@article {Ayache2016189,
	title = {Analysis and verification of XACML policies in a medical cloud environment},
	journal = {Scalable Computing},
	volume = {17},
	number = {3},
	year = {2016},
	note = {cited By 2},
	pages = {189-205},
	abstract = {The connectivity of devices, machines and people via Cloud infrastructure can support collaborations among doctors and specialists from different medical organisations. Such collaborations may lead to data sharing and joint tasks and activities. Hence, the collaborating organisations are responsible for managing and protecting data they share. Therefore, they should define a set of access control policies regulating the exchange of data they own. However, existing Cloud services do not offer tools to analyse these policies. In this paper, we propose a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The analysis process detects anomalies at two policy levels: a) intra-policy: detects discrepancies between rules within a single security policy (conflicting rules and redundancies), and b) interpolicies: detects anomalies between several security policies such as inconsistency and similarity. The verification process consists in verifying the completeness property which guarantees that each access request is either accepted or denied by the access control policy. In order to demonstrate the efficiency of our method, we also provide the time and space complexities. Finally, we present the implementation of our method and demonstrate how efficiently our approach can detect policy anomalies. {\textcopyright} 2016 SCPE.},
	doi = {10.12694/scpe.v17i3.1180},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84986332574\&doi=10.12694\%2fscpe.v17i3.1180\&partnerID=40\&md5=86b782c01a2231027ed2e7308e178385},
	author = {Ayache, M.a and Erradi, M.a and Khoumsi, A.b and Freisleben, B.c}
}
@article {Benkaouz201648,
	title = {Nearest neighbors graph construction: Peer sampling to the rescue},
	journal = {Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)},
	volume = {9944 LNCS},
	year = {2016},
	note = {cited By 0},
	pages = {48-62},
	abstract = {In this paper, we propose an efficient KNN service, called KPS (KNN-Peer-Sampling). The KPS service can be used in various contexts e.g. recommendation systems, information retrieval and data mining. KPS borrows concepts from P2P gossip-based clustering protocols to provide a localized and efficient KNN computation in large-scale systems. KPS is a sampling-based iterative approach, combining randomness, to provide serendipity and avoid local minimum, and clustering, to ensure fast convergence. We compare KPS against the state of the art KNN centralized computation algorithm NNDescent, on multiple datasets. The experiments confirm the efficiency of KPS over NNDescent: KPS improves significantly on the computational cost while converging quickly to a close to optimal KNN graph. For instance, the cost, expressed in number of pairwise similarity computations, is reduced by ≈23\% and ≈49\% to construct high quality KNN graphs for Jester and MovieLens datasets, respectively. In addition, the randomized nature of KPS ensures eventual convergence, not always achieved with NNDescent. {\textcopyright} Springer International Publishing AG 2016.},
	doi = {10.1007/978-3-319-46140-3_4},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84990068831\&doi=10.1007\%2f978-3-319-46140-3_4\&partnerID=40\&md5=001c7ac565106835cc5cd7a01e01a3c4},
	author = {Benkaouz, Y.a and Erradi, M.a and Kermarrec, A.-M.b}
}
@conference {Ayache201655,
	title = {Towards an efficient policy evaluation process in multi-tenancy cloud environments},
	booktitle = {CCSW 2016 - Proceedings of the 2016 ACM Cloud Computing Security Workshop, co-located with CCS 2016},
	year = {2016},
	note = {cited By 0},
	pages = {55-59},
	abstract = {Cloud computing offers most of its services under multi-tenancy environments. To satisfy security requirements among collaborating tenants, each tenant may define a set of access control policies to secure access to shared data. Several cloud solutions make use of XACML to specify such policies. However, existing implementations of XACML perform a brute force search to compare a request to all existing rules in a given XACML policy. This decreases the decision process (i.e., policy evaluation) performance especially for policies with a large number of rules. In this paper, we propose an automata-based approach for an efficient XACML policy evaluation. We implemented our approach in a cloud policy engine called X2Automata. The engine first converts both XACML policies and access requests to automata. Second, it combines the two automata by a synchronous product. Third, it applies an evaluation procedure to the resulting automaton to decide whether an access request is granted or not. To highlight the efficiency of X2Automata, we compare its performance, based on the OpenStack cloud environment, with the XACML implementation named Balana. {\textcopyright} 2016 ACM.},
	doi = {10.1145/2996429.2996431},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85001655008\&doi=10.1145\%2f2996429.2996431\&partnerID=40\&md5=8259d7215d88c0a1a7a94d837b9564a3},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b and Khoumsi, A.c}
}
@conference {Benkaouz201672,
	title = {Work in progress: K-nearest neighbors techniques for ABAC policies clustering},
	booktitle = {ABAC 2016 - Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control, co-located with CODASPY 2016},
