Search

International audience; Blockchains face many challenges in time, among which the ever-growing storage needs for blockchains' data. In particular, Ethereum is quickly approaching the 1 TB storage limit for a node, what may significantly reduce the candidates able to run an Ethereum fullnode. In this paper, we propose a new synchronization and storage strategy for Ethereum that takes full advantage of the Distributed Hash Table implemented in all clients but left unused. By digging into the history of Ethereum's synchronization and storage strategies, we justify why such distribution of storage duties among peers makes much sense today. We implemented our solution in the official Ethereum client Geth and validated its smooth operation on a private Ethereum instance. Our solution can save around 60% of the storage of a node (360 GB) which represents a total of 12 PB of data at the network scale, while being fully backward compatible with current clients.

International audience

International audience; Cryptographic algorithms that can provide both encryption and authentication are increasingly required in modern security architectures and protocols (e.g. TLS v1.3). Many authenticated encryption systems have been proposed in the past few years, which has resulted in several cryptanalysis research work. In this same direction, the National Institute of Standards and Technology (NIST) is coordinating a large effort to find a new standard authenticated encryption algorithm to be used by resource-constrained and limited devices. In this paper, 12 algorithms of the 33 candidates of the Round 2 phase from NIST competition are being benchmarked on a real IoT test-bed. These 33 ciphers implement authenticated encryption with associated data which aims at preserving integrity, privacy and authenticity at the same time. In this work, we ported the 12 algorithms to different hardware platforms (an x86_64 PC, an AVR ATmega128, an MSP430F1611 and the IoT-LAB platform) and make a fair comparison between their performance. We adapted these algorithms to the Contiki operating system to evaluate the latency and efficiency of each algorithm on IoT applications deployed on a national experimental platform which is IoT-LAB. In addition, we used the FELICS-AE benchmark to quantify locally the RAM, execution time and code size of each algorithm. In fact, this work provides practical results of their performance in an IoT scenario which pave the way for further research on other algorithms, platforms or OS.

International audience; Les blockchains font face à de multiples défis parmi lesquels l'augmentation continuelle des données à stocker par les pairs qui en supportent l'infrastructure. En particulier, Ethereum se rapproche de la barrière symbolique de 1 To de données à stocker par fullnode. Dans cet article, nous proposons une nouvelle stratégie de stockage basée sur l'exploitation de la table de hachage distribuée d'Ethereum. Nous avons implanté une preuve de concept dans Geth, et évalué que l'économie possible est d'environ 60% du stockage actuel demandé à un pair. Cela représente un gain de l'ordre d'une dizaine de pétaoctets pour le réseau pair-à-pair dans son ensemble. De plus, notre solution est compatible avec les clients actuels et peut-être déployée incrémentalement.

International audience; Cloud Gaming (CG) has been gaining a lot of interest and major actors have entered this market such as Google, Nvidia, Sony or Microsoft. They operate CG platforms that attract an increasing number of players worldwide. This type of traffic is highly demanding for network infrastructures because it requests simultaneously high bandwidth, low delay and no traffic degradation (interruptions or jitter) to ensure a good end-user's QoE. To improve the delivery of low-latency applications, new Active Queue Management architectures like L4S (Low Latency, Low Loss, Scalable Throughput) are proposed. Currently, traffic is routed to a low-latency queue only based on the presence of the Explicit Congestion Notification bit (ECN) in the IP header, but this is too restrictive and can be easily manipulated. Instead, we aim at analyzing and detecting CG traffic based on its inherent characteristics, to forward the packets in the low-latency queue. This paper presents our models to efficiently detect CG traffic based on flow-level features among other highbitrate applications transported over UDP. The evaluation proves that our model based on decision trees achieves very good results (98.5% accuracy) and can be realistically deployed as a Virtualized Network Function at the edge, handling more than 10Gb/s of medium-sized flows on a low-end server. Our network captures and source code are open to ensure reproducible results.

This thesis concerns new detection methods for the security of heterogenous IoT systems, and fits within the framework of the SecureIoT European project. We have first proposed a solution exploiting the process mining together with pre-treatment techniques, in order to build behavioral models, and identifying anomalies from heterogenous systems. We have then evaluated this solution from datasets coming from different application domains : connected cars, industry 4.0, and assistance robots.. This solution enables to build models that are more easily understandable. It provides better detection results than other common methods, but may generate a longer detection time. In order to reduce this time without degrading detection performances, we have then extended our method with an ensemble approach, which combines the results from several detection methods that are used simultaneously. In particular, we have compared different score aggregation strategies, as well as evaluated a feedback mechanism for dynamically adjusting the sensitivity of the detection. Finally, we have implemented the solution as a prototype, that has been integrated into a security platform developed in collaboration with other European industrial partners.; Cette thèse porte sur de nouvelles méthodes de détection pour la sécurité des systèmes IoT hétérogènes, et s'inscrit dans le cadre du projet européen Secure IoT. Nous avons tout d'abord proposé une solution utilisant le process mining couplé à un pré-traitement des données, pour construire des modèles de comportement et identifier des anomalies à partir de données hétérogènes. Nous avons évalué cette solution à partir de jeux de données issus de plusieurs domaines d'applications différents : véhicules connectés, industrie 4.0, robots d'assistance. Cette solution permet de construire des modèles plus facilement compréhensibles. Elle obtient des meilleurs résultats de détection que d'autres méthodes usuelles, mais demande un temps de traitement plus long. Pour réduire ce dernier sans dégrader les performances de détection, nous avons ensuite étendu notre méthode à l'aide d'une approche ensembliste, qui permet de combiner les résultats de plusieurs méthodes de détection utilisées simultanément. En particulier, nous avons comparé différentes stratégies d'agrégation des scores. Nous avons aussi évalué un mécanisme permettant d'ajuster dynamiquement la sensibilité de la détection. Enfin, nous avons implanté la solution sous la forme d'un prototype, qui a été intégré à une plateforme de sécurité développée avec des partenaires européens.

International audience; With the recent technological evolutions in networks and increased deployment of multi-tier clouds, cloud gaming (CG) is gaining renewed interest and is expected to become a major Internet service in the upcoming years. Many companies have launched powerful platforms such as Google Stadia, Nvidia GeForce Now, Microsoft xCloud, Sony PlayStation Now, among others, to attract players. However, for all endusers to fully enjoy their gaming sessions over the wide range of network access qualities, CG platforms must adapt their traffic. In this paper, we present the outcomes of a comprehensive measurement study performed on the four aforementioned CG platforms, configuring different synthetic network constraints like packet loss, throughput decrease, latency increase and jitter variation to observe the traffic of these CG platforms under degraded network conditions and infer their adaptive behaviour. We also present how the four CG platforms behave when used under real cellular network conditions, captured on the Orange network in January 2022. Our findings show that the four platforms exhibit different adaptation behaviours. Moreover, many cases result in a degraded QoS, leaving room for further improvements at both application and/or network levels.

