@article {Iraqi2022,
	title = {Communizer: A collaborative cloud-based self-protecting software communities framework - Focus on the alert coordination system},
	journal = {Computers and Security},
	volume = {117},
	year = {2022},
	note = {cited By 0},
	abstract = {Popular software has always been appealing to adversaries, as related vulnerabilities are synonymous with millions of exposed businesses. Collaborative intrusion detection, as well as software self-protection, try to alleviate this situation. However, they lack either autonomy and adaptation, or Internet-scale oversight and mitigation. In this work, we present Communizer: a collaborative cloud-based framework that creates communities of self-protecting software across organizations. It allows community members to turn their common weaknesses into collaborative and proactive self-protection, empowering them to detect intrusions, exchange alerts, and anticipate attacks. We start by integrating multiple autonomic MAPE-K loops through cloud-based coordination, and a novel hierarchical, regional coordination pattern (HRCP), optimizing scalability, resiliency, accuracy and privacy. Then, we design a trust-based multi-level alert coordination system (TMACS), as well as a lightweight alert coordination message exchange format (ACMEF). At its core, TMACS aggregates, validates, and shares security alerts among community members while fostering agreement and managing trust. It also addresses insider attacks by detecting and blacklisting rogue members. Moreover, TMACS identifies and neutralizes selfish members through a specifically designed probabilistic model. The analysis, optimization, and evaluation of TMACS show a good trade-off between the precision and recall of untrustworthy and selfish members detection. More importantly, we demonstrate a drastic reduction of monitoring loads on community members while ensuring a high collaborative attack detection and anticipation rate, even for small-scope attacks. {\textcopyright} 2022 Elsevier Ltd},
	keywords = {Autonomic Computing, collaboration, Coordination systems, Economic and social effects, Intrusion detection, Mape, MAPE-K, Self protecting, Self-protecting software, Selfishness, Software community, Trust, Trusted computing},
	doi = {10.1016/j.cose.2022.102692},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85127747467\&doi=10.1016\%2fj.cose.2022.102692\&partnerID=40\&md5=246bfc07692396ec6709a73d31126fb6},
	author = {Iraqi, O. and Bakkali, H.E.}
}
@conference {Rachidi202213,
	title = {Network intrusion detection using Machine Learning approach},
	booktitle = {ACM International Conference Proceeding Series},
	year = {2022},
	note = {cited By 0},
	pages = {13-17},
	abstract = {Today, intrusion detection has become an active research area. Due to the rapidly increasing number of intrusion variants, intrusion detection system analyses and notifies the activities of users as normal (or) anomaly. In our paper, we built a model of intrusion detection system applied to the NSL-KDD data set using different supervised classifiers such as KNN and Na{\"\i}ve Bayes. We also proposed two algorithms for multi-classification based on the Random Forest (RF) which is an ensemble classifier and KNN. Then we used the K-folds method to evaluate and validate our model. To evaluate the performances, we realized experiments on NSL-KDD data set. The result shows that the second proposed algorithm is efficient with high accuracy and time optimization. {\textcopyright} 2022 ACM.},
	keywords = {Barium compounds, Classification (of information), Computer crime, data set, Decision trees, Intrusion detection, Intrusion Detection Systems, Intrusion-Detection, Machine learning, Machine learning approaches, Multi-classification, Network intrusion detection, NSL-KDD, Random forests, Research areas, Sodium compounds, Supervised classifiers},
	doi = {10.1145/3551690.3551693},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85139141127\&doi=10.1145\%2f3551690.3551693\&partnerID=40\&md5=e47a5f8038487b706673543f7fdf2de4},
	author = {Rachidi, Z. and Chougdali, K. and Kobbane, A. and Ben-Othman, J.}
}
@article {Karbal2020157,
	title = {A Comparison of Different Machine Learning Algorithms for Intrusion Detection},
	journal = {Communications in Computer and Information Science},
	volume = {1264},
	year = {2020},
	note = {cited By 0},
	pages = {157-169},
	abstract = {With the rapid development of the internet, intrusion detection became one of the major research problems in computer security. Many Intrusion Detection Systems (IDS) use data mining algorithms for classifying network traffic data and detecting different security violations. In this paper, we present some of the datasets and methods employed with the focus on network anomaly detection. We compare different machine learning techniques used in the latest research carried out for developing network intrusion detection systems. We also present an overview of some deep learning methodologies and their application for IDS purposes. The primary objective of this survey is to provide with a researcher, the state of the artwork already performed in this field of research. {\textcopyright} 2020, Springer Nature Switzerland AG.},
	keywords = {Anomaly detection, Classification (of information), Computer crime, Data communication systems, Data mining, Data mining algorithm, Deep learning, Intrusion detection, Intrusion Detection Systems, Learning algorithms, Learning systems, Machine learning techniques, Network anomaly detection, Network intrusion detection systems, Network security, Primary objective, Research problems, Security violations},
	doi = {10.1007/978-3-030-61143-9_13},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85097408678\&doi=10.1007\%2f978-3-030-61143-9_13\&partnerID=40\&md5=3725b891261e386c6df84eebcbc0e514},
	author = {Karbal, B. and Romadi, R.}
}
@article {Ezzarii2020,
	title = {Epigenetic algorithm-based detection technique for network attacks},
	journal = {IEEE Access},
	volume = {8},
	year = {2020},
	note = {cited By 2},
