The accelerated growth of the Internet and smart devices has increased the volume of data generated at the network edge, also raising the incidence of attacks targeting the exploitation of sensitive information. Thus, the relevance and necessity of distributed, efficient Intrusion Detection Systems (IDS) that preserve user privacy become evident. This paper proposes FedPEAC-Net, an IDS based on federated learning that combines an autoencoder and a binary classifier trained in parallel, integrated with a feature selection technique guided by reconstruction error. The adopted methodology involves experimentation with the CICIDS2017 dataset in a federated scenario with 10 clients. The results show that FedPEAC-Net achieves an F1-score of 0.95 before and 0.93 after feature selection, showing only a 2.3% drop, while ResNet and LeNet-5 models showed reductions of 15.6% and 15%, respectively. FedPEAC-Net also achieved the lowest total training time among the evaluated models, attaining 542 seconds over 20 federated rounds, compared to 819 seconds for LeNet-5 and 1742 seconds for ResNet. These results confirm the effectiveness and efficiency of the proposed approach in distributed environments, even with resource-constrained devices.
Rapid global adoption of applications requires robust architectural designs for scalability, latency, and cost-efficiency. This paper presents the architectural transformation of CaieFinder, a search engine for the past papers and mark schemes of Cambridge Assessment International Examinations (CAIE), from a monolithic system to microservices and, ultimately, to serverless infrastructure. Initially deployed on a single virtual machine in a monolithic architecture, CaieFinder faced latency spikes exceeding 300 ms for users outside of Southeast Asia despite serving 7.51 million monthly queries. Transitioning to a microservices-based architecture using Kubernetes-orchestrated Docker containers improved modularity and fault tolerance but introduced orchestration overhead and increased operational costs. Finally, migration to a serverless architecture, i.e., leveraging Function-as-a-Service (FaaS) and edge computing, significantly reduced global response times by $\mathbf{4 4 \%}(\mathbf{1 5 0 ~ m s}$ on average) and lowered cloud computing costs by $9 \%$, while enabling granular auto-scaling and superior fault isolation. We present our real-world deployment data, including latency, cost, and resource utilization, to demonstrate the advantages and trade-offs of each architecture.
The proliferation of Internet of Things (IoT) devices has significantly advanced automation and connectivity across various domains, including smart homes, cities, industry, agriculture, transportation, and healthcare. However, this widespread adoption also presents substantial management and security challenges. In smart home environments, the limited computational capabilities and lack of robust encryption mechanisms in IoT devices make them prime targets for cyberattacks. Accurate identification of IoT devices is essential for implementing effective cybersecurity measures. Previous studies have proposed various approaches for identifying IoT devices; however, these studies are constrained by complex networks under strict conditions, with a small number of IoT devices in the datasets and variations in implementations. This study introduces ScanIoT, an easily deployable data collection framework designed to capture IoT device traffic in smart homes. Using this framework, we collected the Concordia University IoT device identification dataset (CU2025). We also propose a DFNN model that achieves an accuracy of $\mathbf{9 9 . 9 7 \%}$ for the device category classification and 99. 73% for the device classification on the CICIoT2023 dataset. DFNN achieves an accuracy of $\mathbf{9 9 . 9 9 \%}$ on the CU2025 dataset for device classification.
Efficient and secure data processing in heterogeneous networks, such as the Internet of Things, is a challenge for ensuring Quality of Service (QoS) and security. In this sense, applying artificial neural networks for intrusion detection and decision-making faces difficulties related to high computational cost and dependence on labeled data, which is complex and expensive to acquire. This paper proposes a self-supervised approach based on data representation with Bloom Filters as a pre-training step to transform network flows into binary matrices. The proposal extracts latent representations from the data using self-supervised learning, eliminating the need for labels and reducing computational costs. The experimental results demonstrate the effectiveness of the proposed approach. Among the evaluated models, SimCLR and Barlow Twins achieved the best performance, with an F1-score of 0.77 and an AUC of up to 0.86, indicating their potential for building more robust and efficient intrusion detection systems.
With the deployment of Elastic Optical Networks (EONs), fragmentation has often been viewed as a loose proxy for network blocking. In prior work, we examined the correlation between various global fragmentation metrics and blocking rates, revealing that global metrics alone are unreliable predictors of blocking.In this paper, we extend our investigation to assess the predictive capabilities of path-level fragmentation metrics and formalize a novel fragmentation-as-a-picture approach. Through extensive simulations across different network topologies, congestion levels, and connection granularities, we collected comprehensive blocking data. Using this dataset, we trained several machine learning models and found that both path-level metrics and fragmentation-as-a-picture representations significantly improve prediction accuracy.Notably, aggregating path-specific fragmentation values, augmented by statistical descriptors such as kurtosis, standard deviation, and skewness, yields strong predictive performance. Moreover, the fragmentation-as-a-picture approach proves highly effective in predicting the blocking status of individual lightpaths by capturing spatial and structural spectrum patterns in a visual form.
