BSIDES BELGRADE 2026
AGENDA 2026

About the Workshop/Talk

Detecting that an organisation is being targeted well before the initial attack requires proactive monitoring and early intelligence collection. One of the most valuable yet challenging sources of such intelligence lies behind the scenes: in the darknet. The darknet is a rich but chaotic source of threat intelligence. Gaining access is only the first step: the real challenge is processing and interpreting the vast amount of unstructured, ambiguous, and often low-quality data shared by threat actors. This talk presents an AI-powered approach to transforming this noisy data into actionable intelligence. We will explore common data patterns, normalisation strategies, and message scoring techniques that help distinguish relevant content from background chatter. The session will also cover named entity extraction tailored for the cybersecurity domain and automated threat attribution methods that enable early warning, efficient search and context-aware analysis. In addition, we will discuss how modern AI models operate, how to prepare relevant data for them, and practical approaches to training domain-specific models. Finally, we will demonstrate how to design an AI agent capable of continuously monitoring, reasoning about, and analysing darknet activity in near real time.

Key Topics:

- Common data patterns and pitfalls in darknet sources

- Message filtering, normalisation, and prioritisation

- Named entity extraction for cybersecurity use cases

- Data labelling and model training

- Threat attribution and classification

- Designing an AI agent for darknet analysis