Blockchains rely on P2P networks that are essential to their proper functioning, as they ensure the dissemination of transactions and blocks to all parties.While Bitcoin and Ethereum - the two main public blockchains - are now worth trillions of dollars, attracting new users every day, few studies focus on the network aspects, although the literature shows that many problems can reduce the reliability of public P2P networks.In this thesis, we first focused on the monitoring of the P2P networks of the Bitcoin and Ethereum blockchains.We implemented a crawler for each network able to discover all connected peers and analyzed data from several months of measurement campaigns.Different criteria that can affect the reliability of the network were studied, such as the number of peers, their geographical distribution, their distribution over the IP network, the churn, the proportion of clients with known vulnerabilities, the existence of daily connection patterns or the ability to infer topology. It appears that both networks show good properties on all these points.Starting from the observation that, on the one hand, the Ethereum P2P network based on a distributed hash table (DHT) is largely untapped, as no data is stored in the DHT, and on the other hand, thestorage of the blockchain data is only growing (which will eventually be problematic),we studied in a second time the data storage of the main client of Ethereum(Geth) and its way of synchronizing the state of the blockchain between the peers. We have designeda new distributed storage architecture for Ethereum taking advantage of the DHT, backward compatible with the current clients and able to reduce the disk space, used for long-term storage, by 95% (58% of the total storage) without impacting the guarantees or the performances of the Ethereum blockchain.However, storing data on the DHT makes it more prone to attacks, especially Sybil attacks.We therefore analyzed Ethereum peers for patterns that could reflect Sybil attacks and showed the existence of thousands of suspicious nodes grouping many identifiers for a single IP address (up to 10000/IP).We finally designed and implemented a protection architecture against Sybil attacks. It is based on a crawler detecting suspicious nodes in real time, a smart contract structuring the information and distributing it to all peers, and finally a fully-distributed revocation system, each peer noticing itself the attack and removing its connections.The deployment on an Ethereum test network has shown the effectiveness of the proposed architecture.; Les blockchains reposent sur des réseaux P2P essentiels à leur bon fonctionnement puisqu'ils assurent la dissémination des transactions et des blocs à l'ensemble des parties. Alors que Bitcoin et Ethereum - les deux principales blockchains publiques - capitalisent aujourd'hui des milliers de milliards de dollars, attirant chaque jour de nouveaux utilisateurs, peu d'études s'intéressent aux aspects réseau bien que la littérature montre que de nombreux problèmes peuvent réduire la fiabilité des réseaux P2P publics. Dans cette thèse, nous nous sommes intéressés dans un premier temps à la supervision des réseaux P2P des blockchains Bitcoin et Ethereum. Nous avons implanté un crawler pour chaque réseau capable de découvrir tous les pairs connectés et avons analysé les données issues de campagnes de mesure de plusieurs mois. Différents critères pouvant affecter la fiabilité du réseau ont été étudiés, tels que le nombre de pairs, leur distribution du point de vue géographique ou du réseau IP, leur taux d'attrition, la proportion de clients aux vulnérabilités connues, l'existence de motifs journaliers de connexion ou encore la capacité d'inférer la topologie. Il apparaît que les deux réseaux montrent de bonnes propriétés sur tous ces points. Partant du constat que, d'une part, le réseau P2P d'Ethereum basé sur une table de hachage distribuée (DHT) est largement inexploité, car aucune donnée n'est stockée dans la DHT, et que, d'autre part, le stockage des données de la blockchain ne fait que croître (ce qui posera des problèmes à terme), nous avons étudié dans un second temps le stockage des données du principal client d'Ethereum (Geth) et sa manière de synchroniser l'état de la blockchain entre les pairs. Nous avons conçu une nouvelle architecture distribuée de stockage pour Ethereum tirant parti de la DHT, rétrocompatible avec les clients actuels et pouvant réduire l'espace disque, utilisé pour le stockage long terme, de 95% (58% du stockage total) sans impact sur les garanties ou les performances de la blockchain Ethereum. Le stockage des données sur la DHT la rend cependant plus intéressante à attaquer, en particulier par des attaques Sybil localisées. Nous avons donc analysé les pairs d'Ethereum à la recherche de motifs pouvant traduire des attaques Sybil et montré l'existence de milliers de nœuds suspects regroupant un grand nombre d'identifiants pour une même adresse IP (jusqu'à 10000/IP). Nous avons finalement conçu et implanté une architecture de protection contre les attaques Sybils. Celle-ci se base sur un crawler détectant les nœuds suspects en temps réel, un smart contract structurant l'information et la distribuant à tous les pairs, et enfin une révocation complètement distribuée, chaque pair constatant lui-même l'attaque et coupant ses connexions aux nœuds Sybils. La mise en œuvre sur un réseau de test Ethereum a montré l'efficacité de l'architecture proposée.

International audience; The growing maturity of orchestration languages, such as the Topology and Orchestration Specification for Cloud Applications (TOSCA) language, and the continuous improvement of virtualization techniques contribute to the large-scale deployment of cloud composite services based on multiple resources that may be hosted over different cloud service providers. The resources composing these services may be subject to migrations, either live or offline, in order to cope with performance objectives, such as load balancing, latency minimization, and energy savings. However, these migrations may induce changes affecting the configurations of migrated resources. In particular, these changes may lead to vulnerabilities, that may compromise the security of resources, or even the security of the whole cloud service. This demonstration showcases a vulnerability prevention tool, called CMSec, for supporting the resource migrations of TOSCA-based cloud composite services by considering OVAL vulnerability descriptions together with verification techniques. Based on two main scenarios, we will expose how the CMSec tool is able to detect vulnerable configurations prior to resource migrations, and to suggest corrective operations for remediating them.

International audience; Cloud gaming applications have gained great adoption on the Internet particularly benefiting from the wide availability of broadband access networks. However, they still fail to meet users' quality requirements when accessed using cellular networks due to common wireless channel degradations. Machine Learning (ML) techniques can be leveraged to detect such anomalies during users' cloud gaming sessions. In this respect, unsupervised ML approaches are particularly interesting since they do not require labeled datasets. In this work, we investigate these approaches to understand their performance and their robustness. Our dataset consists of game sessions played on the public Google Stadia Cloud Gaming servers. The game sessions are played using a 4G network emulation replicating the capacity variations sampled on a commercial 4G network. We compare different models ranging from traditional approaches to deep learning and we evaluate their default performance while varying the level of contamination in their training datasets. Our experiments show that Auto-Encoders models achieve the best performance without contamination while the OC-SVM and the Isolation Forest are the most robust to data contamination.

