Data Representation, Data Quality and Data Generation: Contributions to Anomaly-Based Intrusion Detection

Cyberattacks are becoming increasingly common, and the success of LLM-based agents only exacerbates this threat. This HDR defense focuses on contributions to anomaly detection, i.e., the detection of attacks without assuming their specific form. More specifically, it details three parts: data representation, data quality, and data generation. Data representation focuses on the best way to extract and prepare security data for analysis by artificial intelligence tools. However, this detection is often limited by the quality of the datasets, which is the focus of the second part. This part presents research on the correction and creation of datasets, as well as on the explainability of AI models, which helps identify biases in the data. Finally, the third part focuses on the generation of synthetic network traffic (without simulation or emulation) using AI techniques. This generation is designed to be interpretable, modular, and cost-effective, and relies in particular on statistical models and data mining techniques.