Slide
Centre Interdisciplinaire
de Recherche et d’Innovation
en Cybersécurité et Société
de Recherche et d’Innovation
en Cybersécurité et Société
1.
Malasi, J. -J. M.; Moudoud, H.; Missaoui, R.
CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems Proceedings Article
In: Dig Tech Pap IEEE Int Conf Consum Electron, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 0747668X (ISSN); 979-833155343-2 (ISBN), (Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron).
Abstract | Links | BibTeX | Tags: Alarm systems, Budget control, causal reasoning, Chains, Computer crime, Concept Drift, Concept drifts, Conformal Risk Control, Counterfactuals, Generative AI, Human computer interaction, Intrusion Detection, Intrusion Detection Systems, Intrusion-Detection, Knowledge based systems, Language model, LLM, LLMs, Network intrusion, Network security, Risks controls, Sampling
@inproceedings{malasiCausalGraphWhenCausal2026,
title = {CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems},
author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},
url = {https://www.scopus.com/pages/publications/105037367854?origin=resultslist},
doi = {10.1109/ICCE67443.2026.11449614},
isbn = {0747668X (ISSN); 979-833155343-2 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {Dig Tech Pap IEEE Int Conf Consum Electron},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Modern intrusion detection systems often achieve impressive benchmark accuracy yet fail in real-world deployment, where network behavior and attacker tactics continuously evolve. Under concept drift, decision boundaries learned offline can diverge from operational reality, triggering false-alarm cascades and creating detection blind spots that erode analyst trust. In this paper, we propose CausalGraph-IDS, a causal and language-model-assisted intrusion detection framework that moves beyond purely correlational scoring by explicitly verifying multi-stage attack chains. Additionally, we propose CHAIN-CRC, a unified algorithm that (i) learns a constrained attack-chain causal graph guided by knowledge-based priors derived from widely used adversary behavior taxonomies, (ii) computes robustness scores by testing whether alarms persist under feasible counterfactual security interventions, and (iii) applies conformal risk control to enforce operator-defined false-positive budgets with finite-sample guarantees.Generative models are integrated in strictly assistive roles through three modules: prior induction to distill causal constraints from unstructured threat reports, counterfactual generation to propose realistic and operationally feasible interventions, and causal logic justification to produce human-readable explanations grounded in the learned attack chain. Experiments on two widely used network intrusion detection benchmarks show that CausalGraph-IDS provides robust, explainable, and risk-governed detection, maintaining strong recall at low false-positive rates while delivering actionable causal insights for mitigation. © 2026 IEEE.},
note = {Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron},
keywords = {Alarm systems, Budget control, causal reasoning, Chains, Computer crime, Concept Drift, Concept drifts, Conformal Risk Control, Counterfactuals, Generative AI, Human computer interaction, Intrusion Detection, Intrusion Detection Systems, Intrusion-Detection, Knowledge based systems, Language model, LLM, LLMs, Network intrusion, Network security, Risks controls, Sampling},
pubstate = {published},
tppubtype = {inproceedings}
}
Modern intrusion detection systems often achieve impressive benchmark accuracy yet fail in real-world deployment, where network behavior and attacker tactics continuously evolve. Under concept drift, decision boundaries learned offline can diverge from operational reality, triggering false-alarm cascades and creating detection blind spots that erode analyst trust. In this paper, we propose CausalGraph-IDS, a causal and language-model-assisted intrusion detection framework that moves beyond purely correlational scoring by explicitly verifying multi-stage attack chains. Additionally, we propose CHAIN-CRC, a unified algorithm that (i) learns a constrained attack-chain causal graph guided by knowledge-based priors derived from widely used adversary behavior taxonomies, (ii) computes robustness scores by testing whether alarms persist under feasible counterfactual security interventions, and (iii) applies conformal risk control to enforce operator-defined false-positive budgets with finite-sample guarantees.Generative models are integrated in strictly assistive roles through three modules: prior induction to distill causal constraints from unstructured threat reports, counterfactual generation to propose realistic and operationally feasible interventions, and causal logic justification to produce human-readable explanations grounded in the learned attack chain. Experiments on two widely used network intrusion detection benchmarks show that CausalGraph-IDS provides robust, explainable, and risk-governed detection, maintaining strong recall at low false-positive rates while delivering actionable causal insights for mitigation. © 2026 IEEE.
2.
Laamari, A.; Moudoud, H.; Houda, Z. A. El
Lightweight LLM Adaptation for Intrusion Detection via Token-Efficient Flow Representation Proceedings Article
In: IEEE Conf. Artif. Intell., CAI, pp. 2122–2127, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 979-833156039-3 (ISBN), (Journal Abbreviation: IEEE Conf. Artif. Intell., CAI).
