3762964. Full text in Research Archive Show summary

  As code generated by Large Language Models (LLMs) becomes more common, identifying the specific model behind each sample is increasingly important. This paper presents the first systematic study of LLM authorship attribution for C programs. We release CodeT5-Authorship, a novel LLM that uses only the encoder layers from the original CodeT5 encoder-decoder architecture. Our model’s encoder output (first token) is passed through a two-layer classification head with GELU activation and dropout, producing a probability distribution over possible authors. To evaluate our approach, we introduce LLM-AuthorBench, a benchmark of 32,000 compilable C programs generated by eight state-of-the-art LLMs across diverse tasks. We compare our model to seven traditional ML classifiers and eight fine-tuned transformer models, including BERT, RoBERTa, CodeBERT, ModernBERT, DistilBERT, DeBERTa-V3, Longformer, and LoRA-fine-tuned Qwen2-1.5B. In binary classification, our model achieves 97.56 % accuracy in telling apart source code written by related models such as GPT-4.1 and GPT-4o, and 95.40 % accuracy for multi-class attribution among five leading LLMs (Gemini 2.5 Flash, Claude 3.5 Haiku, GPT-4.1, Llama 3.3, and DeepSeek-V3). To support open science, we release the CodeT5-Authorship architecture, the LLM-AuthorBench dataset, and all relevant Google Colab scripts on GitHub: https://github.com/LLMauthorbench/.

• Eckhoff, Magnus Wiik; Halvorsen, Jonas; Hansen, Bjørn Jervell; Eian, Martin; Mavroeidis, Vasileios & Chetwyn, Robert Andrew [Show all 8 contributors for this article] (2025). Experimenting with Neurosymbolic Artificial Intelligence for Defending Against Cyber Attacks. Neurosymbolic Artificial Intelligence. ISSN 2949-8732. 1. doi: 10.1177/29498732251377352. Full text in Research Archive Show summary

  It is generally accepted that all cyber attacks can not be prevented, and it is therefore necessary to have the ability to detect and respond to cyber attacks. Both connectionist and symbolic approaches are currently being employed for this purpose, but far less work has been done on the intersection of the two. This paper argues that the cyber security domain holds significant potential for applying neurosymbolic artificial intelligence (AI). We identify a set of challenges faced in cyber security today, and from this, we propose a set of neurosymbolic use cases that can help address the challenges. Feasibility is demonstrated through multiple experiments that apply neurosymbolic AI to cyber security. We find a significant overlap between the challenges in cyber security and the promises of neurosymbolic techniques, making it an interesting research direction for both the neurosymbolic AI and cyber security communities. This paper is an extended version of a paper published at the NeSy 2024 conference ( Grov et al., 2024 ). The main additional contributions are further experimental evidence for our hypothesis that NeSy offers real benefits in this domain and a more in-depth treatment of knowledge graphs for cyber security.

• Grov, Gudmund; Halvorsen, Jonas; Eckhoff, Magnus Wiik; Hansen, Bjørn Jervell; Eian, Martin & Mavroeidis, Vasileios (2024). On the Use of Neurosymbolic AI for Defending Against Cyber Attacks. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. doi: 10.1007/978-3-031-71167-1_7. Full text in Research Archive
• Norbert, Tihanyi; Bisztray, Tamas György; Dubniczky, Richard; Toth, Rebeka; Borso, Bertalan & Cherif, Bilel [Show all 14 contributors for this article] (2024). Dynamic intelligence assessment: Benchmarking llms on the road to agi with a focus on model confidence. In Ding, Wei (Eds.), 2024 IEEE International Conference on Big Data, Dec 15 - Dec 18, 2024 • Washington DC, USA - Proceedings. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798350362480. doi: 10.1109/BigData62323.2024.10825051. Full text in Research Archive
• Mavroeidis, Vasileios; Hohimer, Ryan; Casey, Tim & Jøsang, Audun (2021). Threat Actor Type Inference and Characterization within Cyber Threat Intelligence. In Jancarkova, Tatiana; Lindstrom, Lauri & Visky, Gabor (Ed.), 2021 13th International Conference on Cyber Conflict: Going Viral. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9789916956557. p. 335–360. doi: 10.23919/CyCon51939.2021.9468305. Full text in Research Archive Show summary

