DNS as a language model: AI support for increased responsiveness to cyber threats

Purpose and goal

The project´s objective is to develop and test an AI-based language model for DNS data, and enable federated and privacy-protected training and analysis across organizations. The project develops a federation architecture for secure sharing of threat indicators and model artifacts between multiple instances. The solution is adapted for both the private and public sectors and aims to strengthen the ability to detect and analyze cyber threats through improved and privacy-protected analysis.

Expected effects and result

By analyzing DNS patterns from multiple actors, threats can be detected early, but without the right architecture, sensitive data risks being exposed. The project strengthens Swedish cyber resilience by creating a better situational awareness, faster reaction capacity and increased ability to detect new threat patterns without compromising privacy or business-sensitive data.

Planned approach and implementation

The project is implemented by developing and training a language model for DNS data. The model is trained in a distributed environment with strict privacy protection. It is integrated into existing data flows and tested in a new Core-instance developed for the private sector. The results are evaluated based on detection, accuracy, scalability and integrity, shared through industry collaboration and published as open source within the framework of existing work with the DNS TAPIR platform.