CPS Security Assessment Platform

Participants: Abdelkader Lahmadi, Frédéric Beck, Thomas Lacour, Jérôme François.

News Of The Year:

During 2020, we have extended our IoT (Internet of Things) and CPS (Cyber-Physical Systems) security assessment platform with more off-the-shelf IoT devices. The platform is used for several demonstrations and it is extensively used for the development carried on the SCUBA tool suite to automate the assessment of the security of IoT and SCADA systems by using ML/AI methods. So a major release of the SCUBA tool suite will be achieve on 2021.

7.1.1 Adaptive monitoring of Low-Power IoT Networks

Participants: Abdelkader Lahmadi, Laurent Andrey, Mohamed-Said Frikha.

7.1.2 Programmable Network Monitoring

Participants: Jérôme François, Isabelle Chrisment, Abir Laraba, Raouf Boutaba, Shihab Chowdhury.

We proposed a systematic method to map Extended Finite State Machine (EFSM) models into a P4 switch in order to embed detection of complex behaviors within the dataplane. Advantage of EFSM over widely used formalisms in SDN (like flow based rules) is to be stateful and so able to track multi-step attacks. Our mapping method can be leveraged to monitor any protocol or its misuse. We demonstrated its effectiveness against TCP protocol attacks. First, in our initial work 17, the misuse of ECN (Explicit Congestion Notification) mechanism has been considered in a simple scenario. Second, we extended this work with a more realistic setup assuming AQM (Adaptive Queue Management) and also with optimistic ACK attack. In all cases, our solution enforces a fair bandwidth share between flows even in case of non-cooperative or misbehaving flows. This extended work has been accepted for publication in IEEE TNSM Transactions on Network and Service Management in 2021.

7.1.3 Encrypted Traffic Analysis

Participants: Jérôme François, Pierre-Olivier Brissaud, Isabelle Chrisment, Thibault Cholez, Olivier François, Olivier Bettan.

We pursued our research on HTTP/2 traffic analysis by demonstrating the robustness of our classifier (H2Classifier), regarding its ability to be leveraged for diverse services (+3000 websites tested) and to remain performant over time (four months) assuming a regular model update 10. The results highlight that an off-the-shelf machine-learning method to classify HTTP/2 traffic is applicable to many websites but a weekly training may be needed to keep the model accurate.

7.1.4 Predictive Security Monitoring for Large-Scale Internet-of-Things

Participants: Jérôme François, Rémi Badonnel, Abdelkader Lahmadi, Isabelle Chrisment, Adrien Hemmer.

The Internet-of-Things has become a reality with numerous protocols, platforms and devices being developed and used to support the growing deployment of smart services. Providing new services requires the development of new functionalities, and the elaboration of complex systems that are naturally a source of potential threats. Real cases recently demonstrated that the IoT devices can be affected by naïve weaknesses. Therefore, security is of paramount importance.

In 2020, we pursued our efforts on this topic by performing a comparative analysis of process mining for supporting IoT predictive security, as presented in the IEEE TNSM journal 4. We have first formalized and integrated into our architecture four other categories of commonly-used detection methods, including elliptic envelope, support-vector machine, local outlier factor and isolation forest techniques, that serve as a support to this analysis. We have then performed extensive sets of experiments with three different industrial datasets (connected cars, industry 4.0, and robot networks), in order to comparatively evaluate our process mining solution, by considering the influence of the time splitting, the influence of the clustering techniques, and the overall detection performance according to multiple criteria. Moreover, we have tested how our approach reacts against noisy or missing data. The experiments have clearly shown the benefits of jointly using process mining and data pre-processing, in particular clustering techniques. The data pre-processing permits to identify and minimize the states characterizing the IoT-based system, so that the process mining is not facing a state explosion. As future work, we are interested in elaborating an ensemble-learning solution capable to efficiently combine different learning techniques to detect misbehaviors and potential attacks in these environments.

This work has been achieved in the context of the H2020 SecureIoT project (section 9.2.1).

7.1.5 Monitoring of Blockchains' Networking Infrastructure

Participants: Thibault Cholez, Jean-Philippe Eisenbarth, Olivier Perrin.

