| Vol-3056 urn:nbn:de:0074-3056-4 Copyright © 2021 for the individual papers by the papers' authors. Copyright © 2021 for the volume as a collection by its editors. This volume and its papers are published under the Creative Commons License Attribution 4.0 International (CC BY 4.0).

# C&ESAR 2021
Automation in Cybersecurity

### Proceedings of the 28th Computer & Electronics Security Application Rendezvous
co-located with the 6th European Cyber Week (ECW 2021)

### Rennes, France, November 16-17, 2021.

Edited by

### Gurvan LE GUERNIC * **

* DGA Maîtrise de l’Information, BP 7, 35998 Rennes Cedex 9, France
** Université de Rennes 1, Campus de Beaulieu, IRISA/Inria Rennes, 263 avenue du Général Leclerc, 35042 RENNES cedex

## Table of Contents

- C&ESAR’21: Automation in Cybersecurity (preface)3-7
  Summary: There were 32 papers submitted for peer-review to this conference. Out of these, 14 papers were accepted for this volume, 14 as regular papers and 0 as short papers.
- Automation of Cybersecurity: the Cybersecurity Grand Challenge and its Prospects (keynote abstract)9
  William LECAT

### Session 1: Protection & Evaluation

- PROSECCO: Formally-Proven Secure Compiled Code 13-25
  Nicolas BELLEVILLE, Damien COUROUSSÉ, Emmanuelle ENCRENAZ, Karine HEYDEMANN, Quentin MEUNIER
- From Source Code to Crash Test-Case through Software Testing Automation 27-37
  Robin DAVID, Jonathan SALWAN, Justin BOURROUX

### Session 2: Cyber Threat Intelligence

- Automation of Binary Analysis: From Open Source Collection to Threat Intelligence 41-56
  Frédéric GRELOT, Sébastien LARINIER, Marie SALMON
- Automated Risk Analysis of a Vulnerability Disclosure Using Active Learning 57-75
  Clément ELBAZ, Louis RILLING, Christine MORIN
- Attack Forecast and Prediction 77-97
  Florian KAISER, Tobias BUDIG, Elisabeth GOEBEL, Tessa FISCHER, Jurek MUFF, Marcus WIENS, Frank SCHULTMANN

### Session 3: Experience Report

- Network Automation and Security 101-115
  Jean-Michel FARIN, David ROY
- L’Automatisation au Service de la Défense et de la Sécurité par Conception dans un Monde Déconnecté
  (Automation for Defense and Security by Design in a Disconnected World)117-131
  Nicolas LORIOT, Fabien LEBOSSÉ
- L'Automatisation comme Mesure Active de Protection
  (Automation as an Active Measure of Protection)133-145
  Nicolas AUDIOT, Nicolas LORIOT
- Retour d'Expérience d'Intégration des Principes de Sécurité dans un Cycle de Développement Logiciel
  (Integrating Security into Software Development Lifecycle : an Experience Return)147-162
  Laurent BUTTI

### Session 4: Cyber Range

- Cyber Range Automation, a Bedrock for AI Applications 165-174
  Leonardo GAVAUDAN, Swann LEGRAS, Véronique VENTOS
- Cheat Detection in Cyber Security Capture The Flag Games - An Automated Cyber Threat Hunting Approach 175-190
  Robert CHETWYN, Laszlo ERDODI
- Reinforced Autonomous Agents with Attack-Defense Exercises in Realistic Environments 191-209
  Frédéric GUIHÉRY, Georges BOSSERT, Damien CRÉMILLEUX, Édouard KLEIN, Olivier TÉTARD, Baptiste GIGODEAUX

### Session 5: Security Analysis

- Systématisation d’une Démarche de Sécurisation par Conformité Ajustée aux Besoins et Enjeux de Sécurité – une Revue Critique
  (A Critical Review of Approaches to Securing Proportionally to the Needs and Stakes – with Automation Considerations)213-231
  Stephane PAUL, Nicolas VAN CAUTER, Paul VARELA, Simon LEBOEUF, Michael CATROUX
- Automation of Risk-Based Vulnerability Management Based on a Cyber Kill Chain Model 233-248
  Paul VARELA, Alexis ULLIAC, Jean-Luc SIMONI, Thomas MASSIP, Thomas DEVAUX

We offer a BibTeX file for citing papers of this event from LaTeX.

2021-12-15: submitted by Gurvan Le Guernic, metadata incl. bibliographic data published under Creative Commons CC0
1021-12-23: published on CEUR Workshop Proceedings (CEUR-WS.org, ISSN 1613-0073) |valid HTML5|