The 2nd International Workshop on Assessment with New methodologies, Unified Benchmarks, and environments, of Intrusion detection and response Systems (ANUBIS) will take place in Rome, Italy in September 2026. ANUBIS is co-located with the 31st European Symposium on Research in Computer Security (ESORICS 2026). ANUBIS is supported by France 2030 through the “Superviz” (ANR-22-PECY-0008) project.

In the face of the humongous volume of publications in the field of intrusion detection and response, coupled with the lack of rigorous evaluation methodology of these (increasingly AI-based) methods, reproducibility is close to impossible. To remediate to that issue, ANUBIS offers the opportunity for researchers from different domains and communities to bring and discuss their evaluation methodology practices.

Evaluation is a fundamentally transverse topic, and multidisciplinary expertise about cybersecurity goals, technical domain constraints, and machine learning components is necessary to achieve fair, explainable, and trustworthy evaluation. As such, we are looking for submissions that deal with the methods, tools and techniques to evaluate security measures that aim to protect (computer) systems against intrusions. We welcome original papers submitted by researchers and practitioners from various backgrounds, such as security and privacy (incl. code audit or penetration testing), formal methods, experimental platforms (incl. digital twins), machine learning and data mining.

Topics of Interest

The aim of ANUBIS is to bring together scientists involved in bringing new and better ways to evaluate intrusion detection and response systems used in various environments (IT, OT, IoT and 5G/6G) and relying on various data (e.g., radio, system, and network). We invite researchers and practitioners to submit original papers focusing on:

  • Threat data collection software and methods
  • Evaluation of current and new security datasets
  • Privacy-preserving datasets collection
  • AI for synthetic data generation (legitimate, malicious and mixed workloads)
  • Data representation for security
  • Methodology, benchmark, metrics, formal methods, and tools for datasets or security tools evaluation
  • Evaluation in dynamic environments and concept drift analysis
  • Platforms, learning environments, digital twins, and software for reproducible experiments
  • Evaluation of AI approaches for intrusion detection and response, such as reinforcement learning and federated learning

Submission Guidelines

The workshop accepts original research work and work-in-progress, not substantially overlapping with previous publications or concurrent submissions, as either:

  • research papers: at most 16 pages (using 10-point font), excluding the bibliography and well-marked appendices, or
  • position and work-in-progress papers: at most 8 pages (using 10-point font), excluding the bibliography and well-marked appendices.

Submitted papers must follow the LNCS template from the time they are submitted. ANUBIS follows a double-blind review process and all papers that are not desk-rejected will be reviewed by two to three experts. Submissions must be uploaded to the following EasyChair website https://easychair.org/conferences/?conf=esorics2026, in the ANUBIS track.

Important dates

  • Submission deadline: June 12, 2026 AoE July 7, 2026 AoE (extended!)
  • Notification to authors: July 31st, 2026
  • Camera-ready version: August 22nd, 2026 AoE
  • Workshop: September 18, 2026

Organizers of the Workshop

  • Pierre-François Gimenez, Inria, France
  • Gregory Blanc, Télécom SudParis, France

Program Committee

  • Marta Catillo, Università del Sannio, Italy
  • Sara Chennoufi, Inria, France
  • Umberto Fontana, Amadeus IT Group, Telecom SudParis, France
  • Sebastian Garcia, Stratosphere Lab, AIC Group, Department of Computer Science, CTU University, Czech Republic
  • Thomas Hoger, LAAS-CNRS, France
  • Manuel Kern, Austrian Institute of Technology, Austria
  • Corentin Larroche, ANSSI, France
  • Léo Lavaur, University of Luxembourg, Luxembourg
  • Siamak Layeghy, The University of Queensland, Australia
  • Frédéric Majorczyk, DGA, France
  • Stéphane Mocanu, Laboratoire d’Informatique de Grenoble, France
  • Benoit Nougnanke, Télécom SudParis, France
  • Philippe Owezarski, LAAS-CNRS, France
  • Barbara Pilastre, AMIAD, France
  • Nicolas Prigent, PTCC, France
  • Adrien Schoen, ENS Lyon, France
  • Majd Shalak, Telecom SudParis, France
  • Florian Skopik, Austrian Institute of Technology, Austria
  • Franco Terranova, LORIA, France
  • Priyanka Singh, The University of Queensland, Australia
  • Katarzyna Wasielewska, University of Applied Sciences in Elblag, Poland
  • Edgar Weippl, University of Vienna, Austria
  • Gabriel Zaïd, CryptoExperts, France

Workshop Planning

The ANUBIS workshop will be held at the Main Campus of Sapienza University of Rome on September 18. You’ll find more information on the venue on the ESORICS website.

Time Content
13h50 Introduction
14h When Packet Length Is Not Packet Length: Correcting CICFlowMeter Features for Interpretable NIDS Evaluation, Helene Huang, Sébastien Bois and Thomas Marchioro
14h15 Superviz26-SQL: A Multi-Domain Benchmark for SQL Attack Detection, Grégor Quetel, Pierre-François Gimenez, Thomas Robert and Laurent Pautet
14h30 Provenance-Preserving Auditing of Vulnerability Labels in Large-Scale CVE-Derived Datasets, Parul Gupta, Lea Achter, Julienne Eder and Hans Joachim Hof
14h45 How Much Do SOC Analysts Agree on MITRE ATT&CK? A Four-Team Inter-Rater Study on IDS Alert Labeling, Manuel Kern, Florian Skopik, Max Landauer and Edgar Weippl
15h Realistic Intrusion Detection: Strategically Discarding Malicious Data, Houda Jmila and Alexis Olivereau
15h20 Coffee break (20 min)
15h40 BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learning, Mouhamed Amine Bouchiha, Gregory Blanc and Yufei Han
15h55 On fair and realistic performance evaluations for graph-based lateral movement detectors, Corentin Larroche
16h10 Alert-Budget-Aware Assessment Workflow for Evaluating Unsupervised IDS in IEC 61850 Smart-Grid Communication, Tobias Axelson and Livinus Nweke
16h25 MalDAF: A Unified Dataset Audit Framework for Benchmarking ML-Based Android Malware Detectors Under Temporal Drift, Class Imbalance, and Obfuscation, Islam Aboubakarov and Guillaume Guérard
16h40 Benchmarking Detection Engineering Improvements through Instrumented Adversary Emulation, Tristan Madani, Yulliwas Ameur and Samia Bouzefrane
17h Conclusion
17h10 End of the workshop