Research Engineer F/m On Ai-driven Network Intrusion Detection for Clouds

Le descriptif de l’offre ci-dessous est en Anglais_

**Type de contrat**: CDD

**Niveau de diplôme exigé**: Bac + 5 ou équivalent

**Fonction**: Ingénieur scientifique contractuel

**Niveau d'expérience souhaité**: Jeune diplômé

**A propos du centre ou de la direction fonctionnelle**:
The Inria Centre at Rennes University is one of Inria's eight centres and has more than thirty research teams. The Inria Centre is a major and recognized player in the field of digital sciences. It is at the heart of a rich R&D and innovation ecosystem: highly innovative PMEs, large industrial groups, competitiveness clusters, research and higher education players, laboratories of excellence, technological research institute, etc.

**Contexte et atouts du poste**:
Previous practices of Machine Learning (ML)-driven intrusion detection systems (IDS) suffer from two bottlenecks. First of all, the attack behaviors evolve persistently. New attack techniques / campaigns emerge and may change drastically the malicious payloads that recorded in the data, e.g., system logs or network traffics. Such change over malicious behaviors can lead to failure of Machine Learning-driven intrusion detection. Second, beyond evaluating the detection accuracy, it is interesting to understand the decision logics learned by the intrusion detection model. Current practices of ML-based intrusion detection methods depend heavily on black-box prediction models. It is therefore difficult to the owner of IDS to assess and identify potential bias in the detection output.

Therefore, the goal of this research engineer position is to collaborate with our research team to develop and integrate fast and adaptive ML methods that can detect and update the model to cope with the variation of attack behaviors. This position will be hosted at Rennes and may be required to travel to work with the AI and security team of Scality in Paris regularly. Travel expenses will be covered within the limits of the scale in force.

**Mission confiée**:
**Assignments**:
In a further step, we will also focus on providing interpretable intrusion detection algorithms. The expected ML-driven intrusion detection model should automatically discover malicious payload signatures and attack behaviors from network traffic data. These ML-generated signatures can help understand the process of stealth attacks, such as APT attacks, and make the decision of ML-based detection models more reliable compared to black box ML models. In this respect, we plan to explore if the popular examplanable methods, e.g. Shapley value [4] or LIME [5] could be applied to interpret the detection logics and highlight the important attributes of cyber attack behaviours.

[2] Chelsea Finn, Pieter Abbeel, Sergey Levine (2017). “Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks” arXiv:1703.03400

[3] Jeeyung Kim, Alex Sim, Jinoh Kim, Kesheng Wu, and Jaegyoon Hahm. 2020. Transfer Learning Approach for Botnet Detection Based on Recurrent Variational Autoencoder. In Proceedings of the 3rd International Workshop on Systems and Network Telemetry and Analytics (SNTA '20).

**Responsibilities**:
**Principales activités**:
Main activities:

- Co-development (with the post-doc and permanent researchers in the PIRAT team) of extensible ML methods to deliver fast adaption of intrusion detection use across different attack behaviours, as well as across different data sources. In this study, we especially focus on network traffic flow-based intrusion detection.
- Preprocessing and measurement study of the proposed methods using publica datasets and network flows collected by the team members
- Preparing technical documents of developped ML-based network intrusion detection algorithms.

**Compétences**:
Technical skills and level required:

- Basic knowledge in intrusion detection systems. Previous experiences with network flow-based intrusion detection systems will be favored.
- Knowledge in Machine Learning.
- Proficient in programming in python. Experience with programming using pytorch and GPU platform will be preferred.

Relational skills
- Good communications skills
- Reasonable presentations skills

Working Language : English (will be preferred)

**Avantages**:

- Subsidized meals
- Partial reimbursement of public transport costs
- Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.)
- Possibility of teleworking (after 6 months of employment) and flexible organization of working hours
- Professional equipment available (videoconferencing, loan of computer equipment, etc.)
- Social, cultural and sports events and activities
- Access to vocational training
- Social security coverage

**Informations générales**:

- **Thème/Domaine**: Sécurité et confidentialité
Système & réseaux (BAP E)
- **Ville**: Rennes
- **Centre Inria**: Centre Inria de l'Université de Rennes
- **Date de prise de fonction s