structing a byte stream at the level of network traffic analysis equipment that is consistent
with the behavior of the monitored machine. The IP and TCP protocols use specific mecha-
nisms such as fragmentation and segmentation to transmit arbitrary amounts of data while
overcoming the constraints of the physical medium or the lower protocol layer. However,
fragment or segment overlaps may not be empty. Operating systems (OS) use various poli-
cies to remedy the ambiguities of overlap associated with these two mechanisms. The way
in which passive network traffic analysis tools manage the different reassembly policies im-
plemented in end-point entities is therefore critical. Indeed, if these tools do not reconstruct
byte streams in the same way as end-point entities, it becomes possible for an attacker to
cause the analysis tool to behave incorrectly. The attacker can thus make data invisible
(evasion attack [1]), but it can also insert data into the stream visible only to the analysis
equipment (insertion attack [1]).
Some IDS/IPS systems take these policies into account to reconstruct a byte stream
consistent with what applications observe at the end of the path [2, 3, 4]. The work of
Lucas Aubard’s thesis [5, 6] shows that policies evolve over time, that these policies are
extremely diverse, and that their implementations within IDS [2, 3, 4] sometimes contain
errors that allow evasion or insertion attacks [7]. However, analysis tools such as firewalls
or TLS interception tools have not been addressed in the state-of-the-art literature. The
only existing work that manipulates concepts related to data recovery to target firewalls [8]
is limited to a very restricted aspect of the IPv6 header, the extension headers (as opposed
to IPv4, IPv6, and TCP data in our recent work [5, 6]) and a single fragment intersection
configuration (as opposed to 422 in [5, 6]).
[1] Ptacek, Thomas H and Newsham, Timothy N, “Insertion, evasion, and denial of service:
Eluding network intrusion detection,” Secure Networks inc Calgary Alberta, Tech. Rep.,
1998.
[2] Snort. (2020) README.frag3. [Online]. Available:
https://www.snort.org/faq/
readme-frag3
[3] ——. (2020) README.stream5. [Online]. Available:
https://www.snort.org/faq/
readme-stream5
[4] OISF. (2020) Suricata Documentation on Host-os-policy. [Online]. Avail-
able: https://suricata.readthedocs.io/en/suricata-4.0.2/configuration/suricata-yaml.
html#host-os-policy
[5] Aubard, Lucas and Mazel, Johan and Guette, Gilles and Chifflier, Pierre, “Overlapping
data in network protocols: bridging OS and NIDS reassembly gap,” in DIMVA, 2025.
[6] ——, “Overlapping IPv4, IPv6, and TCP data: exploring errors, test case context, and
multiple overlaps inside network stacks and NIDSes with PYROLYSE,” in RAID, 2025.
[7] NIST. (2024) CVE-2024-32867. [Online]. Available: https://nvd.nist.gov/vuln/detail/
CVE-2024-32867
[8] Lin, Bin and Zhang, Liancheng and Guo, Yi and Zhang, Hongtao and Fang, Yakai,
“Research on Security Protection Evasion Mechanism Based on IPv6 Fragment Head-
ers,” in 2024 IEEE 49th Conference on Local Computer Networks (LCN). IEEE, 2024,
pp. 1–9.
A first difficulty is identifying the policies implemented within firewalls or TLS interception
tools. To our knowledge, there are no studies focusing on the behavior or configuration of
these tools. A second difficulty in designing network detection systems is the configuration
of these systems. We plan to use fingerprinting to identify the operating systems of the
monitored machines and automate the configuration of these tools, either with signature-
based approaches or machine learning (AI). Transformer-based techniques could be relevant
in this context [9, 10].
The objective of this post-doc is therefore to analyze how firewalls [11, 12, 13, 14] and
TLS interception tools [15, 16, 17] handle the problem of data recovery for IPv4, IPv6, and
TCP protocols. The handling of IPv6 extension headers may also be addressed by extending
existing work [8] using the formalism proposed in Lucas Aubard’s thesis. We also plan to
design automated configuration approaches for these analysis tools.
[9] Boumhand, Ahcene and Deep Singh, Kamal and Hadjadj-Aoul, Yassine and Liewig
Matthieu and Viho César, “Multi-Task Learning for Identifying Multi-Activity Situa-
tions and Application Type From Network Traffic,” in 20th International Conference
on Wireless and Mobile Computing, Networking and Communications, WiMob 2024,
Paris, France, October 21-23, 2024. IEEE, 2024, pp. 644–650.
[10] ——, “Network Traffic Classification for Detecting Multi-Activity Situations,” in IEEE
Symposium on Computers and Communications, ISCC 2023, Gammarth, Tunisia, July
9-12, 2023. IEEE, 2023, pp. 681–687.
[11] (2020) Netfilter. [Online]. Available: https://netfilter.org/
[12] (2020) An Introduction to Packet Filter (PF). [Online]. Available:
https:
//freebsdfoundation.org/resource/an-introduction-to-packet-filter-pf/
[13] (2020) PF User’s Guide. [Online]. Available: https://www.openbsd.org/faq/pf/index.
html
[14] (2025) Microsoft Defender Antivirus. [Online]. Available: https://en.wikipedia.org/
wiki/Microsoft_Defender_Antivirus
[15] (2020) SSLproxy. [Online]. Available: https://github.com/sonertari/SSLproxy
[16] (2020) mitmproxy. [Online]. Available: https://github.com/mitmproxy/mitmproxy
[17] (2020) Artica. [Online]. Available: https://www.artica-protect.fr/artica-proxy/
dows/Linux), networks, and security, good interpersonal skills, and the ability to
express oneself orally and in writing in English.
panied by a CV and cover letter should be done on https://institutminestelecom.recruitee.com/l/en/o/post-doctorat-en-cybersecurite-cdd-24-mois