Abstract | Links | BibTeX | Tags: Classification (of information), Data flow analysis, Decoder-only large language model, Decoder-only LLMs, decoding, Flow classification, Intrusion Detection, Intrusion-Detection, Language model, Large language model, LLMs, LoRA, Low-rank adaptation, Network Flow Classification, Network intrusion, Network security, Networks flows, Qwen2.5, Signal encoding, T5-Small, Token-oriented object notation, Tokenization, TOON
@inproceedings{laamariLightweightLLMAdaptation2026,
title = {Lightweight LLM Adaptation for Intrusion Detection via Token-Efficient Flow Representation},
author = {A. Laamari and H. Moudoud and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105042133342?origin=resultslist},
doi = {10.1109/CAI68641.2026.11536533},
isbn = {979-833156039-3 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Conf. Artif. Intell., CAI},
pages = {2122–2127},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Large language models (LLMs) are emerging as a promising approach for intrusion detection using structured network flow data. However, their practical deployment is constrained by context window limitations and the excessive token overhead introduced by conventional tabular serialization formats such as JSON. Verbose data representations inflate sequence lengths, often exceeding model input limits and causing feature truncation. Additionally, it remains unclear which LLM architecture is more suitable for structured intrusion detection tasks under limited training resources. To tackle this issue, we propose a novel representation-aware intrusion detection framework based on Token-Oriented Object Notation (TOON), a compact serialization format that maximizes token efficiency while preserving schema structure. Also, we integrate a Low-Rank Adaptation (LoRA) scheme to enable parameter-efficient fine-tuning. Finally, we evaluate the proposed framework as an encoder-decoder model (T5-Small) with a decoder-only model (Qwen2.5) on three benchmark datasets, including NSL-KDD, UNSW-NB15, and CIC-IDS2018 for binary and multi-class classification scenarios. The results show that our tokenizer-aligned, representation-aware preprocessing combined with lightweight encoder-decoder adaptation provides a practical and resource-efficient foundation for LLM-based intrusion detection. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Conf. Artif. Intell., CAI},
keywords = {Classification (of information), Data flow analysis, Decoder-only large language model, Decoder-only LLMs, decoding, Flow classification, Intrusion Detection, Intrusion-Detection, Language model, Large language model, LLMs, LoRA, Low-rank adaptation, Network Flow Classification, Network intrusion, Network security, Networks flows, Qwen2.5, Signal encoding, T5-Small, Token-oriented object notation, Tokenization, TOON},
pubstate = {published},
tppubtype = {inproceedings}
}
Large language models (LLMs) are emerging as a promising approach for intrusion detection using structured network flow data. However, their practical deployment is constrained by context window limitations and the excessive token overhead introduced by conventional tabular serialization formats such as JSON. Verbose data representations inflate sequence lengths, often exceeding model input limits and causing feature truncation. Additionally, it remains unclear which LLM architecture is more suitable for structured intrusion detection tasks under limited training resources. To tackle this issue, we propose a novel representation-aware intrusion detection framework based on Token-Oriented Object Notation (TOON), a compact serialization format that maximizes token efficiency while preserving schema structure. Also, we integrate a Low-Rank Adaptation (LoRA) scheme to enable parameter-efficient fine-tuning. Finally, we evaluate the proposed framework as an encoder-decoder model (T5-Small) with a decoder-only model (Qwen2.5) on three benchmark datasets, including NSL-KDD, UNSW-NB15, and CIC-IDS2018 for binary and multi-class classification scenarios. The results show that our tokenizer-aligned, representation-aware preprocessing combined with lightweight encoder-decoder adaptation provides a practical and resource-efficient foundation for LLM-based intrusion detection. © 2026 IEEE.
3.
Selamnia, A.; Moudoud, H.; Khoukhi, L.; Brik, B.; Houda, Z. A. El
QSFL-ID: Quantum-Split Federated Learning for Intrusion Detection in IIoT Networks Proceedings Article
In: IEEE Int Conf Commun, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 15503607 (ISSN); 979-831954209-0 (ISBN), (Journal Abbreviation: IEEE Int Conf Commun).