  As the cyber threat landscape is constantly becoming increasingly complex and polymorphic, the more critical it becomes to understand the enemy and its modus operandi for anticipatory threat reduction. Even though the cyber security community has developed a certain maturity in describing and sharing technical indicators for informing defense components, we still struggle with non-uniform, unstructured, and ambiguous higher-level information, such as the threat actor context, thereby limiting our ability to correlate with different sources to derive more contextual, accurate, and relevant intelligence. We see the need to overcome this limitation in order to increase our ability to produce and better operationalize cyber threat intelligence. Our research demonstrates how commonly agreed-upon controlled vocabularies for characterizing threat actors and their operations can be used to enrich cyber threat intelligence and infer new information at a higher contextual level that is explicable and queryable. In particular, we present an ontological approach to automatically inferring the types of threat actors based on their personas, understanding their nature, and capturing polymorphism and changes in their behavior and characteristics over time. Such an approach not only enables interoperability by providing a structured way and means for sharing highly contextual cyber threat intelligence but also derives new information at machine speed and minimizes cognitive biases that manual classification approaches entail.

• Bisztray, Tamas; Gruschka, Nils; Mavroeidis, Vasileios & Fritsch, Lothar (2020). Data Protection Impact Assessment in Identity Control Management with a Focus on Biometrics. In Roßnagel, Heiko; Schunck, Christian H.; Mödersheim, Sebastian & Hühnlein, Detlef (Ed.), Open Identity Summit 2020. Gesellschaft für Informatik. ISSN 9783885796992. p. 185–192. doi: 10.18420/ois2020_17. Full text in Research Archive
• Mavroeidis, Vasileios & Brule, Joe (2020). A nonproprietary language for the command and control of cyber defenses – OpenC2. Computers & Security. ISSN 0167-4048. 97. doi: 10.1016/j.cose.2020.101999. Full text in Research Archive
• Mavroeidis, Vasileios & Jøsang, Audun (2018). Data-Driven Threat Hunting Using Sysmon. In Wang, Yulin (Eds.), 2018 the 2nd International Conference on Cryptography, Security and Privacy. Association for Computing Machinery (ACM). ISSN 9781450363617. p. 82–88. doi: 10.1145/3199478.3199490. Full text in Research Archive Show summary

  Threat actors can be persistent, motivated and agile, and they leverage a diversified and extensive set of tactics, techniques, and procedures to attain their goals. In response to that, organizations establish threat intelligence programs to improve their defense capabilities and mitigate risk. Actionable threat intelligence is integrated into security information and event management systems (SIEM) forming a threat intelligence platform. A threat intelligence platform aggregates log data from multiple disparate sources by deploying numerous collection agents and provides centralized analysis and reporting of an organization's security events for identifying malicious activity. Sysmon logs is a data source that has received considerable attention for endpoint visibility. Approaches for threat detection using Sysmon have been proposed mainly focusing on search engines (NoSQL database systems). This paper presents a new automated threat assessment system that relies on the analysis of continuous incoming feeds of Sysmon logs. The system is based on a cyber threat intelligence ontology and analyses Sysmon logs to classify software in different threat levels and augment cyber defensive capabilities through situational awareness, prediction, and automated courses of action.

