On-premise pseudonymization of sensitive security data.
Built at AI Horizon Labs.
A vulnerability scan report is a map of an organization's attack surface. It carries IP addresses, hostnames, TLS certificates, service fingerprints and the versions of everything that answers on the network. That is exactly why an incident response team cannot simply hand one over to a partner, or feed it to a language model, even when doing so would help.
Stripping the identifiers destroys the data instead: correlating two reports, or following one host across a year of scans, requires that the same host keep the same name. AnonShield resolves that by replacing each identifier with a deterministic pseudonym derived with HMAC-SHA256. The same input always yields the same token, so referential integrity survives across documents and across runs, and the mapping can be reversed by whoever holds the key. Nothing leaves the machine: detection, replacement and the mapping store all run locally.
| Throughput | 550 MB and 70,951 records in under 10 minutes, against more than 92 hours before |
| Speedup | up to 738x |
| Detection | F1 of 94.2% and recall of 96.4% on a specialist-annotated set |
| Where it runs | entirely on premise: no cloud, no telemetry, no data leaving the host |
AnonShield was selected the Best Artifact of SBRC 2026, among every artifact submitted to the conference, and received all four quality seals of the Brazilian Computer Society: Available, Functional, Sustainable and Reproducible. The official results list the decision.
anonshield |
The tool, under active development. Deterministic pseudonyms, NER and regex detection, OCR, a command line and a web application |
tool |
The frozen version that backs the SBRC 2026 paper. Use this one to reproduce the published experiments |
AnonLFI2.0 |
The architecture that came before it: OCR, technical entity recognizers, and masking that preserves the structure of JSON and XML |
LabVulnerabilities |
A containerized lab with more than 158 vulnerable services, on an isolated network, for generating the reports the rest of this work consumes |
anonshield.org explains the tool and runs a live demonstration in the browser: paste a report and watch the entities being replaced, with nothing sent anywhere.
| AnonShield: Scalable On-Premise Pseudonymization for CSIRT Network Vulnerability Data | SBRC 2026, Salão de Ferramentas. SBC OpenLib · doi:10.5753/sbrc_estendido.2026.23154 |
| AnonLFI 2.0: Extensible Architecture for PII Pseudonymization in CSIRTs with OCR and Technical Recognizers | WRSeg, ERRC 2025. SBC OpenLib |
We work at AI Horizon Labs, a research group on artificial intelligence and software engineering at the Universidade Federal do Pampa (UNIPAMPA), on the Alegrete campus in Rio Grande do Sul, Brazil.
|
CRISTHIAN KAPELINSKI works on security, privacy, and machine learning at AI Horizon Labs, Universidade Federal do Pampa (UNIPAMPA). He has held research fellowships with the Brazilian National Research and Education Network (RNP), where he led the AnonShield and AnonLFI pseudonymization frameworks, with the Instituto Tecnológico de Aeronáutica (ITA), and with the LARC laboratory of the University of São Paulo (USP). His interests include privacy and memorization in language models, their use in security operations and the attacks against them, and large-scale measurement of software ecosystems.
ORCID · Lattes · Scholar · GitHub · LinkedIn |
|
DOUGLAS PAIM LAUTERT is an IT technician and developer at the Universidade Federal do Pampa (UNIPAMPA), where he has worked since 2018, and a researcher at AI Horizon Labs. He received the B.S. degree in computer science, specialization degrees in full-stack development and in public management, and the M.Sc. degree in software engineering, with research on language models and natural language processing applied to cybersecurity. He has co-authored AnonShield, AnonLFI 2.0, MulitaMiner and VulnSyncAI, and was recognized as a distinguished artifact reviewer at SBSeg 2025 and SBRC 2026. His interests include the structured extraction of vulnerability data, pseudonymization, and AI-based automation in security work.
ORCID · Lattes · GitHub · LinkedIn |
|
BEATRIZ MACHADO works on cybersecurity research at AI Horizon Labs, Universidade Federal do Pampa (UNIPAMPA), on vulnerability analysis, data anonymization, and the use of language models to automate security work. She was a research fellow with the Brazilian National Research and Education Network (RNP), and wrote MulitaMiner, which turns the heterogeneous reports of security scanners into structured records with the help of language models. That work received second place for best paper at WRSeg 2025.
ORCID · Lattes · GitHub · LinkedIn |
|
DIEGO KREUTZ is a professor and researcher at AI Horizon Labs, Universidade Federal do Pampa (UNIPAMPA), where he has taught since 2008 and coordinates the group. He received the B.S. degree in computer science and the M.Sc. degrees in production engineering and in informatics from the Universidade Federal de Santa Maria (UFSM), and the Ph.D. degree in computing, and has carried out research at the University of Lisbon, the University of Luxembourg and Monash University. His interests include cybersecurity and adversarial AI, language models, AutoML, distributed systems and networks, and software artifact engineering.
ORCID · Lattes · Scholar · GitHub · LinkedIn |
Lattes is the Brazilian national registry of researcher CVs, maintained by CNPq, the federal research council.
Each repository carries a CITATION.cff and a citation section at the end of its README. Cite
the paper the tool was published in, rather than the repository URL alone.