Abstract | Links | BibTeX | Tags: Automation, Complex networks, Cyber threats, Federated learning, IIoT, Industrial automation, Industrial internet of thing, Intrusion Detection, Intrusion-Detection, Learning systems, Machine learning methods, Network intrusion, Network security, Privacy-preserving techniques, Processing power, QML, Quantum circuit, Quantum entanglement, Split Learning, Variational quantum circuit, VQC
@inproceedings{selamniaQSFLIDQuantumSplitFederated2026,
title = {QSFL-ID: Quantum-Split Federated Learning for Intrusion Detection in IIoT Networks},
author = {A. Selamnia and H. Moudoud and L. Khoukhi and B. Brik and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105045419288?origin=resultslist},
doi = {10.1109/ICC59461.2026.11587037},
isbn = {15503607 (ISSN); 979-831954209-0 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Int Conf Commun},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {The Industrial Internet of Things (IIoT) is reshaping industrial automation through interconnected, intelligent systems. However, this evolution increases exposure to sophisticated cyber threats, especially given the constraints of IIoT devices such as limited processing power, bandwidth, and heterogeneous protocols. Traditional machine learning methods often fail to meet these security demands due to their computational intensity and centralized data requirements. To address this, we propose a hybrid quantum-classical Split Federated Learning (SFL) framework for intrusion detection in IIoT networks. Our method integrates Variational Quantum Circuits (VQCs) to model complex, non-linear data relationships, enhancing detection accuracy while preserving data privacy through decentralized learning. The architecture assigns lightweight preprocessing to edge devices and complex analysis to a quantum backend, ensuring efficiency and scalability. To evaluate the proposed framework, we conduct extensive experiments on the real-world EDGE-IIoT dataset; the experimental results demonstrate that the model attains 95.5% training accuracy, significantly surpassing classical SFL (85.7%). In addition, the quantum model's enhanced entanglement properties and expressibility strengthen its generalization performance. This approach offers an efficient and privacy-preserving solution for securing IIoT systems. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Int Conf Commun},
keywords = {Automation, Complex networks, Cyber threats, Federated learning, IIoT, Industrial automation, Industrial internet of thing, Intrusion Detection, Intrusion-Detection, Learning systems, Machine learning methods, Network intrusion, Network security, Privacy-preserving techniques, Processing power, QML, Quantum circuit, Quantum entanglement, Split Learning, Variational quantum circuit, VQC},
pubstate = {published},
tppubtype = {inproceedings}
}
The Industrial Internet of Things (IIoT) is reshaping industrial automation through interconnected, intelligent systems. However, this evolution increases exposure to sophisticated cyber threats, especially given the constraints of IIoT devices such as limited processing power, bandwidth, and heterogeneous protocols. Traditional machine learning methods often fail to meet these security demands due to their computational intensity and centralized data requirements. To address this, we propose a hybrid quantum-classical Split Federated Learning (SFL) framework for intrusion detection in IIoT networks. Our method integrates Variational Quantum Circuits (VQCs) to model complex, non-linear data relationships, enhancing detection accuracy while preserving data privacy through decentralized learning. The architecture assigns lightweight preprocessing to edge devices and complex analysis to a quantum backend, ensuring efficiency and scalability. To evaluate the proposed framework, we conduct extensive experiments on the real-world EDGE-IIoT dataset; the experimental results demonstrate that the model attains 95.5% training accuracy, significantly surpassing classical SFL (85.7%). In addition, the quantum model's enhanced entanglement properties and expressibility strengthen its generalization performance. This approach offers an efficient and privacy-preserving solution for securing IIoT systems. © 2026 IEEE.
4.
Guerziz, I.; Falk, T.; Le, L. B.; Houda, Z. A. E.
Domain Adversarial Neural Networks with Adversarial Robustness Evaluation for Intrusion Detection Systems Proceedings Article
In: K., Adi; O., Nguena Timo; N., Boulahia-Cuppens; D., Espes; N., Stakhanova; M., Omar (Ed.): Lect. Notes Comput. Sci., pp. 153–165, Springer Science and Business Media Deutschland GmbH, 2026, ISBN: 03029743 (ISSN); 978-303220731-9 (ISBN), (Journal Abbreviation: Lect. Notes Comput. Sci.).
Abstract | Links | BibTeX | Tags: Adversarial Attacks, Adversarial neural network, Adversarial Neural Networks, Attack Resilience, Attack resiliences, Computer crime, Domain adaptation, Fast gradient sign method, FGSM, Gradient-descent, Intrusion Detection, Intrusion Detection Systems, Network intrusion, Network intrusion detection systems, Network security, Neural networks, Neural-networks, PGD, Projected gradient, Projected gradient descent
@inproceedings{guerzizDomainAdversarialNeural2026,
title = {Domain Adversarial Neural Networks with Adversarial Robustness Evaluation for Intrusion Detection Systems},
author = {I. Guerziz and T. Falk and L. B. Le and Z. A. E. Houda},
editor = {Adi K. and Nguena Timo O. and Boulahia-Cuppens N. and Espes D. and Stakhanova N. and Omar M.},
url = {https://www.scopus.com/pages/publications/105046102448?origin=resultslist},
doi = {10.1007/978-3-032-20732-6_10},
isbn = {03029743 (ISSN); 978-303220731-9 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {Lect. Notes Comput. Sci.},
volume = {16295 LNCS},
pages = {153–165},
publisher = {Springer Science and Business Media Deutschland GmbH},
abstract = {Modern Network Intrusion Detection Systems (NIDS) face the dual challenge of maintaining performance across diverse network environments while resisting adversarial manipulations. This paper investigates the intersection of domain adaptation and adversarial robustness in NIDS, a topic that has not been extensively studied. We implement a Domain-Adversarial Neural Network (DANN) with dynamic gradient reversal to adapt models from NSL-KDD to UNSW-NB15. To evaluate security, we assess the model under Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks. Additionally, we introduce FGSM-based adversarial training to enhance robustness. Our results show that while domain adaptation improves cross-domain detection, it also increases susceptibility to adversarial attacks. Incorporating adversarial training mitigates this vulnerability, improving resilience without compromising performance on clean data. These findings provide key insights for designing adaptive and secure intrusion detection systems. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.},
note = {Journal Abbreviation: Lect. Notes Comput. Sci.},
keywords = {Adversarial Attacks, Adversarial neural network, Adversarial Neural Networks, Attack Resilience, Attack resiliences, Computer crime, Domain adaptation, Fast gradient sign method, FGSM, Gradient-descent, Intrusion Detection, Intrusion Detection Systems, Network intrusion, Network intrusion detection systems, Network security, Neural networks, Neural-networks, PGD, Projected gradient, Projected gradient descent},
pubstate = {published},
tppubtype = {inproceedings}
}
Modern Network Intrusion Detection Systems (NIDS) face the dual challenge of maintaining performance across diverse network environments while resisting adversarial manipulations. This paper investigates the intersection of domain adaptation and adversarial robustness in NIDS, a topic that has not been extensively studied. We implement a Domain-Adversarial Neural Network (DANN) with dynamic gradient reversal to adapt models from NSL-KDD to UNSW-NB15. To evaluate security, we assess the model under Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks. Additionally, we introduce FGSM-based adversarial training to enhance robustness. Our results show that while domain adaptation improves cross-domain detection, it also increases susceptibility to adversarial attacks. Incorporating adversarial training mitigates this vulnerability, improving resilience without compromising performance on clean data. These findings provide key insights for designing adaptive and secure intrusion detection systems. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.
