@inproceedings{kadiQuantumEnhancedLSTMSequential2026,

title = {Quantum-Enhanced LSTM for Sequential Network Flow Analysis: A Hybrid Approach to DDoS Detection},

author = {A. Kadi and H. Moudoud and L. Khoukhi and Z. A. El Houda},

url = {https://www.scopus.com/pages/publications/105040813271?origin=resultslist},

doi = {10.1109/QCNC69040.2026.00136},

isbn = {979-833156110-9 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {Proc. - Int. Conf. Quantum Commun., Netw., Comput., QCNC},

pages = {830–834},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Distributed Denial-of-Service (DDoS) attacks continue to grow at a rapid rate, making timely and reliable detection a challenge for intrusion detection systems (IDSs). Classical deep models such as Long Short-Term Memory (LSTM) can capture temporal dependencies; however, they still struggle with highly nonlinear and noisy flow dynamics, especially when attack patterns shift. To address this, we propose QLSTM-E, an enhanced hybrid quantum-classical architecture for network intrusion detection that uses Variational Quantum Circuits (VQCs) and LSTM modeling to learn complex temporal dependencies in network traffic. QLSTM-E exploits quantum characteristics, including superposition and entanglement, to improve the representation of nonlinear patterns in sequential flow features. To balance expressivity and circuit cost on near-term devices, we adopt an angle-based encoding strategy and a star-topology entangling layout that reduces two-qubit gate overhead while preserving effective quantum correlations. We implement QLSTM-E using PennyLane and Qiskit and evaluate it on the CIC-DDoS2019 dataset under a fully simulated setting, requiring no access to quantum hardware. Experimental results demonstrate strong detection effectiveness, achieving 99.7% accuracy and F1-score, and show strong robustness under depolarizing noise up to p= 0.1. © 2026 IEEE.},

note = {Journal Abbreviation: Proc. - Int. Conf. Quantum Commun., Netw., Comput., QCNC},

keywords = {Denialof- service attacks, Distributed computer systems, Distributed denial of service, Distributed denial-of-service, Distributed Denial-of-Service (DDoS), Hybrid approach, Intrusion Detection, Learning systems, Logic gates, Long short-term memory, Machine-learning, Memory architecture, Network architecture, Network flow analysis, Network security, QLSTM, Quantum entanglement, Quantum machine learning, Quantum Machine Learning(QML), Quantum machines, Qubits, short term memory},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{mehrbanGameTheoreticSecurityOrchestration2026,

title = {Game-Theoretic Security Orchestration for Cross-RIC Policy Conflicts in O-RAN},

author = {A. Mehrban and H. Moudoud and B. Brik and L. Khoukhi and Z. A. El Houda},

url = {https://www.scopus.com/pages/publications/105045343135?origin=resultslist},

doi = {10.1109/ICC59461.2026.11587926},

isbn = {15503607 (ISSN); 979-831954209-0 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {IEEE Int Conf Commun},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {In Open Radio Access Network (Open RAN), disaggregated network components can interact through specialized xApps or rApps from multiple vendors. Despite the flexibility of operations and the dynamism of functions enabled by the open architecture, this openness can cause conflicts in security policy enforcement (e.g., encryption levels, key rotation, firewall restrictiveness), formally defined as thresholded divergences on shared or interdependent security parameters, where one app wants to set a stricter rule while another wants a more lenient policy simultaneously. The current solutions of "first-come"or "last-write"make the change one-sided for the benefit of a single app, while other apps may be harmed by the result, and at a network level, security and stability can be compromised. In this paper, we propose a novel Game-Theoretic Security Orchestrator (GTSO) that operates at the Service Management and Orchestration (SMO) layer, with cross-RIC scope, and is responsible for resolving parameter conflicts across xApps and rApps. GTSO treats xApps/rApps as strategic players and negotiates convergent solutions using game-theoretic models such as non-cooperative Nash games, cooperative bargaining, and leader-follower (Stackelberg) that guide competing control applications toward stable equilibrium points, while exchanging strategy summaries over secure channels to protect sensitive details and enhance overall network security. © 2026 IEEE.},

