SANDS Lab wins KRW 7 billion R&D project for AI-based hyperautomation deception technology

SANDS Lab wins KRW 7 billion R&D project for AI-based hyperautomation deception technology

• Developing an early-stage technology that lures attacks for proactive defense into a globally leading solution
• Preventing economic losses from malware takes on new importance after a Korean telecom hacking incident
• Collected intelligence will strengthen CTX and increase the value of its cyber threat intelligence service

Photo 1. IITP (Institute of Information & Communications Technology Planning & Evaluation) and SANDS Lab

Cyber threats are becoming more sophisticated and intelligent through AI and other technologies, with increasing cases of attackers bypassing traditional security solutions such as EDR, IDS/IPS and firewalls. Consequently, companies and institutions often discover attacks only after damage has occurred, making proactive response difficult.

AI security technology specialist SANDS Lab (CEO Kim Ki-hong, KOSDAQ 411080) announced on the 30th that it had won the “Development of Hyperautomation Deception Technology for Active Threat Hunting” project under the Ministry of Science and ICT and IITP’s program for developing core foundational information security technologies.

The project aims to develop active deception technology to counter sophisticated cyberattacks missed by traditional security solutions. It induces attackers to enter decoy systems, then captures and analyzes their actions in real time during intrusion to enable an early response.

Rather than passively waiting for attacks, the core concept is to build a proactive defense system that makes attackers believe they are targeting real services, actively draws out attacks, and uses the resulting activity to identify and block threats in advance.

SANDS Lab will lead a consortium with Unissoft, MONITORAPP and Korea University. Its R&D goals include AI-based automatic generation of virtual endpoints and networks; hyperautomation deception for active threat hunting; real-time detection of attacker activity and analysis of attack patterns; data integration between deception systems and security equipment for proactive response; and validation of deception technology against diverse cyberattack scenarios.

Photo 2. Architecture of the integrated hyperautomation deception system

Project lead Heo Su-man of SANDS Lab said, “Existing security systems focus on responding after an attack, making it difficult to fundamentally prevent situations in which intrusion traces are discovered too late and lead to large-scale damage.” He emphasized, “AI-based deception is a new paradigm that actively attracts attackers, detects attacks in real time and enables a proactive response.”

Once commercialized, the technology could help companies and institutions prevent substantial economic losses, including incident response and legal costs. It is expected to detect and block in advance attacks that cause large-scale data leaks and economic damage, such as the recent telecom hacking incident that drew widespread public concern.

CEO Kim Ki-hong said, “This project will also increase the value of the threat analysis information provided by CTX, our cyber threat intelligence (CTI) service.” He added, “We will develop this early-stage technology into a globally leading core technology and help protect the critical assets of public institutions and private companies from advanced cyberattacks.”

Approximately KRW 7 billion, including government R&D funding, will be invested over four years through 2028. The consortium also plans to accelerate validation and commercialization by establishing partnerships with telecom operators, incident response organizations and internet data center operators.