Matthieu Mouzaoui — PhD Student at Inria PIRAT

I am Matthieu Mouzaoui, a PhD student (2024-2027) at Inria in Rennes (Brittany🧈, France), within the PIRAT research team.

My research interests are about Adversarial Robustness for Machine Learning-based Network Intrusion Detection System (ML-NIDS).

ML-NIDS?

ML based NIDS is a trendy topic in academia, as ML based IDS allow for higher performance than Signature based NIDS. However, as ML model they are vulnerable to adversarial attacks. NIDS are essential tools for detecting malicious activity in network traffic. As signature-based NIDS resulted in too many false negatives against novel attacks, and as the technology evolved, modern NIDS started to leverage Machine Learning techniques to identify patterns of malicious behavior. However, these ML-based NIDS can be vulnerable to adversarial attacks, where attackers manipulate network traffic to evade detection.

Are Adversarial Attacks against NIDS any different?

Unlike attacks in computer vision or text, adversarial attacks in network security face strict structural and semantic constraints.
For instance, any modified traffic must remain syntactically valid and semantically meaningful. It must still represent a legitimate communication or a real-world intrusion attempt. As a result, directly applying existing adversarial algorithms from other domains often leads to unrealistic or invalid samples. (e.g. modifying packet headers in a way that breaks protocol compliance, use IP 4.7 to communicate…)

Current Work

Current work explores Graph Neural Network (GNN)-based NIDS, which model the relationships between entities in network traffic.
These models are often considered more explainable for human analysts. Yet, this property may also be exploitable from an adversarial perspective.

Details incoming… (no spoilers!) If you are interested in this topic or would like to discuss related ideas, feel free to reach out.

Disclaimer

These materials are works in progress and may contain inaccuracies or incomplete explanations. Morever, the site is under construction, please do not judge the many “TODO” you may find around!