On the internet, tunneling has played an important role. For a long time it has, e.g., been used as part of the IPv4/IPv6 transitioning strategy with tunnel brokers bridging IPv6 islands over IPv4-only infrastructure. Also, VPNs make use of tunnels, providing secure remote access to resources over untrusted networks. And these are just two examples where tunnels are being used.However, tunnels do come with a number of problems and for some time it seemed that tunneling has fallen out of favor. Many corporations e.g. have introduced zero trust models, such as Google’s BeyondCorp, that do not rely on VPNs. Tunnel brokers are becoming increasingly obsolete, with some of the better known ones having stopped operation already, such as SixXS in 2017.But more recently, tunneling seems to experience a certain Renaissance with new tunneling technologies, new use cases and increasing interest by some of the biggest players on the internet. In this paper, we compare two of these technologies and measure their performance, including an implementation of our own, namely MASQUE (CONNECT-IP).
A new family of algorithms for loop-free routing over multiple paths based on path identifiers is introduced. It is shown that different types of path identifiers can be used to attain loop-free routing if total ordering is established among such identifiers. A path identifier can range from the path itself to a succinct representation of it that need not be unique. POLAR (Path-Ordered Loop-free Algorithm for Routing) is presented as an example in which each router labels its shortest distance to each destination with a path identifier consisting of the number of hops and the identifier of the second-to-last hop along its least preferred loop-free path to that destination. POLAR is shown to converge to shortest paths without ever creating loops, and to be able to converge faster than routing protocols like OSPF depending on the type of topology changes taking place in a network.
The growing interest in leveraging the potential of open interfaces and standards brought forth the Open Radio Access Network (O-RAN) specifications, which are becoming increasingly relevant in 5G and 6G Radio Access Networks (RANs). Amongst other features, O-RAN is expected to bring intelligence to 5G and 6G networks by enabling native support for Artificial Intelligence (AI) in the management of the RAN and its control plane. However, AI modules need to be previously trained and evaluated in simulated or emulated network testbeds as not to negatively affect users in real RANs. This separation between initial training and evaluation and the final usage of AI in real network deployments brings many challenges: while the O-RAN specification expects these AI modules to be reusable across RANs, their interfaces, timing, and data models are coupled with those of the RAN, requiring significant re-development effort to make the transition from simulation to real usage. To address this challenge, this work proposes the Open Intelligent Interfaces and Infrastructure Architecture (OI3A), a software architecture to decouple the specifics of RANs and simulators from the AI modules that are trained, evaluated, and used in them. OI3A is evaluated in a realistic proof-of-concept, which considers a use case of Deep Reinforcement Learning-driven MAC scheduling, allowing online training with minimal overhead.
The Metaverse will emphasize the use of 3D, shared, spatial content. To meet Metaverse requirements, networks will evolve to incorporate edge computing and a shift toward information-centric approaches, like Named Data Networking (NDN). A shared Metaverse over NDN requires spatial assets to be synchronized between users via Sync. To ensure users experience low latency while also avoiding unnecessary bandwidth usage, a prefetching approach for assets is necessary. We develop a model and set of algorithms for a prefetching system for both Sync datasets and assets that uses levels of detail to reduce bandwidth usage. Our model validates our simulations, which demonstrate the benefits of our system in reducing unnecessary bandwidth usage relative to a naive prefetching approach while simultaneously maintaining a very high successful prefetch rate.
Multicast routing with Quality of Service (QoS) requirements is considered a non-linear combinatorial optimization problem in network communication. Existing approaches rely on constructing multicast trees to address this issue, which can be reduced to a minimal Steiner tree problem (MStTG) in graphs, proven to be NP-complete. However, these approaches do not ensure stringent QoS, such as end-to-end delay. Consequently, it is crucial to adopt advanced multicast routing strategies. In this paper, we propose a novel bio-inspired optimization method based on the discrete greedy flower pollination algorithm (DGFPA) to solve the delay-constrained least-cost problem of multicast routing. Indeed, our main focus is to determine multicast trees that optimize the cost function while satisfying stringent QoS requirements in terms of delay. Computational experiments on different network settings demonstrate the effectiveness of the proposed DGFPA-based solution in terms of cost and delay performances and its superiority over benchmark methods.
