I am an Associate Professor and head of the Threat Analysis group in the Security Cluster of the Eindhoven University of Technology, the Netherlands. We study attacker actions to help analysts find their traces in log and alert data. Our two research lines are cyber threat intelligence (the cybercriminal ecosystem and social engineering) and security operations (analyst processes, analyst training, and detection rule engineering in SOCs). Our work draws from computer security, economics, risk analysis, and criminology.
Office MF 6.061 · l.allodi at tue.nl · CV · PGP key · Mastodon · LinkedIn · More about me
Research infrastructure
My group runs two research infrastructures that also deliver services in practice.
ESH-SOC
- Managed detection for organisations in industry and government
- 24/7 monitoring of logs and network traffic
- More than 140 detection use cases covering all 14 MITRE ATT&CK tactics
- Response to the most severe incidents, with a report in under an hour
- Incident, monthly KPI, and identity reports for auditors
Managed by my group; I am its Scientific Director. Initiated by TU/e with Fontys and KEMBIT. We carry out our security operations research in and with the SOC.
CTILab
- Access to our cyber threat intelligence for third parties
- Indicators and detection rules for the ESH-SOC
- Analyses of criminal markets and communities
Run with the Jheronimus Academy of Data Science (JADS). The lab collects data from underground forums and Telegram communities with crawlers and classification pipelines such as TeleHunt.
Some highlights
Editorial
I am a Department Editor of IEEE Security & Privacy magazine.
Organization
I am the organizer and co-chair of the multidisciplinary Workshop on Attackers and Cyber-Criminal Operations (WACCO), together with, among others, Alice Hutchings (Twitter, homepage) and Sergio Pastrana (Twitter, homepage). The workshop is held annually jointly with the IEEE European Symposium on Security and Privacy.
Recent publications
- Glas, M., Kersten, L., Mulders, T., Pernul, G., & Allodi, L. (2026). T1GER: An Instructional Re-Design of a Cyber Range Exercise in a Commercial Security Operations Center. In Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems. Publisher Code
- Teuwen, K. T. W., Mulders, T., Zambon, E., & Allodi, L. (2025). Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers. In Proceedings of ASIA CCS 2025. Publisher Code
- Weinz, M., Zannone, N., Allodi, L., & Apruzzese, G. (2025). The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations. In Proceedings of ASIA CCS 2025.
- Kersten, L., Darré, S., Mulders, T., Zambon, E., Caselli, M., Snijders, C., & Allodi, L. (2024). A Security Alert Investigation Tool Supporting Tier 1 Analysts in Contextualizing and Understanding Network Security Events. In Proceedings of ACSAC 2024. PDF