Diagnosing performance degradations in 5G networks remains challenging due to the limited visibility of internal RAN behavior in open-source deployments, where radio impairments, such as interference, directly affect performance and are difficult to observe. This demo presents a real-time RAN observability framework for open-source 5 G systems and demonstrates its effectiveness under controlled radio interference. The solution extends Monarch's existing cloud-native monitoring stack with a non-intrusive, Prometheus-compatible telemetry pipeline for the OAI gNB, exposing fine-grained, per-UE metrics from the physical, MAC, and RRC layers and visualizing them live in Grafana. The system is deployed automatically using an Ansible-based framework and validated on a controlled testbed with real radio hardware, where interference-induced effects can be observed and correlated in real time, enabling rapid and practical diagnosis of RAN performance degradation.
Remote operation and infrastructure-supported driving expand vehicular perception and control through distributed communication between vehicles, infrastructure, and control centres. However, this also creates the need for a cybersecurity management framework that can satisfy the requirements of the cloud and edge environment, as well as rapidly emerging adversarial AI attacks. Since communications between participants in both scenarios can be modulated as data streams, a hybrid data stream-based cybersecurity management framework extending the GALOIS architecture that satisfies requirements is proposed. So far, no concept has been proposed to model a cybersecurity management framework based on a distributed data stream processing architecture that takes into account the interoperability of the different devices in particular. Our results show that real-time analysis of adversarial attacks is feasible but needs a redesign. Our introduced online detection operator outperformed the classical offline detection by 584.3% in latency time.
Diagnosing performance issues in 5G and future disaggregated networks remains challenging due to the complexity of the protocol stack and the multitude of interdependent metrics. This is especially true in experimental environments using open-source 5 G software, where logs are often verbose, fragmented, and difficult to interpret. Real-time visual observability, especially at the Radio Access Network (RAN) level, is therefore essential for effective troubleshooting. However, tools like 5GC-Observer and Monarch provide only partial support, focusing mainly on the core network and lacking visibility into the RAN, where many performance bottlenecks originate. To tackle this, we present a Prometheus-compatible telemetry pipeline for the OpenAirInterface (OAI) gNB that extracts RAN metrics, adjusts acquisition intervals via a custom FlexRIC model, and visualizes the data in real time with Grafana. The pipeline is also compatible with SRSRAN through a lightweight Telegraf-Prometheus integration, extending its use to multiple open-source stacks. We integrate our solution into the Monarch monitoring architecture for cloud-native 5G, enabling end-to-end observability. An Ansible-based automation simplifies testbed setup and ensures reproducible experimentation. Validation on a realistic testbed shows real-time RAN metrics exposure with negligible overhead.
Enhancing the user experience for students and researchers on university networks is a top priority of network administrators, as it directly impacts academic performance in classrooms and laboratories. The goal is to ensure that the online experience is so seamless that students and faculty forget they are on a managed network at all. A key determinant of network performance is the efficiency of traffic routing. Optimizing routing mechanisms can significantly improve user experience by alleviating issues, such as congestion, as well as minimizing packet loss. In this paper, we propose the primary steps for exploiting network digital twins as a powerful tool to fine-tune routing schemes by optimizing routes at the flow level. The proposed framework establishes a virtual environment where routing metrics defined by the administrator's Service Level Agreement (SLA), such as flow-level round-trip time, can be tested and analyzed before deployment, enabling network optimization tailored to specific performance requirements. Furthermore, we demonstrate how deploying a digital twin to enhance flow-level routing can address the limitations of traditional approaches, such as Open Shortest Path First (OSPF), by providing greater flexibility and adaptability to dynamic network conditions.
