This paper presents TimeLSB, a covert channel built on TCP timestamps using extended Berkeley Packet Filter (eBPF) technology. The channel encodes information by modifying the least significant bit of timestamp values through a CRC32-based scheme in the Linux kernel, while a passive receiver reconstructs the hidden message. We implement and evaluate this channel under a range of controlled network impairments, demonstrating that embedding covert bits does not significantly alter the behavior of normal TCP connections. The eBPF implementation introduces only on average 250 ns of processing overhead per packet, which corresponds to several million packets per second and is negligible compared to typical forwarding performance. Finally, we analyze detectability using the distinct-timestamp ratio, showing that while absolute values differ from prior work, the metric still provides a stable separation between covert and normal flows. These results highlight the practicality of an eBPFbased covert channel and provide defensive insights for network security operations.
Xtended Reality (XR) and holographic telepresence place stringent Quality of Service (QoS) demands on network infrastructure, requiring ultra-low latency, high throughput, and reliable connectivity. Meeting such QoS demands is critical in dynamic, distributed cloud environments, but does not always guarantee a satisfactory user experience. Quality of Experience (QoE) captures the user’s perception of service performance, which may be influenced by factors not fully reflected in systemlevel metrics. Thus, novel orchestration strategies must consider both QoS and QoE. This paper proposes a Reinforcement Learning (RL)-driven approach to edge-cloud orchestration capable of adapting to dynamic network conditions, leveraging a multiobjective reward function, including both QoS and QoE aspects, to guide service placement decisions. Evaluation shows that our RL approach reaches a 21.3% QoE gain over heuristics and 14.7% over balanced strategies, with 100% request acceptance. The results highlight the robustness and scalability of RL-driven orchestration, particularly for latency-sensitive 6 G applications. Our findings also reveal the limitations of traditional heuristics under complex objectives and highlight the potential of RL as a transformative tool for intelligent network and service management in next-generation communication systems.
The ever-increasing automation of complex decisionmaking processes through Operations Research (OR) raises the need for specialized management systems. To support multiple vertical industries, OR service providers must handle a diverse portfolio of solvers having widely varying resource, computational, and availability requirements. To address this fundamental challenge, we present Octopus, a state-of-the-art cloud-native solver orchestrator. Leveraging Kubernetes, Octopus features event-driven autoscaling to align resources with application demand, dedicated queue management to meet service-level agreements, and robust reliability mechanisms to prevent service interruptions. This demonstration showcases Octopus’s capabilities in a production-like environment, illustrating its full end-to-end workflow and commenting on its real-time performance.
Existing traffic steering mechanisms often struggle to meet the dynamic requirements of today’s applications. This paper demonstrates a novel approach that leverages Segment Routing over IPv6 (SRv6) and Intent-Based Networking (IBN) principles to enable advanced, application-aware end-to-end traffic engineering between clients and servers. The solution illustrates how high-level, application-specific traffic steering intents are seamlessly translated into dynamic network instructions, thereby eliminating the need for complex, manual network steering policies. The system further incorporates standardized protocols to enable real-time telemetry data collection and analysis, pioneering next-level traffic engineering capabilities that were previously unachievable. This demonstration showcases the practical feasibility of this approach through targeted use cases, leveraging its open-source foundation, and highlights the significant benefits of creating highly dynamic networks that autonomously adapt to changing conditions and application requirements.
Programmable data plane devices have enabled various in-network applications that rely on locally stored state for delivering low-latency and high-throughput services. However, these applications are susceptible to network failures, which can disrupt state access and network functionality. Timely and reliable failure detection is therefore a critical component of a stateful data plane. In this paper, we propose a data plane framework, FASTR, that enables microsecond-scale fast failure detection between directly connected switches. FASTR can achieve sub- $10 \mu$ s detection latency by implementing a heartbeat mechanism in the data plane. In addition, FASTR also incorporates traffic-awareness to reduce overhead and priority queuing to avoid false alarms. We validate FASTR with hardware experiments, demonstrating that it can consistently detect failures within $10 \mu$ s using a $4 \mu$ s interval while remaining robust to network congestion.
