Dynamic multi-hop networks face fast link-level dynamics including topological changes, stochastic failures, time-varying residual capacities, etc., which can cause transmission timeout, persistent congestion and frequent route flapping, undermining network stability. Aiming at jointly optimizing route qualities including success rate, path length, congestion, and path-rerouting stability, etc., sophisticated planning algorithm is needed to flexibly adapt to the time-varying patterns of the whole network. In this paper, a novel interactive two-level reinforcement learning (RL) policy is proposed and decouples candidate path generation from online selection. The upper-level learns to propose a set of stable candidate paths for arbitrary source–destination data routing demands, guided by long-term per-path instability estimations aggregated from past collections. The lower-level performs online selection from the candidates, by employing a temporal graph attention encoder to capture state dynamics, and applying selection policy constrained by success rate, stability, low-congestion, tail-switching avoidance, etc. The two-level policy is interactively learned by bridging them with a flow of stability features from the lower- to upper-level. Experiments on public network datasets demonstrate that the proposed method consistently achieves high-quality routing, with the reduced congestion and path switching while maintaining high success rates and near-shortest paths.
Microservice applications rely heavily on DNS for internal service discovery in ephemeral environments. Unlike traditional public DNS, cloud-native DNS operates as a core infrastructure component with strict requirements for correctness, low latency, and adaptation to frequent record changes. There is a gap between existing DNS research focused mainly on performance in public environments and the unexplored resilience of internal, cloud-native DNS systems, especially those supporting private zones in containerized environments.This paper addresses this gap by examining the role of private DNS in cloud-native systems and applying resilience testing techniques to systematically evaluate its behavior. First, this work analyzes public cloud incident post-mortems and finds that DNS is rarely the primary root cause of outages, and incidents disproportionately affect private DNS over public DNS. Secondly, we design and evaluate a resilience testing strategy for a multi-cluster cloud-native DNS system published by Swisscom AG, the biggest telecommunications provider in Switzerland. The proposed strategy uses chaos injection and DNS traffic generation to evaluate availability, latency, accuracy, and recovery behavior under different disruption scenarios. We find that the system operates within acceptable limits in most scenarios and resilience testing can reliably capture the impact of caching, resolution inconsistencies, and failure-handling weaknesses across test cases.
Compact probabilistic data structures (CPDS) such as Bloom filters, Invertible Bloom Lookup Tables (IBLTs), and sketches are widely used in network telemetry systems to collect traffic statistics directly in resource constrained, high-speed programmable data planes (e.g., smartNICs and Intel Tofino switches). While CPDS enable scalable and efficient monitoring, they also increase the attack surface area. Adversaries can launch pollution attacks that corrupt stored statistics, leading to incorrect network management decisions.In this paper, we present ListGuard, a lightweight system that detects and recovers flow statistics in IBLT-based telemetry primitives affected by pollution attacks. Our key idea is to selectively sample additional flows and use them to resume the stalled decoding process without modifying the IBLT structure. Using realistic traces, we demonstrate attacks and show that ListGuard restores affected statistics with low memory overhead.
Fine-grained network traffic identification is crucial for service quality assurance, security monitoring, and traffic scheduling. However, the construction of fine-grained datasets currently relies heavily on manual efforts, suffering from prohibitive costs, low efficiency, and rapid obsolescence due to frequent application updates. To overcome these scalability bottlenecks, we propose NanoTG, an automated framework leveraging a Plan-Execute-Reflect Agent architecture for reliable mobile traffic generation. NanoTG autonomously explores target apps to identify fine-grained app-activities and achieves semanticlevel traffic attribution by aligning network flows with granular execution logs. We evaluated NanoTG on 10 popular applications. During exploration phase, NanoTG uncovered 21.6% more unique IP addresses and 22.7% more SNIs than baseline tools. This demonstrates that NanoTG can identify more fine-grained app-activities. For app-activity quality, NanoTG generated 113 high-quality tasks and achieved a 62% improvement in network relevance score over baseline methods. We further discuss the effectiveness of NanoTG-generated traffic, and preliminarily validate its realism and downstream task utility.
