@inproceedings{shangweDetectionEvaluatingLLMs2026,

title = {Beyond Detection: Evaluating LLMs’ Semantic Understanding of Code Vulnerabilities},

author = {C. N. Shangwe and A. Davoust and R. Khoury},

editor = {Adi K. and Nguena Timo O. and Boulahia-Cuppens N. and Espes D. and Stakhanova N. and Omar M.},

url = {https://www.scopus.com/pages/publications/105046105995?origin=resultslist},

doi = {10.1007/978-3-032-20732-6_2},

isbn = {03029743 (ISSN); 978-303220731-9 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {Lect. Notes Comput. Sci.},

volume = {16295 LNCS},

pages = {19–34},

publisher = {Springer Science and Business Media Deutschland GmbH},

abstract = {As Large Language Models (LLMs) become increasingly integrated into software development and analysis workflows, a critical question arises: do these models truly understand the semantics of code, or do they merely excel at pattern matching? Our goal is to assess the extent to which LLMs can back their predictions in vulnerability detection by correctly attributing the identified vulnerabilities to the violation of particular rules as proof that their decision is based on actual code semantics understanding. We employed the SVEN dataset, composed of function-level code snippets, to conduct a series of experiments that evaluate both the model’s ability to detect vulnerabilities and attribute predictions to the correct violated rule and measure LLMs’ performance under varying experimental setups. Our findings reveal that while LLMs achieve reasonable accuracy in vulnerability detection, a significant drop in performance is observed when correct rule attribution is also required, exposing a gap between perceived accuracy and actual accuracy. The difference between actual and perceived accuracy offers critical insight into the depth of code semantics understanding of LLMs in vulnerability detection. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.},

note = {Journal Abbreviation: Lect. Notes Comput. Sci.},

keywords = {Analysis workflow, Code Semantics, Codes (symbols), Critical questions, Development workflow, Interpretability, Language model, Large language model, Large Language Models (LLMs), Model semantics, Pattern matching, Semantics, Semantics understanding, Software design, Vulnerability detection},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{malasiCausalGraphWhenCausal2026,

title = {CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems},

author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},

url = {https://www.scopus.com/pages/publications/105037367854?origin=resultslist},

doi = {10.1109/ICCE67443.2026.11449614},

isbn = {0747668X (ISSN); 979-833155343-2 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {Dig Tech Pap IEEE Int Conf Consum Electron},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Modern intrusion detection systems often achieve impressive benchmark accuracy yet fail in real-world deployment, where network behavior and attacker tactics continuously evolve. Under concept drift, decision boundaries learned offline can diverge from operational reality, triggering false-alarm cascades and creating detection blind spots that erode analyst trust. In this paper, we propose CausalGraph-IDS, a causal and language-model-assisted intrusion detection framework that moves beyond purely correlational scoring by explicitly verifying multi-stage attack chains. Additionally, we propose CHAIN-CRC, a unified algorithm that (i) learns a constrained attack-chain causal graph guided by knowledge-based priors derived from widely used adversary behavior taxonomies, (ii) computes robustness scores by testing whether alarms persist under feasible counterfactual security interventions, and (iii) applies conformal risk control to enforce operator-defined false-positive budgets with finite-sample guarantees.Generative models are integrated in strictly assistive roles through three modules: prior induction to distill causal constraints from unstructured threat reports, counterfactual generation to propose realistic and operationally feasible interventions, and causal logic justification to produce human-readable explanations grounded in the learned attack chain. Experiments on two widely used network intrusion detection benchmarks show that CausalGraph-IDS provides robust, explainable, and risk-governed detection, maintaining strong recall at low false-positive rates while delivering actionable causal insights for mitigation. © 2026 IEEE.},

note = {Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron},

keywords = {Alarm systems, Budget control, causal reasoning, Chains, Computer crime, Concept Drift, Concept drifts, Conformal Risk Control, Counterfactuals, Generative AI, Human computer interaction, Intrusion Detection, Intrusion Detection Systems, Intrusion-Detection, Knowledge based systems, Language model, LLM, LLMs, Network intrusion, Network security, Risks controls, Sampling},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{laamariLightweightLLMAdaptation2026,

title = {Lightweight LLM Adaptation for Intrusion Detection via Token-Efficient Flow Representation},

author = {A. Laamari and H. Moudoud and Z. A. El Houda},

url = {https://www.scopus.com/pages/publications/105042133342?origin=resultslist},

doi = {10.1109/CAI68641.2026.11536533},

isbn = {979-833156039-3 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {IEEE Conf. Artif. Intell., CAI},

