AI Research Centre

Darktrace Cyber AI Research Center

“Research unlocks the unknowns; it also helps shed light on what we are collectively up against.” - Jack Stockdale OBE, CTO

The Darktrace AI Research Centre is foundational to our continued innovation.

Teams of mathematicians and other experts examine how AI can be applied to real-world problems.

Their aim is to discover new paths forward to augment human capabilities.

With over 200 patents and patents pending, the AI Research Centre comprises more than 200 R&D employees, including experts with ~100 master's degrees and 20 doctorates in disciplines from astrophysics to linguistics to data science.

28%

R&D Headcount Growth in FY22

20+

Doctorates

~100

Masters

Our history

Founded by mathematicians and cyber defense experts in 2013, Darktrace is a global leader in cybersecurity AI, delivering complete AI-powered solutions in its mission to free the world of cyber disruption. We protect more than 9,000 customers from the world’s most complex threats, including ransomware, cloud, and SaaS attacks.

Our roots lie deep in innovation. The Darktrace AI Research Center based in Cambridge, UK, has conducted research establishing new thresholds in cyber security, with technology innovations backed by over 125 patents and pending applications. The company’s European R&D center is located in The Hague, Netherlands.

Rather than confined to work on product roadmaps, researchers are free to experiment and explore, guided by creative insight arising from pure research. Yet we have never shied away from taking on real challenges faced by the industry, and the AI Research Centre operates with a common goal of solving these challenges with AI and mathematics.

The AI Research Centre has produced numerous award-winning breakthroughs, which have gone on to form the AI capabilities that today comprise our products contained in the Darktrace ActiveAI Security Platform. Please see below a selection of research abstracts stemming from these research initiatives.

Cyber AI Research Centre

Featured research

Innovating Cyber Recovery - Key to Cyber Resilience

Read our second Darktrace Discourse paper, authored by John C. Allen, MBA, CRISC, and VP Cyber Risk & Compliance, Darktrace. This paper reviews the current state of incident recovery and sets forth seven areas of innovation to improve Recovery from cyber incidents, based on a core capability: Real-Time Adaptive Incident Response.

Download

Attack Path Modeling Research

This paper outlines Darktrace's Attack Path modeling (APM) capabilities, exploring how real-time, automated, dual-aspect, multi-data-source, end-to-end APM can be used to give blue teams a comprehensive view of realistic, risk-prioritized attack paths so that resources can be best allocated to defend key assets.

Download

Prevent: Security through Adversity

Read our Darktrace Discourse paper, authored by one of our researchers based at the Centre. The author has seven years’ experience in the automation of complex cyber-centric processes with specialization in the offensive domain, and holds a PhD in Astrophysics from the University of Cambridge.

Download

Research

Gaussian constructions on surfaces for anomalous event identification

Determining anomalies by creating probability density functions on different surfaces corresponding to the properties of interest.

Researchers

Dr. Tim Bazalgette

Dr. Dickon Humphrey

Securing tenant data in the public cloud

Secure practices to ensure corporate data sitting within public servers such as AWS is sufficiently isolated, in the event of a data breach targeting these public cloud providers.

Researchers

Alex Smith

Identification of cryptomining credentials and their use in differentiating between insider threats and wide-spread malware

How global analysis of cryptomining credentials can identify malicious criminal organizations leveraging corporate computing power for financial gain.

Researchers

Dr. Andrew Woodford

Identification of services associated with data uploads for analysis of exfiltration

How the intelligent analysis of connection properties can help assess whether specific uploads are associated with malicious exfiltration.

Researchers

Dr. Tim Bazalgette

Matryoshka Bloom filters quickly and efficiently determine rarity

A novel data structure for the efficient storage and retrieval of statistics on how common strings are in specific environments.

Researchers

Dr. Matthew Ferguson

Structural construct detection as a variable indicator of compromise

Detecting email spoofing attempts by identifying unusual patterns in HTML and CSS.

Researchers

Stephen Pickman

Robust identification of ransomware encryption over SMB

How the high-level analysis of SMB operations, files, and properties can identify ransomware infections.

Researchers

Dr. Tim Bazalgette

Detecting and preventing misdirected emails with correspondence semantics

Identifying if the recipient of a particular email appears correct in the wider context of user activity.

Researchers

Ben Akrill

Programmatically monitoring disparate SaaS environments

Optimizing the use, visibility and security of environments that span multiple complex cloud and SaaS environments.

Researchers

Jacob Araiza

Using graph theory to identify critical nodes within computer networks

How graph theory can be used to map out cross-domain, realistic, and risk-assessed attack paths across an entire digital enterprise

Researchers

Darktrace researcher, PhD

Analysis of email structure to detect malicious intent

Using AI to determine whether an email is trying to induce the reader to do something that would lead to compromise, such as clicking on a link or opening a file.

Researchers

Dr. Antony Lawson

Identifying compromises with graphs of high-precision security metadata

Using directed graphs of lower-level security events to reliably discover complex security incidents.

Researchers

Dr. Tim Bazalgette

Dr. Dickon Humphrey

Analyzing network activity to detect compromised devices sending spam emails

Distinguishing between genuine and illegitimate email traffic from network servers.

Researchers

Dr. Andrés Curto Martín

Sorting long lists of file names by relevance and sensitive content

Quickly assessing the importance of compromised files before, during and after an attack.

Researchers

Dr. Andrés Curto Martín

Rapid Process-Chain Anomaly Detection Using a Multistage Classifier

Timely analysis uses simple methods for simple problems and deep learning for difficult problems, but only if you can tell the difference.

Researchers

Dr. Matthew Ferguson

Autonomous detection of the intended function of a corporate inbox through meta-scoring

Knowing which corporate inboxes are supposed to receive a lot of email and which are not.

Researchers

Dr. Steven Haworth

Automatic Identification of Scanned IP Ranges

Identifying targets of reconnaissance amongst the noise of background network activity

Researchers

Dr. Tim Bazalgette

A system for analyzing network activity to detect stealthy cryptocurrency mining

Using AI to detect hard-to-see crypto-mining activity on corporate devices.

Researchers

Dr. Andrés Curto Martín

Using epidemiology theory to identify the most damaging network devices

Preventing disaster by modeling how an attack might spread after an initial compromise

Researchers

Jake Lal

A multi-platform approach to autonomous response

How autonomous response technology works seamlessly across different environments, providing a solution for organizations using multiple cloud environments and SaaS applications.

Researchers

John Boyer

A real-time, self-correcting similarity classifier for emails

Recognizing when similar but subtly different emails were sent by the same sender or as part of a campaign, but also recognizing when the similarity is coincidental.

Researchers

Dr. Steven Haworth

Newsletter

Stay ahead of threats with the Darktrace blog newsletter

Get the latest insights from the cybersecurity landscape, including threat trends, incident analysis, and the latest Darktrace product developments – delivered directly to your inbox, monthly.

You're subscribed!

Oops! Something went wrong while submitting the form.

Customer stories

Anywhere, everywhere & everyone

We work with organizations across all industries, including the engineering team at McLaren Racing, giving you the chance to meet incredible people who are dedicated to pushing the boundaries of what technology can achieve.