@article {Houmz2021,
	title = {Detecting the impact of software vulnerability on attacks: A case study of network telescope scans},
	journal = {Journal of Network and Computer Applications},
	volume = {195},
	year = {2021},
	note = {cited By 1},
	abstract = {Network scanning is one of the first steps in gathering information about a target before launching attacks. It is used to scan for vulnerable devices and exposed services in order to exploit them. Such exploits can result in data breaches or network disruption, which can be very costly for organizations. There are many factors, including technical and non-technical, affecting the volume of scanning activities. In this paper, we study the impact of vulnerability disclosure on the volume of scans over time and propose a machine learning-based approach to predict this impact. We conducted a comprehensive data collection of network scans from two network telescopes hosted in different countries, as well as the disclosed vulnerabilities from 2014 to 2019. We then designed a set of features to characterize the disclosed vulnerabilities and used several classifiers to predict whether a vulnerability will impact the volume of daily scans. The resulting classifier achieves over 85\% accuracy in predicting the impact. In addition, we performed an analysis of the key characteristics of vulnerabilities that directly affect scanning activities. Our findings show that this approach is able to classify vulnerabilities that have an impact on network scans. The implementation of our model and validation tests proved the efficiency of the selected features, as well as the robustness of our model to classify vulnerabilities{\textquoteright} impact on scans. {\textcopyright} 2021 Elsevier Ltd},
	keywords = {Case-studies, Classification algorithm, CVE, Forecasting, Machine learning, Network scan, Network scanning, Network security, Network telescopes, NVD, OR-networks, Scanning, Software vulnerabilities, Telescopes, Times series},
	doi = {10.1016/j.jnca.2021.103230},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85116335984\&doi=10.1016\%2fj.jnca.2021.103230\&partnerID=40\&md5=1d7f8d5d4111761b27fc93badc70f925},
	author = {Houmz, A. and Mezzour, G. and Zkik, K. and Ghogho, M. and Benbrahim, H.}
}
@article {Sebbar20205875,
	title = {MitM detection and defense mechanism CBNA-RF based on machine learning for large-scale SDN context},
	journal = {Journal of Ambient Intelligence and Humanized Computing},
	volume = {11},
	number = {12},
	year = {2020},
	note = {cited By 15},
	pages = {5875-5894},
	abstract = {Software defined network (SDN) is a promising new network abstraction that aims to improve and facilitate network management. Due to its centralized architecture and the lack of intelligence on the data plane, SDN suffers from many security issues that slows down its deployment. Man in the Middle (MitM) attack is considered as one of the most devastating attacks in an SDN context. In fact, MitM attack allows the attackers to capture, duplicate and spoof flows by targeting southbound interfaces and SDN nodes. Furthermore, it{\textquoteright}s very difficult to detect MitM attacks since it is performed passively at the SDN level. To reduce the impact of this attack, we generally set up security policies and authentication mechanisms. However, these techniques are not applicable for a large scale SDN architecture as they require complexes and static configurations and as they negatively influence on network performance. In this paper, we propose an intrusion detection and prevention framework by using machine learning techniques to detect and stop MitM attempts. To do so, we build a context-based node acceptance based on the random forest model (CBNA-RF), which helps to setting-up appropriate security policies and to automating defense operations on a large-scale SDN context. This mechanism can realize a quick and early detection of MitM attacks by automatically detecting malicious nodes without affecting performances. The evaluation of the proposed framework demonstrates that our model can correctly classify and detect malicious connections and nodes while keeping high accuracy and precision scores. {\textcopyright} 2020, Springer-Verlag GmbH Germany, part of Springer Nature.},
	keywords = {Authentication mechanisms, Centralized architecture, Decision trees, Defense operations, Intrusion detection, Intrusion detection and prevention, Machine learning, Machine learning techniques, Man-In-The-Middle (MITM) Attack, Network abstractions, Network architecture, Network security, Random forest modeling, Security systems},
	doi = {10.1007/s12652-020-02099-4},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85085987877\&doi=10.1007\%2fs12652-020-02099-4\&partnerID=40\&md5=cf120767ba875958e97b87ce22203057},
	author = {Sebbar, A. and Zkik, K. and Baddi, Y. and Boulmalf, M. and Kettani, M.D.E.-C.E.}
}
@article {Baddi2020245,
	title = {Msnd: Multicast software defined network based solution to multicast tree construction},
	journal = {Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)},
	volume = {12293},
	year = {2020},
	note = {cited By 0},
	pages = {245-256},
	abstract = {Internet services provider propose increasingly numerous applications depend on multicast communication patterns, such as database synchronization, newsletter updates, video, and audio group streaming. In spite of, IP multicast is frequently suffered from scaling and instability, which causes internet provider administrators to avoid its utilization. While different multicast protocols in all layers, such as routing and switching, have been created by researchers and providers, through several years, to focus on security, congestion control, and scalability, our work aims to scale multicast regarding the number of supported multicast groups and sources in networks and multicast session. In this paper, we propose an SDN-based IP multicast tree construction module to support and deploy multicast communication-based services. To do so, we take advantage to compute multicast tree, in the centralized way, to achieve a dynamic tree construction algorithm that helps SDN controller to dynamically construct and adjust an optimal multicast tree in all multicast session. The experiments studies on the prototype and simulation system exhibit that our solution gives better performance contrasted with the traditional multicast tree construction algorithms, better also to SDN-based solution proposed in the literature, regarding multicast tree cost, delay, delay variation, and multicast tree construction delay. {\textcopyright} Springer Nature Switzerland AG 2020.},
	keywords = {Database synchronization, Forestry, Internet protocols, Internet services providers, Multicast communication, Multicast protocol, Multicast sessions, Multicast software, Multicast tree construction, Multicasting, Network security, Overlay networks, Simulation systems, Software defined networking, Trees (mathematics), Ubiquitous computing},
	doi = {10.1007/978-3-030-58008-7_20},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85096412695\&doi=10.1007\%2f978-3-030-58008-7_20\&partnerID=40\&md5=f5004a1fb0f79381fe80ca313ad89b13},
	author = {Baddi, Y. and Sebbar, A. and Zkik, K. and Boulmalf, M. and El Kettani, M.D.E.-C.}
}
