Machine learning–based network intrusion detection systems (NIDS) monitor network traffic to identify malicious activity. While NIDS perform well in controlled environments, their effectiveness deteriorates in real-world deployments due to concept drift. As the underlying distribution evolves and new attacks emerge, benign traffic nevertheless remains dominant, so rare and emerging attacks are sparsely observed. This severe class imbalance makes it difficult to identify which data should be prioritized for model adaptation and often leads to high labeling cost, as identifying the few informative attacks requires extensive manual inspection. We present NetGuard, a generative active adaptation framework that enables robust and label-efficient adaptation of NIDS under dynamic network conditions. NetGuard combines density-aware active sampling to identify informative drifted traffic for annotation with deep generative modeling to synthesize diverse, minority-class samples with high-fidelity to expand coverage of rare attacks. By jointly selecting what to label and how to augment scarce data, NetGuard mitigates performance degradation caused by both distribution shift and long-tailed attack distributions. We carry out a comprehensive evaluation of NetGuard across intrusion detection datasets including a large-scale real-world ISP dataset. On average, NetGuard improves overall detection performance by 2×, while achieving 8–15× higher F1 and 4–7× lower false-negative rates for rare and emerging attacks compared to state-of-the-art sample selection baselines, using only 1% labeled data. NetGuard enhances rare attack detection while reducing labeling costs, rendering it scalable and practical for intrusion detection.
Video conferencing has become essential for connecting geographically distributed people. Cross-region video conferencing often employs overlay networks to improve long-haul Internet performance. However, transient packet loss can still occur and break the strict real-time latency requirements. Forward Error Correction (FEC) can recover losses without retransmissions, but existing schemes fail under overlay loss patterns. Our large-scale measurements show that overlay losses are sparse, bursty, and short-lived, with most loss events lasting less than one RTT. Under such patterns, the reactive nature of existing FEC schemes-increasing redundancy only after observing losses-leads to both under-protection during prolonged loss-free intervals and protection lag when short-lived loss events occur. Leveraging these insights, we develop a Zero-Inflated Loss Model that decouples loss occurrence from loss severity, and design Triage, a proactive FEC scheme that speculatively adds redundancy before losses are detected. Triage combines a hierarchical predictor for model parameters with an optimizer that balances video latency penalty against bandwidth cost. In evaluations on a five-region real-world testbed, state-of-the-art reactive schemes exhibit 16.6%--25.3% higher average latency penalty (104.0%--178.0% for P99) than Triage, despite only 1.1%--1.7% lower bandwidth cost.
Cookie banners have become the primary mechanism by which websites obtain consent for tracking and the processing of personal data. Consequently, the disclosures presented through these banners form an important basis for establishing informed consent. Under regulations such as GDPR, consent is valid only when it is informed and specific, requiring websites to clearly disclose essential information, including the type of data being processed. While prior work has mainly focused on banner design choices and stated processing purposes, less is known about whether cookie banners provide sufficient disclosure regarding the actual tracking methods deployed by websites. Given the role of such disclosures in supporting informed consent, we conduct a two-part study to examine the discrepancy between what banners disclose and the tracking behaviors observed on websites. First, using Large Language Models (LLMs), we analyze 33,946 cookie banners from the Tranco Top 100K domains to assess whether tracking is described clearly or vaguely, with 96.8% accuracy. Second, we measure tracking activity after users interact with these banners, including third-party tracking cookies and fingerprinting. Our analysis, based on the 33.9K websites (out of 100K) that displayed cookie banners, reveals that 47.55% of these banners use ambiguous language that blurs the distinction between cookies and other tracking technologies. In addition, we find that among these ambiguous disclosures, 43.36% mention only cookies, omitting other tracking forms. Yet these sites still show extensive tracking---a mean of 2.9 third-party tracking fingerprinting scripts. Critically, rejecting consent does not stop tracking. Among 4,581 sites that withheld third-party cookies, 18.04% still served third-party tracking fingerprinting scripts, with Google responsible for 72.1% of this activity. Finally, regional analysis reveals that Sweden and Germany exhibit the highest levels of post-rejection fingerprinting activity across all disclosure categories, demonstrating a clear gap between established GDPR frameworks and actual technical compliance.