Cloud, Internet, and network infrastructures are now tightly integrated, making experimental research increasingly dependent on advanced technical expertise and real-system deployments. As a result, purely theoretical evaluations are often insufficient to capture real-world behavior. This shift has driven the rise of data-driven research, where hypotheses are validated using high-quality experimental data. However, such data are frequently retained by their producers, limiting reproducibility and reuse. The EU SLICES-RI project addresses this challenge by providing a scientific platform that supports reproducible, large-scale experiments on state-of-the-art hardware and software and enables the systematic sharing of experimental data and metadata across the research community. This demo presents the SLICES-RI Data Management Infrastructure and its Metadata Registry System, demonstrating how lightweight tools can be used to efficiently publish and share experimental results. This Metadata Registry System has already been adopted by other European projects, such as Converge, 6GXCEL, and 6G-Sunrise.
Vehicle-to-Everything (V2X) systems increasingly depend on low-latency perception pipelines that must operate efficiently across the cloud-edge-vehicle continuum, often under constrained embedded hardware. While Convolutional Neural Networks (CNNs) achieve strong accuracy on high-end platforms, their performance shifts significantly in edge environments due to limited CPU parallelism, memory bandwidth bottlenecks, cache pressure, and degraded sensor input quality. Building on our earlier offline evaluation of state-of-the-art detectors, this study investigates the real-time deployment feasibility of representative single-stage and two-stage CNN architectures, specifically for vehicle detection, on embedded $\mathbf{V} 2 \mathbf{X}$ compute nodes, including near-edge Roadside Units (RSUs) and far-edge in-vehicle platforms. Empirical results reveal a pronounced divergence: lightweight single-stage models sustain real-time performance by leveraging compact activation flows and shallow feature hierarchies, while region-based and deeper networks incur severe latency overheads due to memory-bound operations and constrained instruction-level parallelism. Our deployment-based measurements underscore the limits of complex perception models at the edge and emphasize the need for a re-architected V2X perception stack that balances model complexity with hardware constraints, sensor fidelity, and cooperative sensing capabilities.
The Asset Administration Shell (AAS) is a promising approach to integrate Information Technology (IT) and Operational Technology (OT) as it implements the concept of a Digital Twin (DT) of a manufacturing plant, thus enabling monitoring and interaction with the assets in an Industry 4.0 scenario. However, its role as a DT for the modeling and management of OT network connectivity as a factory asset remains underexplored. In this paper, we propose a solution whose goal is twofold: i) modeling both production assets and the OT network using AASbased digital twins to provide a unified visibility and automated management; ii) incorporating machine learning-based traffic fingerprinting and profiling to provide automated management policy enforcement. We showcase the proposed approach with traffic traces from a real-world production plant, comparing traffic classification and profiling techniques. Achieved results show that it is possible to identify the industrial machines in the OT network with reasonable performance metrics.
Modern cloud datacenters require per-tenant Service Level Agreement (SLA) enforcement for bandwidth allocation and latency guarantees, yet existing Active Queue Management (AQM) approaches guarantee only flow-level fairness, failing to enforce contracted bandwidth ratios. This architectural mismatch between per-tenant billing and per-flow fairness causes systematic SLA violations where tenants opening more flows receive disproportionate bandwidth, requiring manual intervention that cannot scale to thousands of tenants. We present TAQM (Tenant-Aware Active Queue Management), combining per-tenant queueing with weighted fair scheduling for superior tenant-level fairness, and Linear Quadratic Regulator (LQR) control using a novel CUBIC TCP model for autonomous queue optimization. NS-3 evaluation shows TAQM achieves up to 24% better tenant fairness (0.92 vs 0.73 weighted Jain's fairness index) through weight-based enforcement while LQR control autonomously reduces queue occupancy by 51% and delay by 61%. TAQM delivers an autonomous, tenant-aware AQM with superior fairness guarantees and performance isolation.
