Thèse : Structural and Spectral Analysis of Dynamic Graphs for Attack Detection.

Jury :

Directeurs

• Pierre PARREND, PR HDR, EPITA Strasbourg / ICube, Strasbourg
• Aline DERUYVER, MCF HDR, Université de Strasbourg / ICube, Strasbourg

Co-directeur

• Nicolas BOUTRY, Enseignant-Chercheur, EPITA Paris

Rapporteurs

• Marc-Oliver PAHL, PR HDR, IMT Atlantique Campus Rennes
• Véronique LEGRAND, PR HDR, CNAM Paris

Examinateurs

• Mohamed-Lamine MESSAI, MCF, Université Lumière Lyon 2, Laboratoire ERIC
• Rushed KANAWATI, MCF, Université Sorbonne Paris Nord

Résume (en anglais) :

This thesis presents a spectral and structural graph-based framework for detecting cyberattacks in dynamic and heterogeneous networks, with a focus on the Internet of Medical Things (IoMT). Traditional machine learning models often fail to capture evolving or weak-signal attacks due to their static data assumptions. To address this limitation, the work introduces three key contributions: the Spectral Time-Windowing (SpectraTW) method, which defines new spectral indicators (Connectedness, Wiriness, Flooding, Asymmetry) for detecting low-signal and multi-class attacks; the BiFlowness metric, which leverages bipartite graph topology for early-stage attack detection; and the Graph Processing for Machine Learning (GPML) library, an open-source Python toolkit that unifies time-series, spectral metrics, and graph-based processing for reproducible cybersecurity analysis. Together, these contributions enhance the accuracy, interpretability, and scalability of attack detection across complex IoMT and cyber-physical systems.