Building research capacity around difficult cybersecurity problems
I lead research at the intersection of critical infrastructures, distributed systems, trustworthy AI, cyber-physical security, and autonomous cyber defence.
My approach is to organize research around scientific questions rather than individual funding instruments. Projects provide the researchers, infrastructure, data, and experimental environments required to investigate those questions over time.
Research Programmes
Trustworthy Security Observability
How can a defender establish security state when the systems producing its telemetry may themselves be compromised?
This programme investigates network, cyber-physical, embedded, deception, and physical evidence as complementary sources of security observability. Current work spans power-assisted security analysis, instruction-level detection, cyber-physical monitoring, honeynet realism, attacker fingerprinting, and cross-layer evidence.
Current researchers: Mohammed Mezaouli, Mathis Durand.
Experimental environments: embedded and physical-security testbeds, industrial cyber-physical systems, OT attack-and-defence environment, and honeynets.
Context and Digital Twins for Cybersecurity
How can system knowledge and cyber-physical models improve security reasoning without themselves becoming new sources of false trust?
Research combines digital twins, system context, sensor authentication, adversarial state manipulation, and cyber-resilience. Experimental work uses partial digital twins of water-treatment processes and IoT devices to investigate state estimation, attack analysis, attribution, and response.
Current researcher: Hugo Bourreau.
Distributed and Autonomous Cyber Defence
How can distributed infrastructures detect, coordinate, and respond to attacks without relying on a single trusted or centralized observer?
This programme builds on research in distributed systems, semantic integration, federated and decentralized anomaly detection, collaborative trust, AIOps, adaptive orchestration, and incident response. Current work increasingly addresses the transition from detection toward bounded, verifiable, and eventually self-healing response.
Current researchers: Christian Lübben, Erkin Kirdan, Luc Bournaud, Antonios Ntib.
Experimental environments include the VSL semantic distributed-systems testbed, OT/IoT environments, and digital-twin-based security experimentation.
Information Resilience
How can trustworthy information and human decision-making be preserved when generative and agentic AI make manipulation inexpensive, adaptive, and scalable?
Research spans AI-mediated disinformation, controlled experimental stimulus generation, human susceptibility, provenance, credibility datasets, and operation-level observability. The programme increasingly treats influence operations as adversarial AI-mediated systems rather than isolated fake artefacts.
Current researcher: Alexander Loth.
Experimental infrastructure includes JudgeGPT/RogueGPT and CRED-1, supporting controlled generation, reproducible experimentation, provenance research, and credibility analysis.
Cyber CNI
The Cybersecurity for Critical National Infrastructures (Cyber CNI) Chair is a multi-institutional academic-industrial research environment spanning IMT Atlantique, Télécom Paris, and Télécom SudParis.
Rather than organizing research around individual industrial use cases, Cyber CNI uses the constraints of real critical infrastructures to expose fundamental cybersecurity problems and provide demanding environments for validation.
Its scientific trajectory has progressed from distributed and federated detection toward cyber-physical observability, deception and honeynets, embedded and physical security evidence, digital twins, and increasingly autonomous response.
Current Industrial Funding Partners
- Airbus — Programme Cyber
- Airbus PROTECT
- EDF
- RTE
- Astek
Former Industrial Funding Partners
- SNCF
- BNP Paribas
- Nokia
- Amossys
- Orange
- La Poste
- Société Générale
Institutional and Public Ecosystem
- COMCYBER — French Cyber Command
- Pôle d’Excellence Cyber (PEC)
- Région Bretagne
- FEDER
- Campus Cyber
Current Research Team
The current research team spans several institutions and scientific programmes. The cards below should remain concise on the website: role, institution, research question, and profile links.
Christian Lübben
PhD Researcher · Technical University of Munich · 2018–2026
Optimizing IoT smart spaces using advanced data analytics, with current work on distributed anomaly detection, federated learning, and autonomous semantic protocol translation.