pages = {2122–2127},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Large language models (LLMs) are emerging as a promising approach for intrusion detection using structured network flow data. However, their practical deployment is constrained by context window limitations and the excessive token overhead introduced by conventional tabular serialization formats such as JSON. Verbose data representations inflate sequence lengths, often exceeding model input limits and causing feature truncation. Additionally, it remains unclear which LLM architecture is more suitable for structured intrusion detection tasks under limited training resources. To tackle this issue, we propose a novel representation-aware intrusion detection framework based on Token-Oriented Object Notation (TOON), a compact serialization format that maximizes token efficiency while preserving schema structure. Also, we integrate a Low-Rank Adaptation (LoRA) scheme to enable parameter-efficient fine-tuning. Finally, we evaluate the proposed framework as an encoder-decoder model (T5-Small) with a decoder-only model (Qwen2.5) on three benchmark datasets, including NSL-KDD, UNSW-NB15, and CIC-IDS2018 for binary and multi-class classification scenarios. The results show that our tokenizer-aligned, representation-aware preprocessing combined with lightweight encoder-decoder adaptation provides a practical and resource-efficient foundation for LLM-based intrusion detection. © 2026 IEEE.},

note = {Journal Abbreviation: IEEE Conf. Artif. Intell., CAI},

keywords = {Classification (of information), Data flow analysis, Decoder-only large language model, Decoder-only LLMs, decoding, Flow classification, Intrusion Detection, Intrusion-Detection, Language model, Large language model, LLMs, LoRA, Low-rank adaptation, Network Flow Classification, Network intrusion, Network security, Networks flows, Qwen2.5, Signal encoding, T5-Small, Token-oriented object notation, Tokenization, TOON},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{elhajjoutLeveragingLargeLanguage2026,

title = {Leveraging Large Language Models for Contextual Threat Hypothesis Generation in IoT Networks},

author = {A. Elhajjout and Z. Jarir and H. Moudoud and A. Davoust and Z. A. El Houda},

url = {https://www.scopus.com/pages/publications/105037351870?origin=resultslist},

doi = {10.1109/ICCE67443.2026.11449914},

isbn = {0747668X (ISSN); 979-833155343-2 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {Dig Tech Pap IEEE Int Conf Consum Electron},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Modern Security Operations Centers face numerous challenges in managing the volume and complexity of security alerts from Internet of Things (IoT) networks. While traditional rule-based systems excel at detection, they provide limited contextual reasoning to help analysts understand ambiguous alerts. Large Language Models (LLMs) have shown promise across various cybersecurity domains. However, their potential to generate rich, explanatory threat hypotheses for ambiguous IoT alerts remains largely unexplored. To address these issues, in this paper, we present a systematic investigation of Large Language Model-based threat hypothesis generation with three key contributions. First, we introduce a context-aware structured prompting framework capable of synthesizing heterogeneous device telemetry into coherent threat narratives. Second, we formalize the assessment of explainability in security through a rigorous multidimensional quality metric system. Third, we provide the first comparative analysis of five state-of-the-art models on real-world IoT incidents, revealing critical performance tradeoffs. Results show that GPT-4o-mini achieves 88.2% accuracy on diverse attack types, while Qwen 3-235B achieves 95.2% accuracy on network-focused attacks. Statistical analysis reveals significant model-dataset interactions. These findings show that properly guided Large Language Models can augment analyst capabilities by providing detailed, contextual explanations that facilitate efficient alert triage. © 2026 IEEE.},

note = {Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron},

keywords = {Alert Triage, Cybersecurity, Hypotheses generation, Internet of thing security, Internet of things, IoT Security, Language model, Large datasets, Large language model, large language models, Network security, Prompt Engineering, Security alerts, Security operation center, Security Operations, Security systems, Threat Hypothesis Generation},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{pimentelPartialAudioDeepfake2026,

title = {Partial Audio Deepfake Detection: Are We Really Detecting Synthetic Media or Just Dataset Content Biases?},

author = {A. Pimentel and Y. Zhu and T. H. Falk},

url = {https://www.scopus.com/pages/publications/105042045476?origin=resultslist},

doi = {10.1109/CAI68641.2026.11536622},

isbn = {979-833156039-3 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {IEEE Conf. Artif. Intell., CAI},

