AI Research Centre

Darktrace Cyber
AI Research Center

“Research unlocks the unknowns; it also helps shed light on what we are collectively up against.” - Jack Stockdale OBE, CTO

The Darktrace AI Research Centre is foundational to our continued innovation.

Teams of mathematicians and other experts examine how AI can be applied to real-world problems.

Their aim is to discover new paths forward to augment human capabilities.

With over 200 patents and patents pending, the AI Research Centre comprises more than 200 R&D employees, including experts with ~100 master's degrees and 20 doctorates in disciplines from astrophysics to linguistics to data science.

28%
R&D Headcount Growth in FY22
20+
Doctorates
~100
Masters
Our History

Founded by mathematicians and cyber defense experts in 2013, Darktrace is a global leader in cybersecurity AI, delivering complete AI-powered solutions in its mission to free the world of cyber disruption. We protect more than 9,000 customers from the world’s most complex threats, including ransomware, cloud, and SaaS attacks.

Our roots lie deep in innovation. The Darktrace AI Research Center based in Cambridge, UK, has conducted research establishing new thresholds in cyber security, with technology innovations backed by over 125 patents and pending applications. The company’s European R&D center is located in The Hague, Netherlands.

Rather than confined to work on product roadmaps, researchers are free to experiment and explore, guided by creative insight arising from pure research. Yet we have never shied away from taking on real challenges faced by the industry, and the AI Research Centre operates with a common goal of solving these challenges with AI and mathematics.

The AI Research Centre has produced numerous award-winning breakthroughs, which have gone on to form the AI capabilities that today comprise our products contained in the Darktrace ActiveAI Security Platform. Please see below a selection of  research abstracts stemming from these research initiatives.

Cyber AI Research Centre

Featured Research

Innovating Cyber Recovery - Key to Cyber Resilience

Read our second Darktrace Discourse paper, authored by John C. Allen, MBA, CRISC, and VP Cyber Risk & Compliance, Darktrace. This paper reviews the current state of incident recovery and sets forth seven areas of innovation to improve Recovery from cyber incidents, based on a core capability: Real-Time Adaptive Incident Response.

Download
Attack Path Modeling Research

This paper outlines Darktrace's Attack Path modeling (APM) capabilities, exploring how real-time, automated, dual-aspect, multi-data-source, end-to-end APM can be used to give blue teams a comprehensive view of realistic, risk-prioritized attack paths so that resources can be best allocated to defend key assets.

Download
Prevent: Security through Adversity

Read our Darktrace Discourse paper, authored by one of our researchers based at the Centre. The author has seven years’ experience in the automation of complex cyber-centric processes with specialization in the offensive domain, and holds a PhD in Astrophysics from the University of Cambridge.

Download

Research

Gaussian constructions on surfaces for anomalous event identification
Determining anomalies by creating probability density functions on different surfaces corresponding to the properties of interest.
Researchers
Dr. Tim Bazalgette
Dr. Dickon Humphrey
Read more
Securing tenant data in the public cloud
Secure practices to ensure corporate data sitting within public servers such as AWS is sufficiently isolated, in the event of a data breach targeting these public cloud providers.
Researchers
Alex Smith
Read more
A multi-platform approach to autonomous response
How autonomous response technology works seamlessly across different environments, providing a solution for organizations using multiple cloud environments and SaaS applications.
Researchers
John Boyer
Read more
Identification of cryptomining credentials and their use in differentiating between insider threats and wide-spread malware
How global analysis of cryptomining credentials can identify malicious criminal organizations leveraging corporate computing power for financial gain.
Researchers
Dr. Andrew Woodford
Read more
Identification of services associated with data uploads for analysis of exfiltration
How the intelligent analysis of connection properties can help assess whether specific uploads are associated with malicious exfiltration.
Researchers
Dr. Tim Bazalgette
Read more
Matryoshka Bloom filters quickly and efficiently determine rarity
A novel data structure for the efficient storage and retrieval of statistics on how common strings are in specific environments.
Researchers
Dr. Matthew Ferguson
Read more
Structural construct detection as a variable indicator of compromise
Detecting email spoofing attempts by identifying unusual patterns in HTML and CSS.
Researchers
Stephen Pickman
Read more
Robust identification of ransomware encryption over SMB
How the high-level analysis of SMB operations, files, and properties can identify ransomware infections.
Researchers
Dr. Tim Bazalgette
Read more
Detecting and preventing misdirected emails with correspondence semantics
Identifying if the recipient of a particular email appears correct in the wider context of user activity.
Researchers
Ben Akrill
Read more
Programmatically monitoring disparate SaaS environments
Optimizing the use, visibility and security of environments that span multiple complex cloud and SaaS environments.
Researchers
Jacob Araiza
Read more
Using graph theory to identify critical nodes within computer networks
How graph theory can be used to map out cross-domain, realistic, and risk-assessed attack paths across an entire digital enterprise
Researchers
Darktrace researcher, PhD
Read more
Analysis of email structure to detect malicious intent
Using AI to determine whether an email is trying to induce the reader to do something that would lead to compromise, such as clicking on a link or opening a file.
Researchers
Dr. Antony Lawson
Read more
Identifying compromises with graphs of high-precision security metadata
Using directed graphs of lower-level security events to reliably discover complex security incidents.
Researchers
Dr. Tim Bazalgette
Dr. Dickon Humphrey
Read more
Analyzing network activity to detect compromised devices sending spam emails
Distinguishing between genuine and illegitimate email traffic from network servers.
Researchers
Dr. Andrés Curto Martín
Read more
Sorting long lists of file names by relevance and sensitive content
Quickly assessing the importance of compromised files before, during and after an attack.
Researchers
Dr. Andrés Curto Martín
Read more
Rapid Process-Chain Anomaly Detection Using a Multistage Classifier
Timely analysis uses simple methods for simple problems and deep learning for difficult problems, but only if you can tell the difference.
Researchers
Dr. Matthew Ferguson
Read more
Autonomous detection of the intended function of a corporate inbox through meta-scoring
Knowing which corporate inboxes are supposed to receive a lot of email and which are not.
Researchers
Dr. Steven Haworth
Read more
A real-time, self-correcting similarity classifier for emails
Recognizing when similar but subtly different emails were sent by the same sender or as part of a campaign, but also recognizing when the similarity is coincidental.
Researchers
Dr. Steven Haworth
Read more
Automatic Identification of Scanned IP Ranges
Identifying targets of reconnaissance amongst the noise of background network activity
Researchers
Dr. Tim Bazalgette
Read more
A system for analyzing network activity to detect stealthy cryptocurrency mining
Using AI to detect hard-to-see crypto-mining activity on corporate devices.
Researchers
Dr. Andrés Curto Martín
Read more
Using epidemiology theory to identify the most damaging network devices
Preventing disaster by modeling how an attack might spread after an initial compromise
Researchers
Jake Lal
Read more
Customer stories

Anywhere, Everywhere & Everyone

We work with organizations across all industries, including the engineering team at McLaren Racing, giving you the chance to meet incredible people who are dedicated to pushing the boundaries of what technology can achieve.
Customer Stories
South Coast Water District
Customer Stories
Darktrace Protects Las Vegas' Digital Infrastructure
Customer Stories
Darktrace Protects McLaren's Cybersecurity

From our blog

Your data. Our AI.
Elevate your network security with Darktrace AI