CIRCAT Objective 2: Automating Cyber Threat Detection and Prioritization with Explainable AI for Critical Infrastructure Protection + Video

By /

Listen to this Post

Featured Image

Introduction

In the rapidly evolving landscape of cybersecurity, not every alert carries the same level of risk—yet security operations centers (SOCs) are drowning in thousands of daily notifications, many of which are false positives or low-priority events. The CIRCAT Project (Cybersecurity Infrastructure Resilience, Collaboration, and Advanced Training), a Digital Europe initiative coordinated by the National Cybersecurity Authority of Greece and launched in January 2026, addresses this challenge through Objective 2: leveraging Artificial Intelligence to automate the detection, assessment, and prioritisation of cyber threats and vulnerabilities affecting critical infrastructures. By integrating near real-time monitoring, AI-based threat detection, and automated mitigation strategies, CIRCAT enables proactive defence against emerging threats while reducing the window of exposure to potential attacks.

Learning Objectives

  • Understand how AI-enhanced tools automate threat detection and prioritisation across critical infrastructure sectors (Energy, Health, Public Administration, Digital Infrastructure, and Financial Markets)
  • Master the implementation of explainable AI (XAI) techniques that facilitate regulatory compliance and build trust in automated security decisions
  • Learn practical steps for deploying continuous monitoring, vulnerability assessment, and Cyber Range simulation environments

You Should Know

  1. AI-Powered Threat Detection and Near Real-Time Risk Assessment

CIRCAT implements continuous monitoring and near real-time risk assessment mechanisms that provide organisations with enhanced visibility of cyber risks and vulnerabilities. The system integrates AI-based threat detection models that analyse network traffic, system logs, and behavioural patterns to identify emerging threats before they escalate into full-blown incidents. Traditional signature-based detection methods are no longer sufficient—AI-driven approaches leverage machine learning and deep learning to detect zero-day exploits, advanced persistent threats (APTs), and sophisticated attack patterns that evade conventional security tools.

Step-by-Step Guide: Deploying AI-Based Threat Detection

  1. Data Collection and Normalisation: Aggregate logs from firewalls, intrusion detection systems (IDS), endpoints, and cloud platforms into a centralised data lake. Use tools like Elastic Stack (ELK) or Splunk for log aggregation.
 Linux: Forward syslog to central server
sudo nano /etc/rsyslog.conf
 Add: . @192.168.1.100:514
sudo systemctl restart rsyslog

Windows: Enable Windows Event Forwarding (WEF)
wecutil qc
wecutil cs "http://schemas.microsoft.com/wbem/wsman/1/windows/eventlog/ForwardedEvents"
  1. Feature Engineering: Extract relevant features from raw data—packet sizes, protocol types, connection durations, authentication attempts, and file access patterns. Use Python’s pandas and scikit-learn for preprocessing.
import pandas as pd
from sklearn.preprocessing import StandardScaler

Load network flow data
df = pd.read_csv('netflow_logs.csv')
features = ['duration', 'src_bytes', 'dst_bytes', 'protocol_type', 'flag']
X = df[bash]
scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)
  1. Model Selection and Training: Deploy supervised learning models (Random Forest, XGBoost) for known attack classification and unsupervised models (Autoencoders, Isolation Forest) for anomaly detection. The CIRCAT project utilises multimodal analytics based on AI to combine multiple data sources for enhanced detection accuracy.
from xgboost import XGBClassifier
from sklearn.model_selection import train_test_split

X_train, X_test, y_train, y_test = train_test_split(X_scaled, y, test_size=0.2)
model = XGBClassifier(n_estimators=100, max_depth=6, learning_rate=0.1)
model.fit(X_train, y_train)
predictions = model.predict(X_test)
  1. Integration with SIEM: Feed AI-generated alerts into your SIEM platform (Splunk ES, IBM QRadar, or Microsoft Sentinel) for correlation and visualisation. Configure alert thresholds to reduce false positives.
 Example: Splunk alert configuration via REST API
curl -k -u admin:password https://splunk-server:8089/services/alerts/fired_alerts \
-d name="AI_Threat_Detection" -d search="index=ai_alerts severity=high"
  1. Continuous Model Retraining: Implement a feedback loop where security analysts validate AI predictions, and the model retrains periodically using validated data to improve accuracy over time.