Teleoperation provides a critical safety fallback when autonomous vehicles (AVs) encounter scenarios that are outside their operational design domain. In practice, however, remote operators rely primarily on compressed camera streams over 5G, which often lack depth and spatial geometric cues for safe operation in complex dynamic environments. While multi-sensor fusion can enhance situational awareness, directly transmitting raw camera and LiDAR data is impractical due to 5G uplink bandwidth and latency constraints. In this paper, we propose SHARDED, a collaborative camera–LiDAR perception framework that deploys a feature-level fusion pipeline across the vehicle and edge to reduce uplink traffic while preserving 3D detection and depth estimation accuracy. We further design two complementary mechanisms for SHARDED: (i) A network-aware adaptive feature transmission mechanism that reduces data traffic by 50% on average (peaking at over 95%) compared to raw sensor data, and (ii) a latency-aware positional drift compensation mechanism to mitigate cross-modal misalignment induced by unstable network conditions. Evaluations on the nuScenes dataset and real-world 5G measurement traces show that SHARDED achieves competitive perception quality while reducing uplink bandwidth consumption and end-to-end latency.
Traditional intrusion detection system solutions and modern machine learning (ML) and deep learning (DL)-based approaches depend on large labeled datasets, which makes them less effective in detecting rare attacks in Internet of Things (IoT) networks. This paper addresses these limitations by proposing a self-supervised few-shot learning (SSL-FSL) intrusion detection framework that enables data-efficient learning and adaptive recognition of unseen attack types using only a small number of labeled samples. The model will be trained and tested on the Edge-IIoTset dataset as well as on unseen attack categories from the CICIoT2023 dataset. The traffic data will be represented as images to allow the model to learn spatial feature patterns rather than relying on class-specific characteristics. This representation, combined with self-supervised pre-training and prototype-based few-shot adaptation, enables the extraction of robust and transferable embeddings that capture intrinsic relationships within the data. Experimental results demonstrate that the proposed SSL-FSL framework achieves strong unseen attack detection performance and achieves an accuracy of 69.76% on the CICIoT2023 dataset without any fine-tuning, highlighting its ability to generalize to novel attack types. Overall, the proposed framework provides a practical, data-efficient, and generalizable solution for adaptive intrusion detection in heterogeneous IoT environments.
Internet protocols continue to evolve. The verification of modern protocols such as QUIC needs to consider not only the protocol specification but also the real implementations. Verifying implementations requires the ability to execute them in controlled environments. We propose, implement, and evaluate JADE (Just A Deterministic Emulator), a lightweight user-space framework that is situated in the middle ground between network simulators and emulators. JADE enforces time determinism by interposing a minimal set of libc calls (time, randomness, and blocking I/O), advancing a global event-driven simulated clock, and buffering packet transmissions until scheduled delivery times. This selective interposition preserves binary compatibility and low extension cost. We integrate JADE with Ivy’s Network-centric Compositional Testing workflow and demonstrate deterministic, reproducible verification of picoquic, a standards-compliant QUIC implementation, including the reproduction of a known temporal bug. Compared to kernel-based emulation (tc), JADE achieves delay-agnostic execution with sub-millisecond per-packet delivery overhead; compared to the Shadow simulator, JADE offers a lower implementation complexity.
5G+ (5G and beyond) mobile networks are increasingly complex, making their monitoring and management challenging. This paper presents a PhD research focused on automating 5G+ network performance assessment through a family of Multimodal Data Analysis Methods (MDAM) in 5G+ cellular networks. We identify limitations of unimodal approaches, describe the design-science methodology adopted, and present the Module for Automated and Context-Preserving Telecommunication Network State Analysis (MACNSA) – a modular analytics platform hosting MDAM. The first MDAM implemented within MACNSA is an agentic RAG-based system (Agentic-RAG-MDAM) that fuses numerical KPI data with textual feature documentation. The evaluation protocol, based on both traditional information retrieval and LLM-as-a-judge metrics, is described. Preliminary experiments on real operator data demonstrate that Agentic-RAG-MDAM significantly reduces per-feature analysis time compared to traditional human expert approaches. Current limitations and planned future work are discussed.
