C&ESAR 2025: Mathis Durand presented his work on honeypots

December 19, 2025December 19, 2025 By Dylan Massieux ECW / Event / PhD PresentationC&ESAR,cyber,cybercni,cybersecurity,ECW,PhD,research

The Cyber CNI Chair reports back on C&ESAR 2025, the cybersecurity conference organized by the Direction Générale de l’Armement (DGA) as part of European Cyber Week in Rennes. Among the highlights of this year’s event was a presentation by Mathis Durand, a third-year doctoral student at IMT Atlantique and member of our chair, which attracted particular attention.

On Thursday, November 20 at 11:30 a.m., Mathis presented his work under the title:
“Can you spot the trap? Detecting honeypots in the face of evolving evasion tactics (SoK),” highlighting the importance of his research for the French and international cyber community.

Understanding and analyzing honeypot detection techniques

Honeypots and honeynets play a crucial role in observing and understanding cyberattacks. As attack techniques evolve, attackers are now developing sophisticated methods to detect and circumvent these decoys. Mathis Durand’s thesis focused on analyzing these evasion methods, categorizing them, and proposing ways to strengthen the robustness of honeynets, particularly in the context of cyber-physical systems (CPS).

His work was based on an in-depth review of the state of the art, structuring the techniques according to several axes: environment, code, behavior, and system realism.

Concrete contributions to cybersecurity

Based on his research, supervised by Marc-Oliver Pahl and Yvon Kermarrec, Mathis presented several concrete contributions aimed at strengthening system analysis and protection capabilities:

New datasets on honeypot detection techniques.

A realistic evaluator capable of testing the resistance of a honeypot against various evasion methods.

A design guide for building more credible and difficult-to-detect honeynets.

This work improves the detection and understanding of threats, particularly in industrial and critical sectors, where digital decoys are an essential tool for analyzing adversarial behavior.

Find out more:
🔗 https://cybercni.fr
🔗 https://www.european-cyber-week.eu
🔗 https://2025.cesar-conference.org