5.
Elhajjout, A.; Jarir, Z.; Moudoud, H.; Davoust, A.; Houda, Z. A. El
Leveraging Large Language Models for Contextual Threat Hypothesis Generation in IoT Networks Proceedings Article
In: Dig Tech Pap IEEE Int Conf Consum Electron, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 0747668X (ISSN); 979-833155343-2 (ISBN), (Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron).
Abstract | Links | BibTeX | Tags: Alert Triage, Cybersecurity, Hypotheses generation, Internet of thing security, Internet of things, IoT Security, Language model, Large datasets, Large language model, large language models, Network security, Prompt Engineering, Security alerts, Security operation center, Security Operations, Security systems, Threat Hypothesis Generation
@inproceedings{elhajjoutLeveragingLargeLanguage2026,
title = {Leveraging Large Language Models for Contextual Threat Hypothesis Generation in IoT Networks},
author = {A. Elhajjout and Z. Jarir and H. Moudoud and A. Davoust and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105037351870?origin=resultslist},
doi = {10.1109/ICCE67443.2026.11449914},
isbn = {0747668X (ISSN); 979-833155343-2 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {Dig Tech Pap IEEE Int Conf Consum Electron},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Modern Security Operations Centers face numerous challenges in managing the volume and complexity of security alerts from Internet of Things (IoT) networks. While traditional rule-based systems excel at detection, they provide limited contextual reasoning to help analysts understand ambiguous alerts. Large Language Models (LLMs) have shown promise across various cybersecurity domains. However, their potential to generate rich, explanatory threat hypotheses for ambiguous IoT alerts remains largely unexplored. To address these issues, in this paper, we present a systematic investigation of Large Language Model-based threat hypothesis generation with three key contributions. First, we introduce a context-aware structured prompting framework capable of synthesizing heterogeneous device telemetry into coherent threat narratives. Second, we formalize the assessment of explainability in security through a rigorous multidimensional quality metric system. Third, we provide the first comparative analysis of five state-of-the-art models on real-world IoT incidents, revealing critical performance tradeoffs. Results show that GPT-4o-mini achieves 88.2% accuracy on diverse attack types, while Qwen 3-235B achieves 95.2% accuracy on network-focused attacks. Statistical analysis reveals significant model-dataset interactions. These findings show that properly guided Large Language Models can augment analyst capabilities by providing detailed, contextual explanations that facilitate efficient alert triage. © 2026 IEEE.},
note = {Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron},
keywords = {Alert Triage, Cybersecurity, Hypotheses generation, Internet of thing security, Internet of things, IoT Security, Language model, Large datasets, Large language model, large language models, Network security, Prompt Engineering, Security alerts, Security operation center, Security Operations, Security systems, Threat Hypothesis Generation},
pubstate = {published},
tppubtype = {inproceedings}
}
Modern Security Operations Centers face numerous challenges in managing the volume and complexity of security alerts from Internet of Things (IoT) networks. While traditional rule-based systems excel at detection, they provide limited contextual reasoning to help analysts understand ambiguous alerts. Large Language Models (LLMs) have shown promise across various cybersecurity domains. However, their potential to generate rich, explanatory threat hypotheses for ambiguous IoT alerts remains largely unexplored. To address these issues, in this paper, we present a systematic investigation of Large Language Model-based threat hypothesis generation with three key contributions. First, we introduce a context-aware structured prompting framework capable of synthesizing heterogeneous device telemetry into coherent threat narratives. Second, we formalize the assessment of explainability in security through a rigorous multidimensional quality metric system. Third, we provide the first comparative analysis of five state-of-the-art models on real-world IoT incidents, revealing critical performance tradeoffs. Results show that GPT-4o-mini achieves 88.2% accuracy on diverse attack types, while Qwen 3-235B achieves 95.2% accuracy on network-focused attacks. Statistical analysis reveals significant model-dataset interactions. These findings show that properly guided Large Language Models can augment analyst capabilities by providing detailed, contextual explanations that facilitate efficient alert triage. © 2026 IEEE.
6.