The concept of island readiness envisions that communication networks can fall back to local connectivity islands when global connectivity breaks, e.g., after natural disasters or targeted attacks. Island connectivity would enable users to use crisis-relevant applications hosted at the local edge during crisis response. However, realizing island readiness involves many stakeholders, and this paper is the first to consider the perspective of mobile network operators (MNOs). This paper explains why today’s 5G-Advanced deployments are not island-ready and outlines the options MNOs have to support island connectivity. We introduce a design for island-ready 5G and beyond core networks and demonstrate its functionality in an end-to-end lab testbed with commercial smartphones.
We present NICoLE (Network-Integrated Codec–LLM Engine), an in-network decision layer for real-time RTP video streaming that assists encoder adaptation without modifying end-to-end congestion control. NICoLE correlates RTP telemetry (frame size and packet pacing) with queue dynamics at the bottleneck to detect mismatch between encoded rate and available service capacity. Based on this, it selects discrete encoder profiles (resolution, frame rate, GoP) and applies short-lived ECN-based queue prioritization. The system is implemented using WebRTC (GCC) and GStreamer. Experiments under controlled bottleneck conditions show reduced queue buildup, lower stall ratio, and improved frame pacing stability at high frame rates (90–120 FPS), while gains remain limited at lower rates. To address reliability concerns, NICoLE constrains the LLM to structured inputs and a bounded action space, ensuring deterministic behavior and avoiding free-form reasoning. We show that inference latency (~383 ms) remains below GCC reaction time (600–1500 ms), enabling timely in-network intervention. These results indicate that LLM-assisted in-network control is feasible and beneficial under high-density, delay-sensitive workloads, but not universally required.
Intelligent mobile applications are often constrained by limited on-device hardware and by the latency and bandwidth overhead of cloud offloading. Offloading computation-intensive deep learning tasks to edge servers can potentially mitigate these challenges. However, existing systems struggle to scale as the numbers of tasks and users grow. This limitation stems from a fundamental conflict: requests in edge settings are typically sparse, heterogeneous, and demand immediate processing to minimize latency. However, GPUs operate most efficiently on dense, homogeneous batches, a condition that edge traffic rarely provides. Most existing approaches, including cloud-oriented solutions like Multi-Instance GPU, fail to resolve this tension because edge devices typically lack the advanced features available in high-end cloud GPUs. This paper contributes SMOOTH, a scalable multitask offloading system that introduces a Sparsity-to-Density Abstraction to resolve this conflict. By decomposing deep learning models into a shared backbone and lightweight task-specific heads, SMOOTH transforms sparse, heterogeneous request streams into dense, homogeneous computation blocks amenable to efficient batching. This allows highly efficient cross-task batching without prohibitive accumulation delays. To further optimize responsiveness, SMOOTH employs a compute-lightweight $\left({{\mathcal{O}}\left(1\right)}\right)$, sparsity-aware adaptive scheduler that dynamically balances inference throughput and end-to-end latency based on queue dynamics. Our evaluations demonstrate up to 2.21× higher throughput, 45% lower memory usage, and up to 82% reduced latency across diverse arrival patterns compared to baselines.
