pr\u00e9sentent<\/p>\n\n\n\n
Autoris\u00e9e \u00e0 pr\u00e9senter ses travaux en vue de l\u2019obtention du Doctorat de l’Institut Polytechnique de Paris, pr\u00e9par\u00e9 \u00e0 T\u00e9l\u00e9com SudParis en :<\/p>\n\n\n\n
le MARDI 16 D\u00e9CEMBRE 2025 \u00e0 9h30<\/p>\n\n\n\n
\u00e0<\/p>\n\n\n\n
Salle 1C27
19 Place Marguerite Perey, 91120 Palaiseau<\/p>\n\n\n\n
Membres du jury :<\/strong><\/p>\n\n\n\n M. Herv\u00e9 DEBAR<\/strong>, Professeur, T\u00e9l\u00e9com SudParis, FRANCE – Directeur de th\u00e8se Invit\u00e9s :<\/strong><\/p>\n\n\n\n M. Gregory BLANC<\/strong>, Ma\u00eetre de conf\u00e9rences, T\u00e9l\u00e9com SudParis, FRANCE – Co-encadrant de th\u00e8se R\u00e9sum\u00e9 :<\/strong><\/p>\n\n\n\n Les r\u00e9seaux de cinqui\u00e8me g\u00e9n\u00e9ration (5G) repr\u00e9sentent une avanc\u00e9e importante dans les communications mobiles, offrant des performances am\u00e9lior\u00e9es (par exemple des d\u00e9bits plus \u00e9lev\u00e9s et une latence ultra-faible) et permettant \u00e0 des services vari\u00e9s, allant des applications m\u00e9dicales en temps r\u00e9el aux r\u00e9seaux IoT, de coexister sur une m\u00eame infrastructure gr\u00e2ce \u00e0 des technologies telles que le slicing et la virtualisation.Cette flexibilit\u00e9 s\u2019accompagne de d\u00e9fis importants pour les syst\u00e8mes de d\u00e9tection d\u2019intrusion (IDS), notamment l\u2019h\u00e9t\u00e9rog\u00e9n\u00e9it\u00e9 des donn\u00e9es, les volumes massifs de trafic, les contraintes de confidentialit\u00e9, ainsi que l\u2019\u00e9mergence de nouveaux vecteurs d\u2019attaque susceptibles d\u2019appara\u00eetre d\u2019abord dans certains domaines avant de se propager ailleurs. La collaboration entre participants du r\u00e9seau est essentielle pour construire des mod\u00e8les de d\u00e9tection disposant d\u2019une connaissance plus large des attaques, mais les contraintes r\u00e9glementaires et les exigences de confidentialit\u00e9 emp\u00eachent le partage direct de donn\u00e9es sensibles. L\u2019apprentissage f\u00e9d\u00e9r\u00e9(AF), qui \u00e9change des mises \u00e0 jour de mod\u00e8les plut\u00f4t que des donn\u00e9es brutes, constitue donc un candidat naturel. Cependant, les approches standard telles que FedAvg fonctionnent mal face \u00e0 l\u2019h\u00e9t\u00e9rog\u00e9n\u00e9it\u00e9 marqu\u00e9e des donn\u00e9es dans les environnements 5G, o\u00f9 les classes d\u2019attaque sont distribu\u00e9es de mani\u00e8re in\u00e9gale entre les participants, et o\u00f9 un nombre significatif de clients ne rencontre que tr\u00e8s peu ou pas du tout certains types d\u2019attaques. Cette th\u00e8se aborde ces limitations en trois \u00e9tapes. Premi\u00e8rement, elle propose une analyse d\u00e9taill\u00e9e des IDS et des IDS utilisant l\u2019AF dans le contexte 5G, en identifiant comment les propri\u00e9t\u00e9s sp\u00e9cifiques de la 5G se traduisent en exigences de conception et en mettant en \u00e9vidence les limites des solutions actuelles en mati\u00e8re d\u2019h\u00e9t\u00e9rog\u00e9n\u00e9it\u00e9, de confidentialit\u00e9 et de robustesse. Deuxi\u00e8mement, elle introduit PROTEAN, un cadre f\u00e9d\u00e9r\u00e9 de d\u00e9tection d\u2019intrusion qui agr\u00e8ge conjointement les param\u00e8tres du mod\u00e8le et des prototypes sp\u00e9cifiques aux classes (des moyennes d\u2019embeddings r\u00e9sumant les comportements d\u2019attaque) via un m\u00e9canisme de double agr\u00e9gation alignant les prototypes et le classifieur global entre participants, ce qui permet la reconnaissance de menaces rares ou jamais observ\u00e9es, sans partager le trafic. Troisi\u00e8mement, elle \u00e9value la confidentialit\u00e9 et la robustesse de ce cadre en menant des attaques de reconstruction exploitant