Our research group investigates the potential contribution of edge computing technologies to efficient utilization of wireless communication resources in network environments composed of terminals, wireless access networks, edge servers, and cloud systems. This paper first identifies the conditions under which the utilization of edge servers becomes effective from the perspective of wireless resource efficiency, using an experimental network comprising a local 5G system and a public cloud. Specifically, we analyze communication data collected from the experimental network to evaluate how the processing capability and geographical placement of cloud servers, and application demand details affect the wireless communication resource occupancy time. Furthermore, we employ machine learning techniques on the experimental data to develop and evaluate algorithms that determine the appropriateness of edge server utilization based on network conditions and application demand. Our analysis reveals that the effectiveness of edge server utilization is strongly influenced by the RTT between terminals and cloud servers, the number of data packets transmitted from terminals, and the proportion of data processing conducted at the edge. In addition, we demonstrate that making utilization decisions using machine learning models such as Random Forest and LightGBM result in only 0.1% to 3% increase in average wireless communication resource occupancy time compared to the ideal decision-making scenario.
In the ever-evolving landscape of cybersecurity, the rapid identification and mitigation of Advanced Persistent Threats (APTs) is crucial. Security practitioners rely on detailed threat reports to understand the tactics, techniques, and procedures (TTPs) employed by attackers. However, manually extracting attack testflows from these reports requires elusive knowledge and is time-consuming and prone to errors. This paper proposes FLOWGUARDIAN, a novel solution leveraging language models (i.e., BERT) and Natural Language Processing (NLP) techniques to automate the extraction of attack testflows from unstructured threat reports. FLOWGUARDIAN systematically analyzes and contextualizes security events, reconstructs attack sequences, and then generates comprehensive testflows. This automated approach not only saves time and reduces human error but also ensures comprehensive coverage and robustness in cybersecurity testing. Empirical validation using public threat reports demonstrates FLOWGUARDIAN’s accuracy and efficiency, significantly enhancing the capabilities of security teams in proactive threat hunting and incident response.
In this demo paper, we present CROSS-FLUX, a novel cross-border, semi-virtualized platform designed to integrate real-world testing environments with advanced 5G vehicular network simulations for cutting-edge cybersecurity research. CROSS-FLUX enables the development, testing, and validation of network security solutions by simulating complex 5G vehicle-to-everything (V2X) use-cases involving vehicle communications across borders. The platform is particularly suited for simulating large-scale attacks involving numerous V2X nodes and collecting datasets to develop machine learning (in particular, deep learning) based intrusion detection systems. Our demo highlights its capability in detecting denial of service attacks, showcasing the platform’s ability to combine a real testbed and simulations to comprehensively analyze real-world and simulated network behaviors under various cyberattack scenarios. Using two open-core network implementations to represent different mobile network operators (MNOs), CROSS-FLUX demonstrates seamless interoperability across MNOs in cross-border contexts. This flexible, scalable, and realistic platform facilitates advanced research into vehicular network security and cross-border communication resilience, providing a robust foundation for evaluating security solutions in increasingly complex and interconnected environments.
Accurate unmanned aerial vehicle (UAV) positioning is essential to ensure reliable wireless coverage in areas where conventional infrastructure is limited or unavailable. However, despite several previous attempts to address this problem using reinforcement learning (RL), most approaches focus on learning a single policy, limiting adaptability to changing conditions and unforeseen scenarios. In this context, the present study introduces a novel UAV positioning mechanism based on generative flow networks (GFlowNets) designed to sample multiple high-performing solutions. More specifically, using entropy-regularized RL for GFlowNet training, we develop three implementations of the mechanism using distinct soft-RL algorithms. Our simulation results demonstrate improved exploration, decision-making, and robustness as compared to standard RL-based methods.
The current cybersecurity landscape for many companies, Small and Midsize Enterprises (SMEs), public services, and organizations is experiencing cyberattacks daily due to two main factors: 1) the powerful hacking and system-infiltrating tools generally supported by advanced AI techniques. 2) The incapability of current intrusion detection systems to react dynamically to new cyber threats once they occur. As the literature is rich with new papers proposing Large Language Model-based (LLM) solutions for anomaly detection and threat hunting, they are being used as detection models mimicking traditional machine learning and deep learning techniques without leveraging the full potential of LLMs. This work proposes a substantial addition to existing Generative Artificial Intelligence-based (GAI) Network Intrusion Detection Systems (NIDSs) by reinforcing their detection engine’s rules generation process. We develop a new training method to train an LLM for the automated generation of new rules and propose the Rule Matching Score RuMS to measure the performance of our LLM-based rule generator. We demonstrated that our Llama and Falcon-based fine-tuned models generate NIDS rules respecting their standard field while achieving a $98.9 \%$ of matching scores between the actual and generated rules, while maintaining a minimal memory footprint.