Open Radio Access Network (O RAN) disaggregates conventional RAN into interoperable components, enabling flexible resource allocation, energy savings, and agile architectural design. In legacy deployments, the binding between logical functions and physical locations is static, which leads to inefficiencies under time varying traffic and resource conditions. We address this limitation by relaxing the fixed mapping and performing dynamic service function chain (SFC) provisioning with on the fly O CU selection. We formulate the problem as a Markov decision process and solve it using GRLDyP, i.e., a graph neural network (GNN) assisted deep reinforcement learning (DRL). The proposed agent jointly selects routes and the O-CU location (from candidate sites) for each incoming service flow to minimize network energy consumption while satisfying quality of service (QoS) constraints. The GNN encodes the instantaneous network topology and resource utilization (e.g., CPU and bandwidth), and the DRL policy learns to balance grade of service, latency, and energy. We perform the evaluation of GRLDyP on a data set with 24-hour traffic traces from the city of Montreal, showing that dynamic O CU selection and routing significantly reduce energy consumption compared to a static mapping baseline, without violating QoS. The results highlight DRL based SFC provisioning as a practical control primitive for energy-aware, resource-adaptive O-RAN deployments.
The Border Gateway Protocol (BGP) is a crucial inter-domain routing protocol that uses update messages to enable Autonomous Systems (ASes) to share network reachability information. Typically, ASes should only trigger update messages to reflect configuration changes and link failures for optimal path selection. However, we have identified recurring patterns of highfrequency repeated updates without any topological changes, which consume unnecessary resources of the route collectors for archiving and storage, and complicate downstream analysis. Although the phenomenon of noisy BGP peers and prefixes is known, current work has not quantified its scope and characteristics. This study fills this gap and analyzes over 80 billion update messages from multiple RouteViews collectors spanning several years. We identify and characterize high-frequency repeated updates driven by a small fraction of sessions and prefixes. For instance, fewer than 2% of the prefixes accounted for over 90% of update messages in some BGP update traces.
Real-time trajectory prediction is critical for safe and efficient operation of connected and autonomous vehicles (CAVs). Yet existing deterministic models struggle to capture the multi-modal, uncertain nature of traffic evolution. This paper addresses this gap by proposing a framework powered by Generative Adversarial Networks (GANs) that uses V2X (Vehicle To Everything) data to create a digital twin capable of simulating plausible future scenarios and of supporting planning and decision-making in CAVs. The Generative framework is designed to generate multiple trajectory predictions conditioned on received CAM (Cooperative Awareness Message) data, using a Transformer-based architecture with temporal consistency regularization. We evaluate it in a SUMO-simulated environment, demonstrating improved stability and realism over baseline GAN training.
Reinforcement Learning (RL) has emerged as a powerful tool for automating complex network management tasks, yet its lack of transparency and black-box nature hinder trust and adoption in operational environments. In this work, we focus on explaining the behavior of an $\mathbf{R L}$ agent applied to the problem of network slice admission control. We present a framework that integrates three key components: a Deep Reinforcement Learning (DRL) agent for admission control, an Integer Linear Programming (ILP) model for network slice embedding, and an explanation module for interpreting the DRL agent’s policies, namely Shapley Value Explainable Reinforcement Learning (SVERL). Our analysis aims gives particular attention to cases where the RL agent rejects admitting a network slice request despite sufficient network capacity to provision it, and investigates whether explanations can be used to verify and validate the agent’s behavior prior to deployment approval. Experimental results reveal that the agent’s decisions are primarily influenced by substrate network conditions such as congestion, rather than by the intrinsic characteristics of slice requests. While this conservative policy prevents overload, it also leads to overly cautious rejections. Importantly, the proposed explanation framework provides operators with actionable insights to scrutinize, validate, and refine RL-driven policies before operational deployment.
Virtual Machine (VM) co-residency occurs when two virtual machines belonging to different users share the same physical host. Co-residency brings important security implications when one of the VMs is malicious: side-channel leakage, denial of service, and performance degradation are all possible attack vectors that can be leveraged. Achieving co-residency is a two-step process: VM placement and detection. While most of the literature focuses on preventing physical placement, we address the under-explored second step: preventing co-residency confirmation. We present HideMe, a modular, lightweight system that detects malicious probes based on dynamic host behavior and redirects them to decoy VMs. Evaluated in two realistic scenarios, HideMe demonstrates high efficacy, preventing 100% of attacks in consistent traffic environments and 97% in highly variable traffic, all with zero false positives and under strict visibility constraints. As contribution, we also release Hide me under an open-source license, provide deployment instructions for network operators, and outline directions for further improvement.
