

de Recherche et d’Innovation
en Cybersécurité et Société
Malasi, J. -J. M.; Moudoud, H.; Missaoui, R.
A Lightweight Multimodal LLM-Based Intrusion Detection System for Open RAN Proceedings Article
In: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 979-833157731-5 (ISBN), (Journal Abbreviation: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW).
Abstract | Links | BibTeX | Tags: Benchmarking, Computational linguistics, Computer crime, Cyber security, Cybersecurity, Embedded systems, Embeddings, Intelligent controllers, Internet protocols, Intrusion Detection, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, Language model, Large language model, Large Language Models (LLMs), Mobile telecommunication systems, Multi-modal, Multi-modal learning, Multimodal Learning, Network security, Open RAN, Pipelines, RAN intelligent controller, RAN intelligent controller (RIC), Semantics
@inproceedings{malasiLightweightMultimodalLLMBased2026,
title = {A Lightweight Multimodal LLM-Based Intrusion Detection System for Open RAN},
author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},
url = {https://www.scopus.com/pages/publications/105043415034?origin=resultslist},
doi = {10.1109/WCNCW67598.2026.11555393},
isbn = {979-833157731-5 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Open Radio Access Network architectures introduce unprecedented openness and programmability through RAN Intelligent Controllers, expanding the attack surface beyond traditional volumetric threats. Most existing intrusion detection systems for fifth-generation mobile networks and ORAN rely primarily on numerical Key Performance Indicators (KPIs), often overlooking the security-relevant semantics embedded in logs and control messages. This paper proposes LLM4IDS, a semantic-aware and multimodal intrusion detection system that fuses lightweight Large Language Model (LLM) embeddings of textified events with traditional tabular KPIs in a compact Transformer-based classifier. Evaluated on the realworld OpenIreland O-RAN dataset and two classical IP network benchmarks (UNSW-NB15 and CICIDS2017), LLM4IDS consistently matches or surpasses strong tabular baselines while maintaining high efficiency. On OpenIreland, it reaches nearperfect detection (F1-score $textbackslashapprox 1.0$) and yields large gains for application-layer and volumetric attacks compared to KPI-only models. Across datasets, the classifier maintains an approximately 4 MB footprint and sub-millisecond CPU inference latency; the frozen sentence-LLM encoder can be shared across tasks, and its embeddings can be cached or precomputed when required by the deployment pipeline. These results indicate that integrating semantic context through multimodal fusion can significantly enhance intrusion detection in O-RAN while remaining competitive on standard IP-based IDS tasks. To the best of our knowledge, this work is among the first to study a complete multimodal LLM-based IDS pipeline for O-RAN data with cross-domain evaluation on both O-RAN and classical IP benchmarks. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},
keywords = {Benchmarking, Computational linguistics, Computer crime, Cyber security, Cybersecurity, Embedded systems, Embeddings, Intelligent controllers, Internet protocols, Intrusion Detection, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, Language model, Large language model, Large Language Models (LLMs), Mobile telecommunication systems, Multi-modal, Multi-modal learning, Multimodal Learning, Network security, Open RAN, Pipelines, RAN intelligent controller, RAN intelligent controller (RIC), Semantics},
pubstate = {published},
tppubtype = {inproceedings}
}
Moudoud, H.; Houda, Z. A. El; Brik, B.
Securing O-RAN with Zero Trust Architecture and Large Language Models Proceedings Article
In: C., Iwendi; Z., Boulouard; N., Kryvinska (Ed.): Lect. Notes Networks Syst., pp. 357–368, Springer Science and Business Media Deutschland GmbH, 2025, ISBN: 23673370 (ISSN); 978-303194619-6 (ISBN), (Journal Abbreviation: Lect. Notes Networks Syst.).