note = {Journal Abbreviation: IEEE Int Conf Commun},

keywords = {Computation theory, Computer system firewalls, Cryptography, Game theory, Game-theoretic, Multiple vendors, Network architecture, Network security, Networks security, Open radio access network, Open RAN, Policy conflict, Radio access networks, Security orchestration, Service management, Service orchestration, SMO, Xapp/rapp conflict, xApp/rApp conflicts},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{mehrbanSecuringORANEquipment2025,

title = {Securing O-RAN Equipment Using Blockchain-Based Supply Chain Verification},

author = {A. Mehrban and Z. A. El Houda and H. Moudoud and B. Brik and L. Khoukhi},

url = {https://www.scopus.com/pages/publications/105011364438?origin=resultslist},

doi = {10.1109/IWCMC65282.2025.11059692},

isbn = {979-833150887-6 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Int. Wirel. Commun. Mob. Comput. Conf., IWCMC},

pages = {1570–1575},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {The Open Radio Access Network (O-RAN) architecture has enabled the integration of multi-vendor equipment, yielding a significant enhancement in the flexibility and interoperability of telecommunications networks. However, this openness has also introduced new security vulnerabilities, particularly in supply chain integrity. Malicious actors may exploit weaknesses at various stages of production, distribution, or integration, leading to critical threats such as data tampering, unauthorized access, and denial-of-service (DOS) attacks. To address these challenges, this paper proposes a novel blockchain-based framework designed to secure the O-RAN supply chain. The proposed solution leverages a private permissioned blockchain ledger and cryptographic firmware authentication to ensure the integrity and authenticity of network equipment throughout its lifecycle. Specifically, the framework consists of: (1) a decentralized architecture integrating blockchain network components, equipment node validators, and secure firmware authentication mechanisms; and (2) a consensus-based verification model to enhance trust and transparency within the supply chain. To the best of our knowledge, this is one of the first approaches to use blockchain for O-RAN supply chain security, and also addressing emerging security threats in a scalable and tamper-resistant manner. Experimental validation and security assessments demonstrate the effectiveness of the proposed framework in mitigating supply chain risks, making it a promising solution for ensuring trust and robustness in next-generation O-RAN ecosystems. © 2025 IEEE.},

note = {Journal Abbreviation: Int. Wirel. Commun. Mob. Comput. Conf., IWCMC},

keywords = {Access network equipment, Authentication, Block-chain, Blockchain, Cryptography, Denial-of-service attack, Firmware, Firmware authentication, Multi-vendor, Network architecture, Network security, O-RAN, Open radio access network, Radio access networks, Security, Security systems, Security vulnerabilities, Supply Chain Verification, Supply chains, Telecommunications networks},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{moudoudSecuringORANZero2025,

title = {Securing O-RAN with Zero Trust Architecture and Large Language Models},

author = {H. Moudoud and Z. A. El Houda and B. Brik},

editor = {Iwendi C. and Boulouard Z. and Kryvinska N.},

url = {https://www.scopus.com/pages/publications/105011259647?origin=resultslist},

doi = {10.1007/978-3-031-94620-2_31},

isbn = {23673370 (ISSN); 978-303194619-6 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Lect. Notes Networks Syst.},