Kadi, A.; Moudoud, H.; Khoukhi, L.; Houda, Z. A. El
Quantum-Enhanced LSTM for Sequential Network Flow Analysis: A Hybrid Approach to DDoS Detection Proceedings Article
In: Proc. - Int. Conf. Quantum Commun., Netw., Comput., QCNC, pp. 830–834, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 979-833156110-9 (ISBN), (Journal Abbreviation: Proc. - Int. Conf. Quantum Commun., Netw., Comput., QCNC).
Abstract | Links | BibTeX | Tags: Denialof- service attacks, Distributed computer systems, Distributed denial of service, Distributed denial-of-service, Distributed Denial-of-Service (DDoS), Hybrid approach, Intrusion Detection, Learning systems, Logic gates, Long short-term memory, Machine-learning, Memory architecture, Network architecture, Network flow analysis, Network security, QLSTM, Quantum entanglement, Quantum machine learning, Quantum Machine Learning(QML), Quantum machines, Qubits, short term memory
@inproceedings{kadiQuantumEnhancedLSTMSequential2026,
title = {Quantum-Enhanced LSTM for Sequential Network Flow Analysis: A Hybrid Approach to DDoS Detection},
author = {A. Kadi and H. Moudoud and L. Khoukhi and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105040813271?origin=resultslist},
doi = {10.1109/QCNC69040.2026.00136},
isbn = {979-833156110-9 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {Proc. - Int. Conf. Quantum Commun., Netw., Comput., QCNC},
pages = {830–834},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Distributed Denial-of-Service (DDoS) attacks continue to grow at a rapid rate, making timely and reliable detection a challenge for intrusion detection systems (IDSs). Classical deep models such as Long Short-Term Memory (LSTM) can capture temporal dependencies; however, they still struggle with highly nonlinear and noisy flow dynamics, especially when attack patterns shift. To address this, we propose QLSTM-E, an enhanced hybrid quantum-classical architecture for network intrusion detection that uses Variational Quantum Circuits (VQCs) and LSTM modeling to learn complex temporal dependencies in network traffic. QLSTM-E exploits quantum characteristics, including superposition and entanglement, to improve the representation of nonlinear patterns in sequential flow features. To balance expressivity and circuit cost on near-term devices, we adopt an angle-based encoding strategy and a star-topology entangling layout that reduces two-qubit gate overhead while preserving effective quantum correlations. We implement QLSTM-E using PennyLane and Qiskit and evaluate it on the CIC-DDoS2019 dataset under a fully simulated setting, requiring no access to quantum hardware. Experimental results demonstrate strong detection effectiveness, achieving 99.7% accuracy and F1-score, and show strong robustness under depolarizing noise up to p= 0.1. © 2026 IEEE.},
note = {Journal Abbreviation: Proc. - Int. Conf. Quantum Commun., Netw., Comput., QCNC},
keywords = {Denialof- service attacks, Distributed computer systems, Distributed denial of service, Distributed denial-of-service, Distributed Denial-of-Service (DDoS), Hybrid approach, Intrusion Detection, Learning systems, Logic gates, Long short-term memory, Machine-learning, Memory architecture, Network architecture, Network flow analysis, Network security, QLSTM, Quantum entanglement, Quantum machine learning, Quantum Machine Learning(QML), Quantum machines, Qubits, short term memory},
pubstate = {published},
tppubtype = {inproceedings}
}
Distributed Denial-of-Service (DDoS) attacks continue to grow at a rapid rate, making timely and reliable detection a challenge for intrusion detection systems (IDSs). Classical deep models such as Long Short-Term Memory (LSTM) can capture temporal dependencies; however, they still struggle with highly nonlinear and noisy flow dynamics, especially when attack patterns shift. To address this, we propose QLSTM-E, an enhanced hybrid quantum-classical architecture for network intrusion detection that uses Variational Quantum Circuits (VQCs) and LSTM modeling to learn complex temporal dependencies in network traffic. QLSTM-E exploits quantum characteristics, including superposition and entanglement, to improve the representation of nonlinear patterns in sequential flow features. To balance expressivity and circuit cost on near-term devices, we adopt an angle-based encoding strategy and a star-topology entangling layout that reduces two-qubit gate overhead while preserving effective quantum correlations. We implement QLSTM-E using PennyLane and Qiskit and evaluate it on the CIC-DDoS2019 dataset under a fully simulated setting, requiring no access to quantum hardware. Experimental results demonstrate strong detection effectiveness, achieving 99.7% accuracy and F1-score, and show strong robustness under depolarizing noise up to p= 0.1. © 2026 IEEE.
7.
Mehrban, A.; Moudoud, H.; Brik, B.; Khoukhi, L.; Houda, Z. A. El
Game-Theoretic Security Orchestration for Cross-RIC Policy Conflicts in O-RAN Proceedings Article
In: IEEE Int Conf Commun, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 15503607 (ISSN); 979-831954209-0 (ISBN), (Journal Abbreviation: IEEE Int Conf Commun).