Abstract | Links | BibTeX | Tags: Access management, Access Management system, Architecture, Authentication, Block-chain, Blockchain, Computer architecture, Computer crime, Cryptography, Distributed computer systems, Intrusion Detection, Language model, Large language model, Management systems, Mobile security, Mobile telecommunication systems, Network architecture, Network security, O-RAN, Open radio access network, Radio access networks, Security systems, Security vulnerabilities, Trusted computing, Zero Trust
@inproceedings{moudoudSecuringORANZero2025,
title = {Securing O-RAN with Zero Trust Architecture and Large Language Models},
author = {H. Moudoud and Z. A. El Houda and B. Brik},
editor = {Iwendi C. and Boulouard Z. and Kryvinska N.},
url = {https://www.scopus.com/pages/publications/105011259647?origin=resultslist},
doi = {10.1007/978-3-031-94620-2_31},
isbn = {23673370 (ISSN); 978-303194619-6 (ISBN)},
year = {2025},
date = {2025-01-01},
booktitle = {Lect. Notes Networks Syst.},
volume = {1312 LNNS},
pages = {357–368},
publisher = {Springer Science and Business Media Deutschland GmbH},
abstract = {The Open Radio Access Network (O-RAN) architecture is critical for the development of 6G networks, offering flexibility and interoperability through disaggregated components. However, this openness exposes O-RAN to new security vulnerabilities, including unauthorized access, data breaches, and malicious xApp deployments. To address these challenges, we propose DistillORAN, a novel Zero-Trust architecture designed specifically for O-RAN. DistillORAN features two core components: (1) a blockchain-based decentralized trust management system for secure verification, authentication, and dynamic access control of xApps, and (2) a lightweight intrusion detection module powered by DistilBERT, a transformer-based model optimized for resource-constrained environments. DistilBERT’s ability to analyze network activities and detect anomalies in real-time allows it to identify complex security threats and multi-step attack scenarios within the O-RAN ecosystem. Its lightweight nature makes it ideal for O-RAN’s distributed infrastructure, where computational resources may be limited. By combining blockchain technology for trust management with DistilBERT’s powerful pattern recognition for intrusion detection, DistillORAN enforces a Zero-Trust security model, ensuring continuous monitoring and verification of all network components. This comprehensive solution enhances the security and resilience of O-RAN networks, aligning with the dynamic needs of next-generation mobile infrastructures. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2025.},
note = {Journal Abbreviation: Lect. Notes Networks Syst.},
keywords = {Access management, Access Management system, Architecture, Authentication, Block-chain, Blockchain, Computer architecture, Computer crime, Cryptography, Distributed computer systems, Intrusion Detection, Language model, Large language model, Management systems, Mobile security, Mobile telecommunication systems, Network architecture, Network security, O-RAN, Open radio access network, Radio access networks, Security systems, Security vulnerabilities, Trusted computing, Zero Trust},
pubstate = {published},
tppubtype = {inproceedings}
}
Mehrban, A.; Houda, Z. Abou El; Moudoud, H.; Bao, L. Le
Integrating Zero Trust Architecture in O-RAN: A Comprehensive Survey and Analysis Journal Article
In: IEEE Open Journal of the Communications Society, vol. 6, pp. 10465–10495, 2025, ISSN: 2644125X (ISSN).