Typosquatting and phishing attacks are increasingly sophisticated cyber threats that exploit user typing errors and social engineering techniques. With the advent of Large Language Models (LLMs), attackers can now generate phishing content comparable to that produced by human experts, achieving click-through rates of $\mathbf{5 4 - 5 6 \%}$. This paper proposes a systematic evaluation framework for analyzing emerging AIpowered attack vectors and developing robust countermeasures. The proposed comprehensive detection framework, TypoGuard, addresses these challenges through automated variant generation, multi-dimensional threat analysis, and adaptive risk scoring. The system incorporates a modular generation engine implementing twelve variation algorithms, including bitsquatting, homoglyph substitution, internationalized domain names (IDN) manipulation, and character-level transformations, alongside a multi-dimensional analysis pipeline that integrates DNS resolution, WHOIS registration data analysis, MX record validation, geographic IP analysis, Trend Micro Locality Sensitive Hash (TLSH)-based HTML similarity computation, and GPT-4o-powered automated screenshot comparison. Empirical validation on 1,440 real domain variants across five major brands demonstrates 92% detection accuracy, a $30-40 \%$ reduction in false positives, and an 80% reduction in manual analysis time.
This study aims to clarify the interconnection structure of National Research and Education Networks (NRENs), which support international research collaboration. Despite their critical role, the global topology, geographical distribution, and routing behavior of NRENs remain poorly understood due to limited observability and the complexity of inter-domain operations. Operators manually manage many inter-NREN connections through community-based coordination, resulting in increased communication overhead and operational effort. To address this issue, we analyze traceroute data from RIPE Atlas probes deployed in 11 NREN Autonomous Systems (ASes) as a first step toward understanding the interconnection structure of the Asia-Pacific (APAC) region. We identified 140 AS border routers and estimated their geographical locations, showing that 78% could be mapped to specific cities. The analysis also detected 29 asymmetric AS paths among the 11 NRENs, as well as two additional cases where AS paths were symmetric but physically routed through different locations. These results demonstrate that data-plane measurements can enhance the transparency of NREN interconnections and reveal hidden routing asymmetries, thereby supporting more efficient and collaborative network operations.
Software-Defined Network (SDN) offers increased programmability and flexibility but also presents security vulnerabilities due to the centralized nature of its control plane. SDN controllers are particularly vulnerable to Distributed Denial-of-Service (DDoS) attacks, which can degrade network performance or disrupt services. To address these challenges, this article proposes a distributed DDoS attack detection framework that preserves data privacy based on Federated Learning (FL) and a hybrid XGBoost-Deep Neural Network (DNN) model. In the proposed approach, each Ryu controller acts as a federated client that locally collects traffic data, performs feature selection using XGBoost, and trains a DNN classifier without sharing raw data. Only the model parameters are exchanged with a central aggregation server, ensuring data privacy while enabling collaborative model improvement. Experiments conducted on a private SDN dataset generated using Mininet/Ryu demonstrate the effectiveness of the proposed framework. The model achieves 99.57% accuracy, 99.57% F1 score, 99.84% AUC-ROC, 0.03% False Negative Rate (FNR), and an inference time of less than 8 seconds on five federated clients.
Detection of Global Positioning System (GPS) spoofing is critical for UAV safety and autonomy under tight resource and energy budgets. We present a lightweight, carbon-aware machine learning (ML) pipeline using receiver-level Global Navigation Satellite Systems (GNSS) features (e.g., latitude, longitude, altitude). Leakage-aware evaluation restricts scaling, RFECV, and tuning to stratified $K$-fold CV on the train-validation split; the test set is used once. We benchmark Logistic Regression (LR), Ridge Classifier, Stochastic Gradient Descent (SGD), and linear Support Vector Machine (SVM) as linear baselines, alongside Gaussian Naive Bayes (NB) as a lightweight probabilistic alternative, measuring accuracy, latency, energy, and $C O_{2}$ with CodeCarbon. On a UAV dataset with 19 features, several lightweight models achieve near-perfect accuracy under this leakage-aware scale-RFECV-tuning workflow, showing receiver-level signals are highly informative for spoofing detection. We further define a lightweight operating-point $k_{\mathrm{L}}$ as the smallest feature subset within 0.5 percentage points of the RFECV optimum $k^{*}$, enabling real-time deployment with fewer features, lower complexity, and reduced emissions.
