Dr. Mourad Debbabi

Scholarly Output

Publications

330+

Peer-reviewed journal & conference publications

Authored books

Selected publications shown below (2018–2026)

Years of continuous output represented

View full record on DBLP → View profile on Google Scholar → View ORCID profile →

Monographs

Books

📘

Android Malware Fingerprinting and Detection Using Machine Learning. Springer, 2021.
📘

Machine Learning for Authorship Attribution and Cyber Forensics. Springer, 2021.
📘

Binary Code Fingerprinting for Cybersecurity: Application to Malicious Code Fingerprinting. Advances in Information Security 78, Springer Nature, 2020.
📘

Cloud Security Auditing. Advances in Information Security 76, Springer, 2019.
📘

Aspect-Oriented Security Hardening of UML Design Models. Springer, 2015.
📘

Verification and Validation in Systems Engineering: Assessing UML/SysML Design Models. Springer, 2010.
📘

Embedded Java Security: Security for Mobile Devices. Springer, 2006.

Journals & Conferences

Selected Publications

The list below presents Dr. Debbabi's journal and conference publications from 2018 to 2026, sourced from his DBLP author profile.

2026

Plug and Prey: Exploiting Design Flaws to Hijack EV Charging Stations. Computers & Security, 161:104759.
Automating Threat-Aligned Testflows Generation Using Ontology-Grounded RAG from CTI Reports. IEEE Transactions on Network and Service Management, 23:4260–4277.
An SDN-Based Framework for Cyber-Physically Coordinated Voltage Support of Virtual Power Plants Against DoS Attacks. IEEE Transactions on Smart Grid, 17(1):617–633.
Context and Semantics-Aware Mapping of Unstructured Tickets to MITRE ATT&CK TTPs. IEEE ICC 2026.

2025

NEXUS: Towards Accurate and Scalable Mapping between Vulnerabilities and Attack Techniques. NDSS 2026 (forthcoming).
Synchronization Plane in O-RAN: Overview, Security and Research Directions. IEEE Communications Magazine, 63(2):88–94.
Comprehensive Advanced Persistent Threats Dataset. IEEE Networking Letters, 7(2):150–154.
ThreatScout: Automated Threat Hunting Solution Using Machine Reasoning. IEEE Security & Privacy, 23(5):56–67.
Internet-Wide Analysis, Characterization, and Family Attribution of IoT Malware: A Comprehensive Longitudinal Study. IEEE Transactions on Dependable and Secure Computing, 22(2):1703–1716.
Cross-Level Security Verification for Network Functions Virtualization (NFV). IEEE Transactions on Dependable and Secure Computing, 22(4):3240–3258.
Measuring the Security Posture of IEC 61850 Smart Grid Substations Against Supply Chain Attacks. IEEE Transactions on Industrial Informatics, 21(9):6946–6957.
Threatify: APT Threat Variant Generation Using Graph-Based Machine Learning. IEEE Transactions on Network and Service Management, 22(5):3978–3994.
Power Distribution Network Topology Detection Using Dual-Graph Structure Graph Neural Network Model. IEEE Transactions on Smart Grid, 16(2):1833–1850.
Anticipating the Evolution of APT Variants Using Generative AI and Reinforcement Learning. IEEE CNS 2025, pp. 1–10.
BTS-Band: An Explainable AI Detection Solution for Base Transceiver Station Resource Depletion Attack in O-RAN. CNSM 2025, pp. 1–7.

