The growing adoption of programmable network architectures, such as ONF’s SD-Fabric, has introduced new levels of flexibility, automation, and control into modern infrastructures. Leveraging P4-programmable data planes, centralized SDN control, and in-band telemetry, these architectures are well-suited to meet the stringent requirements of dynamic, cloud-native, and edge computing environments. However, ensuring service reliability, performance, and compliance with strict Service Level Agreements (SLAs) remains a complex challenge, particularly under high traffic dynamics and resource variability. Within this context, this paper presents a PhD research project that proposes a Forecasting-Oriented Management framework for SD-Fabric environments, combining in-band telemetry, AI-based forecasting, and a hierarchical distributed control strategy to anticipate and mitigate SLA violations. The solution proactively identifies network risks, such as failures, bottlenecks, and resource constraints, enabling intelligent decisions on traffic engineering and resource reallocation. Initial experiments, conducted in an emulated environment using P4-programmed switches and a simulated control layer, allowed comprehensive testing under varied traffic and failure scenarios. These preliminary results demonstrate the potential of the proposed approach to enhance SLA compliance and improve the resilience and efficiency of programmable network fabrics.
Historically, the high latency of storage devices masked the impact of software overheads in the storage stack. However, with the advent of microsecond-scale storage devices, the performance cost of adding new software layers has become more significant. In particular, integrating cryptographic operations into file systems that run on low-latency devices poses substantial challenges. This paper investigates the application of ahead-of-time and speculative encryption techniques to in-kernel file systems, tailored for modern storage devices. Our experimental results demonstrate that these techniques significantly improve both latency and throughput, outperforming current cryptographic file systems.
As the importance of software security escalates, identifying and addressing source code vulnerabilities becomes essential to maintaining robust and trustworthy systems. Static Application Security Testing (SAST) tools play a vital role in detecting potential weaknesses, yet their high false-positive rates often burden developers with time-consuming manual verification–risking both inefficiencies and unintended functional changes during remediation. This research introduces LogiSec of Thoughts, a novel, prompt-driven reasoning framework designed to improve the triage of vulnerabilities identified by SAST tools. Rooted in the classical Reductio ad Absurdum method, LogiSec of Thoughts guides a Large Language Model (LLM) through a structured four-step reasoning process to evaluate the plausibility of each vulnerability. By attempting to refute the existence of the vulnerability and reasoning through contradictions, the model is prompted to critically assess whether the issue is logically and contextually sound. This methodology operates independently of external expert systems and is adaptable for integration into secure development pipelines. By reducing false positives and improving the prioritization of actionable security issues, LogiSec of Thoughts offers a promising step toward intelligent, automated code security assessment.
Recently proposed consensus protocols make use of the network layer to ensure agreement, while the application layer is still used for termination. Those protocols employ the network layer as a sequencer that delivers ordered messages facilitating agreement. However, tolerating a malicious sequencer is a challenging task. For instance, a malicious sequencer can assign the same sequence number to different messages and send them to different replicas. To avoid this problem, the NeoBFT consensus protocol adds an additional communication step at the replicas. Although this approach mitigates the problem, it negatively impacts system performance by requiring an additional synchronization step among replicas before executing requests. This work proposes NsoBFT (Network Secure Ordered BFT), a consensus protocol that uses a secure message ordering service implemented with USIG (Unique Sequential Identifier Generator), a secure component in the network layer. Thus, no additional synchronization step is necessary for the replicas to execute requests. Experimental results comparing NsoBFT with related work show the advantage of this strategy, in particular confirming that NsoBFT outperforms NeoBFT.
Cyber-Physical Systems (CPS) rely on data collection as a fundamental element to control physical devices through the internet. They are widespread in several environments, such as medical, smart cities, wearable devices, and space environments. Despite its importance, recent security incidents point to a neglect of system security in the development of CPS systems. Such neglect is largely due to the difficulty in understanding security requirements, whether those specified in requirements elicitation documents or those arising from security standards for specific systems. Many of these standards lack clarity and contain ambiguities, leading to subjective interpretations and inconsistent implementation. This study suggests a way to simplify and standardize security requirements, creating a Minimum Security Baseline (MSB) for CPS development, particularly in situations where several standards must be met. Large Language Models (LLMs) are used to process texts in natural language and find complements and intersections among the different documents in order to automate the generation of the MSB. The mission requirements of the CubeSat satellite, model CONASAT-0, created by INPE (National Institute for Space Research), are used as a case study. Using the OWASP IoT Security Verification Standard (ISVS) as the ontological foundation for security words, the MSB is produced by semantically examining the criteria of the NIST, ECSS, and CCSDS standards. The results include an MSB that can be valuable for guiding embedded system implementations, as engineers have a single document to follow that can be applied to CPSs in a variety of contexts.