Abstract | Links | BibTeX | Tags: 6g network, 6G networks, Access control, Data flow analysis, Intelligent controllers, Interoperability, Mobile telecommunication systems, Multi-vendor, Network architecture, Network components, Network security, New approaches, Open radio access network, open radio access network (O-RAN), Radio access networks, RAN intelligent controller, RAN intelligent controller (RIC), Smart contract, Survey and analysis, Trusted computing, Vendor interoperability, Zero trust architecture, Zero trust architecture (ZTA)
@article{mehrbanIntegratingZeroTrust2025,
title = {Integrating Zero Trust Architecture in O-RAN: A Comprehensive Survey and Analysis},
author = {A. Mehrban and Z. Abou El Houda and H. Moudoud and L. Le Bao},
url = {https://www.scopus.com/pages/publications/105025432034?origin=resultslist},
doi = {10.1109/OJCOMS.2025.3644132},
issn = {2644125X (ISSN)},
year = {2025},
date = {2025-01-01},
journal = {IEEE Open Journal of the Communications Society},
volume = {6},
pages = {10465–10495},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Open Radio Access Network (O-RAN) is a new approach to mobile networks that disaggregates the network architecture into multi-vendor interoperable physical and software-defined network components connected through standardized open interfaces. This architecture enables deploying solutions on cloud-native platforms and boosting Artificial Intelligence(AI)-driven automation for network optimization. Despite the benefits of O-RAN’s heterogeneous and multi-vendor architecture, this approach inevitably enlarges the attack surface and introduces additional trust boundaries, which imminently threaten the uniformity of network performance. This also justifies the necessity of Zero Trust Architecture (ZTA) principles as a countermeasure, securing all network components, interfaces, and data flows. This survey shows how ZTA tenets can be integrated into O-RAN settings, contributing in three key areas: (1) a novel ZTA-to-O-RAN mapping model that explicitly places Policy Engine (PE), Policy Administrator (PA), and Policy Enforcement Points (PEPs) across RIC layers (Non-RT/Near-RT RIC), standardized interfaces (A1/E2/O1/O2), and disaggregated RAN functions (O-DU/O-CU/O-RU); (2) a Risk-Adaptive Access Control (RAdAC) framework that dynamically modulates verification depth based on contextual risk; and (3) integration of blockchain-based decentralized identity management with smart-contract-driven authorization for xApp/rApp lifecycle security. © 2020 IEEE.},
keywords = {6g network, 6G networks, Access control, Data flow analysis, Intelligent controllers, Interoperability, Mobile telecommunication systems, Multi-vendor, Network architecture, Network components, Network security, New approaches, Open radio access network, open radio access network (O-RAN), Radio access networks, RAN intelligent controller, RAN intelligent controller (RIC), Smart contract, Survey and analysis, Trusted computing, Vendor interoperability, Zero trust architecture, Zero trust architecture (ZTA)},
pubstate = {published},
tppubtype = {article}
}
Mehrban, A.; Houda, Z. A. El; Moudoud, H.; Brik, B.; Khoukhi, L.
A Blockchain-Enabled Multi-Layered Zero-Trust Security Framework for O-RAN Proceedings Article
In: Int. Wirel. Commun. Mob. Comput. Conf., IWCMC, pp. 1564–1569, Institute of Electrical and Electronics Engineers Inc., 2025, ISBN: 979-833150887-6 (ISBN), (Journal Abbreviation: Int. Wirel. Commun. Mob. Comput. Conf., IWCMC).
Abstract | Links | BibTeX | Tags: Access control, Block-chain, Blockchain, Data privacy, Federated learning, federated learning (FL), Internet of thing, Internet of things, Internet of Things (IoT), Interoperability, Learning systems, Mobile telecommunication systems, Multi-layered, Network architecture, Network security, Open access, Open radio access network, open radio access network (O-RAN), Radio, Radio access networks, Radio access technologies, Radio communication, Secure communication, Security, Security frameworks, Security risks, Transfer learning, Trusted computing
@inproceedings{mehrbanBlockchainEnabledMultiLayeredZeroTrust2025,
title = {A Blockchain-Enabled Multi-Layered Zero-Trust Security Framework for O-RAN},
author = {A. Mehrban and Z. A. El Houda and H. Moudoud and B. Brik and L. Khoukhi},
url = {https://www.scopus.com/pages/publications/105011345211?origin=resultslist},
doi = {10.1109/IWCMC65282.2025.11059720},
isbn = {979-833150887-6 (ISBN)},
year = {2025},
date = {2025-01-01},
booktitle = {Int. Wirel. Commun. Mob. Comput. Conf., IWCMC},