In 2020, we built an open dataset3 composed of snapshots of the Bitcoin network and we made a comprehensive analysis of it. During one month, we performed daily crawls on the nodes composing the network and gathered information about them. Our dataset and all related tools, more precisely the crawler and the scripts to analyze the data are also open source4, thus making our study fully reproducible and extensible, by opposition to previous studies in the domain. We highlighted some metrics that characterize the network. Among these metrics, we analyzed a few classical ones like the size of the network, the geographical localization of peers and the churn to get fresh results, but also new ones, in particular the popularity of peers, and the inventory of software vulnerabilities that affect clients' versions and their distribution among the deployed nodes. We showed that the size of the p2p Bitcoin network is very stable. The peers composing the network are well balanced throughout the world and show little churn. But the network also exhibits more concerning properties like the fact that a significant part of the network tends to update the client version slowly, and the unbalanced popularity of peers, even among the reachable ones. The first part of these results will be presented as a poster in IFIP/IEEE IM 2021.

7.1.6 Quality of Experience Monitoring

Participants: Isabelle Chrisment, Antoine Chemardin, Frédéric Beck, Lakhdar Meftah, Romain Rouvoy.

In 2020, we carried on our collaboration with the SPIRALS team (Inria/Université de Lille). Even though mobile crowdsourcing allows industrial and research communities to build realistic datasets, it can also be used to track participants' activity and to collect insightful reports from the user environment. Most of existing crowdsourced datasets systematically tag data samples with metadata (e.g., time and location stamps), which may lead to user privacy leaks. We proposed a software library that empowers legacy mobile crowdsourcing apps to increase user privacy without compromising the overall quality of the crowdsourced datasets. By introducing an a priori data anonymization process, we showed that our decentralized crowdsourcing approach, named Fougere, defeats state-of-the-art location-based privacy attacks with little impact on the quality of crowdsourced datasets 5

To address indoor environments, we also used WiFi places to capture the user context in a privacy-friendly way. In particular, we defined a WiFi places recognition algorithm based on WiFi scans data and we showed how this WiFi places data can be shared between users, while preserving their privacy. This contribution has been published at the IFIP DAIS’2020 conference 19.

In the context of both ANR BottleNet (section 9.3.1) and IPL BetterNet (section 9.3.5) projects, we also continued to work on our open measurement platform for the quality of mobile Internet access (i.e., setup and manage the backend infrastructure for data collection and analysis). This platform is hosted by the High Security Laboratory 5 located at Inria Nancy Grand-Est. After consolidating our backend infrastructure and after an agreement of Inria's ethics committee (COERLE), we were able to run experimentations with real users with the help of INSEAD, a management school running a behavioral lab to provide users for various experiments. We conducted from April 2020 to July 2020 a measurement campaign involving 60 users, over a three-month period per user. Even if such campaigns were very complex to perform, we have now at our disposal a huge amount of collected data, which is valuable for our observatory.

7.2.1 Grid'5000 Design and Evolutions

Participants: Lucas Nussbaum, Benjamin Berard, Luke Bertot, Alexandre Merlin, Nicolas Perrin, Patrice Ringot, Teddy Valette.

The team was again heavily involved in the evolutions and the governance of the Grid'5000 testbed. Since the beginning of 2017, Lucas Nussbaum serves as the directeur technique (CTO) of Grid'5000 in charge of managing the global technical team (10 FTE). He is also a member of the Bureau of the GIS Grid'5000.

7.2.2 Distributing Connectivity Management in Cloud-Edge infrastructures

Participants: Lucas Nussbaum.

In the context of David Espinel's PhD (CIFRE Orange, co-supervised with Adrien Lebre and Abdelhadi Chari), we worked on distributing connectivity management in Cloud-Edge infrastructures. In 2020, we finalized a survey on that topic 23 which was recently accepted for publication in IEEE Communications Surveys & Tutorials. Then, we designed DIMINET, a module able to interconnect independent networking resources in an automatized and transparent manner in the context of Edge infrastructures 11.

7.3.1 CPS Security Analytics

Participants: Abdelkader Lahmadi, Mingxiao Ma, Isabelle Chrisment.

With the increasing penetration of inverter-based distributed generators (DG) into low-voltage distribution micro-grid systems, it is of great importance to guarantee their safe and reliable operations. These systems leverage communication networks to implement a distributed and cooperative control structure. However, the detection of stealthy attacks with a large impact and weak detection signals on such distributed control systems is rarely studied. We addressed the problem of detecting a stealthy attack, named MaR (Measurement as Reference), that we designed in a previous work, targeting the communication network of a microgrid while an attacker modifies the voltage measurement with the reference values 18. We collect datasets from a hardware platform modeled after a simplified microgrid and running the MaR attack performed with a Man-in-the-Middle (MitM) technique. We use the collected datasets to compare different attack detection algorithms based on multiple categories of machine learning algorithms. Our results show that the Random Forest algorithm outperforms the others to detect suspicious packets modified by a MitM attacker with an accuracy close to 97%.