Erkin Kirdan
PhD Researcher · Technical University of Munich · 2019–2026
Industrial IoT engineering and the security, scalability, and operational behaviour of machine-to-machine communication protocols.
Alexander Loth
PhD Researcher · Frankfurt University of Applied Sciences · 2023–2026
The AI-driven disinformation ecosystem: controlled generation, human susceptibility, provenance, and resilient information infrastructures.
Mathis Durand
PhD Researcher · IMT Atlantique · 2023–2026
Realism of cyber-threat-intelligence harvesting infrastructures, with a focus on honeynets, attacker fingerprinting, and anti-honeypot resilience.
Mohammed Mezaouli
PhD Researcher · IMT Atlantique · 2023–2026
Real-time AI-based power-assisted security analysis for embedded systems, including instruction-level and physical side-channel observability.
Hugo Bourreau
PhD Researcher · IMT Atlantique · 2024–2028
Modular digital-twin-based cyber resilience, including sensor authentication, adversarial state manipulation, and proactive attack attribution.
Luc Bournaud
PhD Researcher · IMT Atlantique · 2025–2028
Fully decentralized incident response and the transition from distributed detection toward coordinated autonomous mitigation.
Antonios Ntib
PhD Researcher · Western University · 2026–2028
Cybersecurity research programme currently being defined; initial work addresses security and resilience of connected cyber-physical infrastructures.
Axel Dupraz
Research Engineer · IMT Atlantique · 2025–2027
OT cybersecurity and hands-on industrial-security experimentation in the Train Cyber Experts (TCE) project.
Research Alumni
Former doctoral researchers, postdoctoral researchers, and research engineers have contributed to the evolution of the programme from distributed systems and IoT toward collaborative AI, cyber-physical and embedded security, immersive analytics, and information resilience.
Doctoral Researchers
Jan Seeger · TUM · 2016–2020 · Smart Bridging of Device Heterogeneity in the Internet of Things · doctoral project not completed.
Stefan Liebald · TUM · 2016–2019 · Delay Tolerant Distributed Systems · doctoral project not completed.
Manel Smine · IMT Atlantique · 2019–2022 · Software-defined Security for Network Function Virtualization.
Romain Dagnas · IMT Atlantique · 2019–2020 · New network architectures designed to support IoT · doctoral project not completed.
Stefan Nowak · IMT Atlantique · 2020–2021 · Distributed-ledger-based collaborative cybersecurity.
Léo Lavaur · IMT Atlantique · 2020–2024 · Improving intrusion detection in distributed systems through federated learning.
Awaleh Meraneh · IMT Atlantique · 2020–2023 · Strengthening industrial-system security using physical information leakage.
Nicolas Delcombel · IMT Atlantique · 2020–2023 · Virtual reality for cybersecurity and intrusion-detection decision support.
Julius Bünger · IMT Atlantique · 2022 · Secure IoT life-cycle management.
Lucie David · IMT Atlantique · 2022–2023 · Immersive data analytics for cybersecurity · doctoral project not completed.
Postdoctoral Researchers
Alexandre Kabil · IMT Atlantique · 2020–2022 · Virtual reality for cybersecurity.
Loïc Miller · IMT Atlantique · 2022–2023 · Blockchain for cybersecurity.
Nisrine Ibadah · IMT Atlantique · 2022–2023 · Railway cybersecurity.
Elie Chedemail · IMT Atlantique · 2024–2026 · AI-enabled disinformation.
Research Engineers
Fabien Autrel · IMT Atlantique · 2019–2021 · Cyber CNI testbed.
Edwin Bourget · IMT Atlantique · 2019–2021 · Cyber CNI testbed.
Fabien Eyssartier · IMT Atlantique · 2024–2026 · Virtual reality for cybersecurity in the Horizon Europe CyberSecDome project.
