SANDS Lab wins KISA’s KRW 4.5 billion cybersecurity AI dataset project
Developing more advanced defenses against increasingly sophisticated AI-driven cyberattacks Building datasets reflecting the latest malware and threats exploiting generative AI Validating effectiveness to strengthen incident response with new technology and support intelligent systems
SANDS Lab wins KISA’s KRW 4.5 billion cybersecurity AI dataset project
- Developing more advanced defenses against increasingly sophisticated AI-driven cyberattacks
- Building datasets reflecting the latest malware and threats exploiting generative AI
- Validating effectiveness to strengthen incident response with new technology and support intelligent systems
Photo 1. KISA, which commissioned the cybersecurity AI dataset project, and the SANDS Lab consortium
AI-based cyber threat intelligence (CTI) specialist SANDS Lab (KOSDAQ 411080, CEO Kim Ki-hong) announced on the 28th that its consortium won the cybersecurity AI dataset construction and utilization enhancement project commissioned by KISA under the Ministry of Science and ICT.
Attackers are continually developing sophisticated techniques by abusing generative AI and ChatGPT. Incident response systems that quickly identify and counter fabricated content, manipulated information and subtly distorted data generated by AI are therefore increasingly important.
Against this backdrop, AI datasets must be updated and enhanced to reflect detection evasion and emerging generative AI threats while remaining consistent and compatible with existing datasets. AI models capable of responding to real incidents are also needed. The project therefore seeks to encourage early adoption and use of datasets and AI models in cybersecurity while driving continued progress.
Photo 2. Definition and architecture of threat profiling datasets generated for each attack group
SANDS Lab, with strengths in CTI, AI and big data, formed a consortium with SecOps platform specialist Logpresso (CEO Yang Bong-yeol) focused on proactive AI-based response. They will build and update two datasets—latest malware and threat profiling—while establishing raw data collection, processing and construction environments; strengthening quality assurance and customer validation; supporting sharing and use; and identifying broader applications and disseminating results.
Beyond optimized dataset and AI model creation processes, the consortium plans to use generative AI to automatically update attack group and trend information. It will develop an on-premises cybersecurity-specific small language model (sLLM), directly apply it in real security environments, assess meaningful incident response results and possibilities, and propose ways to introduce and use generative AI in cybersecurity.
On completion, the project will provide the private sector with high-impact threat data involving generative AI, APT tools and ransomware, establishing a basis for proactive response. It will also validate effectiveness for organizations struggling to obtain AI datasets or seeking intelligent AI-based incident response, playing a key role in strengthening data-driven cyber defense.
By building, sharing and promoting national-scale cybersecurity-specific datasets, then leading the development of AI incident response methodologies and best practices, the project is expected to establish a growth base for Korea’s foundational cybersecurity AI technologies and strengthen global competitiveness.
Photo 3. The latest threat profiling dataset separates IoC and APT intelligence to track relationships.
Overall project manager and CEO Kim Ki-hong said, “We need to move beyond simply collecting and analyzing threat information to build and use an automated information-generation system that explains attack situations and identifies response priorities.” He added, “We will combine next-generation generative AI, including LLMs, with cybersecurity to promote dataset use, and maximize the value of datasets through effectiveness and quality validation.”
The project’s total budget is KRW 4.5 billion, with SANDS Lab responsible for 90% under the consortium allocation. Its contract value is approximately 8% higher than last year. The project runs for six months; if completed within the year, all revenue is expected to be recognized this year.
Photo 4. AI integration and uses of the threat profiling dataset.