7.3.2 Efficient distribution of security filtering rules in SDN

Participants: Abdelkader Lahmadi, Ahmad Abboud, Michael Rusinowitch, Adel Bouhoula.

Software Defined Networks administrators can specify and smoothly deploy abstract network-wide policies, and then the controller acting as a central authority implements them in the flow tables of the network switches. The rule sets of these policies are specified in the forwarding tables, which are usually accessed using very expensive and power-hungry ternary content-addressable memory (TCAM). Consequently, a given table can only contain a limited number of rules. However, various applications need large rule sets to perform filtering on diverse flows. We proposed several algorithms 7, 25 for decomposing and distributing a rule set on network switches of limited flow table size, while preserving the network policy semantics. Through experiments on several rule sets with single and multiple dimensions, we evaluate and analyse the performance of our rule placement techniques. Our results show that our proposals are efficient in practice.

7.3.3 Anomaly Detection

Participants: Jérôme François, Abdelkader Lahmadi, Rémi Badonnel, Isabelle Chrisment, Adrien Hemmer, Mohamed Abderrahim.

In 16, we demonstrated a Man-in-the-Middle (MitM) attack against Bluetooth Low Energy (BLE) devices while collecting datasets of network traffic data exchange with and without the attack. We studied the use of machine learning to detect this attack by combining unsupervised and supervised techniques. We compared two unsupervised techniques based on autoencoders (Long Short-Term Memory: LSTM, Temporal Convolutional Network: TCN) to reconstruct the model of BLE communications and detect suspicious data batches. Our results show that a TCN approach is more accurate and provides higher temporal memory effect since our datasets are of small size. We then applied a classification method based on Text-CNN technique to classify packets as normal or attack inside each suspicious batch. Our model reconstruction results show that we are able to discriminate normal and attack models with high precision and our classification method achieves high accuracy ($\approx$ 0.99) and low false positive rate ($\approx$ 0.03).

7.3.4 Support for Programmable In-Network Analytics

Participants: Jérôme François, Olivier Festor, Kahina Lazri, Matthews Jose.

In the context of the M. Jose's PhD thesis, our research aimed at increasing the support of in-network analytics. Although several papers claim for adding analytic capabilities in switch, especially to support machine learning functions, current capabilities of hardware switches are not satisfactory even with the recent dataplane programming paradigm. Although switch architectures are well tailored for performing matching and forwarding operations, they have not been designed to run computations such as arithmetic. Some works have proposed solutions for fixed point operations with all inherent limitations in terms of accuracy. Assuming the commonly accepted Reconfigurable Match Table (RMT) model, we were the first to add support for floating point arithmetic in programmable hardware switches using P4 (accepted at IFIP/IEEE IM 2021). Native integer addition is the limited capability that exists in such hardware. However, P4 switches also include match-action tables that can be leveraged for designing lookup tables to perform floating point operations. We are the first to do so in an efficient way. The first step consisted in defining a computational pipeline using a lookup table and native operators for each elementary operation (division, log,...). In a second step, optimization techniques have been proposed to combine efficiently these elementary operations to apply a compound function. These optimizations include the analysis of function inputs and domains of operations to restrict the lookup table range to limit their size and/or improve the operation accuracy. Parallelization of operations was also necessary to reduce the number of stages in the processing pipeline which is drastically limited in real hardware. Finally, we have showcased our prototype on real hardware (Tofino) by applying different operations including a logistic regression to highlight a practical use case.

7.4.1 Scheduling and Offloading Mechanisms

Participants: Jérôme François, Raouf Boutaba, Shihab Chowdhury, Anthony Anthony.

The simple programming model and very low-overhead I/O capabilities of emerging packet processing techniques leveraging kernel-bypass I/O and poll-mode processing are gaining significant popularity for building high performance software middleboxes (aka Virtual Network Functions (VNFs)). However, existing OS schedulers fall short in rightsizing CPU allocation to poll-mode VNFs due to the schedulers' shortcoming in capturing the actual processing cost of these VNFs. The state-of-the-art VNF schedulers proposed as an alternative to OS schedulers are intrusive, requiring the VNFs to be built with scheduler specific libraries or having carefully selected scheduling checkpoints. Unlike existing approaches, we proposed UNiS that is non-intrusive, i.e., does not require VNF modifications and treats poll-mode VNFs as black boxes. UNiS is also workflow-aware, i.e., takes Service Function Chaining (SFC) processing order into account while scheduling VNFs. Testbed experiments show that UNiS is able to achieve a throughput within 90% and 98% of that achievable using an intrusive cooperative scheduler for synthetic and real data center traffic, respectively. While this work started before 2020, it has been extended in  1. We have considered alternative implementations of the scheduler and included additional illustrative examples. The overhead of the scheduler was also investigated deeply by evaluating the number of context switches and cache misses.