2024

AUTOMA: Automated Generation of Attack Hypotheses and Their Variants for Threat Hunting Using Knowledge Discovery. IEEE Transactions on Network and Service Management, 21(5):5178–5196.
Uncovering Covert Attacks on EV Charging Infrastructure: How OCPP Backend Vulnerabilities Could Compromise Your System. ACM AsiaCCS 2024.
OctopusTaint: Advanced Data Flow Analysis for Detecting Taint-Based Vulnerabilities in IoT/IIoT Firmware. ACM CCS 2024, pp. 2355–2369.
Chronohunt: Determining Optimal Pace for Automated Alert Analysis in Threat Hunting Using Reinforcement Learning. DSC 2024, pp. 1–8.
Modularizing Directed Greybox Fuzzing for Binaries over Multiple CPU Architectures. DIMVA 2024, pp. 84–103.
Discerning Security Flaws in IoT Firmware via Call Sequence Semantics. DIMVA 2024, pp. 395–415.
SecMonS: A Security Monitoring Framework for IEC 61850 Substations Based on Configuration Files and Logs. DIMVA 2024, pp. 483–502.
Siamese Neural Network for Robust IoT Device-Type Identification: A Few-Shot Learning Approach. SecureComm 2024 (3), pp. 91–112.
ChainPatrol: Balancing Attack Detection and Classification with Performance Overhead for Service Function Chains Using Virtual Trailers. USENIX Security Symposium 2024.

2023

CPID: Insider Threat Detection Using Profiling and Cyber-Persona Identification. Computers & Security, 132:103350.
Security of Wide-Area Monitoring, Protection, and Control (WAMPAC) Systems of the Smart Grid: A Survey on Challenges and Opportunities. IEEE Communications Surveys & Tutorials, 25(2):1294–1335.
A Survey on Threat Hunting in Enterprise Networks. IEEE Communications Surveys & Tutorials, 25(4):2299–2324.
A Survey of Binary Code Fingerprinting Approaches: Taxonomy, Methodologies, and Features. ACM Computing Surveys, 55(2):19:1–19:41.
On the Prevalence of Software Supply Chain Attacks: Empirical Study and Investigative Framework. Forensic Science International: Digital Investigation, 44(Supplement):301508.
SwiftR: Cross-Platform Ransomware Fingerprinting Using Hierarchical Neural Networks on Hybrid Features. Expert Systems with Applications, 225:120017.
A Real-Time Cosimulation Testbed for Electric Vehicle Charging and Smart Grid Security. IEEE Security & Privacy, 21(4):74–83.
Detection of Microgrid Cyberattacks Using Network and System Management. IEEE Transactions on Smart Grid, 14(3):2390–2405.
Binary Function Clone Search in the Presence of Code Obfuscation and Optimization over Multi-CPU Architectures. ACM AsiaCCS 2023, pp. 443–456.
A Tenant-Based Two-Stage Approach to Auditing the Integrity of Virtual Network Function Chains Hosted on Third-Party Clouds. ACM CODASPY 2023, pp. 79–90.
Evaluating the Security Posture of 5G Networks by Combining State Auditing and Event Monitoring. ESORICS 2023 (2), pp. 123–144.
Accurify: Automated New Testflows Generation for Attack Variants in Threat Hunting. FPS 2023 (2), pp. 52–69.
Vulnerability Analysis of Virtual Power Plant Voltage Support under Denial-of-Service Attacks. IEEE ISGT 2023, pp. 1–5.
A Resilience Quantitative Framework for Wide Area Damping Control Against Cyberattacks. IEEE ISGT 2023, pp. 1–5.
Detection of Cyber Attacks on Synchro-Phasor Network Targeting Topology Detection Application of Power Distribution Grids. IEEE SmartGridComm 2023, pp. 1–6.

2022

Chameleon: Optimized Feature Selection Using Particle Swarm Optimization and Ensemble Methods for Network Anomaly Detection. Computers & Security, 117:102684.
Automatic Vulnerability Detection in Embedded Devices and Firmware: Survey and Layered Taxonomies. ACM Computing Surveys, 54(2):25:1–25:42.
Inferring and Investigating IoT-Generated Scanning Campaigns Targeting a Large Network Telescope. IEEE Transactions on Dependable and Secure Computing, 19(1):402–418.
Factor of Security (FoS): Quantifying the Security Effectiveness of Redundant Smart Grid Subsystems. IEEE Transactions on Dependable and Secure Computing, 19(2):1018–1035.
ProSAS: Proactive Security Auditing System for Clouds. IEEE Transactions on Dependable and Secure Computing, 19(4):2517–2534.
Security Monitoring of IEC 61850 Substations Using IEC 62351-7 Network and System Management. IEEE Transactions on Industrial Informatics, 18(3):1641–1653.
Hardening Substations Against Supply Chain Attacks Under Operational Constraints. IEEE ISGT 2022, pp. 1–5.
Security Monitoring of the Microgrid Using IEC 62351-7 Network and System Management. IEEE ISGT 2022, pp. 1–5.
A Cyber-Physical Resilience-Based Survivability Metric Against Topological Cyberattacks. IEEE ISGT 2022, pp. 1–5.
Real-Time Co-Simulation Platform for Security Analysis of Distribution Automation Systems. IEEE ISGT 2022, pp. 1–5.

