Pierre Parrend on Pierre Parrend — Cyber and AI

Contact

Fri, 14 Aug 2026 00:00:00 +0000

Email: pierre dot parrend at epita dot fr
GitHub: https://github.com/pierrep67
LinkedIn: https://fr.linkedin.com/in/pierreparrend
X: https://x.com/pierrep67

CV / Skills

Fri, 14 Aug 2026 00:00:00 +0000

Employment

Current positions

Deputy Head of LRE - Laboratoire de Recherche de l’EPITA — since September 2022
Head of Security & Systems Teams @ LRE — since September 2022
Professor — EPITA, since May 2021
Researcher — Laboratoire ICube, since August 2012

Past positions

Head of ‘Cybersecurity and Systems’ major of the EPITA Engineer diploma (apprenticeship program), 2023-2026
Professor — ECAM Strabourg-Europe, 2018-2021
Department Head, Computer Science and Mathematics — ECAM Strasbourg-Europe, 2012–2021
Senior Researcher — Forschungszentrum Informatik (FZI), 2008–2012
PhD Student — INSA-Lyon, 2005–2008

Education

Habilitation à Diriger les Recherches — Université de Strasbourg, 2017
Doctorat en Informatique — INSA-Lyon, 2005–2008

Professional Activities

Member of the board — GDR Sécurité, GT SSLR, since September 2024

More on ORCID: ORCID 0000-0002-1680-1182

OTARQ: Adaptive and Automated Risk Quantification Method for OTA Updates in SDVs

Mon, 03 Aug 2026 00:00:00 +0000

The increasing frequency of Over-The-Air (OTA) updates on Software-Defined Vehicles (SDVs), combined with heterogeneous OTA architectures, introduces unpredictable attack entry points and vulnerabilities that may scale with fleet size. These vulnerabilities can escalate from external infrastructure components to in-vehicle systems, expanding the attack surface across the update ecosystem. In SDV architectures, real-time vulnerability risk management is challenging, as OTA updates may be deployed before corresponding security patches are released and validated.

PTCC event — Cybersecurity of Critical Distribution Networks

Tue, 16 Jun 2026 00:00:00 +0000

On 16 June 2026, PTCC (Programme de Transfert au Campus Cyber) hosted an afternoon at the Auditorium Galaxy in Puteaux dedicated to the cybersecurity of critical distribution networks — telecom, energy, drinking water — whose architectures and operational constraints share common vulnerabilities.

Program

Nicolas Prigent (PTCC/Inria) — introduction and a look back at incidents analyzed by the Polish CERT
Stéphane Mocanu (Grenoble INP) — SCADA system vulnerabilities
Mathieu Galissot (CEA) — electric grid security and deception techniques
Pérez Pelage (SecurZenn) — regulatory landscape (NIS2, Cyber Resilience Act)
Nassim Bouiche (Sandfox) — critical infrastructure resilience
Léa Kenmogne (Grenoble INP) — AI-based attack detection
Lucas Georget (EDF R&D / LAAS-CNRS) — hardware-assisted malware detection
Pierre Parrend (EPITA / ICube) — water distribution network security, as part of the CoRREau project (ANR-22-CE39-0010)

Our talk

Our presentation covered cyberattack detection in water distribution networks, building on work carried out within the ANR CoRREau project. It extends the results published in Combining Physical and Network Data for Attack Detection in Water Distribution Networks (WDSA/CCWI 2024) and in Tool Demo: Topology analysis with GPML for detection of cyberattacks in Water Distribution Networks (IEEE/IFIP NOMS 2026), which combine physical and network data to improve attack detection on this type of infrastructure.

RedTeamLLM — Agentic AI framework for offensive security

Thu, 11 Jun 2026 00:00:00 +0000

From automated intrusion testing to discovery of zero-day attacks before software launch, agentic AI calls for great promises in security engineering. This strong capability is bound with a similar threat: the security and research community must build up its models before the approach is leveraged by malicious actors for cybercrime. This repository implements RedTeamLLM, an integrated architecture with a comprehensive security model for automatization of pentest tasks. RedTeamLLM follows three key steps — summarizing, reasoning, and act — which embed its operational capacity, addressing plan correction, memory management, context window constraints, and generality vs. specialization. Evaluation is performed through the automated resolution of a range of entry-level, but not trivial, CTF challenges.