This work proposes an intermediate solution between a full-fledged Zero-Trust Architecture (ZTA) for remote access and a conventional, less secure Virtual Private Network (VPN). Our approach enhances the authentication component of VPNs to help achieve some of the benefits of ZTA without requiring modifications to the VPN infrastructure or code. We leverage the Cloud Native Computing Foundation’s open-source standard, SPIFFE, and its reference implementation, SPIRE, to build an attestation-based authorization for VPN access. The work proposes new node and workload attestors for SPIRE, enabling the verification of user and machine identity before granting access to the VPN. SPIRE also provides automatic credential rotation, which avoids long-term credentials and consequently minimizes the impact if the credentials are stolen. Finally, the paper provides an overview of the major security issues associated with traditional VPN authentication methods, such as credential or physical device theft, and how the proposed solution addresses these threats.
Currently, there is a noticeable increase in concern regarding the cybersecurity of corporate and personal data due to the rise of malicious software (Malware). In this context, this work presents a solution for intelligent malware detection in Windows Operating Systems by applying Artificial Intelligence (AI) techniques to memory process data. The solution aims to detect malware with minimal impact on the user’s device and network infrastructure, achieving scalability and appropriate response times through data compression and segmentation of functionalities by environment. The results demonstrate the feasibility of the solution, with the compression approach achieving approximately 60
State Machine Replication has been widely employed to implement fault- and intrusion-tolerant distributed applications. The seminal PBFT (Practical Byzantine Fault Tolerance) algorithm ensures replica consistency even in the presence of Byzantine faults. However, PBFT is computationally and communication-intensive, and its performance degrades as the number of replicas increases. In this work, we take the first steps toward developing a hierarchical version of the PBFT algorithm that preserves its Byzantine fault tolerance while improving scalability, such that the cost of executing the algorithm grows more moderately with the number of replicas. Our proposal is based on the VCube, a virtual topology that is scalable by definition. We present preliminary results that suggest how this hierarchical version can enhance the original algorithm, most notably by reducing the number of messages exchanged as the system size grows. While promising, further work is required to fully specify and comprehensively evaluate the hierarchical PBFT algorithm.
Legacy computing environments in the public sector present significant cybersecurity challenges due to outdated systems, technological heterogeneity and complex operational demands. In this context, this paper presents an initial study within a real-world case at a Brazilian governmental institution that applies the DevSecOps methodology in the CI/CD pipeline with two distinct security tools: Static Application Security Testing (SAST) and Vulnerability Management (VM). SAST was applied to assess application security at code level, while VM targeted infrastructure-level risks using metrics such as CVSS and EPSS. The results demonstrate the value of each approach in improving risk visibility and mitigation and the possibility of integrating both tools into a unified DevSecOps workflow, aiming for continuous security and greater operational resilience. This work provides practical insights for public institutions seeking to modernize their cybersecurity posture while addressing the constraints inherent to legacy systems, in alignment with frameworks such as NIST CSF and CIS Controls.
As software plays an increasingly central role in daily life, ensuring its trustworthiness is essential. Existing Software Trustworthiness Assessment (STA) techniques often lack theoretical grounding, disregard user expectations, and provide limited actionable guidance. At the same time, Large Language Models (LLMs) have shown strong capabilities in software engineering tasks, but their use for holistic and interpretable STA remains unexplored. This paper presents an exploration of using LLMs to perform context-aware STA, with a specific focus on system software functions written in C programming language. Our approach involved selecting functions from the Linux Kernel, designing tailored prompts, and executing LLM-based assessments. We report on three practical experiences, two involving expert-based assessments and one comparing results against SCOLP, a state-of-the-art automated technique. The results show that LLM-based categorizations achieve substantial agreement with most voted expert rankings, fair agreement with consensus ranking, and only slight agreement with the automated baseline. These experiences provide insight into the limitations of LLMs in supporting trustworthiness assessments in real-world systems.
