Research & Innovation - Participant Portal


TOPIC : Dynamic countering of cyber-attacks

Topic identifier: SU-ICT-01-2018
Publication date: 27 October 2017
Focus area: Boosting the effectiveness of the Security Union (SU)

Types of action: IA Innovation action
Opening date:
15 March 2018
Deadline: 28 August 2018 17:00:00

Time Zone : (Brussels time)
  Horizon 2020 H2020 website
Pillar: Industrial Leadership
Work Programme Year: H2020-2018-2020
Topic Description
Specific Challenge:

The prevention of and the protection against attacks that target modern ICT components, complex ICT infrastructures and emerging technologies (e.g. IoT) remains a difficult task. The complexity of heterogeneous collections of hardware and software components finds its roots in the diversity of development contexts and of levels of maturity, in the growing means of networked interactions, in the massive exchange of information and data, and in the varied schedules of systems lifecycles that generate highly dynamic behaviours. The increase of encrypted flows over the Internet should lead to adopt new techniques for detection of suspicious cyber activities and traffic patterns, and for classification of flows, while keeping privacy and confidentiality. Another relevant challenge is to use machine learning and analytics for cybersecurity.


Proposals are invited against at least one of the following two subtopics:

a) Cyber-attacks management - advanced assurance and protection

Innovative, integrated and holistic approaches in order to minimize attack surfaces through appropriate configuration of system elements, trusted and verifiable computation systems and environments, secure runtime environments, as well as assurance, advanced verification tools and secure-by-design methods. This may entail a whole series of activities, including behavioural, social and human aspects in the engineering process until developed systems and processes address the planned security/privacy/accountability properties.

Proposals should explore how recent progress in artificial intelligence, in deep learning and in other related technologies can be used to provide breakthroughs in the fight against cyber-attacks (e.g. recognition of malicious activities on the network). Deep learning applications may also be used for cyber threat intelligence in anticipation of cyberattacks to identify malicious activity trends in the cyber space and correlate with attackers’ information, tools and techniques.

Proposals may also cover secure execution environments not only including the execution platforms themselves plus the operating systems, but also the mechanisms (e.g. security supporting services, authentication/access control mechanisms) that ensure an adequate level of security, privacy and accountability in the execution of all processes.

Proposals are encouraged to provide mechanisms for informing the users on their security/privacy levels, for providing warnings and assisting them in handling security and privacy related incidents.

b) Cyber-attacks management – advanced response and recovery

Innovative capabilities to dynamically support human operators (e.g. Incident Response professionals), in controlling response and recovery actions, including information visualization. The capabilities should include the assessment how attacks propagate in a particular infrastructure and/or across interconnected infrastructures (e.g. attack-defence graphs) and what the best measures are to withstand and recover from a threat/attack, including the convergence with measures beyond cyber that can be needed (e.g. security policies).

Proposals should address the use of -and the contribution to- appropriate threat intelligence sources as well as the share of information with relevant parties (e.g. industry cooperation groups, Computer Security Incident Response Teams - CSIRTs).

Proposals should explore forensics, penetration testing, investigation and attack attribution services -local or remote- to achieve proper identification and better protection against future attacks and zero-day vulnerabilities. Approaches can include the combination of massive data and logs collection from various sources (e.g. network traffic, dark web) to facilitate investigation on security alerts and to find suspicious files trajectories in order to have the most appropriate response. Efficient utilization of both structured data (e.g. logs) and unstructured data (e.g. data coming from social networks such as pictures, tweets, discussions on forums) should be addressed.

Applicants should also consider the efficient handling (e.g. classification, anomaly detection) of encrypted network traffic and in particular where data stays encrypted, while keeping compliance with end user’s privacy requirements.

Proposals need to consider dynamic, evidence based security and privacy risk assessment methodologies and management tools targeting emerging/advanced technologies (e.g. IoT, virtualised and service-oriented systems/networks).

Proposals are encouraged to provide mechanisms for informing the users on their security/privacy levels, for providing warnings and assisting them in handling security and privacy related incidents.

The outcome of the proposal is expected to lead to development up to Technology Readiness level (TRL) 6; please see Annex G of the General Annexes.

The Commission considers that proposals requesting a contribution from the EU of between EUR 4 and 5 million would allow this area to be addressed appropriately. Nonetheless, this does not preclude submission and selection of proposals requesting other amounts.

For grants awarded under this topic for Innovation Action the Commission or Agency may object to a transfer of ownership or the exclusive licensing of results to a third party established in a third country not associated to Horizon 2020. The respective option of Article 30.3 of the Model Grant Agreement will be applied.

Expected Impact:

Short/medium term

  • Enhanced protection against novel advanced threats.
  • Advanced technologies and services to manage complex cyber-attacks and to reduce the impact of breaches.
  • The technological and operational enablers of co-operation in response and recovery will contribute to the development of the CSIRT Network across the EU, which is one of the key targets of the NIS Directive.

