Intrusion Detection am AIT
Hardly a week goes by without headlines about a major cyber attack on data networks – ranging from public and corporate information systems to critical infrastructure such as smart grids. To defend against such attacks, it is crucial to detect them as early as possible. So-called ‘intrusion detection systems’ serve as key components of modern cyber security protection for data infrastructure.
Detecting unusual events in networks reliably
This involves the constant monitoring of a computer system – including both network traffic and system behaviour, as well as the physical processes underlying the data. Intrusion detection systems detect when something unusual is happening in the system: they provide early warning of a hacker intrusion, thereby enabling rapid countermeasures. Among other things, machine learning methods are used for this purpose, as they are very good at identifying deviations from ‘normal’ system behaviour.
A major problem here is that there are too many false alarms. This can happen, for example, in a power grid when deviations from normal system behaviour occur for entirely different reasons, such as a thunderstorm. The practical challenge is that everything has to happen very quickly: as soon as the system reports an anomaly, one must immediately set about finding the cause in order to be able to make the right decisions swiftly.
The AIT StealthCup system ensures effectiveness
Despite all the progress made in terms of methodology, it remains difficult to measure the actual effectiveness of these defence systems under real-world operating conditions. Experts at the AIT Austrian Institute of Technology have developed the ‘StealthCup’ experimental test environment for this purpose. This is a research and evaluation concept that is unique internationally, enabling realistic, multi-stage cyber attacks to be carried out in a fully automated cyber range. This approach lays the foundation for reproducible assessments of intrusion detection systems (IDS) in large IT systems.
In the process, 56 international ‘ethical hackers’ – that is, IT security experts who legally and with authorisation penetrate systems or networks to uncover vulnerabilities before cybercriminals do – generated several thousand events that replicate realistic attack patterns. The fully automated provisioning of the IT infrastructure enabled reproducible IDS benchmarking experiments in realistic environments. The publication of this consistent, structured and realistically annotated dataset now closes a long-standing gap, thereby enabling the independent validation of such systems.
Contribution to Europe’s technological sovereignty
The AIT plays a leading role in this regard: the StealthCup offers a combination, unique in Europe, of a fully reproducible ‘Infrastructure as Code’ (IaC)-based test environment and realistic attack patterns generated by human attackers. The infrastructure was developed and validated in collaboration with infrastructure companies, which demonstrates its relevance and practical applicability.
By providing independent, scientifically robust evaluation and testing facilities, AIT supports Europe’s ability to assess security-critical technologies in a transparent and evidence-based manner. This contributes to Europe’s security and technological sovereignty. European authorities, organisations and manufacturers are showing concrete interest in collaboration, particularly in the fields of detection engineering and the training of specialist staff.
The StealthCup test environment is undergoing continuous development. The next opportunity for ethical hackers to test the environment under realistic conditions will be on 31 October 2026 as part of the Hackfest at the Québec City Convention Centre in Canada.
Developing defences against new threats
The need for evaluation methods for security solutions will continue to grow in the coming years – not least due to increasingly stringent regulatory requirements (NIS2, DORA, CRA) and the AI-powered techniques and adaptive attack chains employed by attackers. To meet these requirements, StealthCup is being specifically expanded, for example by incorporating AI-powered attack simulations and so-called adversarial machine learning models, by broadening the range of scenarios and industrial protocols, and by developing repeatable attacker profiles for standardised, reproducible comparative tests across multiple IDS solutions.
Through these further developments, the AIT is making a long-term contribution to securing data infrastructures and establishing robust defence mechanisms in Europe.
AIT: Research for the infrastructure of tomorrow
More than 1,600 staff members work every day at the AIT Austrian Institute of Technology on the key infrastructure issues of the future, particularly in the fields of energy, mobility, health and data. At AIT, the infrastructure of tomorrow is conceived and researched. Austria's largest research and technology organisation, AIT acts as a bridge between science and innovation, collaborating with industry and public institutions across the entire innovation chain – from the initial idea through to implementation. To further develop future-proof technologies, the AIT operates Austria’s most advanced research infrastructure, with specialised laboratories for energy, mobility, urban planning, digital security, food security and much more. AIT research makes a difference and creates solutions – for industry, society and, ultimately, for us all.
Mag. Michael Hlava
Head of AIT Communication
T +43 (0)50550-4014 I michael.hlava(at)ait.ac.at
Daniel Pepl, MAS MBA
AIT Communication / AI Factory Austria AI:AT
T +43 (0)50550-4040 I daniel.pepl(at)ait.ac.at
Mag. Florian Hainz BA
AIT Communication - Press & PR
T +43 (0)50550-4518 I florian.hainz(at)ait.ac.at