Recent content on Grégor Quétel - Blog
The paper Title: Superviz26-SQL: A Multi-Domain Benchmark for SQL Attack Detection Authors: Grégor Quetel, Pierre-François Gimenez, Thomas Robert, Laurent Pautet Venue: Assessment with New methodologies, Unified Benchmarks, and environments, of Intrusion detection and response Systems (ANUBIS) 2026. Abstract: Machine-learning intrusion detectors that excel on a testbed often fail once the…
The paper Title: Parser Instrumentation for Semantic-Aware Applicative Intrusion Detection Authors: Grégor Quetel, Pierre-François Gimenez, Thomas Robert, Laurent Pautet Venue: 41st International Conference on ICT Systems Security and Privacy Protection (IFIPSEC26), 2026 Abstract: Intrusion Detection Systems (IDS) are common security tools for protecting modern information systems, yet their…
Context The list of web-based services I self-host is growing. For each service that needs to be reachable from the internet, I register a subdomain and point it to my public IP. My ISP-provided router then forwards incoming HTTP/HTTPS traffic to a single internal machine via NAT. The problem is that my services are spread across multiple machines: I need a routing mechanism to dispatch traffic to…
Motivation When looking for related work for my PhD, Google Scholar is my go-to search engine. However, its results can be overwhelming. Citation counts alone are not always a reliable heuristic for paper quality. To narrow things down, one can use the source: operator in a query to filter by venue name. Ultimately that’s what I did. Over time, I had this saved search string that I would…
Context For a while, I have been wanting to improve my practical knowledge about networking and system administration. Until now, it was limited to university projects and the administration of my Ubuntu-based laptop and an old HP OptiPlex hosting a few services. On top of that, I had this big list of services that could be self-hosted to replace paid or third-party services. Two events triggered…
On my NixOS servers, I set up services (here, nginx) listening on the tailscale IP. However, during deployment the service sometimes fails to start, despite specifying the service to start once tailscale is online: systemd . services . nginx = { after = [ 'tailscaled.service' ]; requires = [ 'tailscaled.service' ]; }; For instance: déc. 21 14:30:52 garmr nginx-pre-start[347563]: nginx: [emerg]…
Context I possess a set of internal web applications that are only available from my tailnet (virtual network using tailscale and headscale). Headscale allows the declaration of extra DNS records 1 , for instance: services . headscale . settings . dns = { extra_records = [ { name = 'deluge.net.gq' ; type = 'A' ; value = '100.64.0.3' ; } ]; }; Then, I set up a Nginx reverse proxy for that record…
The paper Title: Superviz25-SQL: High-Quality Dataset to Empower Unsupervised SQL Injection Detection Systems Authors: Grégor Quetel, Eric Alata, Pierre-François Gimenez, Thomas Robert, Laurent Pautet Venue: Assessment with New methodologies, Unified Benchmarks, and environments, of Intrusion detection and response Systems (ANUBIS) at ESORICS 2025. Abstract: The digitalization of public and…
Context I have an old server running NixOS that is used as my media server: it hosts a Jellyfin instance. While no transcoding is necessary to play most of the movies, the server needs to transcode locally when the played movie uses a specific encoding format unknown by the streaming machine, or when burning subtitles. Transcoding mostly consists of decoding the media stream to raw data,…
About me I am currently pursuing a PhD at Télécom Paris in the ACES team (started October 2023). My research revolves around the design of a new type of applicative data collector for Intrusion Detection. Prior to this, I completed an internship in the PIRAT (ex CIDRE) team at CentraleSupelec (Rennes, France), where I also worked in the field of Intrusion Detection. My educational background…
Context I recently installed NixOS on my machine. I am currently working on some Python project using Visual Studio Code and was previously relying on Python virtual environments and a requirements.txt file to manage my dependencies. Visual Studio Code was smart enough to probe the working directory for virtual environments, and automatically use the one found as the default interpreter. However,…
TIL you can access all known SSH public keys by GitHub with the following: curl https://github.com/<username>.keys . Useful to append those to `authorized_keys. For instance: $ curl https://github.com/gquetel.keys ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKdb082uVrUeJFYQpgyaNG0aBqZFEPUzgYjBoK/LUPr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINL71Lp5AIPb7TftAtD1CB7+ovR6OYTZGeo0H2TItn7u ssh-ed25519…
Today I Learned that Firefox possess a built-in color picker: select top-right burger menu -> More tools -> Eyedropper. It works on any content on displayed web page, here on an embedded jpg picture. Screenshot of firefox's color picker.
Why should I use a reference manager? Efficiency . At university, when I had to study a paper, I would take notes about it in Obsidian. And it was fine as I wasn’t confronted with reading a new article every day. Then, I began to read more and more paper during my research internship and the number of papers I needed to keep track of grew. Importing new entries or exporting bibliography…
NLP Natural Language Processing is a field of linguistics and computer science focused on understanding the human language. NLP tasks include sentiment analysis, translation between different languages, information extraction, question answering, and so on. Application of these mechanisms surrounds us in our all-day life: search engines, chatbots, or even the lately famous ChatGPT are all based on…
TLS protocol mechanism The Transport Layer Security (TLS) protocol is a widely used security protocol that allows the secure exchange of messages between a client and a server over a computer network. It is designed to provide data integrity, confidentiality, and authenticity for the communication. TLS accomplishes this by using encryption and other cryptographic techniques to prevent unauthorized…
Context In computer science parsing corresponds to the transformation of input data (text, code, logs…) into data structures that will be used by some other software. For instance, data structures can be given to a compiler to produce executable code, an interpreter to directly execute code, or a translator to compute an equivalent represention in a different format. Parsing is at the origin of…
Machine learning PyTorch Geometric is an extension of PyTorch to train GNNs on structured data. Their introduction by example page and list of collab notebooks (and associated videos) are very pedagogic and interesting to experiment with. Content in french: videos of classes and seminars on the topic of Natural Language Processing. Classes given by Benoît Sagot. Cybersecurity SQL Injection…