Publications | Emmanuele Zambon @ TU/ehttps://zambo99.github.io/publications/PublicationsHugoBlox Kit (https://hugoblox.com)en-usMon, 07 Dec 2026 00:00:00 +0000https://zambo99.github.io/media/icon_hu_f200e544be99c78e.pngPublicationshttps://zambo99.github.io/publications/ICtoolS: Fingerprinting ICS Tools to Characterize Honeypot Interactionshttps://zambo99.github.io/publications/icss2026/Mon, 07 Dec 2026 00:00:00 +0000https://zambo99.github.io/publications/icss2026/Behavior-driven user profiling: A case study on Microsoft Entra ID sign-inhttps://zambo99.github.io/publications/jcs2026/Thu, 08 Oct 2026 00:00:00 +0000https://zambo99.github.io/publications/jcs2026/Evaluating ICS honeypot attractiveness: The role of interaction level, network type, and geolocationhttps://zambo99.github.io/publications/ijcip2026/Tue, 22 Sep 2026 00:00:00 +0000https://zambo99.github.io/publications/ijcip2026/How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Ruleshttps://zambo99.github.io/publications/arxiv2026/Tue, 22 Sep 2026 00:00:00 +0000https://zambo99.github.io/publications/arxiv2026/A Comparative Study of ICS Honeypot Deploymentshttps://zambo99.github.io/publications/cps4cip2025/Mon, 22 Sep 2025 00:00:00 +0000https://zambo99.github.io/publications/cps4cip2025/POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineeringhttps://zambo99.github.io/publications/asiaccs2025_2/Mon, 25 Aug 2025 00:00:00 +0000https://zambo99.github.io/publications/asiaccs2025_2/Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centershttps://zambo99.github.io/publications/asiaccs2025/Mon, 25 Aug 2025 00:00:00 +0000https://zambo99.github.io/publications/asiaccs2025/On the Effect of Ruleset Tuning and Data Imbalance on Explainable Network Security Alert Classifications: a Case-Study on DeepCASEhttps://zambo99.github.io/publications/worma2025/Wed, 30 Jul 2025 00:00:00 +0000https://zambo99.github.io/publications/worma2025/A Field Study to Uncover and a Tool to Support the Alert Investigation Process of Tier-1 Analystshttps://zambo99.github.io/publications/usec2025/Mon, 24 Feb 2025 00:00:00 +0000https://zambo99.github.io/publications/usec2025/A Test Tool to Evaluate the Skill Sets of Tier-1 Security Analysts in a SOC Environment: A Case Study from Recruitment to Operationshttps://zambo99.github.io/publications/wosoc2025/Mon, 24 Feb 2025 00:00:00 +0000https://zambo99.github.io/publications/wosoc2025/A Security Alert Investigation Tool Supporting Tier 1 Analysts in Contextualizing and Understanding Network Security Eventshttps://zambo99.github.io/publications/acsac2024/Mon, 09 Dec 2024 00:00:00 +0000https://zambo99.github.io/publications/acsac2024/Unveiling the Operation and Configuration of a Real-World Bulk Substation Networkhttps://zambo99.github.io/publications/smartsp2024/Thu, 07 Nov 2024 00:00:00 +0000https://zambo99.github.io/publications/smartsp2024/A Methodology to Measure the "Cost" of CPS Attacks: Not all CPS Networks are Created Equalhttps://zambo99.github.io/publications/wacco2024_2/Mon, 08 Jul 2024 00:00:00 +0000https://zambo99.github.io/publications/wacco2024_2/Attacking Operational Technology Without Specialized Knowledge: The Unspecialized OT Threat Actor Profilehttps://zambo99.github.io/publications/wacco2024_1/Mon, 08 Jul 2024 00:00:00 +0000https://zambo99.github.io/publications/wacco2024_1/A Tale of Two Industroyers: It was the Season of Darknesshttps://zambo99.github.io/publications/sp2024/Mon, 01 Jan 2024 00:00:00 +0000https://zambo99.github.io/publications/sp2024/From Power to Water: Dissecting SCADA Networks Across Different Critical Infrastructureshttps://zambo99.github.io/publications/pam2024/Mon, 01 Jan 2024 00:00:00 +0000https://zambo99.github.io/publications/pam2024/ICSvertase: A Framework for Purpose-based Design and Classification of ICS Honeypotshttps://zambo99.github.io/publications/ares2023/Tue, 29 Aug 2023 00:00:00 +0000https://zambo99.github.io/publications/ares2023/'Give Me Structure': Synthesis and Evaluation of a (Network) Threat Analysis Process Supporting Tier 1 Investigations in a Security Operation Centerhttps://zambo99.github.io/publications/soups2023/Mon, 07 Aug 2023 00:00:00 +0000https://zambo99.github.io/publications/soups2023/ Industroyer2 and INCONTROLLER - In-depth Technical Analysis of the Most Recent ICS-specific Malwarehttps://zambo99.github.io/publications/industroyer2_incontroller2022/Thu, 