Due to the constant evolution of cyber-attacks, more effective and efficient intrusion detection systems (IDS) are paramount to modern networks. This is particularly true for zero-day attacks, which cannot be detected using traditional signature-based approaches.

To address these problems, CEA LIST's Laboratoire des Systèmes Communicants (LSC) has developed SIGMO-IDS, an anomaly-based intrusion detection system that, instead of detecting attacks using known signatures, identifies them based on anomalies in network traffic.

Anomaly-based intrusion detection systems face two major challenges: performance and explainability. The performance challenge mainly consists in ensuring that unknown attacks are rapidly detected while minimizing the number of false alarms at the same time. Explainability, on the other hand, refers to the ability to understand the alerts raised by the system and their underlying causes.

The proposed internship aims to address these two challenges using state-of-the-art artificial intelligence techniques, particularly large language models (LLMs). The aim of the internship is twofold: 1) to integrate an LLM for anomaly-based intrusion detection into SIGMO-IDS; 2) to test the implementation on a demonstration scenario.

• Education: Master Degree
• Good English level (B2 or higher)
• Specialized in networks or machine learning
• Good programming skills (mainly in Python)