The emergence of the Software-Defined Networking paradigm has supported the development of new network monitoring schemes thanks to network programmability. The first purpose of SDN is to centralize the network intelligence at the control plane with a stateless data plane (i.e., network elements, switches). As a result, the network monitoring functions require the help of the remote controller or the extension of existing data plane protocols. In recent years, efforts have been made to make the data plane more programmable and stateful, permitting customized functions deployment and offloading many applications to network elements (e.g., forwarding devices). For example, the data plane programmability can be enabled by the P4 language that defines how packets are processed in a switch pipeline and supports stateful packet processing. However, P4 does not provide intuitive stateful abstractions to model behavioral attacks. Therefore, rethinking on the general abstractions to model and track a complex and stateful behavior in the data plane is necessary. To exploit the opportunities offered by a programmable data plane, including stateful and real-time packet processing, we need models which are simple enough to be deployed on a programmable switch with respect to the existing primitives that remain limited and, at the same time, capable of capturing a complex behavior.Meantime, attackers exploit vulnerabilities present in protocols used in the core of the Internet, such as TCP and DNS. However, the proposed solutions to detect these attacks require modifying the protocol implementation at the end-hosts or having a negative impact on benign flows. Therefore, patching at the scale of the Internet would require much time for deployment, such as in the case of DNSSEC. In this thesis, we address these shortcomings by designing a security function (i.e., an attack mitigation approach) that can be deployed in an SDN programmable data plane. We propose an abstraction based on an Extended Finite State Machine (EFSM) to model an attack behavior. To detect sophisticated attacks such as multi-step attacks, we extend it with Petri Net to synchronize the detection of a set of attack steps. We present how these models can be mapped to P4 primitives so that we can detect and react against an attack within the network. We present three attacks from Layer-3, Layer-4, and Layer-7 of the OSI model, namely the ECN protocol abuse, the Optimistic ACK attack, and the recent DNS multi-step cache poisoning attack. Our approach does not require modifying protocol implementation at the end hosts. Besides, our solution leverages programmable data planes, enabling flow tracking and reaction against attacks in real-time within the network.; L'émergence du paradigme des réseaux définis par logiciel (SDN) a favorisé le développement de nouveaux mécanismes de surveillance des réseaux grâce à leur programmabilité. Le premier objectif de SDN est de centraliser l'intelligence du réseau au niveau d'un plan de contrôle avec un plan de données sans état (i.e., des éléments de réseau, des commutateurs). Par conséquent, les fonctions de surveillance du réseau nécessitent l'aide du contrôleur distant ou l'extension des protocoles de plan de données existants. Ces dernières années, des efforts ont été faits pour rendre le plan de données plus programmable et plus apte à supporter un traitement à état, ce qui permet de déployer des fonctions personnalisées et de décharger de nombreuses applications sur les éléments du réseau. Par exemple, la programmabilité du plan de données peut être assurée par le langage P4 qui définit la manière dont les paquets sont traités dans un pipeline d'un commutateur et qui prend en charge le traitement à état des paquets. Cependant, le langage P4 ne fournit pas d'abstractions à états intuitives pour modéliser les attaques comportementales. Il est donc nécessaire de reconsidérer des abstractions générales pour modéliser et surveiller un comportement complexe et à état dans le plan de données. Pour exploiter les opportunités offertes par un plan de données programmable, notamment le traitement des paquets à état et en temps réel, nous avons besoin de modèles suffisamment simples pour être déployés sur un commutateur programmable, tout en respectant les primitives existantes qui restent limitées, et en même temps, capables de capturer un comportement complexe. Parallèlement, les attaquants exploitent les vulnérabilités présentes dans les protocoles utilisés au cœur de l'Internet, tels que TCP et DNS. Cependant, les solutions proposées pour détecter ces attaques nécessitent de modifier l'implémentation des protocoles au niveau des hôtes finaux ou ont un impact négatif sur les flux bénins. Par conséquent, corriger les vulnérabilités à l'échelle de l'Internet nécessiterait beaucoup de temps pour le déploiement, comme dans le cas de DNSSEC. Dans cette thèse, nous abordons ces lacunes en définissant une fonction de sécurité (c'est-à-dire une approche de détection et d'atténuation des attaques) qui peut être déployée dans un plan de données programmable de SDN. Nous proposons une abstraction reposant sur une machine à états finis étendue (EFSM) pour modéliser le comportement d'une attaque. Pour détecter des attaques sophistiquées telles que les attaques à étapes multiples, nous l'étendons avec un réseau de Petri pour synchroniser la détection d'un ensemble d'étapes d'attaque. Nous présentons comment ces modèles peuvent être mappés aux primitives P4 afin de pouvoir détecter et agir contre une attaque au sein du réseau. Nous présentons trois attaques de la couche 3, la couche 4 et la couche 7 du modèle OSI (Open System Interconnection), à savoir l'abus du protocole ECN (Explicit Congestion Notification), l'attaque Optimisitic ACK et la récente attaque DNS par empoisonnement du cache. Notre approche ne nécessite pas de modifier l'implémentation du protocole au niveau des hôtes finaux. En outre, notre solution s'appuie sur des plans de données programmables, permettant la surveillance des flux et la réaction contre les attaques en temps réel au sein du réseau.

International audience

Nowadays, the use of Internet of Things (IoT) devices in our personal and work space makes our everyday life easier, but those IoT devices often suffer from security issues. The objective of this thesis is to evaluate the security of IoT devices. On one hand, we investigate the risk of user privacy leakage introduced by IoT hubs (or IoT gateways). Those IoT hubs act as a middlebox between a user and the IoT devices. Existing passive fingerprinting techniques are not applicable in this configuration considering that the network traffic of each individual IoT device attached to the IoT hub is not accessible. We propose a passive fingerprinting technique to infer the user actions by analysing the network traffic of the IoT gateway. Our method works on encrypted network traffic, and consists of decomposing a packet payload size into a set of, potential, user actions. We applied our technique on one IoT gateway controlling up to 16 IoT devices and show that an attacker, located on the Internet, is able to infer the user actions in more than 91.2% of the investigated cases.In a further step, we propose a hybrid firmware analysis technique to evaluate the security of an IoT device by inspecting the content of its firmware. Our analysis combines a dynamic analysis and a static analysis to improve our chances to extract data. Our objectives are not to detect unknown vulnerabilities but only the known ones, and inspect if the binaries included are deprecated. We applied our analysis on 4,730 firmwares belonging to IoT devices released between 2009 and 2019, and noticed the widespread use of a small set of binaries, notably to deploy HTTP and SSH services. From 2017, we observed that IoT manufacturers implemented many updates which reduced the exposure to known vulnerabilities.Using those firmwares, we defined an active fingerprinting technique allowing an attacker to infer details about a connected IoT devices, such as its brand or the binary used to deploy the HTTP server. Thanks to the firmware content, we can 1) obtain precise information about the binaries (name, version), and 2) assume the services actually deployed by the device i.e., the results of a TCP/UDP port scans. Considering those two aspects, our method consists of training classifiers to predict one particular property of a connected IoT device from, among others, the supposed results of a TCP/UDP port scans. Our method allows to predict fine details such as the name or version of a binary, the usernames or the passwords present in an IoT device. Using our approach, we noticed that the predictions of the name and version of the HTTP, SSH and DNS binaries are achieved with a precision superior to 73.14%. On the other hand, the prediction of at least one valid password is more challenging and requires up to two tries. Our method is more effective and furtive than a naive brute-force method.Knowing the vulnerabilies present in a IoT device does not guarantee that attackers use them on a regular basis. Hence, we propose in our fourth contribution, a high interaction honeypot capable of intercepting cyberattacks targeting IoT devices. The defined honeypot is based on an existing emulation technique that uses IoT devices firmwares. Implementing an honeypot is hard, and because of the stealth constraint, the existing emulation technique could not be used as-is. Due to this constraint, we implemented a framework capable of emulating IoT devices while assuring their furtivity, and adding honeypot-specific capabilities, such as exfiltrating the attackers activities. We then compared our approach to the state of the art one, and showed that ours can emulate up to 825 (82.5%) devices compared to 454 (45.4%). Our honeypot was deployed on one server during about one year and captured unknown and recent attacks from botnets, and sometimes humans., L'usage des objets de l'Internet des Objets (IdO) dans nos environnements personnel ou professionnel facilite nos interactions du quotidien, mais ces derniers souffrent souvent de problèmes de sécurité. L'enjeu de cette thèse est d'évaluer la sécurité des objets IdO à l'échelle de l'Internet selon plusieurs axes. Pour ce faire, les travaux proposés doivent satisfaire plusieurs contraintes comme le passage à l'échelle, la gestion de l'hétérogénéité des objets IdO ou, dans le cas d'une analyse de trafic réseau, l'impossibilité d'intercepter les communications sans-fil d'objets IdO. Nous nous sommes d'abord intéressés aux risques de fuite de données utilisateur introduits par les box domotiques, dont le rôle est d'agir comme un relai entre un utilisateur et des objets IdO. De plus, la box agrège le trafic réseau des objets ce qui empêche l'utilisation des méthodes existantes pour identifier les actions utilisateur effectuées. Nous proposons une méthode capable d'inférer les actions utilisateur en décomposant la taille des données dans les requêtes reçues par la box en une ou plusieurs combinaisons d'actions utilisateur possibles. Notre méthode a ensuite été appliquée sur une box domotique connectée à 16 objets IdO, et nous avons montré qu'un attaquant pouvait inférer les actions utilisateur dans plus de 91.2% des cas. Dans une deuxième contribution, nous évaluons le niveau de sécurité d'objets IdO à l'aide d'une analyse hybride de firmwares combinant une analyse statique et dynamique. Contrairement aux solutions existantes, notre objectif n'est pas de détecter de nouvelles vulnérabilités mais plutôt d'analyser la composition des binaires présents dans les firmwares, notamment par rapport à la présence de vulnérabilités connues ou à l'utilisation de versions de binaires obsolètes. Nous avons ensuite analysé 4 730 firmwares d'objets IdO publiés entre 2009 et 2019, et noté une utilisation prépondérante de certains binaires, mais également une vague de patches en 2017. L'analyse de firmwares permet d'obtenir 1) des informations précises sur les binaires (nom et version), 2) les noms et mots de passe des utilisateurs. À l'aide de ces informations, nous avons élaboré une méthode d'identification active permettant à un attaquant d'inférer, à partir des résultats supposés d'un scan de ports, des propriétés précises sur un objet IdO connecté, comme le nom du binaire utilisé pour déployer le serveur HTTP ou les noms d'utilisateur. Notre méthode consiste à entraîner des classificateurs à partir des données extraites des firmwares. Elle est capable de prédire correctement (>73.14%) le nom ou la version d'un binaire déployant HTTP, SSH ou DNS. La prédiction des mots de passe nécessite, elle, moins de deux tentatives. L'utilisation de notre approche semble plus efficace, et furtive, qu'une approche par brute-force. Notre quatrième contribution s'intéresse aux cyberattaques ciblant les objets IdO. Pour ce faire, nous avons défini un pot de miel à forte interaction basé sur une méthode d'émulation utilisant des firmwares d'objets IdO. Le déploiement d'un pot de miel est difficile à cause de la contrainte de furtivité que les méthodes existantes d'émulation d'objets IdO n'intègrent pas. Notre contribution est capable d'émuler un objet IdO en 1) maximisant sa furtivité, et 2) en intégrant des fonctionnalités inhérentes à un pot de miel (par exemple exfiltrer les activités des attaquants). Notre approche peut émuler jusqu'à 825 (82.5%) objets IdO contre 454 (45.4%) avec la méthode de l'état de l'art. Enfin, nous avons déployé notre pot de miel durant environ un an, et montré que ce dernier recevait des attaques inconnues ou récentes de botnets, et d'humains.