• Mavroeidis, Vasileios; Vishi, Kamer & Jøsang, Audun (2018). A framework for data-driven physical security and insider threat detection, 2018 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538660515. p. 1108–1115. doi: 10.1109/ASONAM.2018.8508599. Full text in Research Archive Show summary

  This paper presents PS0, an ontological framework and a methodology for improving physical security and insider threat detection. PS0 can facilitate forensic data analysis and proactively mitigate insider threats by leveraging rule-based anomaly detection. In all too many cases, rule-based anomaly detection can detect employee deviations from organizational security policies. In addition, PS0 can be considered a security provenance solution because of its ability to fully reconstruct attack patterns. Provenance graphs can be further analyzed to identify deceptive actions and overcome analytical mistakes that can result in bad decision-making, such as false attribution. Moreover, the information can be used to enrich the available intelligence (about intrusion attempts) that can form use cases to detect and remediate limitations in the system, such as loosely-coupled provenance graphs that in many cases indicate weaknesses in the physical security architecture. Ultimately, validation of the framework through use cases demonstrates and proves that PS0 can improve an organization's security posture in terms of physical security and insider threat detection.

• Mavroeidis, Vasileios; Vishi, Kamer; Zych, Mateusz & Jøsang, Audun (2018). The impact of quantum computing on present cryptography. International Journal of Advanced Computer Science and Applications (IJACSA). ISSN 2158-107X. 9(3), p. 405–414. doi: 10.14569/IJACSA.2018.090354. Full text in Research Archive Show summary

  The aim of this paper is to elucidate the implications of quantum computing in present cryptography and to introduce the reader to basic post-quantum algorithms. In particular the reader can delve into the following subjects: present cryptographic schemes (symmetric and asymmetric), differences between quantum and classical computing, challenges in quantum computing, quantum algorithms (Shor’s and Grover’s), public key encryption schemes affected, symmetric schemes affected, the impact on hash functions, and post quantum cryptography. Specifically, the section of Post-Quantum Cryptography deals with different quantum key distribution methods and mathematical-based solutions, such as the BB84 protocol, lattice-based cryptography, multivariate-based cryptography, hash-based signatures and code-based cryptography.

• Gruschka, Nils; Mavroeidis, Vasileios; Vishi, Kamer & Jensen, Meiko (2018). Privacy Issues and Data Protection in Big Data: A Case Study Analysis under GDPR. In Abe, Naoki; Liu, Huan; Hu, Xiaohua; Ahmed, Nesreen; Qiao, Mu; Song, Yang; Kossmann, Donald; Liu, Bing; Lee, Kisung; Tang, Jiliang; He, Jingrui & Saltz, Jeffrey (Ed.), 2018 IEEE International Conference on Big Data (Big Data), Seattle, 10-13 Dec. 2018. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538650356. p. 5027–5033. doi: 10.1109/BigData.2018.8622621. Full text in Research Archive Show summary

  Big data has become a great asset for many organizations, promising improved operations and new business opportunities. However, big data has increased access to sensitive information that when processed can directly jeopardize the privacy of individuals and violate data protection laws. As a consequence, data controllers and data processors may be imposed tough penalties for non-compliance that can result even to bankruptcy. In this paper, we discuss the current state of the legal regulations and analyse different data protection and privacy-preserving techniques in the context of big data analysis. In addition, we present and analyse two real-life research projects as case studies dealing with sensitive data and actions for complying with the data regulation laws. We show which types of information might become a privacy risk, the employed privacy-preserving techniques in accordance with the legal requirements, and the influence of these techniques on the data processing phase and the research results.

• Lison, Pierre & Mavroeidis, Vasileios (2017). Automatic Detection of Malware-Generated Domains with Recurrent Neural Models. Norsk Informasjonssikkerhetskonferanse (NISK). ISSN 1893-6563. Full text in Research Archive Show summary

  Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.

• Mavroeidis, Vasileios & Bromander, Siri (2017). Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence. In Karampelas, Panagiotis & Brynielsson, Joel (Ed.), Proceedings of European Intelligence and Security Informatics Conference (EISIC) 2017. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538623855. doi: 10.1109/EISIC.2017.20. Full text in Research Archive Show summary

