HORSE Key Achievement: ML Detector Engine

Category: Significant Technology Development

Within the HORSE framework, the DEME (Detection Engine and Mitigation Engine) module was developed as a foundational component of the system’s “Intelligence” subsystem (see green area in the figure). DEME leverages machine learning (ML) capabilities to build predictive models from features observed and extracted by the framework, enabling real-time detection of anomalies by comparing predictions with actual network data. The proposed implementation incorporates advanced technologies and, in some cases, exceeds the current state of the art.

Notably, HORSE integrates diverse, yet complementary, technologies—including ML-based modules (DEME and DTE) and cutting-edge Digital Twin applications (SAN)—in an innovative and synergistic way. The use of multiple ML algorithms, as supported by academic literature, offers significant advantages over signature-based methods, particularly against zero-day attacks. Furthermore, ML enables faster detection than threshold-based systems by identifying early-stage deviations, even when absolute values remain below alert levels. DEME’s novel chained-stage architecture allows egress stages full visibility of parallel ingress stages, ensuring holistic anomaly assessment and improving responsiveness to complex or blended threats. Finally, by focusing detection on the “trigger” phase of attacks—such as identifying anomalous NTP MONLIST requests rather than the amplified traffic they generate—the system ensures earlier, more granular, and more effective mitigation.

horse

References:

HORSE project consortium (2025), HORSE D5.4: Final HORSE Platform Release, at https://horse-6g.eu/deliverables/