7.4.2 Program Encoding and Processing into IP packets.

Participants: Jérôme François, Alexander Clemm, Vivien Maintenant, Sébastien Tabor.

New IP/BPP (Big Packet Protocol) is a proposed protocol and framework to allow the behavior of packets and flows to be programmed from the edge by being encoded into the packet itself. New IP/BPP is very flexible and can rely on various variables or conditions. In 12, we investigated the feasibility of such kind of protocols with a platform-agnostic approach using P4. Our study reveals large gaps between these two but shows that, under reasonable assumptions, it is possible to process in-network packets based on their own programs.

7.4.3 Vulkan for NFV

Participants: Thibault Cholez, Juuso Haavisto.

In the context of the MOSAICO ANR project, we wanted to design a high-performance NFV architecture that can easily use GPU processing. The use-case envisioned was to implement as a GPU-accelerated network function an existing software able to identify in real time encrypted network flows thanks to a random-forest classifier (cf section 7.1.3). We proposed to use APL (Array-processing language) as a high-level domain specific language for developers who want to write network processing algorithms that can be efficiently executed on a GPU. We rewrote the core of the random forest algorithm from the Python implementation in scikit-learn to this language. Then, we developed a first compiler to translate APL programs to the SPIR-V intermediate language for parallel computing with the aim to efficiently execute the latter on any GPU supporting the Vulkan API. Finally, we also proposed a configuration for OpenStack and the orchestrator Kubernetes to automatically deploy the network classifier program on GPUs available in the cloud. The implementation of the architecture demonstrated its soundness. The classifier is currently being rewritten to better take advantage of the high level of concurrency in GPUs and limit the bottleneck to write network packets into the VRAM.

7.4.4 Software-Defined Security for Clouds

Participants: Rémi Badonnel, Olivier Festor, Maxime Compastié, Mohamed Oulaaffart.

Cloud infrastructures provide new facilities to build elaborated added-value services by composing and configuring a large variety of computing resources, from virtualized hardware devices to software products. They are however further exposed to security attacks than traditional environments.

In the context of the efforts done with Orange Labs on software-defined security for clouds, we published a survey on virtualization models for supporting cloud protection in the Elsevier Journal of Computers and Security 3. We described and compared different virtualization models, in order to establish a reference architecture of cloud infrastructures. We then analyzed the security issues related to these models from the reference architecture, by considering related vulnerabilities and attacks. Finally, we pointed out different recommendations with respect to the exploitation of these models for supporting cloud protection. Within the H2020 Concordia project, we also recently started the PhD thesis of Mohamed Oulaaffart who will investigate new security automation mechanisms for cloud composite services, with a particular focus on migration issues. The objective is to automate security enhancement for cloud services and their resources in order to maintain safe configurations when migrations occur. We consider exploiting orchestration language extensibility to enable the specification of security enhancements, according to different orchestrated security levels. We are then interested in designing a dedicated framework with specific algorithms for supporting the security of cloud services during the migration phase, by taking into account configuration changes and dependencies amongst resources. We are also considering the complementarity of endogenous and exogenous security mechanisms with that respect.

This word has been achieved in the context of the Inria-Orange joint lab (section 9.3.2) and the H2020 EU Concordia project.

9.1.1 Inria associate team not involved in an IIL

9.1.2 Inria international partners

9.1.3 Participation in other international programs

9.2.1 FP7 & H2020 Projects

9.2.2 Collaborations in European programs, except FP7 and H2020

9.3.1 ANR

9.3.2 Inria joint Labs

9.3.3 Technological Development Action (ADT)

9.3.4 FUI

9.3.5 Inria Project Lab

10.1.1 Scientific events: organisation

10.1.2 Scientific events: selection

10.1.3 Journal

10.1.4 Invited talks

Olivier Festor gave a keynote at IEEE/IFIP NOMS'2020 entitled: Micro-Servicing NDN and its value for improved security, scalability and integration, April 2020.

10.1.5 Leadership within the scientific community

Rémi Badonnel is chair of the IFIP (International Federation for Information Processing) WG6.6 (Working Group 6.6) dedicated to the management of networks and distributed systems.