International audience; Low-latency applications (cloud-gaming, cloud-robotics, metaverse...) have soared with the rapid evolution of Internet. Current network capacities (especially time-varying capacity networks like 4G/5G networks) struggle to ensure user QoE (Quality of Experience). There is therefore a need to collect, identify and analyze metrics specific to low-latency applications in network equipment (switches, base stations, UEs...) for efficient troubleshooting of user QoE degradation purposes.

International audience; The current generation of networks empowers the use of programmable switches whose behaviour can be defined using languages like P4. Nevertheless, these languages do not support network-wide deployment of stateful real-value functions. This paper presents NetREC, an extension of RMT programmable data planes designed to enable stateful real-value functions computation across multiple switches. NetREC first decomposes the real-value functions into a dependency graph of elementary operations that are distributed among the network. This distribution is carried out by dynamically generating and solving an integer linear program. We deploy a prototype of NetREC on a network of Tofino switches and demonstrate its capability of computing recursive real-value functions like exponential weighted moving average.

International audience; Network reconnaissance is the first step precedinga cyber-attack. Hence, monitoring the probing activities is im-perative to help security practitioners enhancing their awarenessabout Internet’s large-scale events or peculiar events targetingtheir network. In this paper, we present a framework foran improved and efficient monitoring of the probing activi-ties targeting network telescopes. Particularly, we model theprobing rates which are a good indicator for measuring thecyber-security risk targeting network services. The approachconsists of first inferring groups of network ports sharing similarprobing characteristics through a new affinity metric capturingboth temporal and semantic similarities between ports. Then,sequences of probing rates targeting similar ports are used asinputs to stacked Long Short-Term Memory (LSTM) neuralnetworks to predict probing rates 1 hour and 1 day in advance.Finally, we describe two monitoring indicators that use theprediction models to infer anomalous probing traffic and toraise early threat warnings. We show that LSTM networkscan accurately predict probing rates, outperforming the non-stationary autoregressive model, and we demonstrate that themonitoring indicators are efficient in assessing the cyber-securityrisk related to vulnerability disclosure

International audience; To meet their stringent requirements in terms of performance and dependability, communication networks should be "well connected". While classic connectivity measures typically revolve around topological properties, e.g., related to cuts, these measures may not reflect well the degree to which a network is actually dependable. We introduce a more refined measure for network connectivity, the hazard value, which is developed to meet the needs of a real network operator. It accounts for crucial aspects affecting the dependability experienced in practice, including actual traffic patterns, distribution of failure probabilities, routing constraints, and alternatives for services with preferences therein. We analytically show that the hazard value fulfills several fundamental desirable properties that make it suitable for comparing different network topologies with one another, and for reasoning about how to efficiently enhance the robustness of a given network. We also present an optimised algorithm to compute the hazard value and an experimental evaluation against networks from the Internet Topology Zoo and classical datacenter topologies, such as fat trees and BCubes. This evaluation shows that the algorithm computes the hazard value within minutes for realistic networks, making it practically usable for network designers.

International audience; General-purpose computing on graphics processing units (GPGPU) is a promising way to speed up computationally intensive network functions, such as performing real-time traffic classification based on machine learning. Recent studies have focused on integrated graphics units and various performance optimizations to address bottlenecks such as latency. However, these approaches tend to produce architecture-specific binaries and lack the orchestration of functions. A complementary effort would be a GPGPU architecture based on standard and open components, which allows the creation of interoperable and orchestrable network functions. This study describes and evaluates such open architecture based on the cross-platform Vulkan API, in which we execute handwritten SPIR-V code as a network function. We also demonstrate a multi-node orchestration approach for our proposed architecture using Kubernetes. We validate our architecture by executing SPIR-V code performing traffic classification with random forest inference. We test this application both on discrete and integrated graphics cards and on x86 and ARM. We find that in all cases the GPUs are faster than the baseline Cython code.

