Focus on CERES: a CIEDS project to tackle cyberattacks
A three-step methodology
The CERES project focuses on the various stages involved in securing a cyber-physical system, i.e. a system composed of IT entities that collaborate with each other to command and control physical entities. CERES' contribution is structured around three main areas:
- Modelling the security of cyber-physical systems: modelling such systems is necessary because analysing cybersecurity risks remains complex when dealing with systems that interconnect numerous physical and IT components;
- Modelling and evaluation of industrial network protocols: specifications, where they exist, do not always allow vulnerabilities to be discovered, and implementations, which are often partial or even erroneous, require in-depth analysis;
- The evaluation of operational scenarios in a realistic environment: cyber-physical systems, particularly industrial ones, cannot be shut down, making it impossible to test their security. However, a platform that mimics them as closely as possible would allow attack scenarios to be tested, as well as the most appropriate security policies.
Modelling and experimentation for better anticipation
Grégory Blanc and his team use a model-driven engineering approach to represent cyber attacks carried out in several stages. These attacks, known as multi-state attacks, threaten complex systems.
This method provides a detailed view of vulnerabilities, but it is challenged by the large number of possible combinations, requiring modelling strategies at multiple levels of the system :
- A scale that allows the main features of the system to be mobilised in order to understand its critical interactions, while disregarding its overall functioning;
- A system prototype that allows security mechanisms to be demonstrated on isolated prototypes or prototypes integrated into complete systems.
As part of this project, a hardware platform representative of a complex system such as a building's technical management system was designed. With the aim of simulating the impact of cyberattacks on the infrastructure, scientists also developed a digital twin, in other words a virtual replica of the platform.
Military and civil applications
This project has many potential applications in both the military and civilian sectors.
In the military sector, security policy controls could be integrated throughout the lifecycle of complex systems. When security mechanisms and their components are supplied by an external entity, it is essential to rigorously and reproducibly verify that they meet cybersecurity standards.
‘The development and validation of digital security mechanisms are the foundation of our digital sovereignty,’ explains Grégory Blanc. The results obtained in this project would also improve domestic digital security, in other words the security of digital equipment and connected systems in homes.
Finally, the methods developed could also find practical applications in power plants and hospitals, where an IT failure could cause serious physical malfunctions and, in the most critical cases, put lives at risk.
Find out more
Watch a video presentation of the CERES project by Grégory Blanc on the CIEDS playlist on the IP Paris YouTube channel:
Grégory Blanc will also speak on 21 October 2025 at the École Polytechnique in a round table discussion dedicated to artificial intelligence and cybersecurity during the Cybersecurity and Defence Meetings. This event is organised by the Institut Polytechnique de Paris, in partnership with the Interdisciplinary Centre for Defence and Security Studies (CIEDS) and the Cybersecurity and Digital Sovereignty Chair – IHEDN attached to the Institut des Hautes Études de Défense Nationale through its Endowment Fund.