Stage recherche M2 ou école d'ingénieur à Strasbourg en apprentissage machine appliqué à la cybersécurité

2. Objectives The internship will seek to establish when a conformal guarantee remains reliable for insider detection, and how to restore it when it does not. It will aim to: • Build a reproducible pipeline: user-day profiles, individual, peer-group and long-term baselines, detectors (Isolation Forest and recent variants), explanations (DIFFI [4]). • Measure, at a fixed alert budget and with a temporal split, the FDR actually achieved and the detection power on datasets such as CERT, ChimeraLog [2] and the LANL authentication data, using the nonconform library. • Stress-test the guarantee: drift, contaminated calibration, slow insider, per-group calibration under data scarcity, fairness across groups. • Evaluate recent remedies: weighted or sliding calibration, active cleaning of the calibration set, p-values that exploit a few labelled anomalies. Studying the limits of the methods and of the data, both synthetic and real, will be an integral part of the work. 3. Work plan 1. Literature review and scoping: insider threats, conformal inference, evaluation pitfalls in security. 2. Data and first models: CERT, ChimeraLog and/or LANL datasets. Unsupervised baseline detectors. Conformal calibration. 3. Experiments: stress protocols, remedies, explanations, comparison across datasets. 4. Writing and defence: consolidation of results, thesis and defence. Team and working environment The internship takes place in the SDC team (Data Science and Knowledge) of the ICube laboratory (UMR 7357, University of Strasbourg, CNRS). It is co-supervised by Nicolas Lachiche and Gabriel Frey. • Location: ICube, 300 bd Sébastien Brant, CS 10413, 67412 Illkirch Cedex, south of Strasbourg. • Remote work: the internship is mainly on site. Occasional remote work is possible, by agreement with the supervisors. • Stipend: according to the regulations in force at the time of the internship. Duration and dates • Duration: 5 to 6 months. • Start: from February 2027. Profile Student in the second year of a Master’s in computer science (M2), or in the final year of an engineering school in computer science. • Solid background in probability and statistics (hypothesis testing, p-values, multiple testing). • Good command of Python and its scientific ecosystem (NumPy, pandas, scikit-learn). • Knowledge of machine learning. • Interest in computer security. No prior expertise is required: the necessary background is covered at the start of the internship. How to apply Send an e-mail to both supervisors: • Nicolas Lachiche: nicolas.lachiche@unistra.fr • Gabriel Frey: g.frey@unistra.fr The e-mail must contain: • A CV. • Copies of diplomas and academic transcripts. • A short cover letter. Applicants from outside the European Union: due to security regulations and the time required to obtain visas and residence permits, applicants must hold, at the time they apply, a residence permit authorising them to carry out an internship in a French laboratory.