Bluetooth Low Energy (BLE) is widely used in devices like smartphones and personal trackers, but also raises serious privacy risks, especially related to stalking. Machine Learning (ML)-based methods for detecting BLE trackers across vendors show promise, yet are limited by the scarcity and variability of BLE advertisement packets, which hinders model performance. This paper addresses this limitation by introducing the first publicly available, open-source tool for generating synthetic BLE advertisement packets using a Markov model. Designed for structured time-series data, the model can produce all valid BLE packet permutations, addressing a key data gap for research and training. As a case study, synthetic Samsung SmartTag (nearby) packets are used to augment training data, resulting in a 37% increase in median prediction confidence level in real-world evaluations.
Interactivity is a metric that measures the level of control or manipulation users may exert over a system, software, or service. It is considered a key dimension in cloud-gaming services, measuring how effectively users can control and respond to game events in real-time. Although widely acknowledged by standards such as ITU-T Rec. G.1051, G.1072, its relationship to other quality dimensions such as video, audio, and overall Quality of Experience (QoE), remains not thoroughly examined. In this paper, we present a novel Bayesian Network-based framework to model and analyze interactivity alongside other quality factors under varied network conditions. Our method enables probabilistic inference and sensitivity analysis across perceptual variables, offering explainable insights into their mutual influence. Using data from two ($N 1=30$, and $N 2=31$ subjects) subjective studies - one for Virtual Reality Cloud Gaming (VRCG) and another for Mobile Cloud Gaming (MCG) - we show interactivity is most sensitive to round trip time (RTT) but resilient to jitter (RJ) effect. Further, an assessment of the seven interactivity-only variables shows that their distributions change uniformly under varying network conditions, suggesting that interactivity may be captured by a single metric. Finally, sensitivity analyses indicate that QoE is a more representative metric than interactivity for quality assessment in cloud gaming over heterogeneous access networks.
Extending multivariate time series forecasting to resource-constrained edge devices is essential for enabling intelligent and sustainable IoT services. A common scenario involves vertically partitioned data across devices, where each device must forecast its own variables while benefiting from others’ information. This paper studies a resource-efficient solution for this scenario based on vertical federated learning (VFL). Prior VFL frameworks are designed for situations where only one party holds the labels and would struggle to meet the demand of the targeted scenario, as storage resources usage would increase dramatically with the number of devices. Going beyond VFL, we design multivariate vertical federated learning (MVFL) as a novel federated learning framework, where we separate communication features and local features in an embedded feature space. This design enables MVFL to utilize storage and communication resources more efficiently by eliminating redundant models. On four real-world benchmarks, MVFL outperforms the VFL approach in both efficiency and accuracy, demonstrating its practical value for distributed IoT systems.
Application fingerprinting is essential for network management and security, enabling accurate traffic classification and the enforcement of Quality of Service (QoS) policies. In this work, we propose a scalable method for mobile application fingerprinting that leverages MinHash and Locality-Sensitive Hashing (LSH) to efficiently identify behavioral similarities in encrypted network traces. By restricting comparisons to highsimilarity candidates, our approach significantly reduces computational complexity while preserving accuracy and enabling the detection of previously unseen applications. Evaluated on the ReCon dataset, the method achieves an average accuracy of 83% across app identification and unseen app detection tasks, with a reduction in comparison complexity from $\mathcal{O}\left(n^{2}\right)$ to $\mathcal{O}(n \log n)$.
6th-generation (6G)mobile networks are envisioned as AI-native systems, integrating learning and inference across the entire protocol stack. Although 5G’s 3GPP Network Data Analytics Function (NWDAF) introduced analytics-driven automation, it lacks standardised support for model lifecycle control, Data Analytics as a Service (DAaaS), closed-loop feedback, and largescale interoperability. To address these gaps, we propose a protocol-based framework for AI-as-a-Service (AIaaS) management for 6 G, centered on an enhanced NWDAF architecture with four components: Model Lifecycle Orchestrator, Model Registry & Validator, Distributed Execution Engine, and Feedback Aggregator. It introduces two lightweight, service-based interfaces: Model Training and Creation Protocol (MTCP) for intent-based model training and publication, and Model Execution Protocol (MEP) for on-box inference and metric feedback. We validate the framework via formal verification under message loss using a reproducible TLA+ model with three NFs and two model versions. Results show that NWDAF can evolve into a feasible AI lifecycle manager, enabling scalable and stable AI-native deployments in 6G. Complexity modelling confirms linear resource scaling up to 128 network functions (theoretical), with the public TLA+ specification configured for 3 NFs.