  Cyber threat intelligence is the provision of evidence-based knowledge about existing or emerging threats. Benefits from threat intelligence include increased situational awareness, efficiency in security operations, and improved prevention, detection, and response capabilities. To process, correlate, and analyze vast amounts of threat information and data and derive intelligence that can be shared and consumed in meaningful times, it is required to utilize structured, machine-readable formats that incorporate the industry-required expressivity while at the same time being unambiguous. To a large extent, this is achieved with technologies like ontologies, schemas, and taxonomies. This research evaluates the coverage and high-level conceptual expressivity of cyber-threat-intelligence-relevant ontologies, sharing standards, and taxonomies pertaining to the who, what, why, where, when, and how elements of threats and intrusions in addition to courses of action and technical indicators. The results confirm that little emphasis has been given to developing a comprehensive cyber threat intelligence ontology, with existing efforts not being thoroughly designed, non-interoperable and ambiguous, and lacking proper semantics and axioms for reasoning.

• Lison, Pierre & Mavroeidis, Vasileios (2017). Neural Reputation Models learned from Passive DNS data, IEEE Big Data 1st International Workshop on Big Data Analytic for Cyber Crime Investigation and Prevention 2017. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538627150. p. 3662–3671. doi: 10.1109/BigData.2017.8258361. Full text in Research Archive Show summary

  Blacklists and whitelists are often employed to filter outgoing and incoming traffic on computer networks. One central function of these lists is to mitigate the security risks posed by malware threats by associating a reputation (for instance benign or malicious) to end-point hosts. The creation and maintenance of these lists is a complex and time-consuming process for security experts. As a consequence, blacklists and whitelists are prone to various errors, inconsistencies and omissions, as only a tiny fraction of end-point hosts are effectively covered by the reputation lists. In this paper, we present a machine learning model that is able to automatically detect whether domain names and IP addresses are benign, malicious or sinkholes. The model relies on a deep neural architecture and is trained on a large passive DNS database. Evaluation results demonstrate the effectiveness of the approach, as the model is able to detect malicious DNS records with a F1 score of 0.96. In other words, the model is able to detect 95 % of the malicious hosts with a false positive rate of 1:1000.

• Mavroeidis, Vasileios & Mathew, Nicho (2017). Quick Response Code Secure: A Cryptographically Secure Anti-Phishing Tool for QR Code Attacks. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 10446, p. 313–324. doi: 10.1007/978-3-319-65127-9_25. Full text in Research Archive Show summary

  The two-dimensional quick response (QR) codes can be misleading due to the difficulty in differentiating a genuine QR code from a malicious one. Since the vulnerability is practically part of their design, scanning a malicious QR code can direct the user to cloned malicious sites resulting in revealing sensitive information. In order to evaluate the vulnerabilities and propose subsequent countermeasures, we demonstrate this type of attack through a simulated experiment, where a malicious QR code directs a user to a phishing site. For our experiment, we cloned Google’s web page providing access to their email service (Gmail). Since the URL is masqueraded into the QR code, the unsuspecting user who opens the URL is directed to the malicious site. Our results proved that hackers could easily leverage QR codes into phishing attack vectors targeted at smartphone users, even bypassing web browsers’ safe browsing feature. In addition, the second part of our paper presents adequate countermeasures and introduces QRCS (Quick Response Code Secure). QRCS is a universal efficient and effective solution focusing exclusively on the authenticity of the originator and consequently the integrity of QR code by using digital signatures. This research was originally published in Lecture Notes in Artificial Intelligence. © 2017 Springer Verlag

• Vishi, Kamer & Mavroeidis, Vasileios (2017). An Evaluation of Score Level Fusion Approaches for Fingerprint and Finger-vein Biometrics. Norsk Informasjonssikkerhetskonferanse (NISK). ISSN 1893-6563. 10(1), p. 111–122. Full text in Research Archive Show summary

  Biometric systems have to address many requirements, such as large population coverage, demographic diversity, varied deployment environment, as well as practical aspects like performance and spoofing attacks. Traditional unimodal biometric systems do not fully meet the aforementioned requirements making them vulnerable and susceptible to different types of attacks. In response to that, modern biometric systems combine multiple biometric modalities at different fusion levels. The fused score is decisive to classify an unknown user as a genuine or impostor. In this paper, we evaluate combinations of score normalization and fusion techniques using two modalities (fingerprint and finger-vein) with the goal of identifying which one achieves better improvement rate over traditional unimodal biometric systems. The individual scores obtained from finger-veins and fingerprints are combined at score level using three score normalization techniques (min-max, z-score, hyperbolic tangent) and four score fusion approaches (minimum score, maximum score, simple sum, user weighting). The experimental results proved that the combination of hyperbolic tangent score normalization technique with the simple sum fusion approach achieve the best improvement rate of 99.98%.