2021

A Strings-Based Similarity Analysis Approach for Characterizing IoT Malware and Inferring Their Underlying Relationships. IEEE Networking Letters, 3(3):161–165.
VMGuard: State-Based Proactive Verification of Virtual Network Isolation With Application to NFV. IEEE Transactions on Dependable and Secure Computing, 18(4):1553–1567.
SegGuard: Segmentation-Based Anonymization of Network Data in Clouds for Privacy-Preserving Security Auditing. IEEE Transactions on Dependable and Secure Computing, 18(5):2486–2505.
Threat Intelligence Generation Using Network Telescope Data for Industrial Control Systems. IEEE Transactions on Information Forensics and Security, 16:3355–3370.
A Multi-View Approach to Preserve Privacy and Utility in Network Trace Anonymization. ACM Transactions on Privacy and Security, 24(3):14:1–14:36.
Artificial Packet-Pair Dispersion (APPD): A Blackbox Approach to Verifying the Integrity of NFV Service Chains. IEEE CNS 2021, pp. 245–253.
PetaDroid: Adaptive Android Malware Detection Using Deep Learning. DIMVA 2021, pp. 319–340.

2020

Scalable and Robust Unsupervised Android Malware Fingerprinting Using Community-Based Network Partitioning. Computers & Security, 96:101932.
A Scalable Platform for Enabling the Forensic Investigation of Exploited IoT Devices and Their Generated Unsolicited Activities. Digital Investigation, 32 Supplement:300922.
Multi-Depot Vehicle Routing Problem with Risk Mitigation: Model and Solution Algorithm. Expert Systems with Applications, 145:113099.
Stochastic Modeling, Analysis and Investigation of IoT-Generated Internet Scanning Activities. IEEE Networking Letters, 2(3):159–163.
CPA: Accurate Cross-Platform Binary Authorship Characterization Using LDA. IEEE Transactions on Information Forensics and Security, 15:3051–3066.
An Extension to the Precision Time Protocol (PTP) to Enable the Detection of Cyber Attacks. IEEE Transactions on Industrial Informatics, 16(1):18–27.
Exploiting the Vulnerability of Relative Data Alignment in Phasor Data Concentrators to Time Synchronization Attacks. IEEE Transactions on Smart Grid, 11(3):2541–2551.
CASeS: Concurrent Contingency Analysis-Based Security Metric Deployment for the Smart Grid. IEEE Transactions on Smart Grid, 11(3):2676–2687.
Detection and Mitigation of Cyber Attacks on Voltage Stability Monitoring of Smart Grids. IEEE Transactions on Smart Grid, 11(6):5227–5238.
R2DP: A Universal and Automated Approach to Optimizing the Randomization Mechanisms of Differential Privacy for Utility Metrics with No Known Optimal Distributions. ACM CCS 2020, pp. 677–696.
NFVGuard: Verifying the Security of Multilevel Network Functions Virtualization (NFV) Stack. IEEE CloudCom 2020, pp. 33–40.

