{"id":2201,"date":"2026-07-24T08:54:53","date_gmt":"2026-07-24T06:54:53","guid":{"rendered":"https:\/\/pepr-defmal.loria.fr\/?page_id=2201"},"modified":"2026-09-22T11:34:56","modified_gmt":"2026-09-22T09:34:56","slug":"workshop-defmal-2026","status":"publish","type":"page","link":"https:\/\/pepr-defmal.loria.fr\/fr\/evenements\/workshop-defmal-2026\/","title":{"rendered":"Workshop DefMal 2026"},"content":{"rendered":"
\"\"<\/a><\/figure>\n\n\n\n

We are pleased to invite you to the 4th annual DefMal workshop<\/strong>, organized as part of the PEPR Cybersecurity \u2013 DefMal project.

The event will take place in Nancy on October 1 -2<\/strong>.<\/p>\n\n\n\n


This workshop is an opportunity to bring together our teams from Nancy, Rennes, Paris, and Sophia Antipolis, as well as our invited guests, to exchange ideas and share progress on our common topic: combating malware<\/strong>.
The program is currently under construction, and we encourage you to register as soon as possible and plan your trip accordingly. <\/p>\n\n\n\n

We look forward to seeing you in Nancy!<\/p>\n\n\n\n


Workshop Programme<\/strong><\/p>\n\n\n\n

Thursday, October 1<\/strong><\/h3>\n\n\n\n

From 08h30: Welcome coffee<\/strong><\/p>\n\n\n\n

9h00 <\/strong>\u2013 9h20: Workshop introduction<\/strong> by Jean-Yves Marion, Scientific Responsible for the DefMal and Ma\u00edra Nassau, project manager<\/p>\n\n\n\n

9h20 <\/strong>\u2013 10h00 : <\/strong>Prof. Dr. Johannes Kinder (Ludwig Maximilian University of Munich) \u00ab Malicious code continuously changes in response to evolving platforms, defenses, and detection techniques. This makes malware detection inherently difficult : approaches that perform well today may quickly become ineffective. \u00bb<\/strong><\/p>\n\n\n\n

10h00 <\/strong>\u2013 10h30:  <\/strong>Gr\u00e9goire Menguy (CEA List) \u00ab Redefining Grey-Box Deobfuscation through Context-Aware Program Synthesis, and Application to MBA\u00bb<\/strong><\/p>\n\n\n\n

10h30 – 11h00: Coffee break<\/strong><\/p>\n\n\n\n

11h30 <\/strong>\u2013 12h00: <\/strong>Jean-Yves Marion (Universit\u00e9 de Lorraine\/LORIA) Binomics + GoaTracer: Building a Reproducible Infrastructure for Malware Sequencing and Analysis<\/strong><\/p>\n\n\n\n

12h00 \u2013 12:25:<\/strong> Olzhas (CNRS\/IRIF): On Model-Checking Concurrent Self-Modifying Code <\/p>\n\n\n\n

12h30 <\/strong>\u2013 14h00 : Lunch time at Room 101 at \u00c9cole de Mines<\/strong><\/p>\n\n\n\n

14h00 <\/strong>\u2013 14h40 :<\/strong> Karolina Gorna (T\u00e9l\u00e9com Paris) : \u00ab The Data Behind the Race : Rethinking How We Separate Program Inputs from Concurrency Bugs \u00bb<\/strong><\/p>\n\n\n\n

14h40 <\/strong>\u2013 15h05:<\/strong> S\u00e9bastien Larinier (Universit\u00e9 de Lorraine\/LORIA) \u00ab One Engine, Many Brands:Ecosystem, Evasion and the Parental-Control Boundary in Commercial Android Stalkerware\u00bb<\/strong><\/p>\n\n\n\n

15h05 <\/strong>\u2013 15h30: <\/strong>Andr\u00e9 Pacteau (EURECOM) \u00ab <\/strong>Signatures Strike Back or Fall Short? A Comparative Study of Signatures and Machine Learning for Static Malware Classification <\/strong>\u00bb<\/strong><\/strong><\/p>\n\n\n\n

15h25 <\/strong>\u2013 15h50:<\/strong> S\u00e9bastien Killian (CentraleSup\u00e9lec\/IRISA) \u00ab <\/strong>Benchmarking Progress and Reasoning in Autonomous LLM Penetration Testing<\/strong>\u00bb<\/strong><\/strong><\/p>\n\n\n\n