Virtual machine introspection (VMI) has been widely used for stealthy monitoring of guest systems. However, context switching between monitoring system and monitored target introduces considerable overhead, especially for tracing common system calls, and deployment of VMI-based setups is complex. This work investigates whether extended Berkeley Packet Filter (eBPF) based tracing, a low-overhead kernel-level monitoring technique, can serve as an alternative. We compare the two paradigms in terms of performance, stealthiness, and practical applicability. Using micro-benchmarks and a prototype high-interaction SSH honeypot, we evaluate the capabilities and limitations of eBPF-based monitoring in adversarial settings. Our results highlight advantages and limitations of both, providing insights for the design of future security monitoring systems.
Safety in industrial environments, such as construction and factories, is a daily concern for companies, since it directly affects the workers and reputation. One existing approach to improve safety in Industry 4.0 is the integration of the Internet of Things (IoT) and Decision-Making methods, enabling continuous monitoring and risk situation detection. However, it is necessary to deploy these modern solutions in the usual equipment of workers without harming their daily tasks. Within this context, this paper presents an integrated solution comprising a monitoring IoT-helmet and edge computing, which increases occupational safety and reduces response time in risk situations. The IoT-helmet collects data about the current status of the worker (including eye movement, body position, and others), while the station consolidates and displays this information for alert situations (such as falling, drowsiness, fainting, etc.) detected by AI models. This paper presents preliminary results of the development of the solution, encompassing the experiments related to posture monitoring and events of falls and drowsiness. The results indicate the capacity of the solution to identify risk situations with a suitable response time.
Software vulnerability detection is crucial to prevent hostile attacks that can compromise applications and expose sensitive data. Traditional static, dynamic, and symbolic analyzers typically balance precision against computational complexity, often demanding high analytical costs or sacrificing detection accuracy. A recent alternative is the use of machine learning models, which can circumvent this trade-off by offering precise predictions with acceptable complexity. These models draw on advances in Natural Language Processing; however, most existing works focus on classification performance, with limited study of model interpretability. In this work, we fine-tuned two medium-sized language models, CodeBERT and CoTexT, for vulnerability detection in programming language code. We curated a benchmark dataset composed of vulnerable code fragments and their respective ground-truth masks, which indicates the exact tokens corresponding to vulnerabilities. We then applied the two interpretability methods—Saliency and InputXGradient, which rank the most performant interpretability techniques for text classification—to generate token-level importance heatmaps. Our evaluation shows that both methods achieve comparable precision; however, InputXGradient produces heatmaps that are substantially more interpretable. Finally, comparing the language models in terms of their ability to provide interpretation for their predictions, we observed a stark contrast, with CodeBERT providing more precise, consise and intuitive explanations for its predictions. Furthermore, our findings suggest that tokenizer design significantly influences the capacity of the model to learn code syntax and semantics, affecting both predictive performance and the clarity of generated interpretations. The results of our work underscore the critical role of interpretability and tokenizer configuration in ML-based vulnerability detection, highlighting the need to choose suitable attribution methods and tokenizer settings when employing such models.
Improving the quality and reliability of public transportation services is a key requirement for addressing mobility challenges in large urban centers. Bus Rapid Transit (BRT) systems play a significant role in achieving this goal. However, their effectiveness relies on the combination of several elements, among them the monitoring of stations, which is essential for managing passenger flow and ensuring safety. Evaluating the availability of such monitoring systems at scale across an entire corridor with multiple station types is a complex challenge, as individual station analyses fail to capture the systemic risks associated with the network’s topology. To address this issue, this paper proposes a hierarchical approach for modeling and evaluating the availability of monitoring systems in BRT corridors. The proposed solution employs a Fog-Edge architecture, where Fog units are placed at critical integration stations that act as hubs connecting different transit lines, and Edge units are deployed at regular stations. Availability analysis is conducted through Reliability Block Diagrams (RBDs) to represent the corridor topology and incorporate different operational requirements, such as defining the minimum number of stations that must be active for the corridor to be considered functional. We apply the proposed models to the East/West Corridor in the city of Recife, Brazil, as a set of case studies. Results show that even under a permissive operational scenario, where only the integration stations are required to function, the corridor’s availability is limited to a ceiling of 91.3
This paper proposes an architecture for Spectrum Access Systems (SAS) integrated with permissioned blockchain technology to enhance security, traceability, and interoperability in the communication among different SAS instances. The approach leverages smart contracts to automate data usage agreements, device registration, and spectrum coordination, replacing traditional Representational State Transfer (REST) interfaces with a distributed and auditable infrastructure. The proposed model is validated through a practical implementation using Hyperledger Besu, demonstrating feasibility and compliance with regulatory requirements. The hybrid solution offers advantages such as data immutability, shared governance, and operational resilience.