volume = {1312 LNNS},

pages = {357–368},

publisher = {Springer Science and Business Media Deutschland GmbH},

abstract = {The Open Radio Access Network (O-RAN) architecture is critical for the development of 6G networks, offering flexibility and interoperability through disaggregated components. However, this openness exposes O-RAN to new security vulnerabilities, including unauthorized access, data breaches, and malicious xApp deployments. To address these challenges, we propose DistillORAN, a novel Zero-Trust architecture designed specifically for O-RAN. DistillORAN features two core components: (1) a blockchain-based decentralized trust management system for secure verification, authentication, and dynamic access control of xApps, and (2) a lightweight intrusion detection module powered by DistilBERT, a transformer-based model optimized for resource-constrained environments. DistilBERT’s ability to analyze network activities and detect anomalies in real-time allows it to identify complex security threats and multi-step attack scenarios within the O-RAN ecosystem. Its lightweight nature makes it ideal for O-RAN’s distributed infrastructure, where computational resources may be limited. By combining blockchain technology for trust management with DistilBERT’s powerful pattern recognition for intrusion detection, DistillORAN enforces a Zero-Trust security model, ensuring continuous monitoring and verification of all network components. This comprehensive solution enhances the security and resilience of O-RAN networks, aligning with the dynamic needs of next-generation mobile infrastructures. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2025.},

note = {Journal Abbreviation: Lect. Notes Networks Syst.},

keywords = {Access management, Access Management system, Architecture, Authentication, Block-chain, Blockchain, Computer architecture, Computer crime, Cryptography, Distributed computer systems, Intrusion Detection, Language model, Large language model, Management systems, Mobile security, Mobile telecommunication systems, Network architecture, Network security, O-RAN, Open radio access network, Radio access networks, Security systems, Security vulnerabilities, Trusted computing, Zero Trust},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{merzoukiGraphNeuralNetwork2025,

title = {Graph Neural Network Framework for Advanced Persistent Threat Detection in IIoT Environments},

author = {K. Merzouki and Y. Hadi and H. Elghazi and H. Moudoud and Z. A. El Houda},

editor = {El Bouanani F. and Ayoub F.},

url = {https://www.scopus.com/pages/publications/105032074689?origin=resultslist},

doi = {10.1109/CommNet68224.2025.11288886},

isbn = {979-833155781-2 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc.},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {The increasing reliance of industrial infrastructures on the Industrial Internet of Things (IIoT) has made them more vulnerable to complex cyberattacks, especially Advanced Persistent Threats (APTs). To recognize and analyze these multi-stage incursions, we require computational models that can capture both structural and temporal connections in IIoT network architectures. This paper presents a framework based on Graph Neural Networks (GNNs) for detecting and classifying APTs in IIoT settings. We use the CICAPT-IIoT2024 dataset, which provides realistic multi-phase APT attack scenarios. The approach models system components, network communications, and process interactions as nodes and edges in a dynamic graph, allowing for relational learning and context-aware feature extraction. The GNN architecture leverages graph connectivity patterns and message-passing techniques to identify attack phases with greater accuracy and robustness. Experimental results show that this method outperforms traditional deep learning techniques and ensemble methods, particularly in early-stage anomaly detection. This paper highlights the potential of graph-based learning as an effective way to enhance IIoT infrastructure security against the changing behaviors of advanced persistent threats. © 2025 IEEE.},

note = {Journal Abbreviation: Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc.},

keywords = {Advanced persistent threat, Advanced Persistent Threats, Anomaly detection, CICAPT-IIoT2024, Deep learning, extraction, Feature extraction, Features extraction, Graph Neural Networks, Graphic methods, IIoT, Industrial infrastructure, Industrial internet of thing, Learning systems, Message passing, Network architecture, Network frameworks, Network security, Relational learning, Threat detection},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{mehrbanBlockchainEnabledMultiLayeredZeroTrust2025,

title = {A Blockchain-Enabled Multi-Layered Zero-Trust Security Framework for O-RAN},

author = {A. Mehrban and Z. A. El Houda and H. Moudoud and B. Brik and L. Khoukhi},

url = {https://www.scopus.com/pages/publications/105011345211?origin=resultslist},

doi = {10.1109/IWCMC65282.2025.11059720},

isbn = {979-833150887-6 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Int. Wirel. Commun. Mob. Comput. Conf., IWCMC},

