In our next ROC seminar, the PhD students will present their current work on Tuesday, 3 November 2026, from 14:00 to 16:00.
Seminar Location: Room: 33.1.19, 2 rue Conté, 75003 Paris, France
Speaker: Maham Fatima Kayani
Title: Event Detection in the NetMob2023 Dataset Using Autoencoders
Abstract: In this presentation, I will show how mobile-phone traffic can be used to detect events in Paris. I will first introduce the NetMob23 dataset, which covers March to May 2019, 77 days, with the traffic of 68 applications. For the early experiment, I use the month of April 2019, grouped into 250 m squares. Then I will explain how LSTM and BiLSTM autoencoders learn what an ordinary day looks like, and how we score each day by its distance from an expected day. Finally, I will present the results for Easter Monday, the Paris Marathon, the Notre-Dame fire and the football matches at the Parc des Princes, and compare them with a simple baseline.
Speaker: Ramzi Rezki
Title: Spatial and Temporal Context for APT Stage Detection: Graph Learning
Abstract: Advanced Persistent Threat (APT) stage identification is inherently a spatio-temporal problem, as malicious activities evolve through multiple stages and involve interactions among network entities. This work investigates the contribution of relational and temporal context to fine-grained APT-stage classification on the Unraveled dataset. We propose a GraphSAGE–GRU framework in which bidirectional network flows are represented as nodes and graph edges are constructed from shared endpoint-host identities using bounded connectivity. GraphSAGE captures relational dependencies among flows, while a GRU encodes a partition-aware history of the five most recent preceding observations associated with each source host. Preprocessing is fitted exclusively on the training partition, and temporal histories are constructed independently within each partition to prevent information leakage. Experiments over five random seeds show that spatial context provides the dominant contribution to six-class APT-stage classification. MLP, GRU-only, and GraphSAGE-only models achieve macro-𝐹1 scores of 0.5399, 0.4628, and 0.8912, respectively, whereas GraphSAGE–GRU reaches 0.9031 ± 0.0349, with an MCC of 0.9549 ± 0.0259 and a macro-AP of 0.9225 ±
0.0140. Temporal modeling provides complementary, stage-dependent improvements, particularly for Establish Foothold, Data Exfiltration, and Cover Up. For supervised binary detection, GraphSAGE–GRU achieves an attack 𝐹1 of 0.9565 ± 0.0352 and an MCC of 0.9568 ± 0.0343. Overall, the results demonstrate that relational structure is particularly important for fine-
grained APT-stage discrimination, while temporal context provides potentially useful but limited
complementary information.
Speaker: Tristan Madani
Title:
Abstract:
Speaker: Moheed Ali Kayani
Title: A Closed-Loop Architecture for LoRaWAN
Abstract: Standard LoRaWAN deployments rely primarily on basic Network Server operations like Adaptive Data Rate (ADR) to adjust link parameters. However, local ADR mechanisms lack full visibility into dynamic network states, channel loads, and traffic anomalies. In this talk, we introduce a closed-loop framework based on the MAPE-K (Monitor, Analyze, Plan, Execute, Knowledge) autonomic control model that runs alongside the LoRaWAN architecture. By maintaining comprehensive network states including historical transmission profiles, spatial node densities, and gateway utilization the framework performs high-level decisions beyond standard parameter scaling. Key capabilities include dynamic channel assignment, spatial traffic rebalancing, and real-time anomaly detection (such as rogue node behavior, jamming, or abrupt packet loss spikes). We detail the interaction between the MAPE-K Knowledge base and standard LoRaWAN servers, demonstrating how state-aware control enhances long-term reliability, dynamic spectral efficiency, and network resilience.