pages = {1564–1569},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {O-RAN (Open Radio Access Network) is a set of open and interoperable radio access technologies, guided by the O-RAN Alliance, that, despite an open ecosystem, introduces significant security risks, expanding the threat surface in 6G networks. Traditional perimeter-based security approaches are inadequate for O-RAN's highly distributed, multi-vendor environments, where Zero Trust Architecture (ZTA) becomes essential for robust security. To address these challenges, we propose a novel blockchain-based, decentralized Zero-Trust Framework specifically designed for O-RAN security. Our proposed framework comprises two key layers: the first layer utilizes Federated Learning (FL) and Transfer Learning (TL) for advanced attack detection, enabling distributed, privacy-preserving threat analysis across O-RAN nodes. The second layer enforces Zero Trust access control through a blockchain-based identity management system, ensuring tamper-resistant, real-time policy updates. This multi-layered framework provides adaptive threat detection and resilient access control, validated through simulations demonstrating high detection accuracy and robust access management with minimal impact on network performance, offering a scalable security solution for next-generation O-RAN deployments. © 2025 IEEE.},
note = {Journal Abbreviation: Int. Wirel. Commun. Mob. Comput. Conf., IWCMC},
keywords = {Access control, Block-chain, Blockchain, Data privacy, Federated learning, federated learning (FL), Internet of thing, Internet of things, Internet of Things (IoT), Interoperability, Learning systems, Mobile telecommunication systems, Multi-layered, Network architecture, Network security, Open access, Open radio access network, open radio access network (O-RAN), Radio, Radio access networks, Radio access technologies, Radio communication, Secure communication, Security, Security frameworks, Security risks, Transfer learning, Trusted computing},
pubstate = {published},
tppubtype = {inproceedings}
}
Davoust, A.; Gagnon, F.; Esfandiari, B.; Kunz, T.; Cormier, A.
Towards Securing Peer-to-Peer SIP in the MANET Context: Existing Work and Perspectives Proceedings Article
In: Y., Georgalas N. Min G. Wu (Ed.): Proceedings - 2017 IEEE International Conference on Internet of Things, IEEE Green Computing and Communications, IEEE Cyber, Physical and Social Computing, IEEE Smart Data, iThings-GreenCom-CPSCom-SmartData 2017, pp. 223–229, Institute of Electrical and Electronics Engineers Inc., 2017, ISBN: 978-1-5386-3065-5.
Abstract | Links | BibTeX | Tags: Ad-hoc networks, Building blockes, Instant messaging, Internet protocols, Mobile ad-hoc networks, Mobile telecommunication systems, Network contexts, Network security, P2P, Peer to peer networks, Peer-to-peer session initiation protocols, Radio links, Security, Session Initiation Protocols, Social applications, Vehicular ad hoc networks
@inproceedings{davoust_towards_2017,
title = {Towards Securing Peer-to-Peer SIP in the MANET Context: Existing Work and Perspectives},
author = {A. Davoust and F. Gagnon and B. Esfandiari and T. Kunz and A. Cormier},
editor = {Georgalas N. Min G. Wu Y.},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85047394150&doi=10.1109%2fiThings-GreenCom-CPSCom-SmartData.2017.38&partnerID=40&md5=738bee95270122e76104e7afc52fe946},
doi = {10.1109/iThings-GreenCom-CPSCom-SmartData.2017.38},
isbn = {978-1-5386-3065-5},
year = {2017},
date = {2017-01-01},
booktitle = {Proceedings - 2017 IEEE International Conference on Internet of Things, IEEE Green Computing and Communications, IEEE Cyber, Physical and Social Computing, IEEE Smart Data, iThings-GreenCom-CPSCom-SmartData 2017},
volume = {2018-January},
pages = {223–229},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {The Session Initiation Protocol (SIP) is a key building block of many social applications, including VoIP communication and instant messaging. In its original architecture, SIP heavily relies on servers such as proxies and registrars. Mobile Ad hoc NETworks (MANETs) are networks comprised of mobile devices that communicate over wireless links, such as tactical radio networks or vehicular networks. In such networks, no fixed infrastructure exists and server-based solutions need to be redesigned to work in a peer-to-peer fashion. We survey existing proposals for the implementation of SIP over such MANETs and analyze their security issues. We then discuss potential solutions and their suitability in the MANET context. © 2017 IEEE.},
keywords = {Ad-hoc networks, Building blockes, Instant messaging, Internet protocols, Mobile ad-hoc networks, Mobile telecommunication systems, Network contexts, Network security, P2P, Peer to peer networks, Peer-to-peer session initiation protocols, Radio links, Security, Session Initiation Protocols, Social applications, Vehicular ad hoc networks},
pubstate = {published},
tppubtype = {inproceedings}
}
Davoust, A.; Gagnon, F.; Esfandiari, B.; Kunz, T.; Cormier, A.