Isabelle Chrisment served as a co-chair of the Allistene cybersecurity working group, whose main goal is to help drive the French cybersecurity. research and innovation.

Jérôme François is co-chair of NMRG (Network Management Research Group) of IRTF (Internet Research Task Force).

10.1.6 Scientific expertise

Isabelle Chrisment was as a member of the GDR RSD/ASF selection committee for the thesis award. She is also a member of the AFNIC's Scientific Council. She also served as a reviewer for the Luxembourg National Research Fund.

Jérôme François serves as a reviewer for PhD grant of Région Aquitaine and is in the advisory board of the Interreg TERMINAL project (2019-2021).

Olivier Festor is member of the Scientific Council of Orange. In 2020, he was also President of the HCERES evaluation committee of the CITI/Insa de Lyon lab as well as member of the evaluation committee of the CNAM lab project on global security.

10.1.7 Research administration

Thibault Cholez is a member of the executive council of the Digitrust project (I-Site project of the Université de Lorraine to foster research on trust and security in IT).

Isabelle Chrisment is an elected member of the scientific pole AM2I (Automatique, Mathématiques, Informatique et leurs Interaction) at Université de Lorraine. She is also a member of the COMIPERS at Inria Nancy Grand Est.

Lucas Nussbaum is an elected member of the LORIA laboratory council at Université de Lorraine.

Abdelkader Lahmadi is the scientific head of the High Security Lab.

10.2.1 Teaching

Olivier Festor is the Director of the TELECOM Nancy Engineering School.

Rémi Badonnel is heading the Internet Systems and Security specialization of the 2nd and 3rd years at the TELECOM Nancy engineering school.

Thibault Cholez is in charge of the organization of professional projects for the three years of TELECOM Nancy students in apprenticeship.

Abdelkader Lahmadi is heading the training Engineering of Digial Systems at ENSEM engineering school.

Team members are teaching the following courses:

• Rémi Badonnel 242 hours - L3, M1, M2 - Networks, Systems and Services, Software Design and Programming, Cloud Computing, Network and Security Management - TELECOM Nancy, Université de Lorraine
• Thibault Cholez 290 hours - L3, M1, M2 - Computer Networks, Object-Oriented Programming, Network Services, Constraint development on small Connected Objects, Mobile applications and Internet of Things, IT tools for Project Management - TELECOM Nancy, Université de Lorraine
• Isabelle Chrisment 220 hours -L3, M1, M2 -C and Shell Programming, Computer Networking, Operating Systems, Network Security. - TELECOM Nancy, Université de Lorraine
• Jérôme François 70 hours - M1, M2 - Network security, network management, big data - TELECOM Nancy, Université de Lorraine
• Olivier Festor 128 hours - L3, M1, M2 - Advanced algorithmics and problem solving, Data Structures and Algorithms, Network security, network management, Devops and SCRUM, Project Management – TELECOM Nancy, Université de Lorraine
• Abdelkader Lahmadi 280 hours - L3, M1, M2 - Real time and Embedded Systems Programming, Distributed Systems and Algorithms, Green IT, Algorithms and Advanced Programming, Security of Cyber Physical Systems - ENSEM Engineering School, Université de Lorraine
• Lucas Nussbaum 200 hours - L2, Licence Pro (L3), M1 - several courses about systems administration, monitoring, virtualization, configuration management, networking, operating systems. - IUT Nancy-Charlemagne