Abstract | Links | BibTeX | Tags: Computation theory, Computer system firewalls, Cryptography, Game theory, Game-theoretic, Multiple vendors, Network architecture, Network security, Networks security, Open radio access network, Open RAN, Policy conflict, Radio access networks, Security orchestration, Service management, Service orchestration, SMO, Xapp/rapp conflict, xApp/rApp conflicts
@inproceedings{mehrbanGameTheoreticSecurityOrchestration2026,
title = {Game-Theoretic Security Orchestration for Cross-RIC Policy Conflicts in O-RAN},
author = {A. Mehrban and H. Moudoud and B. Brik and L. Khoukhi and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105045343135?origin=resultslist},
doi = {10.1109/ICC59461.2026.11587926},
isbn = {15503607 (ISSN); 979-831954209-0 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Int Conf Commun},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {In Open Radio Access Network (Open RAN), disaggregated network components can interact through specialized xApps or rApps from multiple vendors. Despite the flexibility of operations and the dynamism of functions enabled by the open architecture, this openness can cause conflicts in security policy enforcement (e.g., encryption levels, key rotation, firewall restrictiveness), formally defined as thresholded divergences on shared or interdependent security parameters, where one app wants to set a stricter rule while another wants a more lenient policy simultaneously. The current solutions of "first-come"or "last-write"make the change one-sided for the benefit of a single app, while other apps may be harmed by the result, and at a network level, security and stability can be compromised. In this paper, we propose a novel Game-Theoretic Security Orchestrator (GTSO) that operates at the Service Management and Orchestration (SMO) layer, with cross-RIC scope, and is responsible for resolving parameter conflicts across xApps and rApps. GTSO treats xApps/rApps as strategic players and negotiates convergent solutions using game-theoretic models such as non-cooperative Nash games, cooperative bargaining, and leader-follower (Stackelberg) that guide competing control applications toward stable equilibrium points, while exchanging strategy summaries over secure channels to protect sensitive details and enhance overall network security. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Int Conf Commun},
keywords = {Computation theory, Computer system firewalls, Cryptography, Game theory, Game-theoretic, Multiple vendors, Network architecture, Network security, Networks security, Open radio access network, Open RAN, Policy conflict, Radio access networks, Security orchestration, Service management, Service orchestration, SMO, Xapp/rapp conflict, xApp/rApp conflicts},
pubstate = {published},
tppubtype = {inproceedings}
}
In Open Radio Access Network (Open RAN), disaggregated network components can interact through specialized xApps or rApps from multiple vendors. Despite the flexibility of operations and the dynamism of functions enabled by the open architecture, this openness can cause conflicts in security policy enforcement (e.g., encryption levels, key rotation, firewall restrictiveness), formally defined as thresholded divergences on shared or interdependent security parameters, where one app wants to set a stricter rule while another wants a more lenient policy simultaneously. The current solutions of "first-come"or "last-write"make the change one-sided for the benefit of a single app, while other apps may be harmed by the result, and at a network level, security and stability can be compromised. In this paper, we propose a novel Game-Theoretic Security Orchestrator (GTSO) that operates at the Service Management and Orchestration (SMO) layer, with cross-RIC scope, and is responsible for resolving parameter conflicts across xApps and rApps. GTSO treats xApps/rApps as strategic players and negotiates convergent solutions using game-theoretic models such as non-cooperative Nash games, cooperative bargaining, and leader-follower (Stackelberg) that guide competing control applications toward stable equilibrium points, while exchanging strategy summaries over secure channels to protect sensitive details and enhance overall network security. © 2026 IEEE.
8.
Houda, Z. A. El; Moudoud, H.
Toward a Secure Zero-Touch Tactile Internet: Challenges and Opportunities Journal Article
In: IEEE Communications Magazine, vol. 64, no. 1, pp. 56–62, 2026, ISSN: 01636804 (ISSN).
Abstract | Links | BibTeX | Tags: Communication service, Communications networks, High availability, High reliability, Low latency, Network security, Real-time application, Remote surgery, Security aspects, Security challenges, Tactile sensors, Ultra-high, virtual reality
@article{elhoudaSecureZeroTouchTactile2026,
title = {Toward a Secure Zero-Touch Tactile Internet: Challenges and Opportunities},
author = {Z. A. El Houda and H. Moudoud},
url = {https://www.scopus.com/pages/publications/105025652094?origin=resultslist},
doi = {10.1109/MCOM.001.2500259},
issn = {01636804 (ISSN)},
year = {2026},
date = {2026-01-01},
journal = {IEEE Communications Magazine},
volume = {64},
number = {1},
pages = {56–62},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Tactile Internet (TI) is a new generation of communication networks, extending beyond 5G/6G capabilities to achieve ultra-low latency, ultra-responsive, ultra-high availability, and ultra-high reliability communication services and thus enabling a new era of real-time applications, such as virtual reality, remote surgery, and autonomous driving. TI is expected to revolutionize many industries, including healthcare, transportation, and manufacturing. Despite recent TI initiatives, security aspects remain largely unexplored. TI presents several security challenges due to the increased complexity of the network and the criticality of the applications it supports. Thus, security aspects must be carefully designed to ensure that the benefits of the TI are not outweighed by the risks. In this article, we will initially identify the leading factors that drive TI, with regard to their applications and related technological trends, with respect to ETSI's Zero-touch Service Management (ZSM) principles. Then, we shed light on the primary security challenges, the current missing building blocks toward secure TI, and propose some potential solutions. Finally, we conclude the article with several recommendations and observations for the roadmap toward secure TI. Ultimately, the focus of this article is to establish a foundation for more in-depth research on TI security. © 1979-2012 IEEE.},