Research Infrastructure
Industrial Cyber-Physical Testbeds
Miniaturized Fischertechnik factory environments integrating Siemens, Schneider, Industrial Shields, and Crouzet PLCs; PLC-controlled heating benches; and IoT devices integrated into a smart-building living lab. These environments support reproducible experimentation across industrial control, embedded devices, network communication, and physical processes.
OT Attack & Defence Environment
A virtualized environment for reproducing iconic real-world OT attacks, complemented by physical PLCs and a water-treatment setup. The environment allows researchers and students to experience important stages of attacks and mitigations first-hand while retaining repeatability and isolation.
Digital-Twin Security Testbeds
Experimental and partial digital twins of water-treatment processes and IoT devices. They support research on state estimation, cyber-physical consistency, attack simulation, adversarial state deception, attribution, and resilience.
Immersive Cybersecurity Analytics
A multi-user virtual-reality environment for exploring cybersecurity data and supporting immersive analytics, situational awareness, risk analysis, and mitigation control. Website implementation: embed the existing demonstration video here.
Cyber Deception & Honeynets
Honeynet deployments and analysis tooling for studying realism, detectability, attacker interaction, fingerprinting, and anti-honeypot strategies.
Information Resilience Infrastructure
JudgeGPT/RogueGPT and CRED-1 provide infrastructure for controlled AI-generated stimuli, reproducible human experiments, provenance research, and multi-signal credibility analysis. Website implementation: link JudgeGPT to https://judgegpt.streamlit.app.
Semantic Distributed Systems Testbed
A VSL-based experimental environment for semantic collaboration between distributed agents, built around a dynamically evolving ‘living ontology’. It supports research on heterogeneous system integration, contextual reasoning, and autonomous coordination.
Selected Funded Programmes
Funding is presented here selectively: projects are chosen because they explain the scientific trajectory and the experimental capacity of the group. A complete funding record belongs in the CV.
Cyber CNI Phase IV
2025–2028 · PI · €990k
Current industrial research programme with Airbus Programme Cyber, Airbus PROTECT, EDF, RTE, and Astek, supporting research in critical-infrastructure cybersecurity and the transition toward trustworthy autonomous defence.
CyberSecDome
2023–2026 · Horizon Europe · Institutional PI · €370k institutional / €6M consortium
European programme on secure, collaborative, and privacy-aware incident handling for digital infrastructures; provides a major context for immersive analytics, digital resilience, and human-centred cybersecurity.
AI-based Embedded Security
2023–2026 · PI · €252k
Two complementary programmes on AI-based side-channel attacks against AI systems-on-chip and real-time power-assisted malware prediction, supporting the group’s embedded and physical-observability research.
Life-Cycle Based IoT Service Management
2020–2025 · PI · €225k · Atos
Long-running industrial research on management and evolution of distributed IoT services, connecting the group’s systems foundations to later autonomous-security research.
DTACK
2023–2024 · PI · €60k · German-French Academy for the Industry of the Future
Digital-twin-based framework for analysing cyberattacks in intelligent transportation systems, contributing to the current digital-twin security research line.
CyberCTF
2023–2024 · PI · €30k · German-French Academy for the Industry of the Future
Cybersecurity experimentation and challenge-based research/education connecting realistic attack scenarios with hands-on learning.
DECENT
2018 · PI · €250k · BMWi
Decentralized cross-commodity energy management, contributing to the group’s earlier research on distributed cyber-physical infrastructures.
Building as a Service (BaaS)
2014 · PI · €250k · BMBF
Early systems research on programmable, service-oriented smart-building infrastructures and an important foundation for later work on heterogeneous distributed environments.
Research-Team Development at a Glance
Across the programme described above, Marc-Oliver has supervised or co-supervised 19 doctoral researchers, including 15 completed or ongoing doctoral projects, as well as four postdoctoral researchers and four research engineers. Four doctoral projects were discontinued before completion. The website should keep this distinction explicit rather than folding all researchers into a single completion count.
The current team should be visually dominant. Alumni should be collapsible or placed below the current team so that the page communicates both present research capacity and the longer scientific genealogy.