2019

Wordnet-Based Criminal Networks Mining for Cybercrime Investigation. IEEE Access, 7:22740–22755.
On the Feasibility of Binary Authorship Characterization. Digital Investigation, 28 Supplement:S3–S11.
MalDy: Portable, Data-Driven Malware Detection Using Natural Language Processing and Machine Learning Techniques on Behavioral Analysis Reports. Digital Investigation, 28 Supplement:S77–S87.
Evolutionary Learning Algorithm for Reliable Facility Location Under Disruption. Expert Systems with Applications, 115:223–244.
Securing the Precision Time Protocol (PTP) Against Fake Timestamps. IEEE Communications Letters, 23(2):278–281.
Learning Probabilistic Dependencies Among Events for Proactive Security Auditing in Clouds. Journal of Computer Security, 27(2):165–202.
Decoupling Coding Habits from Functionality for Effective Binary Authorship Attribution. Journal of Computer Security, 27(6):613–648.
Automated Post-Failure Service Restoration in Smart Grid Through Network Reconfiguration in the Presence of Energy Storage Systems. IEEE Systems Journal, 13(3):3358–3367.
Big Data Sanitization and Cyber Situational Awareness: A Network Telescope Perspective. IEEE Transactions on Big Data, 5(4):439–453.
ISOTOP: Auditing Virtual Networks Isolation Across Cloud Layers in OpenStack. ACM Transactions on Privacy and Security, 22(1):1:1–1:35.
Enhancing WAMS Communication Network Against Delay Attacks. IEEE Transactions on Smart Grid, 10(3):2738–2751.
Modeling NFV Deployment to Identify the Cross-Level Inconsistency Vulnerabilities. IEEE CloudCom 2019, pp. 167–174.
Multi-Level Proactive Security Auditing for Clouds. DSC 2019, pp. 1–8.
Detecting, Fingerprinting and Tracking Reconnaissance Campaigns Targeting Industrial Control Systems. DIMVA 2019, pp. 89–108.
BinEye: Towards Efficient Binary Authorship Characterization Using Deep Learning. ESORICS 2019 (2), pp. 47–67.
Proactivizer: Transforming Existing Verification Tools into Efficient Solutions for Runtime Security Enforcement. ESORICS 2019 (2), pp. 239–262.
iCAT: An Interactive Customizable Anonymization Tool. ESORICS 2019 (1), pp. 658–680.
Security Monitoring of IEC 61850 Substations Using IEC 62351-7 Network and System Management. IEEE SmartGridComm 2019, pp. 1–7.

2018

Detecting Internet Abuse by Analyzing Passive DNS Traffic: A Survey of Implemented Systems. IEEE Communications Surveys & Tutorials, 20(4):3389–3415.
Efficient Sensor Network Management for Asset Localization. Computers & Operations Research, 99:148–165.
Data-Driven Approach for Automatic Telephony Threat Analysis and Campaign Detection. Digital Investigation, 24 Supplement:S131–S141.
MalDozer: Automatic Framework for Android Malware Detection Using Deep Learning. Digital Investigation, 24 Supplement:S48–S59.
CSC-Detector: A System to Infer Large-Scale Probing Campaigns. IEEE Transactions on Dependable and Secure Computing, 15(3):364–377.
User-Level Runtime Security Auditing for the Cloud. IEEE Transactions on Information Forensics and Security, 13(5):1185–1199.
Critical Links Identification for Selective Outages in Interdependent Power-Communication Networks. IEEE Transactions on Industrial Informatics, 14(2):472–483.
FOSSIL: A Resilient and Efficient System for Identifying FOSS Functions in Malware Binaries. ACM Transactions on Privacy and Security, 21(2):8:1–8:34.
Optimal Tree Construction Model for Cyber-Attacks to Wide Area Measurement Systems. IEEE Transactions on Smart Grid, 9(1):25–34.
A Detection and Mitigation Model for PTP Delay Attack in an IEC 61850 Substation. IEEE Transactions on Smart Grid, 9(5):3954–3965.

This is a selected list. For the complete, continuously updated record of Dr. Debbabi's 330+ publications and citation metrics, please visit his official DBLP profile, Google Scholar profile, or ORCID profile.

Biography

Academic, Research & Industrial Appointments

Education

Research Chairs

Hydro-Québec Hitachi Partnership Research Chair in Smart Grid Security

Government of Québec Research Chair on the Cybersecurity of Government Networks

NSERC / Hydro-Québec / Thales Senior Industrial Research Chair in Smart Grid Security

Concordia University Research Chair (Tier I) in Information Systems Security

Publications

Books

Selected Publications

Training of Highly Qualified Personnel

Service