The convergence of Multimedia and Internet of Things (IoT) (M-IoT) is driving a new class of applications that combine interactive, high-throughput content with real-time sensing, inference, and actuation. While 5G systems have introduced key enablers such as edge computing, network slicing, and broadcast/multicast delivery, current deployments reveal structural limitations when exposed to the heterogeneous demands of immersive Extended Reality (XR), cooperative perception, and holographic services. This paper consolidates M-IoT requirements from a system-level perspective and analyzes how 5G architectures respond to these demands through the modeling of physical resources of HD and 4K streaming workloads under unicast, sliced, Non-Public Network (NPN), and 5G Multicast/Broadcast Service (5MBS) delivery configurations. These results reveal structural limitations related to throughput saturation, rigid resource partitioning, and unidirectional delivery constraints that cannot be resolved through incremental enhancements alone. In this background, we provide a structured mapping of identified limitations to targeted 6G architectural directions aligned with IMT-2030 objectives, considering that future networks must move beyond capacity upgrades toward integrated support for compute–communication co-design, scalable radio access, and intelligent orchestration. These features are essential to meet the evolving needs of M-IoT and enable resilient, low-latency, and scalable media services.
The shift of power systems towards renewable energy and decentralized energy generation requires additional efforts of operators to keep the grid stable. To accomplish this task, grid operators use Intelligent Electronic Devices (IEDs). These IEDs need to communicate with each other, both inside the LAN of a substation, and between distinct substations and control centers over a wide area network (WAN). Such grid control traffic requires high reliability and low latency. While the communication architecture in substation LANs is well established, communication across WANs is still a field of active research. Therefore, we propose MyRiAD, a duplication-based in-network resilience mechanism implemented in the network layer. MyRiAD leverages existing ring structures within network topologies to boost resilience. Our evaluation results demonstrate that MyRiAD reduces end-to-end packet loss by up to 93% compared with related techniques and achieves over 96% loss reduction compared to conventional shortest-path routing.
The resiliency of Traffic Engineering (TE) algorithms is a critical challenge. Examining the performance against correlated, multi-link failures requires realistic failure scenarios with associated probabilities. However, no publicly available dataset provides such scenarios for the network topologies commonly used in TE research. We address this gap by modeling the impact of seismic activity on network infrastructure and generating the Earthquake-induced Link Failure (ELF) dataset of Probabilistic Shared Risk Link Groups (PSRLGs) for 30 backbone topologies from the REPETITA dataset. Using global earthquake occurrence rates and ground-motion propagation models, we compute for each network all earthquake-induced link failure scenarios with their annual occurrence probabilities. To demonstrate the ELF dataset’s value, we evaluate several state-of-the-art TE algorithms. Our results show conventional TE approaches exhibit high annual overload probabilities. A strategic TE approach cannot find a single pre-computed configuration that withstands all failure scenarios due to their large number and diversity. Some failure scenarios even cause overload under optimal routing. These findings provide evidence for combining strategic TE with tactical measure in order to withstand regional failures. We make the ELF dataset publicly available to encourage further research into regional failure resiliency.
Network functions increasingly rely on machine learning models. Recent work–such as the Agua framework presented at SIGCOMM 2025–has shown that explanations grounded in networking concepts can improve the interpretability of these models. However, this requires a predefined set of concepts that is assumed to completely capture the model’s internal reasoning, without offering any way to verify this assumption. As a result, explanations may appear plausible while omitting substantial parts of the learned representation. In this paper, we introduce a representation-level framework for quantifying concept completeness. Instead of evaluating completeness solely via prediction reconstruction, we measure how much variance in a model’s internal representations is captured by the subspace spanned by predefined networking concepts. This yields a global, post-hoc, model-agnostic completeness metric. To address the high dimensionality and noise typical of large language model-based explanations, we further propose a significant-component completeness measure. Additionally, we derive an importance metric to fairly attribute each concept’s contribution to overall completeness. We apply our approach to assess the completeness of the concept sets used to explain three AI-driven networking scenarios in the Agua paper. We find that the concept set is only moderately complete for two and substantially complete for one of these scenarios.