Researchers working on DDoS detection encounter significant challenges, primarily due to the lack of robust datasets. Existing publicly available datasets are mostly synthetic, mixed, or severely limited. For example, the most cited studies since 2020 have relied on an aggregation of three synthetic datasets, none of which includes up-to-date YouTube and streaming traffic that constitute a significant portion of end-user data. This paper introduces four diverse datasets under the name SCLDDOS2024, collected from 8 Aug, 2022 to 26 Apr, 2024 on various commercial networks using uniform methods and tools. These datasets can significantly enhance DDoS research by supporting and validating the generalization of detection models. The datasets were collected using commercially available DDoS protection solutions and, although not optimal for all research purposes due to real-world data collection constraints, our analysis shows that even simple machine learning models, when paired with effective feature engineering, can achieve high accuracy with SCLDDOS2024. This work highlights the potential of SCLDDOS2024 to transform DDoS detection research by providing richer, more diverse real-world data.
Applying Federated Learning (FL) to real-world network environments, such as telecommunication networks, presents significant challenges. In this paper, we investigate the intrinsic problem of non-IID data training across distributed innetwork FL clients. More specifically, we focus on the feature distribution discrepancy in the use of in-network FL for infrastructure monitoring. While previous works have made notable progress in the design of aggregation functions that compensate strong polarization in data distributions, limited attention was directed toward data load-balancing from sources to processing nodes, which leverages the role and characteristics of the data itself. Our goal is to address feature heterogeneity in in-network federated learning by piloting how data is forwarded in the network on the way to its consumers. To this end, we design and evaluate several scenarios for dynamic data load balancing between FL clients within the network topology, subject to latency constraints.
The increasing complexity and increasing demands of IT applications, especially in federated multi-cluster environments, pose significant challenges for service orchestration. To address these, Zero-Touch Service Management (ZSM) and intent-based management paradigms are gaining traction, allowing users to specify high-level goals rather than low-level configurations. However, current intent-driven approaches often rely on rigid Domain Specific Languages (DSLs) or graphic user interfaces, limiting expressiveness and usability. In this work, we propose a neurosymbolic intent-based platform that leverages Large Language Models (LLMs) for natural language intent ingestion and Answer Set Programming (ASP), a declarative programming paradigm used for solving complex combinatorial problems. The system translates natural language descriptions of microservice requirements into structured policies, enabling explainable service-to-cluster matching across federated Kubernetes environments. We validate our approach through experiments that evaluate both the syntactic correctness and efficiency of various LLMs in intent translation, as well as the computational time of the symbolic placement algorithm.
The increasing reliance on online services across critical sectors (e.g., banking, healthcare, and government) makes robust network infrastructures paramount. However, these services are frequently targeted by malicious actors leveraging distributed overlay networks (botnets) to execute attacks (e.g., data theft, service disruption, and ransomware campaigns). The impact of such attacks correlates with the scale and capabilities of the compromised infrastructure. Therefore, early and proactive detection of botnet infections is crucial for limiting their growth and mitigating potential damage. This paper presents and evaluates a Digital Twin-based approach for proactive botnet detection and multi-level mitigation within large-scale networks, particularly ISP infrastructures. Through simulations using a dedicated network topology framework, we demonstrate how these strategies can effectively limit botnet growth and significantly reduce their impact on critical network operations.
Mobile relays can restore end-to-end connectivity in disconnected ad hoc networks, yet classical placement methods rely on global geometry and channel maps that are rarely available in practice. We study routing-aware reinforcement learning (RL) for a single controlled host that moves on a 2D plane to bridge disconnected clusters and enable multi-hop delivery between a source and destination. Built on OMNeT++/INET, our environment exposes only local, router-observable signals and augments them with a lightweight host-discovery memory. We propose a composite reward that couples end-to-end delivery with topology-shaping incentives. We benchmark PPO and QRDQN under domain randomization and a scenario curriculum that rotates layouts every K episodes. Both methods learn to discover hosts, position between clusters, and sustain high forwarding efficiency on unseen topologies; QRDQN converges faster under sparser rewards while PPO yields smoother final policies.