15h50 <\/strong>\u2013 16h15 :  Coffee break <\/strong><\/p>\n\n\n\n

16h30 <\/strong>\u2013 16h55: <\/strong>Stephano de Rosa (EURECOM) <\/strong>\u00ab<\/strong>Under the Radar: Effectiveness and Prevalence of Action-Hiding and Origin-Hiding Evasion Techniques in Windows Malware <\/strong>\u00bb<\/strong><\/p>\n\n\n\n

16h55 <\/strong>\u2013 17h20 : <\/strong>Bassirou Badiane (CentraleSup\u00e9lec\/IRISA) \u00ab From Commands to TTPs: A Deterministic Approach for Large-Scale SSH Botnet Analysis \u00bb<\/strong><\/p>\n\n\n\n

19h00:<\/strong> Dinner together at Brasserie Excelsior – 50 rue Henri Poincar\u00e9 54000 Nancy, France (\u00e0 confirmer)<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n

Friday, October 2<\/strong><\/h3>\n\n\n\n

From 08h30- Welcome coffee<\/strong><\/p>\n\n\n\n

9h00 <\/strong>\u2013 9h50: Invited speaker – <\/strong>Prof. Dr. Alexandre Bartel (Ume\u00e5 University) \u00ab<\/strong>Benign-Looking Code Changes for Software Supply Chain Attacks <\/strong>\u00bb<\/strong><\/strong><\/p>\n\n\n\n

09h50 <\/strong>\u2013 10h15:<\/strong> Marwa Essalehi (CentraleSupelec\/IRISA) – \u00ab <\/strong>A Source-Derived Ground Truth and Neurosymbolic Approach to LLM-Based TTP Prediction <\/strong>\u00bb<\/strong><\/p>\n\n\n\n

10h15 <\/strong>\u2013 10h40:<\/strong> Leo Bertrand (Universit\u00e9 de Lorraine\/LORIA) – \u00ab A Hybrid Architecture for Offensive Security AI Agents \u00bb<\/strong><\/strong><\/p>\n\n\n\n

10h40-11h10: Coffee break<\/strong><\/p>\n\n\n\n

11h10 <\/strong>\u2013 11h35:<\/strong> Victor Matrat (Universit\u00e9 de Lorraine) – \u00ab When AI Confuses Syntax with Semantics: Functional Adversarial Examples Against Binary Similarity Models \u00bb<\/strong><\/strong><\/p>\n\n\n\n

11h35 <\/strong>\u2013 12h00: <\/strong>Dorian Bachelot (CentraleSupelec\/IRISA) – \u00ab <\/strong>HYPERDRIFT: A new approach to high interaction honeypot data analysis applied to React2Shell <\/strong>\u00bb<\/strong><\/p>\n\n\n\n

12h00 <\/strong>\u2013 12h25 : <\/strong>Maira Nassau (Universit\u00e9 de Lorraine) \u2013 \u00ab <\/strong>D<\/strong>arkGoat: A Tool for Cybercrime Research and Analysis \u00bb<\/strong><\/p>\n\n\n\n

12h30 – 14h00: <\/strong>Lunch time at Room 101 at \u00c9cole de Mines<\/strong><\/p>\n\n\n\n

14h00 <\/strong>\u2013 14h40<\/strong>: Giorgia di Pietro \u00ab<\/strong>TBC<\/strong>\u00bb<\/strong><\/em><\/p>\n\n\n\n

14h40 <\/strong>\u2013 15h05<\/strong>: Flash Presentation Session \u2013 5 minutes<\/strong><\/p>\n\n\n\n

– Leonard Prince (CentraleSupelec) – Development and integration of analysis services for a malware processing pipeline<\/strong><\/p>\n\n\n\n

– Lucas Villaume (Universit\u00e9 de Lorraine) – Hybrid anomaly detection system using artificial intelligence and formal methods<\/strong><\/strong><\/p>\n\n\n\n

– Atieh Atieh (CentraleSupelec) – Application of Graph Foundation Models in Cybersecurity<\/strong>.<\/p>\n\n\n\n

– Jean Haurogne (CentraleSupelec\/ORANGE) – <\/p>\n\n\n\n

15h10 : <\/strong>Conclusions<\/p>\n\n\n\n

To participate<\/a><\/p>\n\n\n\n

Practical Information<\/strong><\/h2>\n\n\n\n

Venue<\/strong><\/h3>\n\n\n\n

The workshop will take place at Mines Nancy \u2013 Campus ARTEM<\/strong>,
92 rue du Sergent Blandan, 54000 Nancy, France. <\/p>\n\n\n\n

Getting to Nancy<\/strong><\/h3>\n\n\n\n

From Luxembourg Airport (LUX)<\/strong><\/h4>\n\n\n\n