Publications

40 publications

Google Scholar DBLP

2026

  1. Conference ICSS ‘26

    ICtoolS: Fingerprinting ICS Tools to Characterize Honeypot Interactions

    Stash Kempinski, Victor Asanache, Lucas Lahaije, Kristopher Schlett, Savio Sciancalepore, Emmanuele Zambon, Nicola Zannone
    Code Project PDF
  2. Journal JCS

    Behavior-driven user profiling: A case study on Microsoft Entra ID sign-in

    Gelareh Hasel Mehri, Emmanuele Zambon, Nicola Zannone
    Source Document DOI
  3. Journal IJCIP

    Evaluating ICS honeypot attractiveness: The role of interaction level, network type, and geolocation

    Frederik Ondrikov, Denis Donadel, Francesco Lupia, Massimo Merro, Daniel dos Santos, Emmanuele Zambon, Nicola Zannone
    Project PDF DOI
  4. Preprint arXiv

    How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules

    Koen T.W. Teuwen, Emmanuele Zambon, Luca Allodi
    Source Document Project DOI

2025

  1. Conference CPS4CIP2025

    A Comparative Study of ICS Honeypot Deployments

    Frederik Ondrikov, Denis Donadel, Francesco Lupia, Massimo Merro, Emmanuele Zambon, Nicola Zannone
    Project PDF DOI
  2. Conference ASIACCS2025

    POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering

    Koen Teuwen, Emmanuele Zambon, Luca Allodi
    Project PDF DOI
  3. Conference ASIACCS2025 ★ Featured

    Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers

    Koen Teuwen, Tom Mulders, Emmanuele Zambon, Luca Allodi
    Project PDF DOI
  4. Conference EuroS&PW2025

    On the Effect of Ruleset Tuning and Data Imbalance on Explainable Network Security Alert Classifications: a Case-Study on DeepCASE

    Koen Teuwen, Sam Baggen, Emmanuele Zambon, Luca Allodi
    Project PDF DOI
  5. Conference USEC 2025 ★ Featured

    A Field Study to Uncover and a Tool to Support the Alert Investigation Process of Tier-1 Analysts

    Leon Kersten, Kim Beelen, Emmanuele Zambon, Chris Snijders, Luca Allodi
    Project PDF DOI
  6. Conference WOSOC 2025

    A Test Tool to Evaluate the Skill Sets of Tier-1 Security Analysts in a SOC Environment: A Case Study from Recruitment to Operations

    Adriana Radu, Leon Kersten, Rik Wosyka, Tom Mulders, Emmanuele Zambon, Luca Allodi
    Project PDF DOI

2024

  1. Conference ACSAC2024 ★ Featured

    A Security Alert Investigation Tool Supporting Tier 1 Analysts in Contextualizing and Understanding Network Security Events

    Leon Kersten, Santiago Darré, Tom Mulders, Emmanuele Zambon, Marco Caselli, Chris Snijders, Luca Allodi
    Project PDF DOI
  2. Conference SmartSP 2024

    Unveiling the Operation and Configuration of a Real-World Bulk Substation Network

    Keerthi Koneru, Juan Lozano, John Castellanos, Emmanuele Zambon, Alvaro Cardenas
    PDF DOI
  3. Conference EuroS&PW2024

    A Methodology to Measure the "Cost" of CPS Attacks: Not all CPS Networks are Created Equal

    Martin Rosso, Emmanuele Zambon, Luca Allodi, Jerry den Hartog
    Project PDF DOI
  4. Conference EuroS&PW2024

    Attacking Operational Technology Without Specialized Knowledge: The Unspecialized OT Threat Actor Profile

    Stash Kempinski, Savio Sciancalepore, Emmanuele Zambon, Luca Allodi
    Project PDF DOI
  5. Conference S&P 2024 ★ Featured

    A Tale of Two Industroyers: It was the Season of Darkness

    Luis Salazar, Sebastian Castro, Juan Lozano, Keerthi Koneru, Emmanuele Zambon, Bing Huang, Ross Baldick, Marina Krotofil, Alonso Rojas, Alvaro Cardenas
    Project PDF DOI
  6. Conference PAM 2024

    From Power to Water: Dissecting SCADA Networks Across Different Critical Infrastructures

    Neil Ortiz, Martin Rosso, Emmanuele Zambon, Jerry den Hartog, Alvaro Cardenas
    Project PDF DOI

2023

  1. Conference ARES ‘23

    ICSvertase: A Framework for Purpose-based Design and Classification of ICS Honeypots

    Stash Kempinski, Shuaib Ichaarine, Savio Sciancalepore, Emmanuele Zambon
    PDF DOI
  2. Conference SOUPS 2023 ★ Featured

    'Give Me Structure': Synthesis and Evaluation of a (Network) Threat Analysis Process Supporting Tier 1 Investigations in a Security Operation Center

    Leon Kersten, Tom Mulders, Emmanuele Zambon, Chris Snijders, Luca Allodi
    PDF

2022

  1. Report Forescout

    Industroyer2 and INCONTROLLER - In-depth Technical Analysis of the Most Recent ICS-specific Malware