The widespread adoption of containerized microservices has made Kubernetes the de facto standard for managing modern cloud-native applications. Despite Kubernetes's advanced features, it presents steep usability hurdles for users, even during common tasks such as workload specification and deployment. These challenges arise from fragmented workflows, a lack of usability-oriented design, and a reliance on low-level configuration languages such as YAML. To address these challenges, we present an Adaptive Container Orchestration Framework (ACOF) that aims to streamline the management of containerized workloads by offering guided workflows and integrated instant performance monitoring in a simplified interface. ACOF supports the full deployment lifecycle while reducing dependency on command-line expertise and exposing the internals of distributed clusters to users. We evaluated the usability aspects of ACOF through a mixed-methods study. Results from task completion analysis, the System Usability Scale (SUS), and post-study interviews highlight improvements in usability and efficiency.
In recent years, a number of edge computing platforms have been proposed to process data produced by IoT sensors. Performing computation close to the sources of data allows faster insight and greater reliability at a lower cost compared to traditional cloud-based deployments. However, designers of IoT/edge platforms face difficult issues. In particular, exercising and testing a new platform in conditions that approach a real deployment requires a sufficient number of standard benchmarking systems capable of generating realistic workloads. In this paper, we propose LivingBench, a benchmarking tool with the capability of incorporating real or synthetic workload injection, developed to exercise edge computing systems. LivingBench integrates a real-world data trace captured in an environmental observatory, together with a collection of actual applications designed for processing these data, and a load injector tool capable of replaying a (possibly pre-processed) trace to benchmark an MQTT-based edge system. We describe the architecture of LivingBench and show how it may be used to evaluate the maximum data processing capacity of an edge system under test.
Software-Defined Networking (SDN) significantly enhances network programmability and configuration flexibility by separating the control plane from the data plane. However, its centralized control architecture also introduces new security vulnerabilities, making the controller a prime target for Distributed Denial-of-Service (DDoS) attacks. Although machine learning (ML)-based approaches demonstrate outstanding performance in enhancing attack detection accuracy-especially XGBoost, which shows outstanding capabilities in both accuracy and computational overhead, they often face critical challenges: deploying models on controllers or switches can introduce detection latency or significant computational overhead, while models deployed on edge devices suffer from insufficient labeled training data and weak detection capabilities against emerging attack patterns, finally XGBoost does not perform well with small training dataset size. To address these issues, this paper proposes a Self-Organizing Map (SOM)-based continuous XGBoost learning approach (SCX). SCX is deployed on edge devices, enabling real-time model learning and updates using unlabeled network traffic and addressing the performance decline of XGBoost with insufficient training data. Experimental results show that SCX's accuracy is improved to 99.91% and the F1 score is improved to 99.93%, proving SCX can effectively achieve optimal detection performance. Through comparison, SCX outperforms existing mainstream models in detection accuracy.
Network operators are gradually evolving “telco cloud” infrastructure to deeper edge locations to service a range of network-oriented workloads. To maximise the return-of-investment of such edge compute, additional workload and application types can be considered to run on such infrastructure. Large Language Model (LLM) inference is one such candidate application, however LLMs are potentially very compute resource intensive, and the way in which they consume resources must be subject to careful attention. Achieving a suitable balance of power and performance for such workloads within what may be a particularly constrained resource envelope at the edge, is a significant challenge. This challenge must also consider actual performance targets of the LLM workload itself: is “good enough” performance acceptable if it reduces costs? This may be achievable in cases where more standard CPU-based computing hardware is used in favour of expensive GPUs. Our experiments reveal that although GPU-based cases perform best, there were some very respectable CPU-based results when CPU pinning to the same processor socket was involved; 18 Tokens Per Second and sub-second Time-to-First Token values were observed. We outline the rationale not just for multi-tenant LLM instances to maximise edge server efficiency, but also the prospect of differentiated LLM performance based on allocated resources.