2. Vulnerability Prioritisation and Automated Mitigation

Not every vulnerability poses an immediate threat to critical infrastructure. CIRCAT Objective 2 emphasises assessing the severity and potential impact of vulnerabilities, enabling organisations to prioritise remediation efforts based on actual risk rather than CVSS scores alone. The project leverages AI-driven vulnerability identification and assessment (Task T3.2) to dynamically score vulnerabilities based on exploitability, asset criticality, and current threat intelligence.

Step-by-Step Guide: Implementing Risk-Based Vulnerability Prioritisation

  1. Asset Inventory and Criticality Mapping: Create a comprehensive inventory of all assets within your infrastructure, categorising them by criticality (e.g., Critical, High, Medium, Low). Use tools like Shodan, Nmap, or Tenable Nessus for discovery.
 Linux: Network discovery with Nmap
nmap -sP 192.168.1.0/24
nmap -sV -p- 192.168.1.10

Export asset inventory to CSV
nmap -sV -oG - 192.168.1.0/24 | grep "Ports" > asset_inventory.txt
  1. Vulnerability Scanning: Run authenticated and unauthenticated scans across your environment. CIRCAT integrates Cyber Threat Intelligence (CTI) feeds to enrich vulnerability data with real-world exploit information.
 Tenable Nessus CLI scan
nessuscli scan launch --scan-1ame "Critical_Infrastructure_Scan" --target "192.168.1.0/24"

OpenVAS (Greenbone) scan
gvm-cli socket --gmp-username admin --gmp-password password \
socket --socket-path /var/run/gvmd.sock \
--xml "<create_task>...</create_task>"
  1. Risk Scoring with AI: Implement a risk scoring engine that combines CVSS base scores, exploit availability (EPSS), asset criticality, and threat intelligence feeds. Use machine learning to predict which vulnerabilities are most likely to be exploited.
 Dynamic risk scoring
def calculate_risk(cvss_score, epss_score, asset_criticality, threat_intel):
base_risk = cvss_score  0.4 + epss_score  0.3
weighted_risk = base_risk  (1 + asset_criticality  0.2)
if threat_intel == "active_exploit":
weighted_risk = 1.5
return min(weighted_risk, 10.0)
  1. Automated Mitigation Workflows: For vulnerabilities exceeding a defined risk threshold, trigger automated remediation actions—patching, configuration changes, or network segmentation.
 Linux: Automated patch deployment via Ansible
ansible-playbook -i inventory/production.yml playbooks/security_patches.yml \
--limit "critical_servers"

Windows: Automate Windows Updates via PowerShell
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot
  1. Reporting and Compliance: Generate AI-based reports for threat detection and response prioritisation (Task T3.5) that support regulatory compliance under NIS2 Directive and DORA.

3. Explainable AI (XAI) for Trustworthy Security Decisions

The lack of transparency in AI models can undermine trust in their decision-making. CIRCAT addresses this through Task T3.6: trustworthy and explainable AI/ML implementation. Explainable AI helps security teams understand why threats are flagged, enabling them to validate recommendations before acting. This is particularly critical for critical infrastructure where incorrect automated decisions could have catastrophic consequences.

Step-by-Step Guide: Implementing Explainable AI in Security Operations

  1. Choose Interpretable Models: When possible, use inherently interpretable models (decision trees, logistic regression) over black-box models. For deep learning, employ post-hoc explainability techniques.

  2. Implement SHAP for Feature Attribution: Use SHAP (SHapley Additive exPlanations) to explain individual predictions.

import shap

Train model (XGBoost example)
model = XGBClassifier().fit(X_train, y_train)

Create SHAP explainer
explainer = shap.TreeExplainer(model)
shap_values = explainer.shap_values(X_test)

Visualise feature importance for a specific alert
shap.force_plot(explainer.expected_value, shap_values[bash], X_test[bash])
  1. Implement LIME for Local Explanations: Generate local interpretable explanations for specific predictions.
from lime.lime_tabular import LimeTabularExplainer

explainer = LimeTabularExplainer(X_train, feature_names=features, class_names=['Benign', 'Malicious'])
exp = explainer.explain_instance(X_test[bash], model.predict_proba)
exp.show_in_notebook()
  1. Create Human-Readable Reports: Translate AI explanations into actionable intelligence for SOC analysts. For each flagged alert, provide:

– The top 3 features that contributed to the decision
– Confidence score
– Recommended response actions
– Similar past incidents for reference

  1. Audit Trail and Compliance: Maintain logs of all AI-driven decisions with corresponding explanations to support regulatory audits under NIS2 and GDPR requirements.

