Internship on Artificial Intelligence and Network Intrusion Detection H/F

Scope of the internship

Network intrusion detection systems (NIDS) are software components that analyse network traffic and raise alerts when anomalous behaviour is detected. These systems increasingly rely on artificial intelligence to dynamically learn normal patterns in network traffic and identify abnormal behaviour.

Large language models (LLMs) are strong candidates for these tasks due to their general ability to undertake network‑ and security‑related tasks of varying complexity. However, due to security and ownership concerns, relying on cloud‑based LLM providers is often not viable. Consequently, on‑premise small language models (SLMs) are frequently chosen as a replacement.

This internship will focus on employing SLMs for correlating and characterising NIDS alerts. The candidate is expected to investigate different approaches for using on‑premise SLMs that ultimately enable the characterization of attacks based on MITRE ATT&CK TTPs. Such approaches may make use of agentic workflows and/or information retrieval techniques such as retrieval‑augmented generation (RAG).

Requirements

• Education: Engineering or Master’s degree (final year of study).
• Language: Proficiency in English (written and verbal).
• Cybersecurity: Knowledge of network protocols and cybersecurity principles.
• AI/ML: Understanding of AI/machine learning concepts and tools (NumPy, Pandas, TensorFlow/PyTorch).
• Programming: Good programming skills (Python, C/C++, or other C‑like languages) and basic understanding of DevOps fundamentals (Git, Docker).

Nice to have

• Experience with LLMs and related frameworks (Hugging Face Transformers, Unsloth, LangChain, llama.cpp).

Location

Saclay, France, Ile‑de‑France, Essonne (91), Palaiseau.