<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>[Apologies for multiple postings] </p>
<p>A postdoctoral position is now open at Inria Nancy Grand Est,
France on Data analytics for cybersecurity:</p>
<p><a href="http://bit.ly/2lSdM89">http://bit.ly/2lSdM89</a></p>
<p><span style="text-decoration: underline;">- <strong>Contacts:</strong></span></p>
<p>Jérôme François (<a href="mailto:jerome.francois@inria.fr">jerome.francois@inria.fr</a>),
Isabelle Chrisment (<a href="mailto:isabelle.chrisment@inria.fr">isabelle.chrisment@inria.fr</a>)</p>
<p><span style="text-decoration: underline;">- <strong>Scientific
Context :</strong></span></p>
<p>The huge growth of Internet exposes many users to various
threats. This has been intensified by the large deployment of new
devices in addition to traditional computers. This includes
smartphones and sensors, and will concern daily life objects in a
near future with the emergence of the Internet of Things (IoT) the
last years. Hence, this represents a tremendous playground for
attackers. To fight them, network security is essential to
identify misbehaviors and potential victims as earlier as
possible.</p>
<p>Since attackers evolve from individuals towards organized
cyber-criminal organizations while meantime the attacks being more
distributed and complex. For example, the botnets [2] are still a
major threat on Internet, where thousands of zombie machines can
take part, because they have been successfully adapted from a
centralized model based on IRC towards distributed approach, even
P2P, taking advantage of traditional protocol (DNS for fast
fluxing) and new technologies (social networks for
synchronization). In parallel, they are responsible of various
attacks including spam, denial of service, credential stealing...
Therefore fighting such a threat among others require to collect,
analyze and correlate various sources of data to create summarized
view that are exploitable by human administrator and, if possible,
in real time and in an automated way. This is the current
challenge of the network security monitoring [6]. Currently, most
of attacks remains unrevealed, but when they are suspected, it is
vital to investigate it to confirm, to trace the root causes and
attackers. The forensics security teams have very few tools which
let them performing analysis mainly manual which introduces two
bias: long delay (from few hours to several months) and human bias
due to background and experiences.</p>
<p>In parallel, data-analytics methods have skyrocketed recently and
are able to cope with huge volumes of unstructured data and so are
good candidates for being adapted and applied to security
monitoring challenges by allowing collecting and analyzing
multiple sources of relevant data while current approaches focuses
on few ones or on simple correlation of several ones.<br>
</p>
<p><span style="text-decoration: underline;"><strong>- Missions :</strong></span></p>
<p>The objective of the post-doctorate is to contribute to
investigation of complex attacks by modeling acquired data and
leveraging artificial intelligence techniques. To achieve that, it
will be necessary :</p>
<ul>
<li>analyze current threats to define data and features being
primordial for an efficient monitoring. This will allow then to
design data models which are able to handle heterogeneous and
multi-dimensionnal data.</li>
<li>define methods based on data-analytics to identify anomalies
based on these data models. This will consider statistical
analysis, stochastic modeling (such as Hidden Markov Models)
graph analysis and machine learning approaches (Topological Data
Analysis, topic modeling). Some of these methods are already
prototype and will require further development</li>
<li>define methods for interactive and visual investigation of
multiple sources of security data. This will consider similar
methods that those under the second item but with a hard
constraint on the reactivity and the limited quantity of
information which can be dealt simultaneously by a human. Hence,
these methods may rely on streaming analytics approaches,
learning approaches to predict the next requests of the analysts
to prepare the results, combining and selecting information.</li>
<li>validate the proposed methods on different scenarios</li>
</ul>
<p>In addition to these scientific tasks, the role of post-doctorate
is also to implement proof-of-concepts of those define methods and
interact with and report to other partners in the project to
ensure a proper integration in a global platform (common at all
partners in the projects)</p>
<p>This work will be achieved in the context of the first French
high security academic research laboratory in Nancy (LHS – High
Security Laboratory) which provides powerful tools and support for
collecting and analyzing dataset in a realistic environment and in
the context of the HuMa project funded under the FUI programme
(Fond Unique Interministériel) with major French industrial
players in cyber-security.</p>
<br>
<p> </p>
</body>
</html>