10.2.2 Supervision

• PhD in progress: Ahmad Abboud, Compressed and verifiable filtering rules in Software-defined Networking, since September 2018, supervised by Michael Rusinowitch, Abdelkader Lahmadi, and Adel Bouhoula.
• PhD in progress: Jean-Philippe Eisenbarth, Securing the future blockchain-based security services, since May 2019, supervised by Thibault Cholez and Olivier Perrin (Coast team).
• PhD in progress: David Espinel, SDN solution for Massively Distributed Cloud Infrastructure, since February 2018, supervised by Lucas Nussbaum, Adrien Lebre and Abdelhadi Chari.
• PhD in progress: Philippe Graff, Development and orchestration of network micro-services for low-latency and secure applications, since September 2020, supervised by Thibault Cholez and Olivier Festor.
• PhD in progress: Adrien Hemmer, Predictive Security Monitoring for Large-Scale Internet-of-Things, since October 2018, supervised by Isabelle Chrisment and Rémi Badonnel.
• PhD in progress: Matthews Jose, Programming model for new flow-based network monitoring, since January 2019, supervised by Olivier Festor & Jérôme François.
• PhD in progress: Pierre-Marie Junges, Internet-wide automated assessment of the exposure of the IoT devices to security risks, since October 2018 supervised by Olivier Festor and Jérôme François.
• PhD in progress: Abir Laraba, Data-Driven Intelligent Monitoring for Software-Defined Networks, since October 2018, supervised by Isabelle Chrisment, Raouf Boutaba & Jérôme François.
• PhD in progress: Mingxiao Ma, Cyber-Physical Systems defense through smart network configuration, since November 2017, supervised by Isabelle Chrisment, Abdelkader Lahmadi.
• PhD in progress: Mohamed Oulaaffart, Automating security enhancement for cloud services, since January 2020, supervised by Olivier Festor & Rémi Badonnel.
• PhD in progress: Mehdi Zakroum, Forecasting cyberthreats from exogeneous data, since October 2019, supervised by Isabelle Chrisment & Jérôme François.
• PhD: Pierre-Olivier Brissaud, HTTPS traffic analysis for user activity monitoring. Université de Lorraine, 14 December 2020. Supervised by Isabelle Chrisment, Jérôme François, Thibault Cholez and Olivier Bettan (Thales) 28.
• PhD: Abdulqawi Saif, Experimental Methods for the Evaluation of Big Data Systems. Université de Lorraine, 17 January 2020. Supervised by Ye-Qiong Song & Lucas Nussbaum 22.

10.2.3 Juries

Team members participated to the following Ph.D. defense committees:

• Charles Xosanavongsa, PhD in Computer Science from Université de Rennes 1, France. Title: Heterogeneous Event Causal Dependency Definition for the Detection and Explanation of Multi-Step Attacks, June 2020 – (Isabelle Chrisment as reviewer).
• Joseph Kamel, PhD in Institut Polytechnique de Paris, France. Title: Misbehavior Detection for Cooperative Intelligent Transport Systems, July 2020 – (Isabelle Chrisment as reviewer).
• Quentin Ricard, PhD in Computer Science from Université Toulouse III, Paul Sabatier, France. Title: Détection autonome de trafic malveillant dans les réseaux véhiculaires, September 2020 – (Isabelle Chrisment as reviewer).
• Mohammed Tayeb Oulad Kouider, PhD in Computer Science from Université de Lorraine. Title: Optimisation de la planification des tournées de véhicules électriques. December 2020 – (Isabelle Chrisment as President).
• Pierre-Olivier Brissaud, PhD in Computer Science from Université de Lorraine. Title: Analyse de trafic HTTPS pour la supervision d'activités utilisateurs, December 2020 – (Isabelle Chrisment as co-supervisor).
• José Rafael Suárez-Varela Maciá, PhD in Computer Science from Universitat Politècnica de Catalunya (Spain). Title: Enabling knowledge-defined networks: Deep reinforcement learning, graph neural networks and network analytics, June – (Jérôme François as defense commitee member)
• Thomas Cledel, PhD in Computer Science from IMT Atlantique Bretagne-Pays de la Loire (France). Title: Cyber-résilience des infrastructures critiques – Analyse préventive des défaillances d’origine malveillante, June 2020 – (Olivier Festor as reviewer)
• Aliénor Damien, PhD in Computer Science from Université Fédérale Toulouse Midi-Pyrénées (France). Title: Sécurité par analyse comportementale de fonctions embarquées sur plateformes avioniques modulaires intégrées, June 2020 – (Olivier Festor as reviewer)
• Edwin Bourget, PhD in Computer Science from IMT Atlantique Bretagne-Pays de la Loire (France). Title: Diagnosing accidental and malicious events in industrial control systems, June 2020 – (Olivier Festor as defense commitee member)

Team members participated to the following Habilitation Degree committees:

• Abbas Bradai, PhD in Automation and Control from Université de Poitiers (France). Title: Contributions to the virtualisation of communication systems: from cellular networks to the Internet of Things, December 2020 – (Olivier Festor as reviewer)

10.2.4 Articles and contents

Abdelkader Lahmadi and Isabelle Chrisment provided an article entitled "Comment évaluer le niveau de sécurité de vos objets connectés ?" in Binaire, Le Monde, June 2020, https://www.lemonde.fr/blog/binaire/2020/06/26/comment-evaluer-le-niveau-de-securite-de-vos-objets-connectes/.

10.2.5 Interventions

Isabelle Chrisment participated in a seminar on cyberdefense and cyberespace at Horizon 2035, CEIS, Paris, October 2020.