International audience; The growing maturity of orchestration languages is contributing to the elaboration of cloud composite services, whose resources may be deployed over different distributed infrastructures. These composite services are subject to changes over time, that are typically required to support cloud properties, such as scalability and rapid elasticity. In particular, the migration of their elementary resources may be triggered by performance constraints. However, changes induced by this migration may introduce vulnerabilities that may compromise the resources, or even the whole cloud service. In that context, we propose an automated SMT 1-based security framework for supporting the migration of resources in cloud composite services, and preventing the occurrence of new configuration vulnerabilities. We formalize the underlying security automation based on SMT solving, in order to assess the migrated resources and select adequate countermeasures , considering both endogenous and exogenous security mechanisms. We then evaluate its benefits and limits through large series of experiments based on a proof-ofconcept prototype implemented over the CVC4 commonly-used open-source solver. These experiments show a minimal overhead with regular operating systems deployed in cloud environments.

International audience

International audience; The growth of the Internet-of-Things (IoT) has been characterized by the large-scale deployment of sensors and connected objects. These ones are integrated with other Internet resources in order to elaborate more complex systems and applications. Security management is a major challenge for these systems due to their complexity, their heterogeneity and the limited resources of their devices. In this paper we evaluate the exploitability and performance of a process mining approach for detecting misbehaviors in such systems. We describe the considered architecture and detail its operation, from the generation of behavioral models to the detection of potential attacks. We formalize several alternative commonly-used detection methods, including elliptic envelope, support-vector machine, local outlier factor, and isolation forest techniques. After presenting a proofof-concept prototype, we quantify comparatively the benefits and limits of our process mining solution combined with data preprocessing, through extensive experiments based on different industrial datasets.

The Internet has become a great integration platform capable of efficiently interconnecting billions of entities, from simple sensors to large data centers. This platform provides access to multiple hardware and virtualized resources (servers, networking, storage, applications, connected objects) ranging from cloud computing to Internet-of-Things infrastructures. From these resources that may be hosted and distributed amongst different providers and tenants, the building and operation of complex and value-added networked systems is enabled. These systems arehowever exposed to a large variety of security attacks, that are also gaining in sophistication and coordination. In that context, the objective of my research work is to support security management for the cyberspace, with the elaboration of new monitoring and configuration solutionsfor these systems. A first axis of this work has focused on the investigation of smart monitoring methods capable to cope with low-resource networks. In particular, we have proposed a lightweight monitoring architecture for detecting security attacks in low-power and lossy net-works, by exploiting different features provided by a routing protocol specifically developed for them. A second axis has concerned the assessment and remediation of vulnerabilities that may occur when changes are operated on system configurations. Using standardized vulnerability descriptions, we have designed and implemented dedicated strategies for improving the coverage and efficiency of vulnerability assessment activities based on versioning and probabilistic techniques, and for preventing the occurrence of new configuration vulnerabilities during remediation operations. A third axis has been dedicated to the automated configuration of virtualized resources to support security management. In particular, we have introduced a software-defined security approach for configuring cloud infrastructures, and have analyzed to what extent programmability facilities can contribute to their protection at the earliest stage, through the dynamic generation of specialized system images that are characterized by low attack surfaces. Complementarily, we have worked on building and verification techniques for supporting the orchestration of security chains, that are composed of virtualized network functions, such as firewalls or intrusion detection systems. Finally, several research perspectives on security automation are pointed out with respect to ensemble methods, composite services and verified artificial intelligence., L’Internet est devenu une formidable plateforme d’intégration capable d’interconnecter efficacement des milliards d’entités, de simples capteurs à de grands centres de données. Cette plateforme fournit un accès à de multiples ressources physiques ou virtuelles, allant des infra-structures cloud à l’internet des objets. Il est possible de construire et d’opérer des systèmes complexes et à valeur ajoutée à partir de ces ressources, qui peuvent être déployées auprès de différents fournisseurs. Ces systèmes sont cependant exposés à une grande variété d’attaques qui sont de plus en plus sophistiquées. Dans ce contexte, l’objectif de mes travaux de recherche porte sur une meilleure gestion de la sécurité pour le cyberespace, avec l’élaboration de nouvelles solutions de monitorage et de configuration pour ces systèmes. Un premier axe de ce travail s’est focalisé sur l’investigation de méthodes de monitorage capables de répondre aux exigences de réseaux à faibles ressources. En particulier, nous avons proposé une architecture de surveillance adaptée à la détection d’attaques dans les réseaux à faible puissance et à fort taux de perte, en exploitant différentes fonctionnalités fournies par un protocole de routage spécifiquement développépour ceux-ci. Un second axe a ensuite concerné la détection et le traitement des vulnérabilités pouvant survenir lorsque des changements sont opérés sur la configuration de tels systèmes. En s’appuyant sur des bases de descriptions de vulnérabilités, nous avons conçu et mis en œuvre différentes stratégies permettant d’améliorer la couverture et l’efficacité des activités de détection des vulnérabilités, et de prévenir l’occurrence de nouvelles vulnérabilités lors des activités de traitement. Un troisième axe fut consacré à la configuration automatique de ressources virtuelles pour la gestion de la sécurité. En particulier, nous avons introduit une approche de programmabilité de la sécurité pour les infrastructures cloud, et avons analysé dans quelle mesure celle-ci contribue à une protection au plus tôt des ressources, à travers la génération dynamique d’images systèmes spécialisées ayant une faible surface d’attaques. De façon complémentaire, nous avonstravaillé sur des techniques de construction automatique et de vérification de chaînes de sécurité, qui sont composées de fonctions réseaux virtuelles telles que pare-feux ou systèmes de détection d’intrusion. Enfin, plusieurs perspectives de recherche relatives à la sécurité autonome sont mises en évidence concernant l’usage de méthodes ensemblistes, la composition de services, et la vérification de techniques d’intelligence artificielle.

International audience; The increasing sophistication of attacks over the last years such as the proliferation of complex multi-steps attacks, calls for new monitoring models and methods for diagnosing the attacks’ severity and mitigating them in a timely manner. In this paper, we propose an in-network monitoring approach capable of detecting a set of composed behaviors and consequently triggering different levels of alerts and reactions. Our approach is based on a Petri Net model capable of aggregating individual attacks into a multi-step composition. To this end, we propose a method for deriving a Match-Action Table (MAT) abstraction from a Petri net model. MATs can be then deployed on a P4 programmable data plane, enabling flexible re-composition of attack detection steps at runtime. We demonstrate the feasibility of our proposal by modeling the detection of a multi-step DNS cache poisoning attack and implementing the model on a P4 programmable data plane.

International audience; IoT devices are ubiquitous and widely adopted by end-users to gather personal and environmental data that often need to be put into context in order to gain insights. In particular, location is often a critical context information that is required by third parties in order to analyse such data at scale. However, sharing this information is i) sensitive for the user privacy and ii) hard to capture when considering indoor environments.This paper therefore addresses the challenge of producing a new location hash, named IndoorHash, that captures the indoor location of a user, without disclosing the physical coordinates, thus preserving their privacy. This location hash leverages surrounding infrastructure, such as WiFi access points, to compute a key that uniquely identifies an indoor location.Location hashes are only known from users physically visiting these locations, thus enabling a new generation of privacy-preserving crowdsourcing mobile applications that protect from third parties re-identification attacks. We validate our results with a crowdsourcing campaign of 30 mobile devices during 4 weeks of data collection.

