Poseidon: a 2-tier Anomaly-based Intrusion Detection System - Damiano Bolzoni; Emmanuele Zambon; Sandro Etalle; Pieter H. Hartel (CoRR, 2005)

POSEIDON: a 2-tier Anomaly-based Network Intrusion Detection System. - Damiano Bolzoni; Sandro Etalle; Pieter H. Hartel; Emmanuele Zambon (IWIA, 2006)

Model-Based Mitigation of Availability Risks. - Emmanuele Zambon; Damiano Bolzoni; Sandro Etalle; Marco Salvato (BDIM, 2007)

IT confidentiality risk assessment for an architecture-based approach. - Ayse Morali; Emmanuele Zambon; Sandro Etalle; Paul L. O. Re (BDIM, 2008)

Extended eTVRA vs. security checklist: Experiences in a value-web. - Ayse Morali; Emmanuele Zambon; Siv Hilde Houmb; Karin Sallhammar; Sandro Etalle (ICSE Companion, 2009)

CRAC: Confidentiality risk assessment and IT-infrastructure comparison. - Ayse Morali; Emmanuele Zambon; Sandro Etalle; Roel J. Wieringa (CNSM, 2010)

Model-based qualitative risk assessment for availability of IT infrastructures. - Emmanuele Zambon; Sandro Etalle; Roel J. Wieringa; Pieter H. Hartel (Softw. Syst. Model., 2011)

N-Gram against the Machine: On the Feasibility of the N-Gram Network Analysis for Binary Protocols. - Dina Hadziosmanovic; Lorenzo Simionato; Damiano Bolzoni; Emmanuele Zambon; Sandro Etalle (RAID, 2012)

A2thOS: availability analysis and optimisation in SLAs. - Emmanuele Zambon; Sandro Etalle; Roel J. Wieringa (Int. J. Netw. Manag., 2012)

On the Feasibility of Device Fingerprinting in Industrial Control Systems. - Marco Caselli; Dina Hadziosmanovic; Emmanuele Zambon; Frank Kargl (CRITIS, 2013)

Through the eye of the PLC: semantic security monitoring for industrial processes. - Dina Hadziosmanovic; Robin Sommer; Emmanuele Zambon; Pieter H. Hartel (ACSAC, 2014)

On Emulation-Based Network Intrusion Detection Systems. - Ali Abbasi 002; Jos Wetzels; Wouter Bokslag; Emmanuele Zambon; Sandro Etalle (RAID, 2014)

Sequence-aware Intrusion Detection in Industrial Control Systems. - Marco Caselli; Emmanuele Zambon; Frank Kargl (CPSS@ASIACSS, 2015)

Modeling Message Sequences for Intrusion Detection in Industrial Control Systems. - Marco Caselli; Emmanuele Zambon; Jonathan Petit; Frank Kargl (Critical Infrastructure Protection, 2015)

Stealth Low-Level Manipulation of Programmable Logic Controllers I/O by Pin Control Exploitation. - Ali Abbasi 002; Majid Hashemi; Emmanuele Zambon; Sandro Etalle (CRITIS, 2016)

Specification Mining for Intrusion Detection in Networked Control Systems. - Marco Caselli; Emmanuele Zambon; Johanna Amann; Robin Sommer; Frank Kargl (USENIX Security Symposium, 2016)

ECFI: Asynchronous Control Flow Integrity for Programmable Logic Controllers. - Ali Abbasi 002; Thorsten Holz; Emmanuele Zambon; Sandro Etalle (ACSAC, 2017)

mu Shield - Configurable Code-Reuse Attacks Mitigation For Embedded Systems. - Ali Abbasi 002; Jos Wetzels; Wouter Bokslag; Emmanuele Zambon; Sandro Etalle (NSS, 2017)

Encryption in ICS networks: A blessing or a curse? - Davide Fauri; Bart de Wijs; Jerry den Hartog; Elisa Costante; Emmanuele Zambon; Sandro Etalle (SmartGridComm, 2017)

Characterizing Building Automation System Attacks and Attackers. - Martino Tommasini; Martin Rosso; Emmanuele Zambon; Luca Allodi; Jerry den Hartog (EuroS&P Workshops, 2022)

You Can't Protect What You Don't Understand: Characterizing an Operational Gas SCADA Network. - Xi Qin; Martin Rosso; Alvaro A. Cárdenas; Sandro Etalle; Jerry den Hartog; Emmanuele Zambon (SP (Workshops), 2022)

ICSvertase: A Framework for Purpose-based Design and Classification of ICS Honeypots. - Stash Kempinski; Shuaib Ichaarine; Savio Sciancalepore; Emmanuele Zambon (ARES, 2023)

'Give Me Structure': Synthesis and Evaluation of a (Network) Threat Analysis Process Supporting Tier 1 Investigations in a Security Operation Center. - Leon Kersten; Tom Mulders; Emmanuele Zambon; Chris Snijders 001; Luca Allodi (SOUPS, 2023)

A Security Alert Investigation Tool Supporting Tier 1 Analysts in Contextualizing and Understanding Network Security Events. - Leon Kersten; Santiago Darré; Tom Mulders; Emmanuele Zambon; Marco Caselli; Chris Snijders 001; Luca Allodi (ACSAC, 2024)

Attacking Operational Technology Without Specialized Knowledge: The Unspecialized OT Threat Actor Profile. - Stash Kempinski; Savio Sciancalepore; Emmanuele Zambon; Luca Allodi (EuroS&P Workshops, 2024)

A Methodology to Measure the "Cost" of CPS Attacks: Not all CPS Networks are Created Equal. - Martin Rosso; Luca Allodi; Emmanuele Zambon; Jerry den Hartog (EuroS&P Workshops, 2024)

From Power to Water: Dissecting SCADA Networks Across Different Critical Infrastructures. - Neil Ortiz Silva; Martin Rosso; Emmanuele Zambon; Jerry den Hartog; Alvaro A. Cárdenas (PAM (1), 2024)

A Tale of Two Industroyers: It was the Season of Darkness. - Luis E. Salazar; Sebastián R. Castro; Juan Lozano; Keerthi Koneru; Emmanuele Zambon; Bing Huang; Ross Baldick; Marina Krotofil; Alonso Rojas; Alvaro A. Cárdenas (SP, 2024)

Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers. - Koen T. W. Teuwen; Tom Mulders; Emmanuele Zambon; Luca Allodi (CoRR, 2025)

On the Effect of Ruleset Tuning and Data Imbalance on Explainable Network Security Alert Classifications: a Case-Study on DeepCASE. - Koen T. W. Teuwen; Sam Baggen; Emmanuele Zambon; Luca Allodi (CoRR, 2025)