NOMS MCT 2026 — Management of Complex Threats Workshop

Fri, 22 May 2026 00:00:00 +0000

The NOMS MCT — Management of Complex Threats workshop was held on 22 May 2026 in Rome, in conjunction with IEEE/IFIP NOMS 2026. The workshop looked at the next challenges in the coupling of cybersecurity and artificial intelligence, from zero-days and APTs to threats enabled by generative AI. Co-chairing it with Marc-Oliver Pahl (IMT Atlantique) was a great experience, and it’s time for a well-deserved thank-you to everyone who made it happen.

SmartFlow — temporal data monitoring application

Wed, 20 May 2026 00:00:00 +0000

SmartFlow (“Application de supervision de données temporelles” — temporal data monitoring application) is a small Python stack for collecting and visualizing sensor data over time. It is made of two parts: a harvester (harvester.py) that regularly retrieves sensor data from an origin server and stores it as JSON, and a web application (app.py) that serves the collected data for analysis and monitoring. The deployment stack targets a Linux server with gunicorn, Nginx, and supervisor.

Tool Demo: Topology analysis with GPML for detection of cyberattacks in Water Distribution Networks

Mon, 18 May 2026 00:00:00 +0000

Water distribution networks depend on industrial control systems to integrate the physical process with the communication network, making them vulnerable to cyberattacks that alter traffic patterns and network behavior. Traditional detection approaches that rely on raw traffic or protocol information often overlook structural changes induced by such attacks.

This work presents a topology-driven approach for detecting cyberattacks in water distribution networks based on the Graph Processing for Machine Learning (GPML) framework. Raw traffic is transformed into dynamic graphs, from which community and spectral metrics are extracted and analyzed for structural and communication modifications over time. The methodology is evaluated on three industrial water distribution datasets — HITL, SWaT, and CrossTest — and shows that spectral and community graph metrics improve detection performance for both cyber and physical attacks across the three datasets.

Congratulations Dr. Julien Michel

Wed, 08 Apr 2026 00:00:00 +0000

Congratulations to Julien Michel, who defended his PhD thesis, “Détection d’attaques robuste en temps par métriques de communauté de graphes” (“Real-time robust attack detection using graph community metrics”), on 8 April 2026 at the University of Strasbourg (ED 269, ICube laboratory), under the supervision of Pierre Parrend.

The work builds on the dynamic graph community metrics approach also presented in t-robust spaces with dynamic graphs metrics for mitigating concept drift in attack detection (KES 2025).

Hybrid Evolutionary-ML Surrogate Models for Cyber-Attack Detection in Water Distribution Networks

Wed, 08 Apr 2026 00:00:00 +0000

Water distribution networks (WDNs), as critical infrastructure, face growing cyber-attack risks. While Industry 4.0 initiatives motivate the deployment of edge technologies for monitoring, efficient detection on distributed edge devices requires methods that reduce computational overhead without sacrificing classifier performance.

We propose a hybrid evolutionary-machine learning (ML) approach that constructs probabilistic surrogate models of trained ML classifiers using an Estimation-of-Distribution Algorithm (EDA). Our het-EDA algorithm supports the analysis of heterogeneous network communication features, extending r-UMDA for categorical and PBIL-C for continuous data. It evolves class-wise surrogates which optimize the original classifier’s output scores. Inference is performed via lightweight log-likelihood evaluation, making the method suitable for resource-constrained edge devices.

Presenting the Cloud Risk Mapping report at Forum InCyber 2026 (Lille)

Tue, 10 Mar 2026 00:00:00 +0000

The report Cartographie des risques dans le Cloud (“Cloud Risk Mapping”), produced by the Campus Cyber working group of the same name (part of the “Détection dans le Cloud” Community of Interest), was presented at Forum InCyber 2026 in Lille.

