Matthieu Mouzaoui — PhD Student at Inria PIRAT

I am Matthieu Mouzaoui, a PhD student (2024-2027) at Inria in Rennes (Brittany🧈, France), within the PIRAT research team.

My research focuses on the security of machine learning systems used to protect computer networks. I study how attackers can exploit the weaknesses of modern ML/AI-based NIDS and how these systems can be made more robust against realistic attacks.

Why ML-NIDS?

NIDS are essential tools for detecting malicious activity in network traffic. As signature-based NIDS resulted in too many false negatives against novel attacks, and as the technology evolved, modern NIDS started to leverage Machine Learning techniques to identify patterns of malicious behavior. However, like all machine learning models, they also introduce new attack surfaces, where attackers manipulate network traffic to evade detection.

Are Adversarial Attacks against NIDS any different?

Unlike images, network traffic cannot be modified arbitrarily. Every communication must remain protocol-compliant and every communication must remain functional. This makes adversarial machine learning in cybersecurity fundamentally different from adversarial attacks studied in vision or NLP. In cybersecurity, attackers cannot simply perturb input features until the model fails. Every modification must preserve the attack itself: an exploit that no longer exploits anything is useless. Moreover, the attacker must also consider the network context of the attack. For example, an attacker can only communicate with endpoint with an active listening port or its communication will be dropped by the network. As a result, directly applying existing adversarial algorithms from other domains often leads to unrealistic or invalid samples. (e.g. modifying packet headers in a way that breaks protocol compliance, use IP 4.7 to communicate…)

Current Work

Modern attacks rarely occur as isolated events. They involve interactions between hosts, services, and users across a network. Graph Neural Networks naturally model these relationships and have recently become one of the most promising directions for intrusion detection. Current work explores Graph Neural Network (GNN)-based NIDS, which model the relationships between entities in network traffic.
These models are often considered more explainable for human analysts. However, exploiting relational information also creates new attack opportunities. Can an attacker realistically manipulate the graph structure itself to evade detection? Much of the adversarial machine learning literature assumes unrealistic capabilities, such as direct access to model gradients or arbitrary feature manipulation. My work investigates attacks that remain feasible in operational networks, under realistic constraints such as protocol validity, limited attacker knowledge, restricted query budgets, and preservation of malicious functionality

If you want more details, you can check my publications or my CV.