arXiv subjects

Farid Naït-Abdesselam

Publications and source records attributed to Farid Naït-Abdesselam.

4 recordsLinked to original sources

arXiv2026

Prefix Visibility Ratio: Quantifying Partial Observability in Carpet Bombing Detection

Carpet bombing attacks distribute malicious traffic across many destinations within a network prefix, while operational monitoring commonly provides destination-specific telemetry for only a subset of those targets. This creates an attack-conditional observability problem that is not captured by address utilization or nominal monitoring coverage. We introduce the Prefix Visibility Ratio (PVR), defined as the fraction of attacked destinations for which the telemetry required by the host-level evidence plane is available, and argue that PVR should be treated as an explicit evaluation dimension for carpet bombing detection. We then present VANTA (Visibility-Aware Network Threat Analysis) as one concrete way to operationalize this principle. VANTA combines host-level and prefix-level anomaly scores, estimates PVR online from router-side destination evidence and the monitored-destination inventory, and adjusts evidence fusion according to both estimated visibility and estimator confidence. Across a validated campaign of 2,160 Mininet runs, VANTA achieves 99.18% precision, 93.46% recall, a global F1-score of 96.24%, and a 1.54% false-positive rate. In a separate matched-observability study using task-adapted feature-level reference implementations, VANTA reaches 95.89% pooled F1 and 92.39% recall for configured PVR<=10%, with its largest advantage appearing at configured PVR=1%. These reference comparisons are intended to isolate observability effects under a common binary detection task rather than to reproduce the original end-to-end objectives of the referenced systems. The results establish attacked-destination visibility as a measurable factor that can materially change detector behavior and should be reported explicitly in future carpet bombing evaluations.

cs.NI↗

arXiv2025

LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectors

The rapid growth in both the scale and complexity of Android malware has driven the widespread adoption of machine learning (ML) techniques for scalable and accurate malware detection. Despite their effectiveness, these models remain vulnerable to adversarial attacks that introduce carefully crafted feature-level perturbations to evade detection while preserving malicious functionality. In this paper, we present LAMLAD, a novel adversarial attack framework that exploits the generative and reasoning capabilities of large language models (LLMs) to bypass ML-based Android malware classifiers. LAMLAD employs a dual-agent architecture composed of an LLM manipulator, which generates realistic and functionality-preserving feature perturbations, and an LLM analyzer, which guides the perturbation process toward successful evasion. To improve efficiency and contextual awareness, LAMLAD integrates retrieval-augmented generation (RAG) into the LLM pipeline. Focusing on Drebin-style feature representations, LAMLAD enables stealthy and high-confidence attacks against widely deployed Android malware detection systems. We evaluate LAMLAD against three representative ML-based Android malware detectors and compare its performance with two state-of-the-art adversarial attack methods. Experimental results demonstrate that LAMLAD achieves an attack success rate (ASR) of up to 97%, requiring on average only three attempts per adversarial sample, highlighting its effectiveness, efficiency, and adaptability in practical adversarial settings. Furthermore, we propose an adversarial training-based defense strategy that reduces the ASR by more than 30% on average, significantly enhancing model robustness against LAMLAD-style attacks.

cs.CR↗

arXiv2019

D3S: A Framework for Enabling Unmanned Aerial Vehicles as a Service

In this paper, we consider the use of UAVs to provide wireless connectivity services, for example after failures of wireless network components or to simply provide additional bandwidth on demand, and introduce the concept of UAVs as a service (UaaS). To facilitate UaaS, we introduce a novel framework, dubbed D3S, which consists of four phases: demand, decision, deployment, and service. The main objective of this framework is to develop efficient and realistic solutions to implement these four phases. The technical problems include determining the type and number of UAVs to be deployed, and also their final locations (e.g., hovering or on-ground), which is important for serving certain applications. These questions will be part of the decision phase. They also include trajectory planning of UAVs when they have to travel between charging stations and deployment locations and may have to do this several times. These questions will be part of the deployment phase. The service phase includes the implementation of the backbone communication and data routing between UAVs and between UAVs and ground control stations.

cs.NI↗

arXiv2019

Detection and Prediction of Cardiac Anomalies Using Wireless Body Sensors and Bayesian Belief Networks

Intricating cardiac complexities are the primary factor associated with healthcare costs and the highest cause of death rate in the world. However, preventive measures like the early detection of cardiac anomalies can prevent severe cardiovascular arrests of varying complexities and can impose a substantial impact on healthcare cost. Encountering such scenarios usually the electrocardiogram (ECG or EKG) is the first diagnostic choice of a medical practitioner or clinical staff to measure the electrical and muscular fitness of an individual heart. This paper presents a system which is capable of reading the recorded ECG and predict the cardiac anomalies without the intervention of a human expert. The paper purpose an algorithm which read and perform analysis on electrocardiogram datasets. The proposed architecture uses the Discrete Wavelet Transform (DWT) at first place to perform preprocessing of ECG data followed by undecimated Wavelet transform (UWT) to extract nine relevant features which are of high interest to a cardiologist. The probabilistic mode named Bayesian Network Classifier is trained using the extracted nine parameters on UCL arrhythmia dataset. The proposed system classifies a recorded heartbeat into four classes using Bayesian Network classifier and Tukey's box analysis. The four classes for the prediction of a heartbeat are (a) Normal Beat, (b) Premature Ventricular Contraction (PVC) (c) Premature Atrial Contraction (PAC) and (d) Myocardial Infarction. The results of experimental setup depict that the proposed system has achieved an average accuracy of 96.6 for PAC\% 92.8\% for MI and 87\% for PVC, with an average error rate of 3.3\% for PAC, 6\% for MI and 12.5\% for PVC on real electrocardiogram datasets including Physionet and European ST-T Database (EDB).

cs.LG↗