Universities lack the hands to defend their research infrastructure — building AI that reconstructs the campaign rather than trimming alerts

1Where the defending side is short of resources

Discussion of cyber defense tends to assume large firms or government agencies. What this award targets is the cyberinfrastructure of scientific institutions such as universities. Computing resources built for research are valuable and so become targets, while dedicated staff and budget stay limited.

The description states that collaborations with university cyberinfrastructure facilitators confirmed this asymmetry as an operational difficulty.

2Two shapes of existing solution

Neither holds up where staffing is the binding constraint. Too many false positives and people are needed for triage; only known patterns and there is little point in looking. The project proposes a third path: integrating system audit data, application-specific semantics and threat intelligence, with collective AI agents correlating across them.

3Three lines of work

First, an adaptive provenance collection framework combining lightweight anomaly detection with selective memory monitoring to efficiently capture evidence of stealthy attacks. Second, contextual knowledge extraction deriving application semantics from system logs and structured knowledge from threat intelligence reports.

Third, a collaborative AI framework integrating audit data, application context and threat intelligence to correlate alerts, reconstruct attack campaigns, retrieve evidence and generate explainable investigation results. That explainable is set as a condition follows from limited staffing: with few hands, conclusions are not enough without the grounds for them.

4Program and the spread of institutions

The program is Cybersecurity Innovation, and the award belongs to the CICI framework. The 120 NSF awards this site holds as of 2026-09-02 come from 93 institutions, with few repeating. By state, Arizona accounts for 4. Protecting research infrastructure itself is investment in the foundation that makes research possible rather than in a research result — a form of infrastructure funding. Amounts are the obligated amount as of the check date and may change.