In software-defined networks (SDN), the filtering requirements for critical applications often vary according to flow changes and security policies. SDN addresses this issue with a flexible software abstraction, allowing simultaneous and convenient modification and implementation of a network policy on flow-based switches.With the increase in the number of entries in the ruleset and the size of data that traverses the network each second, it remains crucial to minimize the number of entries and accelerate the lookup process. On the other hand, attacks on Internet have reached a high level. The number keeps increasing, which increases the size of blacklists and the number of rules in firewalls. The limited storage capacity requires efficient management of that space. In the first part of this thesis, our primary goal is to find a simple representation of filtering rules that enables more compact rule tables and thus is easier to manage while keeping their semantics unchanged. The construction of rules should be obtained with reasonably efficient algorithms too. This new representation can add flexibility and efficiency in deploying security policies since the generated rules are easier to manage. A complementary approach to rule compression would be to use multiple smaller switch tables to enforce access-control policies in the network. However, most of them have a significant rules replication, or even they modify the packet's header to avoid matching a rule by a packet in the next switch. The second part of this thesis introduces new techniques to decompose and distribute filtering rule sets over a given network topology. We also introduce an update strategy to handle the changes in network policy and topology. In addition, we also exploit the structure of a series-parallel graph to efficiently resolve the rule placement problem for all-sized networks intractable time.; Au sein des réseaux définis par logiciel (SDN), les exigences de filtrage pour les applications critiques varient souvent en fonction des changements de flux et des politiques de sécurité. SDN résout ce problème avec une abstraction logicielle flexible, permettant la modification et la mise en \oe{}uvre simultanées et pratiques d'une politique réseau sur les routeurs.Avec l'augmentation du nombre de règles de filtrage et la taille des données qui traversent le réseau chaque seconde, il est crucial de minimiser le nombre d'entrées et d'accélérer le processus de recherche. D'autre part, l'accroissement du nombre d'attaques sur Internet s'accompagne d'une augmentation de la taille des listes noires et du nombre de règles des pare-feux. Leur capacité de stockage limitée nécessite une gestion efficace de l'espace. Dans la première partie de cette thèse, nous proposons une représentation compacte des règles de filtrage tout en préservant leur sémantique. La construction de cette représentation est obtenue par des algorithmes raisonnablement efficaces. Cette technique permet flexibilité et efficacité dans le déploiement des politiques de sécurité puisque les règles engendrées sont plus faciles à gérer.Des approches complémentaires à la compression de règles consistent à décomposer et répartir les tables de règles, pour implémenter, par exemple, des politiques de contrôle d'accès distribué.Cependant, la plupart d'entre elles nécessitent une réplication importante de règles, voire la modification des en-têtes de paquets. La deuxième partie de cette thèse présente de nouvelles techniques pour décomposer et distribuer des ensembles de règles de filtrage sur une topologie de réseau donnée. Nous introduisons également une stratégie de mise à jour pour gérer les changements de politique et de topologie du réseau. De plus, nous exploitons également la structure de graphe série-parallèle pour résoudre efficacement le problème de placement de règles.

International audience; This paper proposes a new method to solve the monitoring and anomaly detection problems of Low-power Internet of Things (IoT) devices. However, their performances are constrained by limited processing, memory, and communication, usually using battery-powered energy. Polling driven mechanisms for monitoring the security, performance, and quality of service of these networks should be efficient and with low overhead, which makes it particularly challenging. The present work proposes the design of a novel method based on a Deep Reinforcement Learning (DRL) algorithm coupled with an Unsupervised Learning reward technique to build a pooling monitoring of IoT networks. This combination makes the network more secure and optimizes predictions of the DRL agent in adaptive environments.

International audience; The Internet of Things has known an important development. However, security management is still a key challenge in particular for deploying complex IoT systems that provide sophisticated services. In this paper, we design an ensemble learning-based architecture to support early security detection in the context of multi-step attacks, by leveraging the performance of different detection techniques. The architecture relies on a total of five major methods, including process mining, elliptic envelope, one class support vector machine, local outlier factor and isolation forest. We describe the main components of this architecture and their interactions, from the data preprocessing to the generation of alerts, through the calculation of scores. The different detection methods are executed in parallel, and their results are combined by an ensemble learning strategy in order to improve the overall detection performance. We develop a proof-of-concept prototype and perform a large set of experiments to quantify the benefits and limits of this approach based on industrial datasets.

International audience; Internet-of-Things (IoT) devices or more generally embedded devices are nowadays commonly deployed in public, personal or work spaces despite suffering from security issues often related to their bad design and/or configuration. For instance, IoT botnets such as Mirai successfully compromised thousands of devices using a bruteforce method on a set of known credentials. Although brute-force attacks against a particular service (e.g. SSH, telnet) generate many packets which can be easily detected and mitigated, attackers can easily rely on TCP scans to assess the services present on a device while maintaining a high level of stealthiness. In this paper, we present a method to reconstruct precise information about an IoT device configuration (brand name, usernames, passwords, software components) from partial knowledge such as open ports revealed by a TCP scan. It relies on constituting a knowledge base from a large dataset of publicly accessible firmware serving as training multiple Random Forest (RF) classifiers. Using a dataset of 6935 embedded devices, the HTTP, SSH or DNS software names can be predicted with a precision higher than 80% with a limited knowledge. The correct HTTP, SSH or DNS versions can be inferred in more than 95% of cases after 1.4 trials on average. Similarly, our technique also predicts the password of at least one valid user in more than 97% of the cases after 1.15 trials on average.

International audience; With the recent technological evolutions in networks and increased deployment of multi-tier clouds, cloud gaming (CG) is gaining renewed interest and is expected to become a major Internet service in the upcoming years. Many companies have launched powerful platforms such as Google Stadia, Nvidia GeForce Now, Microsoft xCloud, Sony PlayStation Now among others, to attract players. However, for all end-users to fully enjoy their gaming sessions over the wide range of network access qualities, CG platforms must adapt their traffic. In this paper, we present the outcome of real-life measurements performed between April and July 2021 on the four aforementioned CG platforms, configuring different network constraints like packet loss, throughput decrease, latency increase and jitter variation to observe the behavior of these CG platforms under extreme network conditions. Our findings show that the four platforms exhibit different adaptation behaviors. Moreover, many cases result in a degraded QoS, leaving room for further improvements at both application and/or network levels.

International audience

International audience; Connected devices, such as smartphones and tablets, are exposed to a large variety of attacks. Their protection is often challenged by their resource constraints in terms of CPU, memory and energy. Security chains, composed of security functions such as firewalls, intrusion detection systems and data leakage prevention mechanisms, offer new perspectives to protect these devices using software-defined networking and network function virtualization. However, the complexity and dynamics of these chains require new automation techniques to orchestrate them. This chapter describes an automated orchestration methodology for security chains in order to secure connected devices and their applications. This methodology exploits process learning to establish behavioral models and infer security constraints represented as logical predicates. It then generates and merges a set of chains of security functions on the basis of these predicates. These chains are finally compiled into low-level configuration rules and deployed into the network, optimizing for the underlying topology. The benefits and limits of such a methodology combining machine learning and verification techniques are evaluated by a set of experimental results.