pages = {1846–1851},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {In recent years, the generation of highly realistic audio deepfakes has raised significant concerns regarding privacy and information integrity. While most research has focused on fully bonafide or spoofed speech, partial deep-fakes, where only segments of an utterance are manipulated, remain less explored. Given the nature of the task, existing datasets are relying on large language models to manipulate bonafide speech signals into partial deepfakes by altering, deleting, or replacing segments with synthetic content. These manipulations may alter the semantics and sentiment of the generated content, creating biases that can be captured by deepfake detection models, leading to overly optimistic performance and poor generalizability. In this work, we investigate the presence of such biases in two popular partial deepfake datasets, namely AV-Deepfake1M and PartialEdit. We explore four self-supervised learning models, two relying only on text transcriptions (RoBERTa and RoBERTa-sentiment) and two relying on universal speech representations (WavLM Large and Wav2vec2-XLSR). Our experiments show that, while speech models achieve higher in-domain performance, they do not generalize to out-of-domain conditions. In turn, models trained on only transcribed speech can effectively distinguish manipulated content, achieving up to 97.8% AUC in-domain and nearly 70% AUC out-of-domain. These results suggest that linguistic patterns and dataset confounds may indeed be biasing partial deepfake detection models, leading to poor generalizability. © 2026 IEEE.},

note = {Journal Abbreviation: IEEE Conf. Artif. Intell., CAI},

keywords = {Audio signal processing, Computational linguistics, Condition, Detection models, Information integrity, Language model, Large datasets, Learning models, Optimistics, Performance, Self-supervised learning, Speech communication, Speech models, Speech recognition, Speech signals, Synthetic media, Transcription},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{sadfiComparativeAnalysisMachine2026,

title = {Comparative Analysis of Machine Learning, LLMs, and RAG for Fake News Detection},

author = {Y. Sadfi and H. Amamou and A. Davoust and A. R. Avila},

url = {https://www.scopus.com/pages/publications/105042025800?origin=resultslist},

doi = {10.1109/CAI68641.2026.11536343},

isbn = {979-833156039-3 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {IEEE Conf. Artif. Intell., CAI},

pages = {2128–2133},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {The rapid spread of misinformation on social network platforms poses a serious threat to the decision-making processes in democratic societies. To mitigate the problem and cope with new misinformation scenarios several datasets have been proposed, followed by the emergence of new methods for detecting fake news. While several comparative analyses have been proposed to benchmark these solutions, the ever-growing development of new methods requires up-to-date analysis. For instance, recent approaches based on retrieval-augmented generation (RAG) have yet to be assessed and compared to previous methods used for fake news detection. In this study, we aim to fill this gap by presenting a comprehensive assessment of classical machine learning (ML) algorithms, Transformer-based models, such as BERT, large language models (LLMs), and RAG-based classifiers. We adopt four traditional fake news datasets, including a Portuguese one. Results indicate that classical ML and BERT deliver strong performance on in-domain tasks, demonstrating efficiency and high accuracy. RAG-augmented LLMs, on the other hand, offer enhanced generalization and robustness in cross-domain and cross-dataset settings, but are outperformed by traditional approaches for in-domain evaluation. © 2026 IEEE.},

note = {Journal Abbreviation: IEEE Conf. Artif. Intell., CAI},

keywords = {Classification (of information), Comparative analyzes, Comprehensive assessment, decision making, Decision-making process, Fake detection, Generalisation, High-accuracy, Language model, Learning algorithms, Learning systems, Machine learning, Machine learning algorithms, Machine-learning, Network platforms, Performance},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{malasiLightweightMultimodalLLMBased2026,

title = {A Lightweight Multimodal LLM-Based Intrusion Detection System for Open RAN},

author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},

url = {https://www.scopus.com/pages/publications/105043415034?origin=resultslist},

doi = {10.1109/WCNCW67598.2026.11555393},

isbn = {979-833157731-5 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Open Radio Access Network architectures introduce unprecedented openness and programmability through RAN Intelligent Controllers, expanding the attack surface beyond traditional volumetric threats. Most existing intrusion detection systems for fifth-generation mobile networks and ORAN rely primarily on numerical Key Performance Indicators (KPIs), often overlooking the security-relevant semantics embedded in logs and control messages. This paper proposes LLM4IDS, a semantic-aware and multimodal intrusion detection system that fuses lightweight Large Language Model (LLM) embeddings of textified events with traditional tabular KPIs in a compact Transformer-based classifier. Evaluated on the realworld OpenIreland O-RAN dataset and two classical IP network benchmarks (UNSW-NB15 and CICIDS2017), LLM4IDS consistently matches or surpasses strong tabular baselines while maintaining high efficiency. On OpenIreland, it reaches nearperfect detection (F1-score $textbackslashapprox 1.0$) and yields large gains for application-layer and volumetric attacks compared to KPI-only models. Across datasets, the classifier maintains an approximately 4 MB footprint and sub-millisecond CPU inference latency; the frozen sentence-LLM encoder can be shared across tasks, and its embeddings can be cached or precomputed when required by the deployment pipeline. These results indicate that integrating semantic context through multimodal fusion can significantly enhance intrusion detection in O-RAN while remaining competitive on standard IP-based IDS tasks. To the best of our knowledge, this work is among the first to study a complete multimodal LLM-based IDS pipeline for O-RAN data with cross-domain evaluation on both O-RAN and classical IP benchmarks. © 2026 IEEE.},

