GANNDALF delivers innovations that advance the state of the art in AI-supported cybercrime investigation by combining human-centric AI, privacy-aware collaboration, and operational law enforcement tooling into a unified framework. A central breakthrough is the Human–Swarm Teaming paradigm, introducing attention-driven orchestration of heterogeneous AI agents under human supervision. Unlike current SIEM and analytics solutions, where correlation across sources remains largely manual, GANNDALF enables investigators to dynamically steer AI analysis while the system autonomously correlates multi-source evidence and provides prioritised, explainable outputs.
The project also advances LLM-based knowledge modelling and correlation through automated knowledge graph construction from heterogeneous investigative data (including tabular and conversational formats), combined with cross-modal synthetic data generation. This shifts current practice from fragmented, human-driven data interpretation to AI-assisted, scalable linking of entities, relationships, and events across modalities, supported by recent advances in LLM-based relationship detection on tabular data and hybrid statistical–AI approaches. These capabilities are operationalised in tools that integrate entity extraction, relationship analysis, and AI-driven pattern discovery within a unified investigative workflow.
GANNDALF further advances trustworthy and explainable AI for law enforcement collaboration through reusable explanation pipelines for knowledge graphs and privacy-aware explainability mechanisms, including counterfactual explanations balancing interpretability and data protection. In parallel, the project integrates behavioural and psychological analysis into cybercrime investigations through AI-driven prioritisation and graph-based reasoning, extending investigations beyond purely technical analysis toward holistic socio-technical intelligence, which remains largely absent in current platforms.
At system level, GANNDALF delivers a modular and interoperable ecosystem integrating SIEM, risk assessment, AI analytics, and decision-support tools via containerised and API-driven architectures, coupled with an AI-based recommendation engine for optimised tool utilisation. This represents a significant step beyond current siloed toolchains used by law enforcement agencies.
Finally, GANNDALF extends innovation to the societal domain. Moving beyond static, manually curated training and awareness approaches, it introduces LLM-driven, multilingual and continuously updated training and scenario generation, alongside Cyber Hygiene 2.0 mechanisms. For the latter, the focus is on a first-of-its-kind citizen engagement application that lowers the barrier to participation, enabling not only highly digitally literate individuals but the broader population to understand threats, report incidents, and contribute to investigations, thereby strengthening collective cyber resilience. Of interest is the coverage of future cyber attacks, such as those targeting LLM environments.
Further uptake will require large-scale validation with law enforcement authorities, alignment with interoperability and standardisation frameworks, and integration with existing operational platforms.