International audience; Nowadays, many research studies and industrial investigations have allowed the integration of the Internet of Things (IoT) in current and future networking applications by deploying a diversity of wireless-enabled devices ranging from smartphones, wearables, to sensors, drones, and connected vehicles. The growing number of IoT devices, the increasing complexity of IoT systems, and the large volume of generated data have made the monitoring and management of these networks extremely difficult. Numerous research papers have applied Reinforcement Learning (RL) and Deep Reinforcement Learning (DRL) techniques to overcome these difficulties by building IoT systems with effective and dynamic decision-making mechanisms, dealing with incomplete information related to their environments. The paper first reviews pre-existing surveys covering the application of RL and DRL techniques in IoT communication technologies and networking. The paper then analyzes the research papers that apply these techniques in wireless IoT to resolve issues related to routing, scheduling, resource allocation, dynamic spectrum access, energy, mobility, and caching. Finally, a discussion of the proposed approaches and their limits is followed by the identification of open issues to establish grounds for future research directions proposal.

International audience; A co-simulation applied to Smart Grids consists of grouping in the same setting models of physical components (among other electrical ones) and models of control units (including communication devices). Combining these models needs to use a generic and robust co-simulation environment instead of developing a specific one. In this context, we developed the DACCOSIM 2017 co-simulation platform based on FMI-CS (Functional Mock-up Interface for CoSimulation) standard to simulate the physical components of a Smart Grid. These components represent the most CPU-consuming part of the co-simulation. However, the tasks of FMI-CS-based applications (FMUs) are exposed as heterogeneous gray boxes with no information concerning their computation and communication volumes. Moreover, all these FMUs frequently communicate with each other by sending a lot of small messages. Consequently, the deployment of an FMI-CS based co-simulation on a distributed architecture is a complex task carried out by DACCOSIM 2017. This paper introduces the development of DACCOSIM-2017, and its experiment on distributed architectures.

Cybersecurity is a vital part of digital economies and digital governing but the discipline is suffering from a pronounced skills shortage. Nevertheless, the reasons for the inability of academia to produce enough graduates with the skills that reflect the needs of the cybersecurity industry are not well understood. In this article, we have analysed the skills shortages, gaps, and mismatches affecting cybersecurity education. We performed a Political, Economic, Social, Technological, Legal, and Environmental (PESTLE) analysis, that allowed us to have an overview of the cybersecurity education environment from multiple perspectives. The results of this analysis highlight 31 different factors affecting cybersecurity education on a European level. These factors were further analysed from the specific perspectives of 11 European countries. In this further analysis, particular attention was given to the linkages between the identified factors. This helped to reveal which factors are connected and to describe how they are mutually dependent. A statistical approach was used to depict the results in a more general and comprehensive way and facilitated the development of our conclusions. Our analysis identifies a lack of European coordination and cooperation towards a common cybersecurity framework as one of the main factors affecting cybersecurity education.

National audience; This report is the synthesis of our work carried out within the INRIA research laboratory. The main objective of this project is to automate the mapping of the vulnerability database of MITRE CVE to the MITRE ATT&CK framework which is a set of knowledge base of tactics and techniques used incomputer attacks. We implemented in this project an approach which is based on machine learning, as well as Natural Language Processing(NLP) to be able to process the textual data of the vulnerabilities and thus classify them through a classification algorithm. We also detailed the techniques used such as the pre-processing and post-processing methods implemented in order to improve the datasets quality and to therefore improve the prediction performance.; Ce rapport est le synthèse de notre travail réalisé au sein du Laboratoire de recherche INRIA. L’objectif principal de ce projet est d’automtiser le mapping de la base de données de vulnerabilités de MITRE CVE vers le framework MITRE ATT&CK qui est un ensemble de base de connaissances des tactiques et techniques utilisées dans les attaques informatique. Nous avons implémenté dans ce projet une approche qui sera basée sur l’apprentissage automatique ainsi que les techniques de traitement automatique de langues (NLP) pour pouvoir traiter les données textuelles des vulnerabilités et les classifier a travers un algorithme de classification. Nous avons également détaillé la méthodologie utilisée ainsi que lestraitements appliqués afin d’analyser les jeux de données et améliorer la prédiction.

International audience

International audience; Cybersecurity experiments that involve private data or malware samples require controlled environments and an appropriate facility to collect and characterise them, or understand their operations without compromising the security of these data and the hosting institution. Using such facilities allows the researchers to carry reproducible and long term research activities in a safe environment, without worrying about side effects or loss of data. In this paper, we detail the design of a cybersecurity facility to carry such experiments, including malware collection and analysis, network telescopes and honeypots, or hosting critical services. The facility, aka High Security Lab (HSL), is running since 2010, and is widely used by multiple research groups to carry sensitive data cybersecurity experiments. It includes an evolving infrastructure with tools and processes for building and running long-term and reproducible cyber security experiments. We report on our experience and lessons learned from the design, the setup and the evolution of this facility during 10 years while focusing on major cybersecurity experiments that have been conducted by researchers.

International audience; Cloud infrastructures provide new facilities (elasticity, load balancing, easy integration) to build and maintain elaborated services built from multiple resources in a flexible manner. The changes that continuously affect these services, in particular the migration of resources amongst such cloud infrastructures, induce configuration changes. These latter may generate new vulnerabilities that can compromise the confidentiality, integrity and availability of services. Our approach aims at automating the security enhancement of cloud composite services during the migration of their elementary resources. In that context, it first relies on investigating to what extent orchestration languages can be extended to support such automation. It then requires the design of a framework enabling security automation, in order to adapt and complement the configuration of these elementary resources. This includes specifying dedicated algorithms for selecting adequate security mechanisms before, during and after the migration of one or several resources composing an elaborated service. Finally, it should exploit the complementary of endogenous and exogenous mechanisms for supporting such security enhancement.

International audience; Current generation of switches are highly programmable and able to support stateful. However, these switches cannot perform floating point operations. As a result several network applications have to be run on external servers or middleboxes in the network. We introduce InREC, a system that extends the capabilities of programmable switches to support in-network real-valued operations using the IEEE half-precision floating point representation. Our demo on a Barefoot Tofino switches demonstrates the efficiency of InREC for in-network computation by computing a logistic regression function to classify devices (IoT and laptop) in a simulated home environment.

International audience; Current generation of Reconfigurable Match-Action Tables switches are highly programmable, able to support stateful operations and pipeline specifications using languages like P4. Nevertheless, these switches do not offer primitives to support real-valued operations on the data plane, thus requiring support from external servers or middleboxes to perform advanced operations. We introduce InREC, a system that extends the capabilities of programmable switches to support in-network real-valued operations using the IEEE half-precision floating point representation. It relies on decomposing real-valued functions into lookup tables taking into account the RMT model constraints to reach the right trade-off between accuracy and resource usage. InREC prototype on Barefoot Tofino switches demonstrates the efficiency of InREC for in-network computation of different types of operations and its application for in-network logistic regression models used for classification problems. Our evaluation of InREC shows that it is possible to implement complex in-network applications with high accuracy and low latency.

International audience

International audience; In-band Network Telemetry (INT) has recently emerged as a means of achieving per-packet near real-time visibility into the network. INT capable network devices can directly embed device internal state such as packet processing time, queue occupancy and link utilization information in each passing packet. INT is enabling new network monitoring applications and is currently being used in production for providing fine-grained feedback to congestion control mechanisms. The microscopic network visibility facilitated by INT comes at the expense of increased data plane overhead. INT piggybacks telemetry information on user data traffic and can significantly increase packet size. A direct consequence of increasing packet size for carrying telemetry data is a substantial drop in network goodput. This paper aims at striking a balance between reducing INT data plane overhead and the accuracy of network view constructed from telemetry data. To this end, we propose LINT, an accuracy-adaptive and Lightweight INT mechanism that can be implemented on commodity programmable devices. Our evaluation of LINT using real network traces on a fat tree topology demonstrates that LINT can reduce INT data plane overhead by ≈25% while ensuring more than 0.9 recall for monitoring queries trying to identify congested flows and switches in the network.