    Forescout VedereLabs, Emmanuele Zambon
    PDF
  2. Conference EuroS&PW2022

    Characterizing Building Automation System Attacks and Attackers

    Martino Tommasini, Martin Rosso, Emmanuele Zambon, Luca Allodi, Jerry den Hartog
    Project PDF DOI
  3. Conference SafeThings 2022

    You Can't Protect What You Don't Understand: Characterizing an Operational Gas SCADA Network

    Xi Qin, Martin Rosso, Alvaro A. Cardenas, Sandro Etalle, Jerry den Hartog, Emmanuele Zambon
    Project PDF DOI

2017

  1. Conference ACSAC2017 ★ Featured

    ECFI: Asynchronous control flow integrity for programmable logic controllers

    Ali Abbasi, Thorsten Holz, Emmanuele Zambon, Sandro Etalle
    PDF DOI
  2. Conference CRITIS2016

    Stealth Low-Level Manipulation of Programmable Logic Controllers I/O by Pin Control Exploitation

    Ali Abbasi, Majid Hashemi, Emmanuele Zambon, Sandro Etalle
    DOI
  3. Conference SmartGridComm2017

    Encryption in ICS networks: A blessing or a curse?

    Davide Fauri, Bart de Wijs, Jerry den Hartog, Elisa Costante, Emmanuele Zambon, Sandro Etalle
    PDF DOI
  4. Conference NSS2017

    𝜇Shield: Configurable Code-Reuse Attacks Mitigation For Embedded Systems

    Ali Abbasi, Jos Wetzels, Wouter Bokslag, Emmanuele Zambon, Sandro Etalle
    Code DOI

2016

  1. Conference USENIX Security 16 ★ Featured

    Specification Mining for Intrusion Detection in Networked Control Systems

    Marco Caselli, Emmanuele Zambon, Johanna Amann, Robin Sommer, Frank Kargl
    Source Document Project PDF

2015

  1. Conference ICCIP2015

    Modeling Message Sequences for Intrusion Detection in Industrial Control Systems

    Marco Caselli, Emmanuele Zambon, Jonathan Petit, Frank Kargl
    PDF DOI
  2. Conference CPSS2015

    Sequence-aware Intrusion Detection in Industrial Control Systems

    Marco Caselli, Emmanuele Zambon, Frank Kargl
    Project PDF DOI

2014

  1. Conference ACSAC2014 ★ Featured

    Through the eye of the PLC: semantic security monitoring for industrial processes

    Dina Hadžiosmanović, Robin Sommer, Emmanuele Zambon, Pieter H. Hartel
    Project Project PDF DOI
  2. Conference RAID2014 ★ Featured

    On Emulation-Based Network Intrusion Detection Systems

    Ali Abbasi, Jos Wetzels, Wouter Bokslag, Emmanuele Zambon, Sandro Etalle
    DOI

2013

  1. Conference CRITIS2013

    On the Feasibility of Device Fingerprinting in Industrial Control Systems

    Marco Caselli, Dina Hadžiosmanović, Emmanuele Zambon, Frank Kargl
    PDF DOI

2012

  1. Conference RAID2012 ★ Featured

    N-Gram against the Machine: On the Feasibility of the N-Gram Network Analysis for Binary Protocols

    Dina Hadžiosmanović, Lorenzo Simionato, Damiano Bolzoni, Emmanuele Zambon, Sandro Etalle
    Project PDF DOI

2011

  1. Journal IJNM2012

    A2thOS: availability analysis and optimisation in SLAs

    Emmanuele Zambon, Sandro Etalle, Roel J. Wieringa
    PDF DOI

2010

  1. Conference CNSM2010

    CRAC: Confidentiality risk assessment and IT-infrastructure comparison

    Ayşe Moralı, Emmanuele Zambon, Sandro Etalle, Roel Wieringa
    PDF DOI
  2. Journal SoSyM2010

    Model-based qualitative risk assessment for availability of IT infrastructures

    Emmanuele Zambon, Sandro Etalle, Roel J. Wieringa, Pieter H. Hartel
    PDF DOI

2009

  1. Conference ICSE2009

    Extended eTVRA vs. security checklist: Experiences in a value-web

    Ayşe Moralı, Emmanuele Zambon, Siv Hilde Houmb, Karin Sallhammar, Sandro Etalle
    PDF DOI

2008

  1. Conference BDIM2008

    IT confidentiality risk assessment for an architecture-based approach

    Ayşe Moralı, Emmanuele Zambon, Sandro Etalle, P.L. Overbeek
    PDF DOI

2007

  1. Conference ICIMP2007

    A Model Supporting Business Continuity Auditing and Planning in Information Systems

    Emmanuele Zambon, Damiano Bolzoni, Sandro Etalle, Marco Salvato
    PDF DOI
  2. Conference BDIM2007

    Model-Based Mitigation of Availability Risks

    Emmanuele Zambon, Damiano Bolzoni, Sandro Etalle, Marco Salvato
    PDF DOI

2006

  1. Conference IWIA'06

    POSEIDON: a 2-tier anomaly-based network intrusion detection system

    Damiano Bolzoni, Emmanuele Zambon, Sandro Etalle, Pieter Hartel
    PDF DOI