pages = {1564–1569},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {O-RAN (Open Radio Access Network) is a set of open and interoperable radio access technologies, guided by the O-RAN Alliance, that, despite an open ecosystem, introduces significant security risks, expanding the threat surface in 6G networks. Traditional perimeter-based security approaches are inadequate for O-RAN's highly distributed, multi-vendor environments, where Zero Trust Architecture (ZTA) becomes essential for robust security. To address these challenges, we propose a novel blockchain-based, decentralized Zero-Trust Framework specifically designed for O-RAN security. Our proposed framework comprises two key layers: the first layer utilizes Federated Learning (FL) and Transfer Learning (TL) for advanced attack detection, enabling distributed, privacy-preserving threat analysis across O-RAN nodes. The second layer enforces Zero Trust access control through a blockchain-based identity management system, ensuring tamper-resistant, real-time policy updates. This multi-layered framework provides adaptive threat detection and resilient access control, validated through simulations demonstrating high detection accuracy and robust access management with minimal impact on network performance, offering a scalable security solution for next-generation O-RAN deployments. © 2025 IEEE.},

note = {Journal Abbreviation: Int. Wirel. Commun. Mob. Comput. Conf., IWCMC},

keywords = {Access control, Block-chain, Blockchain, Data privacy, Federated learning, federated learning (FL), Internet of thing, Internet of things, Internet of Things (IoT), Interoperability, Learning systems, Mobile telecommunication systems, Multi-layered, Network architecture, Network security, Open access, Open radio access network, open radio access network (O-RAN), Radio, Radio access networks, Radio access technologies, Radio communication, Secure communication, Security, Security frameworks, Security risks, Transfer learning, Trusted computing},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{mehrbanZtaDrivenHierarchicalByzantine2025,

title = {Zta-Driven Hierarchical Byzantine Consensus for Scalable O-Ran Supply Chain Security},

author = {A. Mehrban and H. Moudoud and Z. A. El Houda},

url = {https://www.scopus.com/pages/publications/105037585759?origin=resultslist},

doi = {10.1109/SmartAgriSuSY68475.2025.11466868},

isbn = {979-833157801-5 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Open RAN (O-RAN) multi-vendor interoperability continues to grow at a rapid pace, bringing flexibility and innovation but also increasing the attack surface. This makes O-RAN deployments vulnerable to supply chain infiltration and firmware tampering. Blockchain has emerged as a promising solution to provide an immutable and verifiable audit trail of equipment firmware hashes from manufacturing through deployment. However, conventional blockchain designs rely on all-to-all validator communication, which introduces scalability challenges and increases verification latency. To alleviate this issue, in this paper, we propose a scalable, efficient, and lightweight blockchain-enabled consensus framework, called H-BFT, to ensure supply chain security and attestation in O-RAN environments. H-BFT consists of three modules. The first module is a hierarchical consensus and attestation module that maps ZeroTrust Architecture (ZTA) microsegments (i.e., RU/DU/CU zones, near-real-time RIC clusters, and SMO domains) to validator committees. These committees verify local attestation events and produce concise summaries. The second module is a lightweight leader checkpointing module that periodically aggregates crosssegment digests, so that only compact validations become global, reducing communication and latency overhead. The third module is a blockchain-based audit and integrity enforcement module, where segment-level contracts enforce onboarding and integrity guarantees, and a checkpoint manager maintains consistency across the entire network. © 2025 IEEE.},

note = {Journal Abbreviation: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},

keywords = {Block-chain, Blockchain, Byzantine consensus, Firmware, Hierarchical Byzantine consensus, Multi-vendor, Network architecture, Network security, Open RAN, Open RAN (O-RAN), Permissioned blockchain, Supply chain security, Supply chains, Supply-chain attestation, Vendor interoperability, Zero-trust architecture, Zero-Trust Architecture (ZTA)},

pubstate = {published},

tppubtype = {inproceedings}

}