The Proceedings of the ACM on Networking (PACMNET) series showcases top-tier research in emerging computer networks and their applications. We welcome submissions introducing new technologies, innovative experiments, creative applications of networking technologies, and fresh insights gained through analysis. Supported by the ACM Special Interest Group on Communications and Computer Networks (SIGCOMM), the journal is backed by a distinguished Editorial Board composed of leading researchers in the field. This issue constitutes the third issue of the fourth volume of PACMNET and features articles submitted to the December 2025 deadline that underwent a “one-shot major” revision. Originally, more than 90 Editors evaluated each of the December 2025 submissions, coordinated by two Associate Editors. In the initial phase, every article received a minimum of three reviews. For those that advanced to the second phase, the Editors produced at least two additional reviews per article. After a second discussion phase, the Editors met online to decide which articles to accept after a minor revision with shepherding, which to offer a one-shot major revision opportunity, and which to reject. Thirteen articles were offered the one-shot major revision option. Authors received about 3 months to revise their work and prepare a major revision addressing reviewers’ comments and feedback. The same Editors then reviewed and discussed the revised version. After this re-review phase, three articles were rejected, and ten articles were finally accepted and appear in this issue of PACMNET. The articles in this issue showcase the breadth of contemporary networking research, spanning networked systems, transport protocols, Internet measurement, security, and data-plane innovation. Contributions advance the performance and efficiency of modern communication infrastructures through new approaches to forward error correction, congestion control, in-network acceleration, SmartNIC architectures, and high-speed stream processing, while also improving the robustness of transport protocols and programmable hardware. The issue further highlights progress in Internet measurement and operations, including large-scale studies of IPv6 scanning, BGP community semantics, and congestion control in virtualized environments, alongside research on machine learning– driven network security, adaptive intrusion detection, and privacy compliance. Collectively, these works underscore the growing convergence of networking, systems design, measurement, and artificial intelligence in building more efficient, resilient, and trustworthy networked infrastructures. As usual, we would like to express our sincere gratitude to all those who contributed to this issue of PACMNET, especially the Authors for submitting their finest work and the Associate Editors for offering valuable feedback in their reviews and engaging in the discussions. Our thanks also go to the SIGCOMM Executive Committee Chair and the CoNEXT Steering Committee members for their continued support and guidance, providing essential suggestions and insights throughout the article selection process.
BGP communities are essential for inter-domain routing control, but their semantics are often buried in noisy, unstructured operator documentation. Manual inspection and annotation is an laborious process that does not scale. Meanwhile, existing automated methods, mainly relying on regular expressions, cannot reliably interpret semantic meaning or handle placeholder-style formats. We develop an LLM-based framework for extracting high-precision BGP community semantics from heterogeneous operator documentation. Our framework combines format-aware preprocessing to filter community-relevant content from noisy operator documents, schema-guided extraction to generate structured output, and consensus-based aggregation across models to mitigate hallucinations and false extractions. Using a manually-annotated benchmark dataset containing 9,244 community value–meaning pairs, our framework achieves 85-99% precision across different extraction tasks and substantially outperforms prior state-of-the-art methods on placeholder communities and preserving semantic accuracy. Using our framework, we construct one of the largest open-access available BGP community dictionaries, containing more than 29.9K semantically annotated communities across 766 ASes. Finally, we perform the first large-scale analysis of semantic variability in operator-defined BGP communities using our dictionary. We release our code, benchmark, and constructed dictionary to support future research.
Detecting recent heavy hitters, objects that frequently appear in the recent past, is fundamental yet challenging for high-speed and time-varying data streams. Approximation offers memory-efficient detection, albeit with accuracy degradation. To optimize the trade-off, we propose Reef, an efficient and accurate framework that leverages real-world stream patterns for recent heavy hitter detection. Reef models item arrivals to prioritize recent occurrences and dynamically filters out irrelevant objects to lower the detection complexity. We conduct trace-driven evaluation against 12 state-of-the-art studies. Results show that Reef improves the precision of baselines by up to 59.6× and reduces the ARE by up to 99.8% under limited memory.
SmartNICs promise hardware offloading for network applications like traffic analysis and virtual host dispatching. However, due to memory bandwidth limitations, SmartNICs are unable to effectively accelerate applications like intrusion detection and deep packet inspection that require high-speed reassembly. We argue that this limitation is due to an architectural mismatch: variable-sized packets arrive out of order, but a SmartNIC's memory is a contiguous address space broken up into fixed-size pages. This mismatch forces multiple unnecessary copies to translate between the two layouts. We propose a new memory addressing scheme, flow-based addressing, which enables software to access the reassembled payloads of a flow's packets as a contiguous region in memory. Flow-based addressing allows software to easily operate on reassembled payloads without copies, dramatically reducing memory traffic. Eliminating copies entirely requires hardware that maps logical flow offsets to non-contiguous physical addresses and assembles misaligned payloads into contiguous cache lines at line rate. The new memory addressing scheme introduces three architectural mechanisms: a flow translation table, a private flow cache, and a specialized DMA engine that assembles unaligned, variable-length packets into contiguous cache lines. We describe a prototype design on an FPGA-based SmartNIC and show that, across synthetic microbenchmarks, university campus network traffic, and data center web-search traffic, flow-based addressing reduces DRAM bandwidth use by 77-83%, lowers execution time by 25-62%, and increases per-core throughput by 1.33-2.66×.