keywords = {Communication service, Communications networks, High availability, High reliability, Low latency, Network security, Real-time application, Remote surgery, Security aspects, Security challenges, Tactile sensors, Ultra-high, virtual reality},
pubstate = {published},
tppubtype = {article}
}
Tactile Internet (TI) is a new generation of communication networks, extending beyond 5G/6G capabilities to achieve ultra-low latency, ultra-responsive, ultra-high availability, and ultra-high reliability communication services and thus enabling a new era of real-time applications, such as virtual reality, remote surgery, and autonomous driving. TI is expected to revolutionize many industries, including healthcare, transportation, and manufacturing. Despite recent TI initiatives, security aspects remain largely unexplored. TI presents several security challenges due to the increased complexity of the network and the criticality of the applications it supports. Thus, security aspects must be carefully designed to ensure that the benefits of the TI are not outweighed by the risks. In this article, we will initially identify the leading factors that drive TI, with regard to their applications and related technological trends, with respect to ETSI's Zero-touch Service Management (ZSM) principles. Then, we shed light on the primary security challenges, the current missing building blocks toward secure TI, and propose some potential solutions. Finally, we conclude the article with several recommendations and observations for the roadmap toward secure TI. Ultimately, the focus of this article is to establish a foundation for more in-depth research on TI security. © 1979-2012 IEEE.
9.
Zoungrana, A. F.; Moudoud, H.; Tajeuna, E. G.; Adi, K.
Adversarial Ensemble Framework: Leveraging GANs for Robust Intrusion Detection in IoT Networks Proceedings Article
In: K., Adi; O., Nguena Timo; N., Boulahia-Cuppens; D., Espes; N., Stakhanova; M., Omar (Ed.): Lect. Notes Comput. Sci., pp. 85–99, Springer Science and Business Media Deutschland GmbH, 2026, ISBN: 03029743 (ISSN); 978-303220731-9 (ISBN), (Journal Abbreviation: Lect. Notes Comput. Sci.).
Abstract | Links | BibTeX | Tags: Adversarial networks, Class imbalance, Computer crime, Concept drifts, Gallium nitride, Generative adversarial networks, Internet of thing network, Internet of things, Intrusion Detection, Intrusion Detection Systems, Intrusion-Detection, IoT Networks, Key Issues, Network intrusion, Network security, Rapid expansion, Security, Security challenges
@inproceedings{zoungranaAdversarialEnsembleFramework2026,
title = {Adversarial Ensemble Framework: Leveraging GANs for Robust Intrusion Detection in IoT Networks},
author = {A. F. Zoungrana and H. Moudoud and E. G. Tajeuna and K. Adi},
editor = {Adi K. and Nguena Timo O. and Boulahia-Cuppens N. and Espes D. and Stakhanova N. and Omar M.},
url = {https://www.scopus.com/pages/publications/105046136116?origin=resultslist},
doi = {10.1007/978-3-032-20732-6_6},
isbn = {03029743 (ISSN); 978-303220731-9 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {Lect. Notes Comput. Sci.},
volume = {16295 LNCS},
pages = {85–99},
publisher = {Springer Science and Business Media Deutschland GmbH},
abstract = {The rapid expansion of Internet of Things (IoT) devices introduces complex security challenges that traditional intrusion detection systems struggle to address. This paper proposes an Adversarial Ensemble Framework using Generative Adversarial Networks (GANs) to improve the accuracy and resilience of intrusion detection in IoT environments. The framework tackles key issues such as class imbalance, concept drift, and adversarial attacks by employing multiple GAN variants such as Vanilla GAN, Conditional GAN (CGAN), and Wasserstein GAN (WGAN) to generate high-quality synthetic attack data. A dynamic ensemble learning mechanism selects the most effective model for each attack type based on performance metrics. Experiments on NSL-KDD and CIC-IDS2017 show that WGAN yields the most effective synthetic data, contributing to a detection rate of up to 96%. The approach proves particularly effective in identifying rare attacks, making it a scalable and adaptive solution for IoT security. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.},
note = {Journal Abbreviation: Lect. Notes Comput. Sci.},
keywords = {Adversarial networks, Class imbalance, Computer crime, Concept drifts, Gallium nitride, Generative adversarial networks, Internet of thing network, Internet of things, Intrusion Detection, Intrusion Detection Systems, Intrusion-Detection, IoT Networks, Key Issues, Network intrusion, Network security, Rapid expansion, Security, Security challenges},
pubstate = {published},
tppubtype = {inproceedings}
}
The rapid expansion of Internet of Things (IoT) devices introduces complex security challenges that traditional intrusion detection systems struggle to address. This paper proposes an Adversarial Ensemble Framework using Generative Adversarial Networks (GANs) to improve the accuracy and resilience of intrusion detection in IoT environments. The framework tackles key issues such as class imbalance, concept drift, and adversarial attacks by employing multiple GAN variants such as Vanilla GAN, Conditional GAN (CGAN), and Wasserstein GAN (WGAN) to generate high-quality synthetic attack data. A dynamic ensemble learning mechanism selects the most effective model for each attack type based on performance metrics. Experiments on NSL-KDD and CIC-IDS2017 show that WGAN yields the most effective synthetic data, contributing to a detection rate of up to 96%. The approach proves particularly effective in identifying rare attacks, making it a scalable and adaptive solution for IoT security. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.