View all works in NVA

• Egiazarov, Alexander; Zennaro, Fabio Massimo & Mavroeidis, Vasileios (2020). Firearm Detection via Convolutional Neural Networks: Comparing a Semantic Segmentation Model Against End-to-End Solutions. Full text in Research Archive
• Mavroeidis, Vasileios & Brule, Joe (2020). A Nonproprietary Language for the Command and Control of CyberDefenses - OpenC2. Computers & Security. ISSN 0167-4048. doi: 10.1016/j.cose.2020.101999. Full text in Research Archive
• Egiazarov, Alexander; Mavroeidis, Vasileios; Vishi, Kamer & Zennaro, Fabio Massimo (2019). Firearm Detection and Segmentation using an Ensemble of Semantic Neural Networks. Full text in Research Archive
• Mavroeidis, Vasileios; Shabani, Daniel Assani & Steen, Fabian Aude (2025). A NIS2 pan-European registry for identifying and classifying essential and important entities. Høyskolen Kristiania. Full text in Research Archive Show summary

  The NIS2 Directive establishes a common cybersecurity governance model across the European Union, requiring member states to identify, classify, and supervise essential and important entities. As part of a broader governance network, member states are also obligated to notify the European Commission, the Cooperation Group, and ENISA about their cybersecurity infrastructure landscape. This thesis presents an analysis of the NIS2 Directive in this context and translates its provisions into concrete technical requirements. These requirements inform the design and implementation of a modular, legally grounded registry system intended to support competent authorities across the EU in meeting their obligations. Using the Design Science Research (DSR) methodology, the thesis transforms complex legal provisions into structured workflows, deterministic classification algorithms, and in- teractive dashboards. The resulting system automates key regulatory processes—including entity registration, classification, and notification—while enabling context-aware super- vision and reducing administrative burden. It supports both automated and manual registration methods and introduces a contextual labeling system to handle edge cases, risk factors, and cross-directive dependencies. Although developed for the Norwegian regulatory ecosystem, the system is designed for adaptation by other member states with minimal modification. This thesis contributes a reusable framework that bridges legal interpretation and technical implementation, offering a scalable solution for national and EU-level NIS2 cybersecurity governance. It also identifies key limitations and outlines opportunities for future research and development. Keywords: NIS2 Directive, Cybersecurity Governance, Entity Classification, Automa- tion and Compliance, Regulatory Technology (RegTech)

• Mavroeidis, Vasileios (2021). Towards Automated Threat-Informed Cyberspace Defense. Universitetet i Oslo. Full text in Research Archive Show summary

  To attain their goals, attackers have developed highly automated intelligence-driven attack capabilities. In contrast, defenders are still challenged by prolonged detection and response times due to their insufficient threat situational awareness and the fact that they heavily rely on manually executed defense operations. This thesis introduced and enhanced foundational technology in support of accomplishing automated threat-informed cyberspace defense. The research direction was influenced by the Integrated Adaptive Cyber Defense (IACD) framework that defines three fundamental capability requirements to realize autonomous defense environments that can detect, respond to, or outmaneuver cyber attacks in cyber-relevant time. In particular, the main contributions of this Ph.D. work are: - To enhance defenders' knowledge about adversaries, we introduced an ontological approach for representing and modeling their personas based on their defining characteristics. - We introduced a playbook standard for creating, documenting, and sharing security processes and procedures. Defenders can exchange such playbooks and utilize them to automate segments of their defense operations. - We supported the development of a machine-readable language that standardizes the way we command and control cyber defense systems.

View all works in NVA