The increasing reliance on NoSQL databases in cloud-native and data-intensive applications raises concerns about their long-term dependability. Software aging is a phenomenon that leads to performance degradation or increased failure rates in long-running systems. Although few studies have investigated the effects of aging in relational Database Management Systems (DBMSs), even less attention has been given to NoSQL systems. To address this gap, this paper presents, to the best of our knowledge, the first long-term experimental investigation of software aging in MongoDB NoSQL database. We also introduce the approach called SWCycles, which accelerates aging manifestation through repeated stress-wait cycles. The experiment performed continuous read operations using 500 concurrent virtual users during 48-hour stress periods and 6 wait hours, repeating over a total span of 63.25 d. Memory usage was continuously monitored, and the collected data were analyzed using the Mann-Kendall trend test. The results indicated a statistically significant upward trend in RAM consumption, suggesting the occurrence of memory leaks and fragmentation. Using Kendall-Theil regression, we estimate system failure due to memory exhaustion, after the completion of each stress-wait cycle.
5G networks are designed to support a wide range of applications and services with heterogeneous performance requirements, where Network Slicing enables the creation of logically isolated slices to meet specific Service Level Agreements (SLAs). Resource allocation strategies ensure that the network dynamically and intelligently provisions bandwidth, computing, and storage resources to each slice based on its SLA constraints. However, there is an existing gap in the literature regarding the systematic and comparative evaluation of the performance implications of resource allocation strategies. Within this context, this paper presents a comprehensive and comparative evaluation of SLA compliance for service delivery slices in 5G networks, from the perspective of resource allocation strategies. Results of the experiments performed, using TCP and UDP traffic and KPI collection, show how different policies affect SLA compliance in terms of throughput, delay, and jitter, highlighting the trade-offs between priority, fairness, and spectral efficiency.
Computing systems are becoming increasingly complex, which makes it necessary to monitor and manage resources. However, manually creating monitoring scripts is time-consuming, error-prone, and does not scale well with system growth. This paper presents a tool that proposes the automatic generation and execution of Shell Scripts for monitoring computing resources through a workflow-based visual interface. Using an intuitive GUI (Graphical User Interface), users can drag and configure components to be evaluated within a visual flow editor. Linux monitoring commands have been transformed into high-level visual representations of computing resources, allowing users to create and execute their own scripts to monitor local or remote systems with minimal interaction or coding knowledge. To demonstrate that the application works effectively, we conducted practical tests, provided different use cases, and compared it with other tools on the market. The results demonstrated the tool’s effectiveness, showcasing its ability to create and execute Shell Scripts while continuously simplifying the monitoring process and maintaining a low impact on the system.
Designing distributed systems is complex, presenting challenges like concurrency and fault tolerance that extend beyond understanding business requirements and underlying technologies. Traditional testing often miss unpredictable but critical failures. Alternatively, model checking allows rigorous verification of system properties early in development. This paper aims to combine the rigor of model checking with an easy-to-use approach for the design of distributed systems, where message exchange is ever-present. To address this, we propose a modular TLA+ library for modeling communication primitives over point-to-point and broadcast abstractions. It enables designers to formally describe and verify solutions by providing these primitives as building blocks for communication subsystems. The library includes fault injection for analyzing system behavior under unreliable conditions, such as message loss, duplication, and out-of-order delivery. We formally verified classic atomic broadcast properties for the library’s primitives and demonstrated its practical utility by specifying and verifying the Deferred Update Replication Protocol.
The growing complexity of cyberattacks demands intelligent and adaptive security solutions, one of which is the detection of malicious IP addresses. This paper presents a novel approach for classifying IP addresses by integrating Machine Learning (ML) with data from multiple public threat intelligence databases, where a novel dataset was built. The proposed solution applies a weighted voting mechanism to enhance interpretability and robustness by combining diverse data sources through a multi-criteria weighting strategy. The experimental results, in a real network environment, indicate that the solution enables scalable and automated risk classification of IP addresses.