	year = {2016},
	note = {cited By 0},
	pages = {72-75},
	abstract = {In this paper, we present an approach based on the K- Nearest Neighbors algorithms for policies clustering that aims to reduce the ABAC policies dimensionality for high scale systems. Since ABAC considers a very large set of attributes for access decisions, it turns out that using such model for large scale systems might be very complicated. To date, researchers have proposed to use data mining techniques to discover roles for RBAC system construction. In this work in progress, we consider the usage of KNN-based techniques for the classification of ABAC policies based on similarity computations of rules in order to enhance the ABAC exibility and to reduce the number of policy rules. {\textcopyright} 2016 ACM.},
	doi = {10.1145/2875491.2875497},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84966549589\&doi=10.1145\%2f2875491.2875497\&partnerID=40\&md5=2378f9f3208a82bfc833b26f1a7ef267},
	author = {Benkaouz, Y.a and Erradi, M.a and Freisleben, B.b}
}
@conference {Ayache201526,
	title = {Access control policies enforcement in a cloud environment: Openstack},
	booktitle = {Proceedings of the 2015 11th International Conference on Information Assurance and Security, IAS 2015},
	year = {2015},
	note = {cited By 1},
	pages = {26-31},
	abstract = {Cloud computing has become a widely used paradigm in many IT domains such as e-health. It offers several advantages to the users, e.g. elasticity, flexibility and the rapid sharing of a huge set of digital data. However, many security and privacy concerns still pose significant challenges. In particular, the most identified problem is how to enforce the user{\textquoteright}s security policy in the access control of the outsourced data. In fact, cloud environments does not provide facilities to support high level defined security policies. For instance, the swift storage component of openstack supports only fine grained access control to execute a specific action on a specific defined object. In this paper, we designed and implemented a middleware to provide high level security policies while using such swift fine grained primitives. An e-health collaborative application dedicated for remote diagnosis is used to illustrate the suggested approach. {\textcopyright} 2015 IEEE.},
	doi = {10.1109/ISIAS.2015.7492740},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84979530321\&doi=10.1109\%2fISIAS.2015.7492740\&partnerID=40\&md5=bc070d8bb2973f9f221582272c86a588},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b}
}
@conference {Ayache2015771,
	title = {CurlX: A middleware to enforce access control policies within a cloud environment},
	booktitle = {2015 IEEE Conference on Communications and NetworkSecurity, CNS 2015},
	year = {2015},
	note = {cited By 3},
	pages = {771-772},
	abstract = {Today cloud security and privacy concerns pose significant challenges. One particular challenge consists in how to take into consideration the user{\textquoteright}s security policies while accessing the outsourced data. In fact, for a given application, we may have a set of rules, as high level security policy, which needs to hold prior to any query execution. Therefore, the main problem that we tackle in this ongoing project is how to enforce this high level security policy in the cloud storage layer without conflicts. To address this challenges, we propose a middleware denoted curlX which consists of two main processes: the security policy enforcement process and the verification process. {\textcopyright} 2015 IEEE.},
	doi = {10.1109/CNS.2015.7346928},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84966440949\&doi=10.1109\%2fCNS.2015.7346928\&partnerID=40\&md5=bc69af0f99d640d39aa014a6a06475e9},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b}
}
@article {Benkaouz201594,
	title = {Distributed privacy-preserving data aggregation via anonymization},
	journal = {Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)},
	volume = {9466},
	year = {2015},
	note = {cited By 0},
	pages = {94-108},
	abstract = {Data aggregation is a key element in many applications that draw insights from data analytics, such as medical research, smart metering, recommendation systems and real-time marketing. In general, data is gathered from several sources, processed, and publicly released for data analysis. Since the considered data might contain personal and sensitive information, special handling of private data is required. In this paper, we present a novel distributed privacy-preserving data aggregation protocol, called ADiPA. It relies on anonymization techniques for protecting personal data, such as k-anonymity, l-diversity and t-closeness. Its purpose is to allow a set of entities to derive aggregate results from data tables that are partitioned across these entities in a fully decentralized manner while preserving the privacy of their individual sensitive inputs. ADiPA neither relies on a trusted third party nor on cryptographic techniques. The protocol performs accurate aggregation when communication links and nodes do not fail. {\textcopyright} Springer International Publishing Switzerland 2015.},
	doi = {10.1007/978-3-319-26850-7_7},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84961141090\&doi=10.1007\%2f978-3-319-26850-7_7\&partnerID=40\&md5=518bf129894b27ee29b635e53f9baf0c},
	author = {Benkaouz, Y.a and Erradi, M.a and Freisleben, B.b}
}
@article {AitOualhaj2015126,