les prototypes partag\u00e9s, en renfor\u00e7ant PROTEAN par de la confidentialit\u00e9 diff\u00e9rentielle, et en exploitant les informations par classe pour concevoir notre algorithme LabelDec pour la d\u00e9tection des attaques par empoisonnement . Cette m\u00e9thode est fond\u00e9e sur les prototypes permettant de d\u00e9tecter les attaques de changement de label et les erreurs de labellisation au niveau des clients et des classes, surpassant les m\u00e9thodes existantes reposant uniquement sur les param\u00e8tres ou performances du mod\u00e8le. Les \u00e9valuations men\u00e9es sur deux ensembles de donn\u00e9es, X-IIoTID et 5G-NIDD, dans des conditions d\u2019h\u00e9t\u00e9rog\u00e9n\u00e9it\u00e9 \u00e9lev\u00e9es, montrent que PROTEAN am\u00e9liore les performances de d\u00e9tection et acc\u00e9l\u00e8re la convergence par rapport aux autres m\u00e9thodes AF de r\u00e9f\u00e9rence, tout en pr\u00e9servant la confidentialit\u00e9 et maintenant une robustesse effective face aux attaques par empoisonnement. Dans l\u2019ensemble, ces contributions font progresser la d\u00e9tection d\u2019intrusion collaborative pour les r\u00e9seaux 5G en d\u00e9montrant que le partage de connaissances fond\u00e9 sur les prototypes peut simultan\u00e9ment traiter les d\u00e9fis li\u00e9s \u00e0 l\u2019h\u00e9t\u00e9rog\u00e9n\u00e9it\u00e9 et \u00e0 la robustesse dans des contextes multipartites, tout en am\u00e9liorant la compr\u00e9hension des attaques absentes des donn\u00e9es locales et en respectant la confidentialit\u00e9. Nous esp\u00e9rons que ces r\u00e9sultats encourageront de futurs travaux sur l\u2019apprentissage par prototypes comme base pour un partage de connaissances sur les menaces de mani\u00e8re pr\u00e9servant la confidentialit\u00e9, robuste et interpr\u00e9table dans les syst\u00e8mes distribu\u00e9s.<\/p>\n\n\n\n Fifth-generation (5G) networks represent a transformative advancement in mobile communications, offering enhanced performance (e.g., higher data rates, ultra-low latency) and enabling diverse services, from real-time medical applications to IoT networks, to coexist on a single infrastructure through technologies such as network slicing and virtualization. This flexibility comes with major challenges for Intrusion Detection Systems (IDSs), including data heterogeneity, massive data volumes, privacy constraints, and the emergence of new attack vectors that may first appear in some domains before propagating to others. Collaboration among network participants is essential to building comprehensive detection models with broad attack knowledge, but privacy concerns and regulatory constraints prevent the sharing of sensitive traffic data. Federated Learning (FL), which exchanges model updates instead of raw data, is a natural candidate. Yet, standard FL approaches such as FedAvg perform poorly under the extreme data heterogeneity in this context, where attack classes are not equally distributed, and many clients either rarely observe certain attacks or never encounter them at all. This thesis tackles these limitations in three steps. First, it offers a detailed analysis of IDSs and FL-based IDSs proposed for 5G, identifying how 5G-specific properties translate into design requirements, and where current solutions fall short in terms of heterogeneity handling and robustness. Second, it introduces PROTEAN, a federated intrusion detection framework that jointly aggregates model parameters and class-specific prototypes (average of embeddings by class summarizing the attack behaviour) through a dual aggregation mechanism that aligns the prototypes and global classifier across participants, enabling the recognition of rare and previously unseen threats