International audience; The Bitcoin blockchain is managed by an underlying peer-to-peer network. This network is responsible for the propagation of transactions carried out by users via the blocks (which contain the validated transactions), and to ensure consensus between the different nodes. The quality and safety of this network are therefore particularly essential. In this work, we present an open dataset on the peers composing the Bitcoin P2P Network that was made following a well defined and reproducible methodology. We also provide a first analysis of the dataset on three criteria: the number of public nodes and their client version and geographical distribution.

Modern low-voltage microgrid systems rely on distributed and cooperative control approaches to guarantee safe and reliable operational decisions of their inverter-based distributed generators (DGs). However, many sophisticated cyber-attacks can target these systems, deceive their traditional detection methods and cause a severe impact on the power infrastructure. In this thesis, we systematically study the vulnerabilities and threats of distributed controlled microgrid systems. We design a novel attack named "measurement-as-reference" (MaR) attack and take it as a typical stealthy attack example to theoretically analyze the attack impact on the microgrid system and use numerical simulation results to verify the analysis. We provide mathematical models of possible false data injection (FDI) and denial of service (DoS) attacks in a representative distributed and cooperative controlled microgrid system. We propose a secure control framework with an attack detection module based on machine learning techniques. To validate the effectiveness of this framework, we implement two typical attacks, MaR attack and delay injection attack, on a hardware platform modeled after a microgrid system. We collect datasets from the platform and validate the performance of multiple categories of machine learning algorithms to detect such attacks. Our results show that tree-based classifiers (Decision Tree, Random Forest and AdaBoost) outperform other algorithms and achieve excellent performance in detecting normal behavior, delay injection and false data attacks.; Les micro-réseaux électriques s'appuient sur des approches de contrôle distribuées et coopératives pour garantir des décisions opérationnelles sûres et fiables de leurs générateurs distribués (DG). Cependant, de nombreuses cyber-attaques sophistiquées peuvent viser ces systèmes, tromper leurs méthodes de détection traditionnelles et avoir des conséquences importantes sur l'infrastructure électrique. Dans cette thèse, nous étudions les attaques ciblant les systèmes de contrôle associés à ces micro-réseaux. Nous avons développé dans un premier temps une nouvelle attaque nommée MaR (Measurement as Reference) qui cible les consignes de synchronisation échangées entre les entités du système de contrôle. Nous avons analysé par simulation numérique l'impact de cette attaque sur la stabilité du micro-réseau et la convergence du système de contrôle vers une consigne commune. Nous avons également développé des modèles d'analyse des attaques de type injection de fausses données et déni de service sur ces systèmes pour étudier leurs impacts et leur détection. Ensuite, nous avons proposé un framework qui permet de détecter ces attaques, en se basant sur l'apprentissage automatique des caractéristiques des paquets réseau échangés entres les entités d'un système de contrôle distribué. Nous avons mis en œuvre une plate-forme expérimentale représentative d'un micro-réseau électrique et son système de contrôle pour collecter des jeux de données et valider notre framework, en particulier son module de détection des attaques.Enfin, nous avons évalué les performances de différents algorithmes d'apprentissage automatique pour détecter les attaques que nous avons introduites sur la plate-forme expérimentale. Nos résultats montrent que les algorithmes basés sur les techniques d'arbres, à l'image des arbres de décision, les forêts aléatoire et AdaBoost offrent les meilleures performances en termes de précision et de justesse pour détecter les différentes attaques et les distinguer.

International audience; Internet of Things (IoT) is increasingly deployed in different domains and environments including smart homes, smart cities, healthcare, industry 4.0, and smart agriculture, by connecting a large number of physical objects to deliver a new class of applications. The rising number of these connected objects and their heterogeneity have raised new research directions and challenges regarding their communications, scalability and the large amount of data that generate. As a result, new communication technologies have been proposed to be applied in these environments and applications, mainly to consider their main inherent properties which are the information that generate and handle, and the content that disseminate. Among the adopted techniques and recently integrated into the IoT is the ICN (Information Centric Networking) paradigm. The choice of integration of ICN in the context of IoT is mainly motivated by all the advantages it represents, in particular content caching and decoupling senders and receivers. In this paper, we provide a detailed analysis of the motivations behind using ICN in IoT environments and a survey of existing research work that have already applied ICN as a communication support for IoT applications.

International audience; This paper proposes a new approach for detecting and mitigating the impact of misbehaving TCP end-hosts, specifically the Optimistic ACK attack, and Explicit Congestion Notification (ECN) abuse. In contrast to the state-of-the-art, we show that it is possible to mitigate such misbehavior leveraging emerging programmable data planes while not requiring any end-host or protocol modifications. A key challenge in doing so is to implement expressive, complex and stateful functions in the data plane within its restricted programming model. In this regard, we propose a security monitoring function that uses Extended Finite State Machine (EFSM) abstraction for monitoring stateful protocols in the data plane. We also design a mechanism for mapping a protocol's EFSM to programmable data plane primitives. Our evaluation results demonstrate that our approach can fully or partially restore the throughput loss caused by misbehaving end-hosts that manipulate TCP congestion control through misinformation.

International audience; Today’s emerging needs (Internet of Things applications, Network Function Virtualization services, Mobile Edge computing, etc.) are challenging the classic approach of deploying a few large data centers to provide cloud services. A massively distributed Cloud-Edge architecture could better fit these new trends’ requirements and constraints by deploying on-demand infrastructure services in Point-of-Presences within backbone networks. In this context, a key feature is establishing connectivity among several resource managers in charge of operating, each one a subset of the infrastructure. After explaining the networking management challenges related to distributed Cloud-Edge infrastructures, this article surveys and analyzes the characteristics and limitations of existing technologies in the Software Defined Network field that could be used to provide the intersite connectivity feature. We also introduce Kubernetes, the new de facto container orchestrator platform, and analyze its use in the proposed context. This survey is concluded by providing a discussion about some research directions in the field of SDN applied to distributed Cloud-Edge infrastructures’ management.

International audience; The growth of embedded devices like IoT or networking devices makes them major targets for attackers in the Internet. They are known to face security issues because of their bad design and/or configuration. In this paper, we propose a systematic method to evaluate the security of an embedded device. It relies on a firmware analysis to extract relevant information about its software composition. Based on our large IoT database, our work aims at providing a global and long-term (10 years) analysis of the security by design of firmwares and of the awareness and versatility of vendors in regards to security issues.

International audience; The Bitcoin peer-to-peer network ensures the consensus between the different nodes responsible for the propagation of the blocks containing the validated bitcoin transactions. The quality and safety of this network are therefore particularly essential. In this work, we present a study of the public nodes that form the backbone of the Bitcoin p2p network. We analyze the results of our measurement campaign that was made following a well-defined and reproducible methodology. In particular we analyze several criteria that can affect the network resilience: distribution and security assessment of the clients' versions, churn, detection of Sybil nodes, dynamicity and popularity of peers. We also investigate the countermeasures deployed to prevent an accurate inference of the network topology and show their effectiveness.