	title = {A ferry-assisted solution for forwarding function in Wireless Sensor Networks},
	journal = {Pervasive and Mobile Computing},
	volume = {22},
	year = {2015},
	note = {cited By 2},
	pages = {126-135},
	abstract = {For sure, Wireless Sensor Networks (WSNs) are becoming an ultimate part of next generation mobile networks. They are a master piece for Ubiquitous computing. Indeed, they sustain development of numerous paradigms/ technologies such as distributed ambient intelligence, context-awareness and future mobile networking (e.g., B4G and 5G). Battery life remains one of the crucial problems to handle. In this article we propose an infrastructure-based topology using mobile ferries (mobile micro-base stations). In real life, a ferry could be robot, bus, tram, train or any other engine scrutinizing periodically a given area. Yet, message ferries are moving along concentric annulus and may collect data generated by the static sensors (could be classic sensors, smart meters, wearable devices, etc.) randomly distributed on given area. Next, transmissions are performed in a ferry-to-ferry forwarding scheme till arriving at the sink. Considered ferries could sense themselves data and therefore behave as mobile sensors allowing better awareness on the area state [1-3]. Our scheme could also assist Machine-to-Machine communications to increase the network lifetime, with potentially some cognitive-radio capabilities and opportunistic detection and access. Our proposal can easily be integrated in a smart-city for better interaction and green communications. Next, we present a queueing model (queues with finite capacity) to handle the generated traffic and to analyze the behavior of mobile ferries. We provided a close-form expression for both end-to-end throughput and end-to-end delay. The main objective of this work is to improve the energy efficiency of the cognitive sensors by asking cognitive sensors to not care about forwarding data of each other except for urgent data, this latter point is out of the scope of the paper. These static sensors will only care about data sensing, which will reduce their individual energy consumption. {\textcopyright} 2015 Elsevier B.V.},
	doi = {10.1016/j.pmcj.2015.05.003},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84941024588\&doi=10.1016\%2fj.pmcj.2015.05.003\&partnerID=40\&md5=83a85e8d64da3c3ac9458a4eba519a14},
	author = {Ait Oualhaj, O.a and Kobbane, A.b and Sabir, E.c and Ben-Othman, J.d and Erradi, M.a}
}
@conference {Krombi2014306,
	title = {Automata-based approach to design and analyze security policies},
	booktitle = {2014 12th Annual Conference on Privacy, Security and Trust, PST 2014},
	year = {2014},
	note = {cited By 2},
	pages = {306-313},
	abstract = {Information systems must be controlled by security policies to protect them from undue accesses. Security policies are often designed by rules expressed using informal text, which implies ambiguities and inconsistencies in security rules. Our objective in this paper is to develop a formal approach to design and analyze security policies. We propose a procedure that synthesizes an automaton which implements a given security policy. Our automata-based approach can be a common basis to analyze several aspects of security policies. We use our automata-based approach to develop three analysis procedures to: verify completeness of a security policy, detect anomalies in a security policy, and detect functional discrepancies between several implementations of a security policy. We illustrate our approach using examples of security policies for a firewall. {\textcopyright} 2014 IEEE.},
	doi = {10.1109/PST.2014.6890953},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84910095793\&doi=10.1109\%2fPST.2014.6890953\&partnerID=40\&md5=c203c3363442208f90fb65f844c4a72b},
	author = {Krombi, W.a and Erradi, M.a and Khoumsi, A.b}
}
@conference {Omar2014,
	title = {A ferry-assisted solution for forwarding function in Wireless Sensor Networks},
	booktitle = {Proceedings - International Symposium on Computers and Communications},
	volume = {Workshops},
	year = {2014},
	note = {cited By 0},
	abstract = {To ensure connectivity in highly sparse Wireless Sensor Networks (WSNs), we consider a Ferry-assisted Wireless Sensor Network(FWSN). In our FWSN, message ferries moving along concentric annulus collect the static sensors generated packets and propagate them throughout a ferry-to-ferry forwarding schema to the sink. In this paper we present a queueing model to study and analyze the FWSN behavior. We will adapt a queuing model with finite queues which will allow us to analyze the network behavior in tens of packet loss using an analytic model. The objective of this work is to provide a way to optimize the energy consumption for each individual sensor. In our approach we consider a sensor Ferry, which is a mobile sensor with the capacity to provide the control operation upon the other fixed sensors within to network. Therefor, these fixed sensors will have to perform less control operations which will reduce their individual energy consumption. By doing so, this will automatically impact positively on to the lifetime of the network. {\textcopyright} 2014 IEEE.},
	doi = {10.1109/ISCC.2014.6912648},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84908132136\&doi=10.1109\%2fISCC.2014.6912648\&partnerID=40\&md5=5d5c3b3309f7b9a5ed0c66f13985600c},
	author = {Omar, A.O.a and Kobbane, A.a and Sabir, E.a b and Erradi, M.a and Ben-Othman, J.c}
}