Long term

  • Robust, transversal and scalable ICT infrastructures resilient to cyber-attacks that can underpin relevant domain specific ICT systems (e.g. for energy) providing them with sustainable cybersecurity, digital privacy and accountability.
Cross-cutting Priorities:

Contractual Public-Private Partnerships (cPPPs)
Socio-economic science and humanities

Topic conditions and documents

1. Eligible countries: described in Annex A of the Work Programme.
A number of non-EU/non-Associated Countries that are not automatically eligible for funding have made specific provisions for making funding available for their participants in Horizon 2020 projects. See the information in the Online Manual.


2. Eligibility and admissibility conditions: described in Annex B and Annex C of the Work Programme.


Proposal page limits and layout: please refer to Part B of the proposal template in the submission system below.


3. Evaluation:

  • Evaluation criteria, scoring and thresholds are described in Annex H of the Work Programme. 
  • Submission and evaluation processes are described in the Online Manual.

4. Indicative time for evaluation and grant agreements:

Information on the outcome of evaluation (single-stage call): maximum 5 months from the deadline for submission.
Signature of grant agreements: maximum 8 months from the deadline for submission.


5. Proposal templates, evaluation forms and model grant agreements (MGA):

Innovation Action:

Specific provisions and funding rates
Standard proposal template
Standard evaluation form
General MGA - Multi-Beneficiary
Annotated Grant Agreement

6. Additional provisions:

Horizon 2020 budget flexibility
Classified information
Technology readiness levels (TRL) – where a topic description refers to TRL, these definitions apply

For grants awarded under this topic the Commission may object to a transfer of ownership or the exclusive licensing of results to a third party established in a third country not associated to Horizon 2020. The respective option of Article 30.3 of the Model Grant Agreement will be applied.

Members of consortium are required to conclude a consortium agreement, in principle prior to the signature of the grant agreement.

8. Additional documents:

1. Introduction WP 2018-20
5. Introduction to Leadership in enabling and industrial technologies (LEITs) WP 2018-20
5i. Information and communication technologies (ICT) WP 2018-20
18. Dissemination, Exploitation and Evaluation WP 2018-20

General annexes to the Work Programme 2018-2020

Legal basis: Horizon 2020 Regulation of Establishment
Legal basis: Horizon 2020 Rules for Participation
Legal basis: Horizon 2020 Specific Programme


7. Open access must be granted to all scientific publications resulting from Horizon 2020 actions.

Where relevant, proposals should also provide information on how the participants will manage the research data generated and/or collected during the project, such as details on what types of data the project will generate, whether and how this data will be exploited or made accessible for verification and re-use, and how it will be curated and preserved.

Open access to research data
The Open Research Data Pilot has been extended to cover all Horizon 2020 topics for which the submission is opened on 26 July 2016 or later. Projects funded under this topic will therefore by default provide open access to the research data they generate, except if they decide to opt-out under the conditions described in Annex L of the Work Programme. Projects can opt-out at any stage, that is both before and after the grant signature.

Note that the evaluation phase proposals will not be evaluated more favourably because they plan to open or share their data, and will not be penalised for opting out.

Open research data sharing applies to the data needed to validate the results presented in scientific publications. Additionally, projects can choose to make other data available open access and need to describe their approach in a Data Management Plan.

Projects need to create a Data Management Plan (DMP), except if they opt-out of making their research data open access. A first version of the DMP must be provided as an early deliverable within six months of the project and should be updated during the project as appropriate. The Commission already provides guidance documents, including a template for DMPs. See the Online Manual.

Eligibility of costs: costs related to data management and data sharing are eligible for reimbursement during the project duration.

The legal requirements for projects participating in this pilot are in the article 29.3 of the Model Grant Agreement.


Additional documents

  • Call results en

Submission Service

No submission system is open for this topic.

Get support

H2020 Online Manual is your guide on the procedures from proposal submission to managing your grant.

Participant Portal FAQ – Submission of proposals.

National Contact Points (NCP) - contact your NCP for further assistance in your national language(s).

Research Enquiry Service – ask questions about any aspect of European research in general and the EU Research Framework Programmes in particular.

Enterprise Europe Network – contact your EEN national contact for advice to businesses with special focus on SMEs. The support includes guidance on the EU research funding.

IT Helpdesk - contact the Participant Portal IT helpdesk for questions such as forgotten passwords, access rights and roles, technical aspects of submission of proposals, etc.

Ethics – for compliance with ethical issues, see the Online Manual and Science and Society Portal

European IPR Helpdesk assists you on intellectual property issues

CEN and CENELEC, the European Standards Organisations, advise you how to tackle standardisation in your project proposal. Contact CEN-CENELEC Research Helpdesk at

The European Charter for Researchers and the Code of Conduct for their recruitment

Partner Search Services help you find a partner organisation for your proposal.

Ideal-IST partner search facility