14 Jul 2022 00:00:00 +0000https://zambo99.github.io/publications/industroyer2_incontroller2022/Characterizing Building Automation System Attacks and Attackershttps://zambo99.github.io/publications/wacco2022/Mon, 06 Jun 2022 00:00:00 +0000https://zambo99.github.io/publications/wacco2022/You Can't Protect What You Don't Understand: Characterizing an Operational Gas SCADA Networkhttps://zambo99.github.io/publications/safethings2022/Thu, 26 May 2022 00:00:00 +0000https://zambo99.github.io/publications/safethings2022/ECFI: Asynchronous control flow integrity for programmable logic controllershttps://zambo99.github.io/publications/acsac2017/Mon, 04 Dec 2017 00:00:00 +0000https://zambo99.github.io/publications/acsac2017/Stealth Low-Level Manipulation of Programmable Logic Controllers I/O by Pin Control Exploitationhttps://zambo99.github.io/publications/critis2016/Wed, 22 Nov 2017 00:00:00 +0000https://zambo99.github.io/publications/critis2016/Encryption in ICS networks: A blessing or a curse?https://zambo99.github.io/publications/smartgridcomm2017/Mon, 23 Oct 2017 00:00:00 +0000https://zambo99.github.io/publications/smartgridcomm2017/𝜇Shield: Configurable Code-Reuse Attacks Mitigation For Embedded Systemshttps://zambo99.github.io/publications/nss2017/Wed, 26 Jul 2017 00:00:00 +0000https://zambo99.github.io/publications/nss2017/Specification Mining for Intrusion Detection in Networked Control Systemshttps://zambo99.github.io/publications/usenix2016/Wed, 10 Aug 2016 00:00:00 +0000https://zambo99.github.io/publications/usenix2016/Modeling Message Sequences for Intrusion Detection in Industrial Control Systemshttps://zambo99.github.io/publications/iccip2015/Sat, 21 Nov 2015 00:00:00 +0000https://zambo99.github.io/publications/iccip2015/Sequence-aware Intrusion Detection in Industrial Control Systemshttps://zambo99.github.io/publications/cpss2015/Tue, 14 Apr 2015 00:00:00 +0000https://zambo99.github.io/publications/cpss2015/Through the eye of the PLC: semantic security monitoring for industrial processeshttps://zambo99.github.io/publications/acsac2014/Mon, 08 Dec 2014 00:00:00 +0000https://zambo99.github.io/publications/acsac2014/On Emulation-Based Network Intrusion Detection Systemshttps://zambo99.github.io/publications/raid2014/Wed, 17 Sep 2014 00:00:00 +0000https://zambo99.github.io/publications/raid2014/On the Feasibility of Device Fingerprinting in Industrial Control Systemshttps://zambo99.github.io/publications/critis2013/Mon, 16 Sep 2013 00:00:00 +0000https://zambo99.github.io/publications/critis2013/N-Gram against the Machine: On the Feasibility of the N-Gram Network Analysis for Binary Protocolshttps://zambo99.github.io/publications/raid2012/Wed, 12 Sep 2012 00:00:00 +0000https://zambo99.github.io/publications/raid2012/A2thOS: availability analysis and optimisation in SLAshttps://zambo99.github.io/publications/ijnm2012/Wed, 20 Jul 2011 00:00:00 +0000https://zambo99.github.io/publications/ijnm2012/CRAC: Confidentiality risk assessment and IT-infrastructure comparisonhttps://zambo99.github.io/publications/cnsm2010/Mon, 25 Oct 2010 00:00:00 +0000https://zambo99.github.io/publications/cnsm2010/Model-based qualitative risk assessment for availability of IT infrastructureshttps://zambo99.github.io/publications/sosym2010/Tue, 22 Jun 2010 00:00:00 +0000https://zambo99.github.io/publications/sosym2010/Extended eTVRA vs. security checklist: Experiences in a value-webhttps://zambo99.github.io/publications/icse2009/Sat, 16 May 2009 00:00:00 +0000https://zambo99.github.io/publications/icse2009/IT confidentiality risk assessment for an architecture-based approachhttps://zambo99.github.io/publications/bdim2008/Mon, 07 Apr 2008 00:00:00 +0000https://zambo99.github.io/publications/bdim2008/A Model Supporting Business Continuity Auditing and Planning in Information Systemshttps://zambo99.github.io/publications/icimp2007/Sun, 01 Jul 2007 00:00:00 +0000https://zambo99.github.io/publications/icimp2007/Model-Based Mitigation of Availability Riskshttps://zambo99.github.io/publications/bdim2007/Mon, 21 May 2007 00:00:00 +0000https://zambo99.github.io/publications/bdim2007/POSEIDON: a 2-tier anomaly-based network intrusion detection systemhttps://zambo99.github.io/publications/iwia2006/Thu, 13 Apr 2006 00:00:00 +0000https://zambo99.github.io/publications/iwia2006/