without sharing raw traffic. Third, it audits the privacy and robustness of this framework by mounting reconstruction attacks using shared prototypes, reinforcing PROTEAN with differential privacy, and exploiting its class-level information to design LabelDec, our poisoning detection algorithm. This novel prototype-based method detects label-flipping poisoning and mislabeling errors at the client and class level and outperforms existing methods relying solely on model parameters or performance. Evaluations on two datasets, X-IIoTID and 5G-NIDD, under severe heterogeneity show that PROTEAN improves detection performance and convergence behaviour over state-of-the-art FL baselines while preserving privacy and showing robustness against poisoning attacks. Together, these contributions advance collaborative intrusion detection for 5G networks by demonstrating that prototype-based knowledge sharing can simultaneously address heterogeneity and robustness in multi-party settings while enhancing unseen attack understanding and respecting privacy. We expect that these results will encourage further work on prototype learning as a foundation for privacy-preserving, robust, and interpretable threat-knowledge sharing in distributed systems.<\/p>\n","protected":false},"excerpt":{"rendered":" L’Ecole doctorale : Ecole Doctorale de l’Institut Polytechnique de Paris et le Laboratoire de recherche SAMOVAR – Services r\u00e9partis, Architectures, Mod\u00e9lisation, Validation, Administration des R\u00e9seaux pr\u00e9sentent l\u2019AVIS DE SOUTENANCE de Madame Sara CHENNOUFI Autoris\u00e9e \u00e0 pr\u00e9senter ses travaux en vue de l\u2019obtention du Doctorat de l’Institut Polytechnique de Paris, pr\u00e9par\u00e9 \u00e0 T\u00e9l\u00e9com SudParis en : […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[286,603],"tags":[],"class_list":["post-7017","post","type-post","status-publish","format-standard","hentry","category-fractualites-ennews-fr","category-seminaire-scn","entry"],"_links":{"self":[{"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/posts\/7017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/comments?post=7017"}],"version-history":[{"count":1,"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/posts\/7017\/revisions"}],"predecessor-version":[{"id":7018,"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/posts\/7017\/revisions\/7018"}],"wp:attachment":[{"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/media?parent=7017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/categories?post=7017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/samovar.telecom-sudparis.eu\/index.php\/wp-json\/wp\/v2\/tags?post=7017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
M. Gilles GUETTE<\/strong>, Professeur, IMT Atlantique (IRISA), FRANCE – Rapporteur
M. Philippe OWEZARSKI<\/strong>, Directeur de recherche, CNRS (LAAS), FRANCE – Examinateur
M. Abdelkader LAHMADI<\/strong>, Professeur, Universit\u00e9 de Lorraine (LORIA), FRANCE – Rapporteur
Mme Nga NGUYEN<\/strong>, Ma\u00eetresse de conf\u00e9rences, ESILV (DVRC), FRANCE – Examinateur
M. Christophe KIENNERT<\/strong>, Ma\u00eetre de conf\u00e9rences, T\u00e9l\u00e9com SudParis, FRANCE – Co-encadrant de th\u00e8se<\/p>\n\n\n\n
M. Yufei HAN<\/strong>, Charg\u00e9 de recherche, Inria, FRANCE<\/p>\n\n\n\n\u00ab Partage de connaissances sur les attaques de mani\u00e8re robuste et pr\u00e9servant la confidentialit\u00e9 dans des r\u00e9seaux 5G h\u00e9t\u00e9rog\u00e8nes gr\u00e2ce \u00e0 une d\u00e9tection d\u2019intrusion bas\u00e9e sur l’apprentissage f\u00e9d\u00e9r\u00e9 par prototype \u00bb<\/h2>\n\n\n\n
pr\u00e9sent\u00e9 par Madame Sara CHENNOUFI<\/h2>\n\n\n\n
Abstract :<\/strong><\/p>\n\n\n\n