Central Servermodels → Federated averaging → SMPC → update → Global model

Organisation AInput (SIEM, alerts, tickets, emails)Global model (based on domains)<ul><li>RoBERTa, CyberBERT (onstro data)</li><li>Attack classification</li><li>Severity classification</li></ul>Automation<ul><li>Generate dynamic playbook</li><li>Explanation</li><li>Automate playbook</li></ul>Human<ul><li>Monitoring</li><li>Explanation</li><li>Notification</li><li>Control</li></ul>

Local model training<ul><li>Train model with the current attack</li><li>Local model</li><li>Central model</li></ul>

nlp