Intent-based networking (IBN) is driven by network assurance principles, aiming to ensure performance reliability through continuous monitoring and automated adjustments. As such, in a data center context, Virtual Machine (VM) resource utilization metrics are critical for predicting network behavior and enhancing network assurance. Yet, each VM presents unique resource usage patterns, which stem from varying statistical properties due to application characteristics, underlying hardware, and user behavior. These variations could lead to a phenomenon known as domain shift in the Machine Learning (ML) field. In this paper, we first introduce the challenge of domain shift in VM resource utilization prediction. We then evaluate the performance robustness of state-of-the-art ML models for VM resource utilization prediction, such as various Recurrent Neural Networks (RNNs), Transformers, Informers, as well as lightweight zero-shot and few-shot approaches. Extensive experimentation in a real-world dataset indicates that the Gated Recurrent Units (GRU) model generalizes more effectively while maintaining a low computational footprint.
Immersive telepresence demands high data rates and low latency, yet no single commercial data path reliably meets these needs. Fine-grained content selection also remains underdeveloped. This work proposes a hybrid, multi-path delivery framework combining broadcast and unicast into a single service. A lightweight base scene is broadcast via File Delivery over Unidirectional Transport (FLUTE), ensuring no viewer ever sees a fully blank scene, while viewer-specific enhancements are steered over unicast. An open-source testbed is released to investigate the impact of network impairments, instrument common protocols, and enable reproducible experiments. On high-quality volumetric video (up to 100k points per frame at 30 frames per second), the hybrid design (i) keeps latency below 40 ms while scaling quality with unicast bandwidth, (ii) reduces server and network load compared to pure unicast, and (iii) masks typical wireless loss patterns with only $15 \%$ Forward Error Correction (FEC) overhead. These findings show that treating broadcast and unicast as complementary channels is crucial for scalable Extended Reality (XR) services.
Real-time streaming of volumetric video requires low latency and high bandwidth, making it hard to scale efficiently with unicast delivery alone. This work presents a multi-path transport framework that combines broadcast and unicast to enable scalable, bandwidth-efficient delivery of interactive volumetric content. A base layer is transmitted via broadcast using File Delivery over Unidirectional Transport, while enhancement layers are fetched on demand via Dynamic Adaptive Streaming over HTTP based on the viewer’s viewport. The approach reduces redundant transmissions and enables fine-grained adaptation without compromising interactivity. An end-to-end implementation is demonstrated with real-time viewport tracking, dynamic quality switching, and live monitoring under varying bandwidth constraints, improving reliability, achieving sub-40 ms latency and reducing per-client unicast load by $18 \mathrm{Mbps}(15 \%)$ per object at the highest quality.
The Internet of Things (IoT) is highly susceptible to cyberattacks due to its vast attack surface and the limited security capabilities of connected devices. These devices are often resource-constrained, lacking the computational power, memory, and energy capacity to support conventional anomaly detection methods. To address this challenge, we propose a lightweight and energy-efficient anomaly detection framework based on Tiny Machine Learning (TinyML). Our approach employs a quantized neural network, enabling real-time detection while operating within the tight resource budgets of IoT edge devices. The model achieves a $\mathbf{9 1 . 6 5 \%}$ reduction in model size and a $\mathbf{4, 4 9 2} \times$ speedup in inference time, with only a minor drop in performance, maintaining $93.99 \%$ accuracy and strong F1-score results with $\mathbf{9 6 . 7 1 \%}$. This work demonstrates the feasibility of deploying sustainable, on-device AI for IoT cybersecurity and provides a detailed evaluation of the trade-offs between detection accuracy and energy efficiency.
Evaluating the performance of 5G Core network deployments in public cloud infrastructures is critical to understanding the optimization potential of next-generation networks in virtualized environments. This paper systematically examines the deployment of 5G-based Service Function Chains (SFCs) on Amazon Web Services (AWS), focusing on both the benefits and the inherent challenges of operating within such a platform. Through a comprehensive performance analysis covering metrics such as average throughput, packet loss, and bandwidth efficiency, the study provides an in-depth assessment of 5G core functions across a range of use-case scenarios. The findings ultimately demonstrate that AWS is a viable and adaptable platform capable of supporting high-performance 5G deployments under diverse workload conditions.