4. Cyber Range Environments and Realistic Simulation

CIRCAT establishes a scalable Cyber Range network to facilitate collaborative and cross-border cybersecurity exercises among EU Member States. These controlled environments allow organisations to test their defences against realistic attack scenarios across enterprise networks, cloud environments, Industrial Control Systems (ICS), and IoT infrastructures.

Step-by-Step Guide: Setting Up a Cyber Range Environment

  1. Infrastructure Provisioning: Deploy virtual machines and network segments that mirror your production environment. Use tools like VMware vSphere, OpenStack, or cloud providers (AWS, Azure, GCP).
 Terraform example for AWS Cyber Range
terraform init
terraform plan -var="environment=cyberrange"
terraform apply -var="environment=cyberrange" -auto-approve
  1. Deploy Attack Simulation Tools: Install penetration testing frameworks (Metasploit, Cobalt Strike, Caldera) within the Cyber Range.
 Install Metasploit
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall

Install Caldera (MITRE ATT&CK simulator)
git clone https://github.com/mitre/caldera.git
cd caldera
pip install -r requirements.txt
python server.py
  1. Inject Threat Intelligence Feeds: Integrate CTI feeds to populate the Cyber Range with realistic threat actor behaviours and indicators of compromise (IoCs).

  2. Conduct Tabletop Exercises: Run scenario-based exercises where security teams respond to simulated attacks, with performance metrics captured for analysis.

  3. Post-Exercise Analysis: Use AI-driven analytics to evaluate team performance, identify gaps, and recommend improvements.

5. Cross-Border Collaboration and Incident Response Coordination

CIRCAT fosters coordinated incident response and knowledge sharing across Europe’s critical infrastructure sectors. This includes developing a Collaborative Intrusion Detection System (CIDS) that enables information sharing between organisations while maintaining privacy and confidentiality.

Step-by-Step Guide: Establishing Cross-Border Incident Response

  1. Establish Information Sharing Agreements: Define data sharing protocols, privacy safeguards, and legal frameworks aligned with GDPR and NIS2.

  2. Deploy Collaborative Detection: Implement distributed intrusion detection systems that share anonymised threat indicators.

 Example: MISP (Malware Information Sharing Platform) setup
 Install MISP
wget -O /tmp/INSTALL.sh https://raw.githubusercontent.com/MISP/MISP/2.4/INSTALL/INSTALL.sh
bash /tmp/INSTALL.sh

Configure sharing communities
 Access: https://misp-server/communities
  1. Automated Threat Intelligence Exchange: Use STIX/TAXII protocols for automated sharing of threat intelligence between participating organisations.

  2. Joint Exercise Coordination: Schedule regular cross-border exercises to test coordinated response capabilities.

6. Specialised Cybersecurity Training and Workforce Development

CIRCAT provides specialised cybersecurity training within realistic and controlled Cyber Range environments. This addresses the critical skills gap in cybersecurity, particularly for critical infrastructure sectors.

Step-by-Step Guide: Developing a Cybersecurity Training Programme

  1. Identify Skill Gaps: Conduct skills assessments across your security team to identify areas for improvement.

2. Develop Training Modules: Create role-based training covering:

  • AI-driven threat detection and response
  • Penetration testing and vulnerability assessment
  • Incident response and forensic analysis
  • ICS/SCADA security
  • Cloud security and DevSecOps
  1. Leverage Cyber Range for Hands-On Training: Use the Cyber Range environment for practical, hands-on exercises.
 Example: Create a vulnerable machine for training (using Vulhub)
git clone https://github.com/vulhub/vulhub.git
cd vulhub/nginx/nginx_parsing_vulnerability
docker-compose up -d
  1. Measure Training Effectiveness: Use AI-driven analytics to assess trainee performance and identify areas requiring additional focus.

