Slide
Centre Interdisciplinaire
de Recherche et d’Innovation
en Cybersécurité et Société
de Recherche et d’Innovation
en Cybersécurité et Société
1.
Malasi, J. -J. M.; Moudoud, H.; Missaoui, R.
A Lightweight Multimodal LLM-Based Intrusion Detection System for Open RAN Proceedings Article
In: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 979-833157731-5 (ISBN), (Journal Abbreviation: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW).
Abstract | Links | BibTeX | Tags: Benchmarking, Computational linguistics, Computer crime, Cyber security, Cybersecurity, Embedded systems, Embeddings, Intelligent controllers, Internet protocols, Intrusion Detection, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, Language model, Large language model, Large Language Models (LLMs), Mobile telecommunication systems, Multi-modal, Multi-modal learning, Multimodal Learning, Network security, Open RAN, Pipelines, RAN intelligent controller, RAN intelligent controller (RIC), Semantics
@inproceedings{malasiLightweightMultimodalLLMBased2026,
title = {A Lightweight Multimodal LLM-Based Intrusion Detection System for Open RAN},
author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},
url = {https://www.scopus.com/pages/publications/105043415034?origin=resultslist},
doi = {10.1109/WCNCW67598.2026.11555393},
isbn = {979-833157731-5 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Open Radio Access Network architectures introduce unprecedented openness and programmability through RAN Intelligent Controllers, expanding the attack surface beyond traditional volumetric threats. Most existing intrusion detection systems for fifth-generation mobile networks and ORAN rely primarily on numerical Key Performance Indicators (KPIs), often overlooking the security-relevant semantics embedded in logs and control messages. This paper proposes LLM4IDS, a semantic-aware and multimodal intrusion detection system that fuses lightweight Large Language Model (LLM) embeddings of textified events with traditional tabular KPIs in a compact Transformer-based classifier. Evaluated on the realworld OpenIreland O-RAN dataset and two classical IP network benchmarks (UNSW-NB15 and CICIDS2017), LLM4IDS consistently matches or surpasses strong tabular baselines while maintaining high efficiency. On OpenIreland, it reaches nearperfect detection (F1-score $textbackslashapprox 1.0$) and yields large gains for application-layer and volumetric attacks compared to KPI-only models. Across datasets, the classifier maintains an approximately 4 MB footprint and sub-millisecond CPU inference latency; the frozen sentence-LLM encoder can be shared across tasks, and its embeddings can be cached or precomputed when required by the deployment pipeline. These results indicate that integrating semantic context through multimodal fusion can significantly enhance intrusion detection in O-RAN while remaining competitive on standard IP-based IDS tasks. To the best of our knowledge, this work is among the first to study a complete multimodal LLM-based IDS pipeline for O-RAN data with cross-domain evaluation on both O-RAN and classical IP benchmarks. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Wirel. Commun. Netw. Conf. Workshops, WCNCW},
keywords = {Benchmarking, Computational linguistics, Computer crime, Cyber security, Cybersecurity, Embedded systems, Embeddings, Intelligent controllers, Internet protocols, Intrusion Detection, intrusion detection system, Intrusion Detection System (IDS), Intrusion Detection Systems, Language model, Large language model, Large Language Models (LLMs), Mobile telecommunication systems, Multi-modal, Multi-modal learning, Multimodal Learning, Network security, Open RAN, Pipelines, RAN intelligent controller, RAN intelligent controller (RIC), Semantics},
pubstate = {published},
tppubtype = {inproceedings}
}
Open Radio Access Network architectures introduce unprecedented openness and programmability through RAN Intelligent Controllers, expanding the attack surface beyond traditional volumetric threats. Most existing intrusion detection systems for fifth-generation mobile networks and ORAN rely primarily on numerical Key Performance Indicators (KPIs), often overlooking the security-relevant semantics embedded in logs and control messages. This paper proposes LLM4IDS, a semantic-aware and multimodal intrusion detection system that fuses lightweight Large Language Model (LLM) embeddings of textified events with traditional tabular KPIs in a compact Transformer-based classifier. Evaluated on the realworld OpenIreland O-RAN dataset and two classical IP network benchmarks (UNSW-NB15 and CICIDS2017), LLM4IDS consistently matches or surpasses strong tabular baselines while maintaining high efficiency. On OpenIreland, it reaches nearperfect detection (F1-score $textbackslashapprox 1.0$) and yields large gains for application-layer and volumetric attacks compared to KPI-only models. Across datasets, the classifier maintains an approximately 4 MB footprint and sub-millisecond CPU inference latency; the frozen sentence-LLM encoder can be shared across tasks, and its embeddings can be cached or precomputed when required by the deployment pipeline. These results indicate that integrating semantic context through multimodal fusion can significantly enhance intrusion detection in O-RAN while remaining competitive on standard IP-based IDS tasks. To the best of our knowledge, this work is among the first to study a complete multimodal LLM-based IDS pipeline for O-RAN data with cross-domain evaluation on both O-RAN and classical IP benchmarks. © 2026 IEEE.