Jérôme François was an invited speaker at the A.I. Now conference 2020 (Metz, France)

International journals

• 1 article A.Anthony Anthony, S.Shihabur Rahman Chowdhury, T.Tim Bai, R.Raouf Boutaba and J.Jérôme François. Non-intrusive and Workflow-aware Virtual Network Function Scheduling in User-space IEEE transactions on cloud computing September 2020
  HAL DOI back to text back to text
• 2 articleR.Rémi Badonnel, C.Carol Fung, Q.Qi Li and S.Sandra Scott-Hayward. Guest Editorial: Special Section on Cybersecurity Techniques for Managing Networked SystemsIEEE Transactions on Network and Service Management171March 2020, 12-14
  HALDOI
• 3 articleM.Maxime Compastié, R.Rémi Badonnel, O.Olivier Festor and R.Ruan He. From virtualization security issues to cloud protection opportunities: An in-depth analysis of system virtualization modelsComputers and Security97October 2020, 101905
  HALDOIback to text
• 4 article A.Adrien Hemmer, M.Mohamed Abderrahim, R.Rémi Badonnel, J.Jérôme François and I.Isabelle Chrisment. Comparative Assessment of Process Mining for Supporting IoT Predictive Security IEEE Transactions on Network and Service Management December 2020
  HAL DOI back to text
• 5 articleL.Lakhdar Meftah, R.Romain Rouvoy and I.Isabelle Chrisment. Empowering Mobile Crowdsourcing Apps with User Privacy ControlJournal of Parallel and Distributed ComputingAugust 2020, 15
  HALDOIback to text
• 6 article D.David Espinel Sarmiento, A.Adrien Lebre, L.Lucas Nussbaum and A.Abdelhadi Chari. Decentralized SDN Control Plane for a Distributed Cloud-Edge Infrastructure: A Survey Communications Surveys and Tutorials, IEEE Communications Society 2021
  HAL DOI