Vehicle-to-Everything (V2X) communication enhances road safety and efficiency, but sparse terrestrial roadside units (TRSUs) and fast highway mobility cause transient coverage gaps. Unmanned Aerial Vehicles (UAVs) can complement TRSUs by providing flexible, line-of-sight connectivity and on-demand coverage extension. Existing UAV-aided solutions mainly optimize instantaneous coverage, ignoring sustained connectivity. We propose HOVER, a mobility-aware UAV placement strategy that maximizes vehicle-infrastructure association time under 3GPP-based access and backhaul constraints and addresses the UAV placement via particle swarm optimization (PSO). In simulation, HOVER outperforms two recently proposed UAV placement strategies, namely UAV-IoV and MOURD, achieving a $\mathbf{1 6 - 2 3 \%}$ CPM (collective perception messages) delivery gain, maintaining sub-millisecond latency, and reducing UAV movement by up to 45%, demonstrating enhanced reliability and energy efficiency.
A holistic solution for intrusion detection in Kubernetes clusters is presented, combining multi-layer monitoring with selective LLM-based analysis. Statistical and rule-based detectors first identify suspicious activity and selectively trigger on-demand LLM reasoning to estimate threat probability and classify attack behavior, producing natural language explanations. The system is validated using realistic attack scenarios such as network flooding, port scanning, authentication abuse, and privilege escalation on vulnerable containerized services, demonstrating how cross-layer threat indicators and selective LLM reasoning support accurate security incident interpretation.
The emergence of 6 G networks introduces unprecedented demands for deterministic, ultra-reliable, and low-latency communication (URLLC) across diverse service domains such as autonomous mobility, industrial automation, and immersive applications. Achieving these requirements within the disaggregated and multi-vendor Open Radio Access Network (O-RAN) architecture remains a major challenge, particularly due to the dynamic nature of radio conditions and transport-layer variability. This paper proposes a proactive, AI-native latency control framework for O-RAN-based 5G/6G networks, targeting deterministic ultrareliable low-latency communication (URLLC) under heterogeneous traffic conditions. Unlike prior reactive or slice-static approaches, the proposed architecture embeds predictive latency modeling and semantic policy reasoning directly within the near-real-time RAN Intelligent Controller (RIC), enabling anticipation and mitigation of end-to-end delay violations before they occur. Through an experimental testbed based on the O-RAN Software Community (OSC) stack, srsRAN, and an open 5G core, the proposed approach demonstrates a consistent reduction in tail latency and hybrid automatic repeat request (HARQ) deadline violations compared to conventional O-RAN scheduling. The results confirm that embedding network intelligence and semantic control within the O-RAN control loop can achieve reliable sub-5 ms communication performance, offering a practical pathway toward AI-native, latency-deterministic 6 G systems.
The problem of optimal sensor placement for wireless sensor networks within a given two-dimensional area has been investigated numerous times under a myriad of proposed solutions. These solutions commonly address key performance metrics such as coverage, connectivity, and adaptability, often in isolation or in a limited combination. However, few approaches have explicitly targeted these criteria within a unified algorithmic framework. This paper introduces a nature-inspired hybrid algorithm that leverages the strengths of Particle Swarm Optimization (PSO), Genetic Algorithm (GA), and an embedded Ant Colony Optimization (ACO) component. The ACO module guides the fitness function through pheromone-based incentives tied to sink node connectivity, while PSO and GA drive exploitation and exploration, respectively, through a tiered swarm strategy. The algorithm maintains a fixed structural core with tunable fitness weights to accommodate varying space sizes and prioritydriven coverage demands. Performance is evaluated on two benchmarks: one that features a field of randomized targets with equal priority and another that features randomized targets with different levels of priority. Using a constant sensor node count and bounded sensing and communication ranges, the algorithm achieved 100.0% connected 3-coverage of all available targets in both benchmark tests with a 25 m sensing range and a 50 m communication range. These results were frequently achieved with a maximum of 30 iterations in all runs. These results demonstrate the adaptability, scalability, and reliable performance of the algorithm, establishing a solid foundation for future work in energy-aware data transmission and intelligent sensor network optimization.
