AnonShield slides

What is a CSIRT?

02

The team that takes care of digital security. Like firefighters, but for digital attacks.

Receives

alerts of attacks and failures

Investigates

what happened and the impact

Responds

contains and fixes the problem

Network vulnerabilities

03

Scans

of vulnerabilities

Of the network, not the code

host, ports and services

X-ray of the network

reveals ports and weaknesses

Incident records

Incident tickets

attacks already detected

Come from the CSIRTs

Expose the victim

emails, names, IPs

04

The scale of the problem: vulnerabilities

The number of vulnerabilities grows much faster than the capacity to analyze them.

18k

2020

25k

2022

40k

2024

48k

2025

59k

2026*

CVEs published per year (*forecast)

NVD/NIST enrichment crisis (2026)

NIST only analyzes the priority CVEs. The rest goes unclassified, and it is left to the local CSIRT.

(NIST, 2026)

05

The scale of the problem: incidents

Incident notifications jumped from thousands to millions in two decades.

3.1k

1999

875k

2019

2.3M

2023

Incident notifications to CERT.br, per year (CERT.br/NIC.br)

Capacity is not keeping up

Global deficit of ~4.8 million security professionals. Each record handled by a CSIRT carries personal data to protect.

(ISC2 Workforce Study, 2024)

!

06

Automation with AI

07

LLMs that prioritize, classify and suggest responses.

Data sensitivity

08

Network identifiers

IP, hostname, certificate

Personal data

names and emails of the victims

Dangerous if leaked

exposes the network and violates the LGPD

How to prepare this data to use AI with security, at scale, without losing utility?

This work's answer: pseudonymization.

09

What is an entity?

10

host: "100.111.20.23" → "[IP_ADDRESS_a4f2b1c3]"

A recognized type

a piece of personal data or a technical artifact

Entity examples

IP, hostname, name, hash, certificate

Example: before and after (Tenable)

Original

Anonymized

11

{

"host-ip": "100.111.20.23",

"host-fqdn": "dns01.corp.br",

"mac-address": "00:1A:2B:3C:4D",

"severity": "High",

"cvss3_base_score": 7.4,

"port": 443

}

{

"host-ip": "[IP_ADDRESS_48624b5c]",

"host-fqdn": "[HOSTNAME_7e9d2a]",

"mac-address": "[MAC_ADDRESS_c8b1]",

"severity": "High",

"cvss3_base_score": 7.4,

"port": 443

}

Red: sensitive · Teal: pseudonymized · Black: preserved · Tenable fields (examples)

The pseudonymization pipeline

12

Stage 1: Input

The system reads several formats. Large files are read as a stream.

13

Stream reading (streaming)

Stage 2: Detection (NER)

Failed login from 100.111.20.23 user=cristhian.kapelinski

the NER and the RegEx recognize the IP and the name as entities

14

Cache (comes first)

GPU in the NER model

Stage 3: HMAC-SHA256

Each entity becomes a pseudonym generated with a secret key.

100.111.20.23

[IP_ADDRESS_48624b5c]

the prefix holds the entity type; the rest is the hash generated with the secret key.

15

Stages 4 and 5: Persistence and Output

16

Persistence

SQLite database (table entities): stores the complete hash

Type

Original

Pseudonym

Complete hash (64c)

IP_ADDRESS

100.111.20.23

[IP_ADDRESS_48624b5c]

48624b5c9a3f2e1d…

HOSTNAME

srv-web-01

[HOSTNAME_e5c53b15]

e5c53b15a1d2f3e4…

Output (e.g.: XML)

structure maintained; sensitive fields (teal) become pseudonyms, the rest (black) is preserved

<result>

<host>[IP_ADDRESS_5b02f379]</host>

<hostname>[HOSTNAME_e5c53b15]</hostname>

<port>[PORT_2edd4ed6]</port> <cvss>10.0</cvss> <severity>Critical</severity>

</result>

The AnonLFI research line

AnonLFI 1.0

first pipeline

from another team (Bandel et al.)

AnonLFI 2.0

extensible architecture (WRSeg)

AnonShield

scale (SBRC, Tools Track)

SBSeg 2025

WRSeg 2025

SBRC 2026

17

Evolution of the AnonLFI line

Lines of code and number of modules per version.

