Detection of Intrusions and Abnormal Behavior in Cybersecurity

Overview

In response to the constantly evolving threat landscape, the “Cybersecurity Intrusion and Abnormal Behavior Detection” workstream explores dynamic, multi-level strategies to detect advanced persistent threats (APTs) and suspicious behaviors.

It relies on machine learning techniques capable of continuously analyzing heterogeneous data streams, with the aim of enhancing the responsiveness of cybersecurity systems while reducing false positives.

Research Axis Leads

Frédéric Legac

Deputy Head of Group Cyber SOC & Head of Data and Innovation

Frédéric Legac has been working in the IT industry for 25 years, combining technical expertise with strategic leadership. As a systems and networks engineer, he initially led development, integration, and critical incident management projects for major clients. In 2004, he joined BNP Paribas CIB, where he oversaw the large-scale deployment of Java and middleware technologies (BEA/Oracle), as well as caching, grid computing, and messaging solutions. Promoted in 2011, he became an international manager overseeing 50–60 employees (in Madrid, London, Mumbai, and Paris) and an infrastructure architect. In 2013, he co-launched a private cloud with a marketplace and data-centric services, then held positions as Product Manager and Director, creating marketing offerings and analytical tools. In 2019, he led the Data & Innovation team at CyberSOC, became deputy manager in 2020, and continues to accelerate data and AI projects to secure the group’s digital assets.

Rida Khatoun

Professor at Télécom Paris

Rida Khatoun earned a Master’s degree in computer engineering and a Ph.D. from the University of Technology of Troyes (UTT) in 2004 and 2008, respectively. He is currently a Professor at Télécom Paris. His research focuses on cloud computing security, Internet of Things security, vehicular network security, security architecture, intrusion detection systems, and blockchain technology.