Supervision : Stefano SECCI
Co-supervision : BOUET Mathieu, CONAN Vania
The nature of anomalies detected in network traffic data is quite diverse. Anomalies range from outages (including equipment malfunctions and outages from cloud and mobile network operators) and operational events (including updates and ingress shifts), to unusual end-users behaviors (including flash crowds and point to multi-point communications) and malicious ones (including denial of service attacks and malicious scans).
Therefore, we rather look at different granularity levels and range of features to take into account each anomaly type's peculiarities. For example, Denial-of-Service (DoS) events may be detected by looking at per-flow volume anomalies, rather than to per-packet attributes. Network and port scanning may be detected at the flow-level (or even at the port-level), as each new port or combination of port and target IP generates a new flow. Finally, botnet detection may be performed at the flow-level and preferably at the host-level. The dissertation discusses several novel anomaly detection techniques in relation to important fields of networking in association with emerging technologies in it. We thus present such anomaly detection and classification techniques in three different contexts: the detection of vulnerabilities' exploitation on the Internet, intrusion detection in IP networks (at enterprise-level), and anomaly detection cellular networks. Our techniques are pragmatic, lightweight and fit to real networks.
On the same occasion, we develop methods that were not exploited before, by exploring novel points of view, as the analysis of the usage of port numbers, services and mobile applications.
Defence : 12/14/2020 - 10h - https://us02web.zoom.us/j/86475294670?pwd=WGppMTVVNVFiYnV4Q2dsY0tCcStpdz09
FIORE Marco (IMDEA Networks) [Rapporteur]
STANICA Razvan (INSA Lyon, Inria) [Rapporteur]
SECCI Stefano (Conservatoire National des Arts et Métiers)
CONAN Vania (Thales)
BOUET Mathieu (Thales)
MAGNIEN Clémence (CNRS, Sorbonne Université)
HOTEIT Sahar (Université Paris Saclay, Centrale-Supélec)
CARNEIRO VIANA Aline (Inria Saclay)
NGUYEN Thi-Mai-Trang (LIP6, Sorbonne Université)
SCOTT-HAYWARD Sandra (Queen University Belfast)