What Undercode Say

  • Key Takeaway 1: AI is not a magic bullet—it requires continuous tuning, validation, and human oversight. The CIRCAT project’s emphasis on explainable AI (XAI) is critical for building trust and ensuring that automated decisions can be audited and understood by security analysts.

  • Key Takeaway 2: Critical infrastructure protection demands a holistic approach that combines AI-driven automation with human expertise, realistic simulation, and cross-border collaboration. The integration of Cyber Threat Intelligence feeds, near real-time monitoring, and Cyber Range environments creates a comprehensive defence-in-depth strategy.

Analysis: The CIRCAT project represents a paradigm shift in how we approach cybersecurity for critical infrastructure. Traditional perimeter-based security models are obsolete—attackers are already inside networks, and the question is no longer “if” but “when” a breach will occur. AI-powered threat detection and prioritisation enable organisations to focus their limited resources on the most critical threats, while explainable AI ensures that decisions are transparent and auditable. The project’s focus on Cyber Range environments and cross-border collaboration addresses the systemic nature of cyber threats—an attack on one EU member state’s energy grid could cascade across borders. However, the success of these initiatives depends on widespread adoption, data sharing, and continuous investment in workforce development. The open call funding up to 18 projects with €40,000 each is a step in the right direction, but sustained commitment from both public and private sectors is essential.

Expected Output

Introduction: The CIRCAT Project’s Objective 2 addresses the critical challenge of alert fatigue in security operations by leveraging AI to automate threat detection, assessment, and prioritisation. With near real-time monitoring and explainable AI techniques, the project enables faster, more accurate responses while supporting regulatory compliance under NIS2 and DORA.

What Undercode Say:

  • Key Takeaway 1: AI-driven threat prioritisation transforms security operations from reactive to proactive, but explainability is non-1egotiable for critical infrastructure where decisions have life-safety implications.
  • Key Takeaway 2: The integration of Cyber Ranges, CTI feeds, and cross-border collaboration creates a resilient ecosystem that can withstand and rapidly recover from sophisticated cyberattacks.

Prediction

  • +1 The adoption of AI-driven threat detection and prioritisation will become mandatory for critical infrastructure operators within the next 3-5 years, driven by regulatory requirements under NIS2 and DORA. Organisations that fail to implement these capabilities will face increased regulatory scrutiny and higher cyber insurance premiums.

  • +1 Explainable AI will emerge as a competitive differentiator for cybersecurity vendors, with organisations prioritising solutions that provide transparent, auditable decision-making over black-box models.

  • -1 The cybersecurity skills gap will widen as AI automation reduces demand for entry-level SOC analysts while increasing demand for AI/ML specialists and XAI experts—creating a talent shortage that could delay adoption.

  • +1 Cross-border Cyber Range exercises will become standard practice, fostering greater collaboration and information sharing between EU member states and reducing the risk of cascading failures across interconnected critical infrastructure.

  • -1 Adversaries will increasingly target AI models themselves through adversarial machine learning techniques, necessitating ongoing research into robust and resilient AI systems.

  • +1 The CIRCAT model will be replicated in other regions (North America, Asia-Pacific) as governments recognise the value of AI-enhanced, collaborative approaches to critical infrastructure protection.

  • -1 Organisations that treat AI as a replacement for human expertise rather than a force multiplier will experience “automation blindness”—missing sophisticated attacks that AI models are not trained to detect.

  • +1 The integration of Cyber Threat Intelligence feeds with AI-driven risk scoring will enable near real-time vulnerability prioritisation, reducing the average time to patch critical vulnerabilities from weeks to hours.

  • +1 The open call funding mechanism will stimulate innovation in the European cybersecurity ecosystem, with up to 18 selected projects developing realistic penetration testing scenarios that benefit the entire critical infrastructure community.

  • -1 Data privacy and sovereignty concerns may limit the effectiveness of cross-border threat intelligence sharing, requiring careful balance between security collaboration and regulatory compliance.

▶️ Related Video (76% Match):

https://www.youtube.com/watch?v=1vD8N0l1PVc

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Circat Objective – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: