SPOT - Spear-Phishing Overwatching Tool
De nos jours, la détection des attaques de phishing génériques à grande échelle est assez efficace. Les techniques qui exploitent la collecte et le partage d’indicateurs de compromission (IOC), telles que MISP (la plateforme open source de partage de renseignements sur les menaces), sont bien établies et donnent de bons résultats sur le terrain. Cependant, la détection des tentatives d’attaques ciblées, dites spear-phishing, est beaucoup plus complexe, car les attaquants exploitent des informations contextuelles sur les cibles qu’ils visent.
En utilisant des informations récentes, pertinentes et précises sur le fonctionnement interne de l’entreprise ciblée, les attaquants peuvent rendre leur tromperie bien plus efficace.
SPOT s’appuie sur des techniques de traitement automatique du langage naturel (NLP), basées notamment sur le machine learning (ML) et les grands modèles de langage (LLM), afin de détecter et prévenir les tentatives de spear-phishing.
Cette présentation couvre l’architecture du projet, les défis rencontrés ainsi que les choix de conception effectués au cours du développement.
Ce projet open source a été cofinancé par l’initiative LU-CID du ministère de l’Économie du Luxembourg.
William manages the technical team behind AS197692 at Conostix S.A. in Luxembourg. He’s been working in cybersecurity using free and opensource software on a daily basis for more than 25 years. Recently, he presented his work on SSL/TLS toolkits at Nullcon 2025 in Goa and Hack.lu 2025 in Luxembourg. He contributed to the cleanup and enhancement efforts done on SSLDump lately. He particularly enjoys tinkering with open (and not so open) hardware. Currently he likes playing around with new tools in the current ML scene, building, hopefully, useful systems for fun and, maybe, profit. When not behind an intelligent wannabe machine, he's doing analog music with his band of humans.
Tech nerd, gamer, living in the past (on purpose)
Mathieu is a software engineer at Conostix, where he's been working, for more than a decade, on cybersecurity and software engineering projects. He is the main developer behind the core of SPOT, focusing on its architecture and backend foundations, while contributing to the broader ecosystem of analysis tooling.
With more than a decade of experience, his interests revolve around building practical, composable systems, such as APIs, integrations and automation pipelines, designed to solve real-world security challenges.
Outside of work, he's equally passionate about video games and retro computing, embracing a deliberately vintage mindset that often influences his approach to technology: understand the fundamentals, keep things simple, and make them last.