Zero-touch Service Management (ZSM) delegates the control of 6G virtualised resources to AI/ML pipelines, increasingly built on time-series models whose opacity undermines operator trust and conflicts with regulatory requirements. Existing XAI-for-networking proposals largely (i) reuse tabular methods unsuited to networking time series and (ii) treat explanations as post-hoc artefacts for humans rather than as first-class signals inside the MAPE-K loop. This PhD aims to close this two-fold gap by designing XAI native to time-series predictors on networking data and by feeding their outputs — with Machine Reasoning (MR) over a knowledge base — into the Plan stage of MAPE-K. We present the problem context, a structured state of the art on MAPE-K-based ZSM and on XAI for sequential models, three research questions, an initial methodology, an evaluation plan grounded on injected ground truth, and a three-year roadmap.
Traffic Engineering (TE) in IP networks has received attention for over a quarter century, mostly within a single autonomous system. Locator/ID Separation Protocol (LISP) has been proposed to enhance Internet routing with new features, among which to allow traffic to be sent to multiple Routing Locators (RLOCs) in LISP-enabled networks. In this paper, we consider a federated environment in which multiple autonomous systems (AS) cooperate to benefit from the LISP capability to determine a load balanced traffic distribution among their RLOCs. In particular, we assume that the ASes agree to share traffic information for federation with a traffic engineering calculator (TEC) through service level agreements (SLAs). We present two novel optimization models that can be used by the TEC for balancing traffic loads in federated LISP-enabled networks that use multiple RLOCs. We compare our models to the base case when proportioning to multiple RLOCs is not available. Based on the cases we studied, we observed that LISP-based flexible traffic balancing through our approach with multiple RLOCs provides up to 78% gain (in terms of link utilization) compared to the base case when the network is asymmetric with non-uniform traffic.
This paper presents the first global analysis of blocked domains at the country and ISP level. It examines the transparency of governments and ISPs regarding the domains they block and compares this to the actual censorship observed in practice. To assess this transparency, 40 officially published blocklists by governments and ISPs are automatically crawled regularly, enabling both cross-country comparisons and longitudinal evaluation over time. These blocklists are also made publicly available through the developed platform WorldWideBlock. To identify the domains that are actually blocked, over 20 million Open Observatory of Network Interference (OONI) anomalies are analyzed and validated through more than 500 million conducted remote measurements, enabling the extraction of anomalies caused specifically by ISP- or country-level blocking. Through this comparison, domain blocklists were generated for 190 countries, enabling cross-country comparisons of censorship strategies and revealing inconsistencies in transparency and enforcement practices. Additionally, our contributions include the development of two measurement tools, rVPmt and rDNSmt, which enhance our ability to analyze and understand Internet censorship dynamics. Finally, the extracted blocklists were applied to RIPE Atlas measurements to identify the share of tested domains that could potentially harm probe hosts due to censorship-related redirects or interception.
With the stringent requirements of evolving vertical services, there is a growing need for more flexible, ultra low-latency Beyond 5G (B5G)/6G architectures. One way to achieve this is by disaggregating core network functions and deploying them closer to the end users. The distribution and optimal placement of both Control Plane (CP) and User Plane (UP) functions at the network edge, along with the collocated orchestrated Application Functions (AFs), can significantly improve End-to-End (E2E) latency and network reliability by avoiding unnecessary traffic flows to the centralized cloud servers. Furthermore, as 5G evolves into 6G, automated and intelligent network management solutions will be needed in the distributed communication compute continuum. This paper presents an early-stage PhD research direction that focuses on the optimal quality-aware disaggregation of 5G core functions, aiming to reduce E2E latency and improve the throughput of 6G vertical services. The focus is on the optimal User Plane Function (UPF) placement, as well as the other CP functions and AFs, which altogether interact with the UPF. As UPF is directly involved in user data forwarding, it is crucial for handling user traffic over 5G/B5G network and, as such, it significantly impacts E2E latency. This paper provides i) an overview of theoretical concepts and State of the Art (SotA) UPF placement methodologies, and ii) future directions for optimized placement of B5G Core and application functions within the edge cloud continuum, leveraging intelligent network and service orchestration solutions.