The document addresses the detection of potential or confirmed attacks on digital production environments hosted on public, private, or hybrid Cloud platforms. It proposes a multi-step approach:

Risk identification, tied to Cloud-specific features: access from the Internet, shared virtualized environments, outsourced administration and hosting
From risks to detection rules, illustrated with examples of major incidents and a summary of the risk analysis
Detection rule coverage, with a deployment prioritization strategy for monitoring tools and platforms

The Cloud risk list is organized by business value and by stakeholder — whether the end user or the service provider — so that each party can rethink its security event detection strategy according to its level of Cloud usage.

GAML-MUDIT — Game Theory and Machine Learning for Multi-Domain Deception in Internet of Things

Thu, 01 Jan 2026 00:00:00 +0000

Project period: 2025-2028

Presentation

Cyber deception uses misleading information, decoys, and honeypots to shape an attacker’s beliefs and actions. In a multi-domain cyber-physical system, however, cyber and physical components are connected and a security decision in one domain can affect the other. Designing deception strategies independently can therefore leave inconsistencies that attackers may exploit.

GAML-MUDIT studies a coordinated deception framework for Internet of Things and cyber-physical environments, including critical infrastructures such as water treatment systems. Game-theoretic models represent the interaction between defenders and adversaries, while deep reinforcement learning supports the prediction of attacker behavior and the adaptation of defensive actions. Intent-based networking is also considered for orchestrating deception automatically. The project aims to create believable, persistent cyber and physical decoys that can adapt in real time without affecting genuine systems.

Software Defined Vehicle Security

Thu, 01 Jan 2026 00:00:00 +0000

Project period: 2024-2027

Presentation

Software-defined vehicles depend on frequent over-the-air updates and on a distributed ecosystem of vehicle, network, and cloud components. This architecture improves the ability to evolve vehicle software, but it also creates new entry points for attacks and allows vulnerabilities to propagate across entire fleets. Security decisions must therefore account for the software update, the vehicle context, and the scale of deployment together.

The project studies automated and adaptive methods for protecting this update ecosystem. Its work combines cybersecurity, safety, and fleet-impact analysis to quantify risks from natural-language vulnerability descriptions. It also explores distributed update delivery using differential updates, peer-to-peer content distribution, and coordinated vehicle-to-network and vehicle-to-vehicle communication, including resilience under intermittent connectivity.

Congratulations Dr. Majed Jaber

Fri, 19 Dec 2025 00:00:00 +0000

Congratulations to Majed Jaber, who defended his PhD thesis, “Structural and spectral analysis of dynamic graphs for attack detection”, on 19 December 2025 at the University of Strasbourg (ICube laboratory), under the supervision of Pierre Parrend and Aline Deruyver. The jury included Marc-Oliver Pahl, Véronique Legrand, Mohamed-Lamine Messai, and Rushed Kanawati.

The thesis introduces a spectral and structural graph-based framework for detecting cyberattacks in dynamic, heterogeneous networks — including the Spectral Time-Windowing method, the BiFlowness metric, and the open-source GPML library — building on work also presented in Graph-Based Spectral Analysis for Detecting Cyber Attacks (ARES ‘24) and Cyberattack detection through GPML: Graph Processing for Machine Learning (SoftwareX).

t-robust spaces with dynamic graphs metrics for mitigating concept drift in attack detection

Wed, 10 Sep 2025 00:00:00 +0000

Concept drift is of primary concern for the detection of attacks in Internet traffic networks. Those networks register a high diversity of heterogeneous activity which change with usage, thus nurturing an evolutive environment. Detecting attacks is the action of dissociating attacks from the other data in the environment in a discriminating classification. However, both the modification of attack behaviors through time and the evolution of the environment are disruptive of the thin boundaries drawn by learning models. For the evaluation of sustainability and trustworthiness of the detection system, concept drift detection approaches have emerged. Those approaches can necessitate a significant amount of time and resources to mitigate the effect of concept drift thus detected.

AI4Sec — Artificial Intelligence for Cybersecurity