Towards Securing Peer-to-Peer SIP in the MANET Context: Existing Work and Perspectives Proceedings Article
In: Y., Georgalas N. Min G. Wu (Ed.): Proceedings - 2017 IEEE International Conference on Internet of Things, IEEE Green Computing and Communications, IEEE Cyber, Physical and Social Computing, IEEE Smart Data, iThings-GreenCom-CPSCom-SmartData 2017, pp. 223–229, Institute of Electrical and Electronics Engineers Inc., 2017, ISBN: 978-1-5386-3065-5.
Abstract | Links | BibTeX | Tags: Ad-hoc networks, Building blockes, Instant messaging, Internet protocols, Mobile ad-hoc networks, Mobile telecommunication systems, Network contexts, Network security, P2P, Peer to peer networks, Peer-to-peer session initiation protocols, Radio links, Security, Session Initiation Protocols, Social applications, Vehicular ad hoc networks
@inproceedings{davoustSecuringPeertoPeerSIP2017,
title = {Towards Securing Peer-to-Peer SIP in the MANET Context: Existing Work and Perspectives},
author = {A. Davoust and F. Gagnon and B. Esfandiari and T. Kunz and A. Cormier},
editor = {Georgalas N. Min G. Wu Y.},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85047394150&doi=10.1109%2fiThings-GreenCom-CPSCom-SmartData.2017.38&partnerID=40&md5=738bee95270122e76104e7afc52fe946},
doi = {10.1109/iThings-GreenCom-CPSCom-SmartData.2017.38},
isbn = {978-1-5386-3065-5},
year = {2017},
date = {2017-01-01},
booktitle = {Proceedings - 2017 IEEE International Conference on Internet of Things, IEEE Green Computing and Communications, IEEE Cyber, Physical and Social Computing, IEEE Smart Data, iThings-GreenCom-CPSCom-SmartData 2017},
volume = {2018-January},
pages = {223–229},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {The Session Initiation Protocol (SIP) is a key building block of many social applications, including VoIP communication and instant messaging. In its original architecture, SIP heavily relies on servers such as proxies and registrars. Mobile Ad hoc NETworks (MANETs) are networks comprised of mobile devices that communicate over wireless links, such as tactical radio networks or vehicular networks. In such networks, no fixed infrastructure exists and server-based solutions need to be redesigned to work in a peer-to-peer fashion. We survey existing proposals for the implementation of SIP over such MANETs and analyze their security issues. We then discuss potential solutions and their suitability in the MANET context. © 2017 IEEE.},
keywords = {Ad-hoc networks, Building blockes, Instant messaging, Internet protocols, Mobile ad-hoc networks, Mobile telecommunication systems, Network contexts, Network security, P2P, Peer to peer networks, Peer-to-peer session initiation protocols, Radio links, Security, Session Initiation Protocols, Social applications, Vehicular ad hoc networks},
pubstate = {published},
tppubtype = {inproceedings}
}
Passerini, K.; Gagnon, S.; Cakici, K.
Opportunities in the digital economy: a new value chain and services for mobile telecom operators Proceedings Article
In: 10th Americas Conference on Information Systems, AMCIS 2004, pp. 2530–2535, Association for Information Systems, 2004.