note = {Journal Abbreviation: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},

keywords = {Benchmarking, Computational linguistics, Computer crime, Cyber security, Cybersecurity, Embedded systems, Embeddings, Intelligent controllers, Internet protocols, Intrusion Detection, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, Language model, Large language model, Large Language Models (LLMs), Mobile telecommunication systems, Multi-modal, Multi-modal learning, Multimodal Learning, Network security, Open RAN, Pipelines, RAN intelligent controller, RAN intelligent controller (RIC), Semantics},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{ngouanfouo_detecting_2025,

title = {Detecting Machine-Generated Text using Grammatical Features},

author = {C. Ngouanfouo and A. Davoust},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-105031903675&doi=10.1109%2FICTAI66417.2025.00123&partnerID=40&md5=5783b8797a3425f9dfa737343ee757d2},

doi = {10.1109/ICTAI66417.2025.00123},

isbn = {10823409 (ISSN); 979-833154919-0 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Proc. Int. Conf. Tools Artif. Intell. ICTAI},

pages = {843–848},

publisher = {IEEE Computer Society},

abstract = {Large Language Models (LLMs) have advanced natural language generation but pose ethical and practical challenges, making it crucial to detect machine-generated texts. Traditional detection methods rely on complex, hard-to-interpret neural encodings and model-specific features like perplexity. This study explores whether grammatical patterns-specifically sequences of parts of speech (POS), including punctuation and symbols-can distinguish machine-written texts from human ones. Using a CNN classifier on POS sequences, the approach achieves nearly 90 % accuracy on a benchmark dataset. Combining POS-based features with neural embeddings improves performance, and the model shows robustness against adversarial attacks, though it is less effective on short texts. © 2025 IEEE.},

keywords = {AI Text Detection, CNN, Computational grammars, Detection methods, Language model, Machine-generated texts, Natural language generation, Natural language processing systems, Neural encoding, Neural modelling, Part Of Speech, Part-of Speech, Speech communication, Text detection, Written texts},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{boudraLightweightIoCExtraction2025,

title = {Toward Lightweight IoC Extraction in IoT: The Role of Small Language Models},

author = {N. Boudra and A. Elhajjout and H. Moudoud and M. Oujaoura and Z. Jarir and Z. A. El Houda},

url = {https://www.scopus.com/pages/publications/105037622873?origin=resultslist},

doi = {10.1109/SmartAgriSuSY68475.2025.11466843},

isbn = {979-833157801-5 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {The proliferation of cyber threats necessitates rapid and accurate extraction of Indicators of Compromise (IoCs) from diverse security data sources. While Large Language Models (LLMs) have demonstrated exceptional capabilities in natural language processing and information extraction tasks, their deployment on resource-constrained IoT devices remains challenging due to computational and memory requirements. This paper investigates whether Small Language Models (SLMs) can serve as effective alternatives to LLMs for IoC extraction in IoT environments with limited resources. We present a novel direct LLM-based IoC extraction system leveraging context memory mechanisms for document-wide semantic understanding, specifically designed for deployment on edge computing infrastructure with consumer-grade hardware. Our experimental setup utilizes an RTX 4080 GPU and Ryzen 7 7700X processor running the Ollama framework with GPT-OSS:20B model to evaluate the feasibility of using smaller models instead of resource-intensive LLMs for security tasks. Evaluated on 9 diverse threat intelligence reports spanning different malware families and attack campaigns, the system achieved an average F1 score of 0.62, precision of 0.54, recall of 0.79, and accuracy of 0.85, demonstrating that SLMs can achieve acceptable accuracy levels for IoC extraction while operating within the computational constraints typical of IoT edge deployments. The results suggest that smaller models may provide viable alternatives to large language models for distributed threat intelligence processing in resource-limited environments. © 2025 IEEE.},

note = {Journal Abbreviation: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},

keywords = {Artificial intelligence, Cyber threats, Data-source, Edge Computing, extraction, Indicator of compromize, Indicators of Compromise, Information retrieval, Information Security, IoT Security, Language model, Malware, Natural languages, Network security, Program processors, Resource Constraint, Resource Constraints, Semantics, Small language model, Small Language Models, Threat Intelligence},

pubstate = {published},

tppubtype = {inproceedings}

}