International peer-reviewed conferences

• 7 inproceedings A.Ahmad Abboud, R.Rémi Garcia, A.Abdelkader Lahmadi, M.Michaël Rusinowitch and A.Adel Bouhoula. Efficient Distribution of Security Policy Filtering Rules in Software Defined Networks NCA 2020 - 19th IEEE International Symposium on Network Computing and Applications Online conference, France November 2020
  HAL back to text
• 8 inproceedingsA.Ahmad Abboud, A.Abdelkader Lahmadi, M.Michael Rusinowitch, M.Miguel Couceiro, A.Adel Bouhoula and M.Mondher Ayadi. Double Mask: An efficient rule encoding for Software Defined NetworkingICIN 2020 - 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops23rd Conference on Innovation in Clouds, Internet and Networks and Workshops, {ICIN} 2020, Paris, France, February 24-27, 2020Paris, France2020, 186--193
  HAL
• 9 inproceedingsL.Luke Bertot, L.Lucas Nussbaum and D.David Margery. Implementing SFA Support on an Established HPC-flavored Testbed: Lessons LearnedCNERT 2020 - Computer and Networking Experimental Research using Testbeds, in conjunction with IEEE INFOCOM 2020Toronto, CanadaJuly 2020, 1-6
  HALback to text
• 10 inproceedings P.-O.Pierre-Olivier Brissaud, J.Jérôme François, I.Isabelle Chrisment, T.Thibault Cholez and O.Olivier Bettan. Encrypted HTTP/2 Traffic Monitoring: Standing the Test of Time and Space WIFS2020 - IEEE International Workshop on Information Forensics and Security IEEE International Workshop on Information Forensics and Security New-York/Virtual, United States December 2020
  HAL back to text
• 11 inproceedingsD.David Espinel Sarmiento, A.Adrien Lebre, L.Lucas Nussbaum and A.Abdelhadi Chari. Multi-site Connectivity for Edge Infrastructures DIMINET:DIstributed Module for Inter-site NETworkingCCGRID 2020 - 20th IEEE/ACM International Symposium on Cluster, Cloud and Internet ComputingMelbourne, Australiahttp://cloudbus.org/ccgrid2020/2020, 1-10
  HALback to text
• 12 inproceedings J.Jérôme François, A.Alexander Clemm, V.Vivien Maintenant and S.Sébastien Tabor. BPP over P4: Exploring Frontiers and Limits in Programmable Packet Processing IEEE Global Communications Conference IEEE Global Communications Conference 2020 Taipei, Taiwan December 2020
  HAL back to text
• 13 inproceedings A.Adrien Hemmer, R.Remi Badonnel and I.Isabelle Chrisment. A Process Mining Approach for Supporting IoT Predictive Security NOMS 2020 - IEEE/IFIP Network Operations and Management Symposium Budapest, Hungary ieee-noms.org April 2020
  HAL
• 14 inproceedings A.Adrien Hemmer, R.Remi Badonnel, J.Jérôme François and I.Isabelle Chrisment. A Process Mining Tool for Supporting IoT Security NOMS 2020 - IEEE/IFIP Network Operations and Management Symposium Budapest, Hungary April 2020
  HAL
• 15 inproceedings N.Nida Khan, A.Abdelkader Lahmadi, Z.Zsofia Kräussl and R.Radu State. Management plane for differential privacy preservation through smart contracts AICCSA 2020 - 17th ACS/IEEE International Conference on Computer Systems and Applications Antalya / Virtual, Turkey http://aiccsa.net/AICCSA2020/home November 2020
  HAL
• 16 inproceedingsA.Abdelkader Lahmadi, A.Alexis Duque, N.Nathan Heraief and J.Julien Francq. MitM Attack Detection in BLE Networks using Reconstruction and Classification Machine Learning TechniquesMLCS 2020 - 2nd Workshop on Machine Learning for CybersecurityGhent, BelgiumSeptember 2020, 1-16
  HALback to text
• 17 inproceedings A.Abir Laraba, J.Jérôme François, I.Isabelle Chrisment, S.Shihabur Rahman Chowdhury and R.Raouf Boutaba. Defeating Protocol Abuse with P4: Application to Explicit Congestion Notification 2020 IFIP Networking Conference (Networking) Paris, France June 2020
  HAL back to text back to text
• 18 inproceedings M.Mingxiao Ma, A.Abdelkader Lahmadi and I.Isabelle Chrisment. Detecting a Stealthy Attack in Distributed Control for Microgrids using Machine Learning Algorithms 3rd IEEE International Conference on Industrial Cyber-Physical Systems (ICPS) Tampere (online), Finland June 2020
  HAL back to text
• 19 inproceedings L.Lakhdar Meftah, R.Romain Rouvoy and I.Isabelle Chrisment. Capturing Privacy-preserving User Contexts with IndoorHash DAIS 2020 - 20th IFIP International Conference on Distributed Applications and Interoperable Systems 12135 Valletta, Malta http://www.discotec.org/2020/dais.html June 2020
  HAL DOI back to text
• 20 inproceedings M.Mohamed Said Frikha, A.Abdelkader Lahmadi, S.Sonia Mettali Gammar and L.Laurent Andrey. Leveraging Reinforcement Learning for Adaptive Monitoring of Low-Power IoT Networks The 16th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob2020) Thessaloniki (Virtual), Greece October 2020
  HAL back to text

Scientific book chapters

• 21 inbookJ.Jérôme François, F.Frédéric Beck, G.Ghita Mezzour, K.Kathleen M Carley, A.Abdelkader Lahmadi, M.Mounir Ghogho, A.Abdellah Houmz, H.Hicham Hammouchi, M.Mehdi Zakroum, N.Narjisse Nejjari and O.Othmane Cherqi. ThreatPredict: From Global Social and Technical Big Data to Cyber Threat ForecastAdvanced Technologies for Security ApplicationsAdvanced Technologies for Security Applications. Proceedings of the NATO Science for Peace and Security 'Cluster Workshop on Advanced TechnologiesJune 2020, 45-54
  HALDOI

Doctoral dissertations and habilitation theses

• 22 thesis A.Abdulqawi Saif. Experimental Methods for the Evaluation of Big Data Systems Université de Lorraine January 2020
  HAL back to text

Reports & preprints

• 23 reportD.David Espinel Sarmiento, A.Adrien Lebre, L.Lucas Nussbaum and A.Abdelhadi Chari. Decentralized SDN Control Plane for a Distributed Cloud-Edge Infrastructure: A SurveyINRIAJune 2020, 40
  HALback to text
• 24 report A.Abdulqawi Saif, L.Lucas Nussbaum and Y.-Q.Ye-Qiong Song. On the Impact of I/O Access Patterns on SSD Storage Inria January 2020
  HAL

Other scientific publications

• 25 misc A.Ahmad Abboud, R.Rémi Garcia, A.Abdelkader Lahmadi, M.Michaël Rusinowitch and A.Adel Bouhoula. R2-D2: Filter Rule set Decomposition and Distribution in Software Defined Networks Izmir/Virtual, Turkey November 2020
  HAL back to text