10.
Malasi, J. -J. M.; Moudoud, H.; Missaoui, R.
A Lightweight Multimodal LLM-Based Intrusion Detection System for Open RAN Proceedings Article
In: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 979-833157731-5 (ISBN), (Journal Abbreviation: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW).
Abstract | Links | BibTeX | Tags: Benchmarking, Computational linguistics, Computer crime, Cyber security, Cybersecurity, Embedded systems, Embeddings, Intelligent controllers, Internet protocols, Intrusion Detection, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, Language model, Large language model, Large Language Models (LLMs), Mobile telecommunication systems, Multi-modal, Multi-modal learning, Multimodal Learning, Network security, Open RAN, Pipelines, RAN intelligent controller, RAN intelligent controller (RIC), Semantics
@inproceedings{malasiLightweightMultimodalLLMBased2026,
title = {A Lightweight Multimodal LLM-Based Intrusion Detection System for Open RAN},
author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},
url = {https://www.scopus.com/pages/publications/105043415034?origin=resultslist},
doi = {10.1109/WCNCW67598.2026.11555393},
isbn = {979-833157731-5 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Open Radio Access Network architectures introduce unprecedented openness and programmability through RAN Intelligent Controllers, expanding the attack surface beyond traditional volumetric threats. Most existing intrusion detection systems for fifth-generation mobile networks and ORAN rely primarily on numerical Key Performance Indicators (KPIs), often overlooking the security-relevant semantics embedded in logs and control messages. This paper proposes LLM4IDS, a semantic-aware and multimodal intrusion detection system that fuses lightweight Large Language Model (LLM) embeddings of textified events with traditional tabular KPIs in a compact Transformer-based classifier. Evaluated on the realworld OpenIreland O-RAN dataset and two classical IP network benchmarks (UNSW-NB15 and CICIDS2017), LLM4IDS consistently matches or surpasses strong tabular baselines while maintaining high efficiency. On OpenIreland, it reaches nearperfect detection (F1-score $textbackslashapprox 1.0$) and yields large gains for application-layer and volumetric attacks compared to KPI-only models. Across datasets, the classifier maintains an approximately 4 MB footprint and sub-millisecond CPU inference latency; the frozen sentence-LLM encoder can be shared across tasks, and its embeddings can be cached or precomputed when required by the deployment pipeline. These results indicate that integrating semantic context through multimodal fusion can significantly enhance intrusion detection in O-RAN while remaining competitive on standard IP-based IDS tasks. To the best of our knowledge, this work is among the first to study a complete multimodal LLM-based IDS pipeline for O-RAN data with cross-domain evaluation on both O-RAN and classical IP benchmarks. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},
keywords = {Benchmarking, Computational linguistics, Computer crime, Cyber security, Cybersecurity, Embedded systems, Embeddings, Intelligent controllers, Internet protocols, Intrusion Detection, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, Language model, Large language model, Large Language Models (LLMs), Mobile telecommunication systems, Multi-modal, Multi-modal learning, Multimodal Learning, Network security, Open RAN, Pipelines, RAN intelligent controller, RAN intelligent controller (RIC), Semantics},
pubstate = {published},
tppubtype = {inproceedings}
}
Open Radio Access Network architectures introduce unprecedented openness and programmability through RAN Intelligent Controllers, expanding the attack surface beyond traditional volumetric threats. Most existing intrusion detection systems for fifth-generation mobile networks and ORAN rely primarily on numerical Key Performance Indicators (KPIs), often overlooking the security-relevant semantics embedded in logs and control messages. This paper proposes LLM4IDS, a semantic-aware and multimodal intrusion detection system that fuses lightweight Large Language Model (LLM) embeddings of textified events with traditional tabular KPIs in a compact Transformer-based classifier. Evaluated on the realworld OpenIreland O-RAN dataset and two classical IP network benchmarks (UNSW-NB15 and CICIDS2017), LLM4IDS consistently matches or surpasses strong tabular baselines while maintaining high efficiency. On OpenIreland, it reaches nearperfect detection (F1-score $textbackslashapprox 1.0$) and yields large gains for application-layer and volumetric attacks compared to KPI-only models. Across datasets, the classifier maintains an approximately 4 MB footprint and sub-millisecond CPU inference latency; the frozen sentence-LLM encoder can be shared across tasks, and its embeddings can be cached or precomputed when required by the deployment pipeline. These results indicate that integrating semantic context through multimodal fusion can significantly enhance intrusion detection in O-RAN while remaining competitive on standard IP-based IDS tasks. To the best of our knowledge, this work is among the first to study a complete multimodal LLM-based IDS pipeline for O-RAN data with cross-domain evaluation on both O-RAN and classical IP benchmarks. © 2026 IEEE.