Abstract | Links | BibTeX | Tags: Business models, Chains, Digital economy, Mobile telecom, Mobile telecommunication operator, Mobile telecommunication systems, Mobile telecommunications, Technological factors, Telecom operators, Telecommunication industry, Telecommunication services, Telecommunications industry, Telecommunications operators, Value chains
@inproceedings{passerini_opportunities_2004,
title = {Opportunities in the digital economy: a new value chain and services for mobile telecom operators},
author = {K. Passerini and S. Gagnon and K. Cakici},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85139064053&partnerID=40&md5=d410151fd810adf44b16f35e3a36106c},
year = {2004},
date = {2004-01-01},
booktitle = {10th Americas Conference on Information Systems, AMCIS 2004},
pages = {2530–2535},
publisher = {Association for Information Systems},
abstract = {The advent of the digital economy has brought about radical changes in traditional business channels and operations in several industries. This paper reviews opportunities and challenges that the digital economy has opened in the telecommunication industry in general, and more specifically for mobile telecom operators. It explores the key strategies and technological factors that are guiding the reshaping of the business models for mobile telecom operators, and discusses ongoing changes in the traditional mobile value chain. In addition to presenting a conceptual overview of emerging business models, the paper describes a methodological approach for determining the range of services, customers and product options that will be successful in the new mobile-business environment. The strength of this approach lies in its ability to closely meet the needs of the digital economy’s more sophisticated customers, and therefore increase the potential success of the new business models. © 2004, Association for Information Systems. All rights reserved.},
keywords = {Business models, Chains, Digital economy, Mobile telecom, Mobile telecommunication operator, Mobile telecommunication systems, Mobile telecommunications, Technological factors, Telecom operators, Telecommunication industry, Telecommunication services, Telecommunications industry, Telecommunications operators, Value chains},
pubstate = {published},
tppubtype = {inproceedings}
}
Passerini, K.; Gagnon, S.; Cakici, K.
Opportunities in the digital economy: a new value chain and services for mobile telecom operators Proceedings Article
In: 10th Americas Conference on Information Systems, AMCIS 2004, pp. 2530–2535, Association for Information Systems, 2004.
Abstract | Links | BibTeX | Tags: Business models, Chains, Digital economy, Mobile telecom, Mobile telecommunication operator, Mobile telecommunication systems, Mobile telecommunications, Technological factors, Telecom operators, Telecommunication industry, Telecommunication services, Telecommunications industry, Telecommunications operators, Value chains
@inproceedings{passeriniOpportunitiesDigitalEconomy2004,
title = {Opportunities in the digital economy: a new value chain and services for mobile telecom operators},
author = {K. Passerini and S. Gagnon and K. Cakici},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85139064053&partnerID=40&md5=d410151fd810adf44b16f35e3a36106c},
year = {2004},
date = {2004-01-01},
booktitle = {10th Americas Conference on Information Systems, AMCIS 2004},
pages = {2530–2535},
publisher = {Association for Information Systems},
abstract = {The advent of the digital economy has brought about radical changes in traditional business channels and operations in several industries. This paper reviews opportunities and challenges that the digital economy has opened in the telecommunication industry in general, and more specifically for mobile telecom operators. It explores the key strategies and technological factors that are guiding the reshaping of the business models for mobile telecom operators, and discusses ongoing changes in the traditional mobile value chain. In addition to presenting a conceptual overview of emerging business models, the paper describes a methodological approach for determining the range of services, customers and product options that will be successful in the new mobile-business environment. The strength of this approach lies in its ability to closely meet the needs of the digital economy’s more sophisticated customers, and therefore increase the potential success of the new business models. © 2004, Association for Information Systems. All rights reserved.},
keywords = {Business models, Chains, Digital economy, Mobile telecom, Mobile telecommunication operator, Mobile telecommunication systems, Mobile telecommunications, Technological factors, Telecom operators, Telecommunication industry, Telecommunication services, Telecommunications industry, Telecommunications operators, Value chains},
pubstate = {published},
tppubtype = {inproceedings}
}