2.
Mehrban, A.; Houda, Z. Abou El; Moudoud, H.; Bao, L. Le
Integrating Zero Trust Architecture in O-RAN: A Comprehensive Survey and Analysis Journal Article
In: IEEE Open Journal of the Communications Society, vol. 6, pp. 10465–10495, 2025, ISSN: 2644125X (ISSN).
Abstract | Links | BibTeX | Tags: 6g network, 6G networks, Access control, Data flow analysis, Intelligent controllers, Interoperability, Mobile telecommunication systems, Multi-vendor, Network architecture, Network components, Network security, New approaches, Open radio access network, open radio access network (O-RAN), Radio access networks, RAN intelligent controller, RAN intelligent controller (RIC), Smart contract, Survey and analysis, Trusted computing, Vendor interoperability, Zero trust architecture, Zero trust architecture (ZTA)
@article{mehrbanIntegratingZeroTrust2025,
title = {Integrating Zero Trust Architecture in O-RAN: A Comprehensive Survey and Analysis},
author = {A. Mehrban and Z. Abou El Houda and H. Moudoud and L. Le Bao},
url = {https://www.scopus.com/pages/publications/105025432034?origin=resultslist},
doi = {10.1109/OJCOMS.2025.3644132},
issn = {2644125X (ISSN)},
year = {2025},
date = {2025-01-01},
journal = {IEEE Open Journal of the Communications Society},
volume = {6},
pages = {10465–10495},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Open Radio Access Network (O-RAN) is a new approach to mobile networks that disaggregates the network architecture into multi-vendor interoperable physical and software-defined network components connected through standardized open interfaces. This architecture enables deploying solutions on cloud-native platforms and boosting Artificial Intelligence(AI)-driven automation for network optimization. Despite the benefits of O-RAN’s heterogeneous and multi-vendor architecture, this approach inevitably enlarges the attack surface and introduces additional trust boundaries, which imminently threaten the uniformity of network performance. This also justifies the necessity of Zero Trust Architecture (ZTA) principles as a countermeasure, securing all network components, interfaces, and data flows. This survey shows how ZTA tenets can be integrated into O-RAN settings, contributing in three key areas: (1) a novel ZTA-to-O-RAN mapping model that explicitly places Policy Engine (PE), Policy Administrator (PA), and Policy Enforcement Points (PEPs) across RIC layers (Non-RT/Near-RT RIC), standardized interfaces (A1/E2/O1/O2), and disaggregated RAN functions (O-DU/O-CU/O-RU); (2) a Risk-Adaptive Access Control (RAdAC) framework that dynamically modulates verification depth based on contextual risk; and (3) integration of blockchain-based decentralized identity management with smart-contract-driven authorization for xApp/rApp lifecycle security. © 2020 IEEE.},
keywords = {6g network, 6G networks, Access control, Data flow analysis, Intelligent controllers, Interoperability, Mobile telecommunication systems, Multi-vendor, Network architecture, Network components, Network security, New approaches, Open radio access network, open radio access network (O-RAN), Radio access networks, RAN intelligent controller, RAN intelligent controller (RIC), Smart contract, Survey and analysis, Trusted computing, Vendor interoperability, Zero trust architecture, Zero trust architecture (ZTA)},
pubstate = {published},
tppubtype = {article}
}
Open Radio Access Network (O-RAN) is a new approach to mobile networks that disaggregates the network architecture into multi-vendor interoperable physical and software-defined network components connected through standardized open interfaces. This architecture enables deploying solutions on cloud-native platforms and boosting Artificial Intelligence(AI)-driven automation for network optimization. Despite the benefits of O-RAN’s heterogeneous and multi-vendor architecture, this approach inevitably enlarges the attack surface and introduces additional trust boundaries, which imminently threaten the uniformity of network performance. This also justifies the necessity of Zero Trust Architecture (ZTA) principles as a countermeasure, securing all network components, interfaces, and data flows. This survey shows how ZTA tenets can be integrated into O-RAN settings, contributing in three key areas: (1) a novel ZTA-to-O-RAN mapping model that explicitly places Policy Engine (PE), Policy Administrator (PA), and Policy Enforcement Points (PEPs) across RIC layers (Non-RT/Near-RT RIC), standardized interfaces (A1/E2/O1/O2), and disaggregated RAN functions (O-DU/O-CU/O-RU); (2) a Risk-Adaptive Access Control (RAdAC) framework that dynamically modulates verification depth based on contextual risk; and (3) integration of blockchain-based decentralized identity management with smart-contract-driven authorization for xApp/rApp lifecycle security. © 2020 IEEE.