361 lines

AnonLFI 1.0

monolithic (1 module)

972 lines

AnonLFI 2.0

5 modules

5,428 lines

AnonShield

17 modules

18

Motivation: the operational scale

19

70,951 vulnerabilities

from CAIS/RNP

Before: +92 hours

unfeasible at scale

Hence AnonShield

built to scale

Datasets

20

130

130

130

130

Dataset

Source

Formats

Files

Size

Purpose

D1

OpenVAS (VulnLab laboratory)

CSV, TXT, PDF, XML

130

9 to 34 MB

Accuracy and performance

D1C

Conversion of D1 (other formats)

XLSX, DOCX, PDF-img, JSON

130

up to 1.5 GB

Accuracy and performance

Laboratory of vulnerable services

21

VulnLab: 130 vulnerable Docker containers, in 11 service categories.

Vulnerable web applications · 21

OWASP

DVWA

Network and infrastructure · 19

OpenSSH

OpenLDAP

Memcached

Databases · 17

MySQL

PostgreSQL

MongoDB

Web and application servers · 17

Apache

Nginx

Tomcat

Languages and runtimes · 12

Python

Node.js

PHP

CMS and web platforms · 11

WordPress

Drupal

GitLab

DevOps and CI/CD · 9

Jenkins

SonarQube

Nexus

Operating systems · 8

Ubuntu

Debian

CentOS

Monitoring and logging · 6

Grafana

Kibana

Prometheus

Messaging and streaming · 5

RabbitMQ

Kafka

ActiveMQ

Specific CVEs · 5

Log4Shell

Scanning with OpenVAS

Each container is scanned with OpenVAS/GVM (Greenbone); the reports make up D1.

Create target

Create task

Scan

Monitor (30s)

Download report

~14 h of total scanning 520 reports (130 targets × 4 formats: PDF, XML, CSV, TXT)

OpenVAS/GVM (Greenbone)

vulnerability scanning engine

Full and fast profile

~30 to 60 min per host

Port coverage

all assigned IANA ports (TCP and UDP)

130 targets

each VulnLab container is scanned

22

Methodology

23

Sample: 67 of 6,472 (D1)

90% confidence, 3 experts

13 entity types

evaluated manually

Metrics

Precision, Recall (critical), F1

Accuracy

Version

Precision

Recall

F1

AnonLFI 1.0

32.4%

18.8%

23.8%

AnonLFI 2.0

80.9%

40.7%

54.2%

AnonShield (standalone)

91.7%

96.1%

93.8%

24

Comparison in the standalone strategy (AnonShield's own detection: NER + RegEx). NER model: SecureModernBERT.

Datasets

1

1

1

1

Dataset

Source

Formats

Files

Size

Purpose

D2

Tenable (CAIS/RNP, private)

CSV, JSON

1

550 MB

Performance

D3

Synthetic (public twin of D2)

CSV, JSON

1

445 MB

Performance

25

Performance at operational scale

738×

speedup over AnonLFI 2.0

BEFORE (AnonLFI 2.0, estimated)

~92 hours

AFTER (AnonShield)

7.5 minutes

26

Recognition

Best Artifact of SBRC 2026

Selected among the 65 artifacts evaluated at the event.

27

Artifact badges granted

Results of the artifact evaluation (CTA)

Analytical utility of the data

28

The pseudonymized data already support published research:

Severo et al. (2025)

Automated classification of incidents in SOCs with LLMs and prompt engineering.

Almeida et al. (2025)

On-premise vs. commercial language models for classifying incidents in CSIRTs.

Best result: 92.27% accuracy (Gemini 2 + Progressive-Hint Prompting)

On-premise ~60% vs. >90% of the commercial ones

Future work (TCC II)

Comparative evaluation between pseudonymized and original data, measuring the balance between privacy and utility in the classification of vulnerabilities and incidents with language models.

29

Activity

Aug

Sep

Oct

Nov

Dec

Preparation of datasets and downstream tasks

Implementation of the utility pipeline

Fine-tuning with privacy preservation

Execution of experiments and analysis

Writing and revision of the final paper

Papers and materials

SBSeg 2025

WRSeg 2025

SBRC 2026

anonshield.org

code and artifacts

Thank you.

Support:

Cristhian Kapelinski · Advisor: Diego Kreutz

30