	abstract = {Nowadays, the cybersecurity issue involves new strategies to protect against advanced threats and unknown attacks. Intrusion detection system (IDS) is considered a robust system dealing with attacks detection, particularly unknown attacks and anomalies. Several IDS-based algorithms have been recently inspected in the literature, among them the well-known strengthen algorithms, i.e. Genetic algorithm (GA). Moreover, Epigenetic-based algorithm (EGA) is known as an improved version of GA ensuring high performance with reduced computational complexity. Its main goal is to converge within a short time towards an optimal solution by acting on genetic operators, namely mutation and crossover. In this article, we propose a new classifier based on EGA for IDS. Especially, based on a database of network traffics, EGA is applied to classify attacks. The results, performed through EGA simulation, show that the performance of the proposed technique outperforms the ones of GA classifier by obtaining a high detection rate up to 98\% and a faster processing time than that of GA and other algorithms that we have compared in this article. {\textcopyright} 2020 BMJ Publishing Group. All rights reserved.},
	keywords = {Classification (of information), Computer crime, Genetic algorithms, Genetic operators, High detection rate, Intrusion detection, Intrusion Detection Systems, Network attack, Network security, Network traffic, Optimal solutions, Processing time, Unknown attacks},
	doi = {10.1109/ACCESS.2020.3035250},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85097226994\&doi=10.1109\%2fACCESS.2020.3035250\&partnerID=40\&md5=2b4d9568d49e06ee5d704619bbb792f2},
	author = {Ezzarii, M. and El Ghazi, H. and El Ghazi, H. and El Bouanani, F.}
}
@conference {Iraqi202024,
	title = {Immunizer: A Scalable Loosely-Coupled Self-Protecting Software Framework using Adaptive Microagents and Parallelized Microservices},
	booktitle = {Proceedings of the Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, WETICE},
	volume = {2020-September},
	year = {2020},
	note = {cited By 2},
	pages = {24-27},
	abstract = {IT professionals are overwhelmed by rapidly-changing technology and growing complexity. Additional challenges are introduced by cyber-security. Self-protecting software tries to alleviate this situation by combining principles and techniques from both autonomic computing and software security. However, this combination creates scalability issues, as well as cross-cutting concerns. In this work, we present Immunizer: A Scalable Loosely-Coupled Self-Protecting Software Framework. Immunizer extends our Application-level Unsupervised Outlier-based Intrusion Detection and Prevention Framework by leveraging the architectural building blocks of autonomic computing, and adopting a microagent/microservice architectural model, augmented with distributed cluster computing, for maximum scalability and separation of concerns. More specifically, we design each of the Monitor, Analyze, Plan and Execute functions of the autonomic MAPE-K control loop as a parallelized microservice, while we model its Knowledge function as a data streaming, caching and storage infrastructure. Moreover, we design the Sensor and Effector touchpoint modules as adaptive lightweight runtime application instrumentation microagents. {\textcopyright} 2020 IEEE.},
	keywords = {Architectural buildings, Architectural modeling, Cluster computing, Computer programming, Control systems, Cross-cutting concerns, Digital storage, Distributed clusters, Immunization, Intrusion detection, Intrusion detection and prevention, Scalability, Separation of concerns, Software frameworks, Storage infrastructure},
	doi = {10.1109/WETICE49692.2020.00013},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85100768767\&doi=10.1109\%2fWETICE49692.2020.00013\&partnerID=40\&md5=8dd6bb02a0433738b505ad00e964a1af},
	author = {Iraqi, O. and El Bakkali, H.}
}
@article {Sebbar20205875,
	title = {MitM detection and defense mechanism CBNA-RF based on machine learning for large-scale SDN context},
	journal = {Journal of Ambient Intelligence and Humanized Computing},
	volume = {11},
	number = {12},
	year = {2020},
	note = {cited By 15},
	pages = {5875-5894},
	abstract = {Software defined network (SDN) is a promising new network abstraction that aims to improve and facilitate network management. Due to its centralized architecture and the lack of intelligence on the data plane, SDN suffers from many security issues that slows down its deployment. Man in the Middle (MitM) attack is considered as one of the most devastating attacks in an SDN context. In fact, MitM attack allows the attackers to capture, duplicate and spoof flows by targeting southbound interfaces and SDN nodes. Furthermore, it{\textquoteright}s very difficult to detect MitM attacks since it is performed passively at the SDN level. To reduce the impact of this attack, we generally set up security policies and authentication mechanisms. However, these techniques are not applicable for a large scale SDN architecture as they require complexes and static configurations and as they negatively influence on network performance. In this paper, we propose an intrusion detection and prevention framework by using machine learning techniques to detect and stop MitM attempts. To do so, we build a context-based node acceptance based on the random forest model (CBNA-RF), which helps to setting-up appropriate security policies and to automating defense operations on a large-scale SDN context. This mechanism can realize a quick and early detection of MitM attacks by automatically detecting malicious nodes without affecting performances. The evaluation of the proposed framework demonstrates that our model can correctly classify and detect malicious connections and nodes while keeping high accuracy and precision scores. {\textcopyright} 2020, Springer-Verlag GmbH Germany, part of Springer Nature.},
	keywords = {Authentication mechanisms, Centralized architecture, Decision trees, Defense operations, Intrusion detection, Intrusion detection and prevention, Machine learning, Machine learning techniques, Man-In-The-Middle (MITM) Attack, Network abstractions, Network architecture, Network security, Random forest modeling, Security systems},
	doi = {10.1007/s12652-020-02099-4},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85085987877\&doi=10.1007\%2fs12652-020-02099-4\&partnerID=40\&md5=cf120767ba875958e97b87ce22203057},
	author = {Sebbar, A. and Zkik, K. and Baddi, Y. and Boulmalf, M. and Kettani, M.D.E.-C.E.}
}