Large-scale training for distributed Machine Learning can cause congestion at bottleneck switch ports, leading to model staleness through update losses. This is particularly detrimental for asynchronous Distributed Reinforcement Learning (DRL) training, as stale updates are known to degrade convergence performance in asynchronous settings. This paper presents Shesha, an in-network DRL accelerator engine, which opportunistically aggregates asynchronously generated model updates on the fly while they traverse the data plane queue. This aggregation operation motivates an alternative queue design, which we prototype and envision for future Top-of-Rack switches. We further present corresponding host-side transmission control in the face of possible congestion, taking advantage of in-network accelerator feedback. A quantification of model staleness, denoted Age-of-Model (AoM), together with a formal verifier allows us to reason on system-wide AoM objectives in multi DRL-cluster scenarios. Shesha shows significant reductions in model staleness and queue congestion, improving overall convergence behavior for asynchronous DRL workloads.
IPv6's vast address space makes scanning particularly challenging. IPv6 scanners must first discover in-use IPv6 addresses they can target and scan. One way of doing this is by collecting IPv6 addresses from domain names : if a DNS name resolves to an IPv6 address, that address is more likely to be used by an actual live host. In this study, we investigate how IPv6 scanners rely on domain names for target reconnaissance. We set up a large IPv6 telescope to which we attract scanners by placing honey domain names on TLD zone files, CT logs, and the Tranco Top 1M. We introduce a technique to trace the packets that IPv6 scanners send to the telescope back to the initial DNS queries they sent to discover the IPv6 addresses, allowing us to better evaluate how large-scale IPv6 scanners collect and scan addresses. Over a period of six months, we collect 9.4M IPv6 scan packets from 25k addresses in 613 ASes. We find that domain-based IPv6 scanners differ in their address collection strategies, which also correlates with different scanner behavior: scanners that scan addresses hours after collecting them send mostly ICMP traffic, while scanners that resolve domains and scan addresses in one go are more focused on TCP/UDP-many of the latter are also not limited to IPv6 and will fall back to IPv4 if necessary. We uncover that scanners often combine (in particular, open) domain sources to find more targets, and that different domain sources attract different scanners. We also demonstrate that the IPv6 Hitlist is a strong mediating factor when attracting scanners through domain names, which we address by excluding our telescope's address space from the Hitlist. Furthermore, we use our fine-grained packet tracing to detect distributed scanning campaigns involving multiple ASes and to distinguish different scanners within large cloud ASes. Our findings show a diverse landscape of domain-based IPv6 scanning on the Internet: different scanners employ distinct scanning strategies and rely on unique domain sources, which greatly impacts how researchers should study them.
Content delivery networks (CDNs) rely on congestion control algorithms (CCAs) to sustain high throughput and low latency. However, existing CCAs are built around single-flow dynamics and do not match modern CDN workloads, where short-lived flows are prevalent on nodes with heterogeneous network conditions and inter-flow competition is intense as one node has to serve hundreds to thousands of concurrent flows. To address this, we propose NLCC, a node-level congestion control framework that configures a set of static CCA parameters shared by flows on a node and regulates the aggregate sending rate of a node. NLCC is composed of three modules. A kernel-aware sensing module exports runtime metrics of flows to the user space. A constraint-aware Bayesian optimization module automatically adapts key CCA parameters for reducing latency, lowering retransmissions, and maintaining throughput. A node-level rate control module caps the node-wise sending rate by deep reinforcement learning for reducing congestion caused by multi-flow competition. We apply NLCC to BBR and evaluate it in CDN production environments. Compared with BBR, NLCC reduces the average retransmission ratio from 16.62% to 11.26% on small nodes and from 3.68% to 2.66% on IDC servers, while maintaining throughput at 1.58/2.12 Gbps versus 1.54/2.08 Gbps for BBR.
Configuration changes on network devices are a routine task for network operators; however, misconfigurations sometimes cause significant network downtime. Configuration repair aims to safely automate this task by inferring new configuration parameters that satisfy operators' high-level network change intents. Despite its benefit, existing repair tools could introduce unexpected forwarding path changes not described by the change intents (i.e., side effects). These side effects hinder their real-world deployment, as such path changes occur without the operators' awareness. We propose ISR, a new augmentative framework for repair tools to prevent undesired side effects in satisfying network change intents. The key idea is iterative specification refinement: ISR (1) identifies side effects in configurations after repair, (2) generates minimal repair specifications to prevent them, and (3) feeds these specifications back into the next repair. This iterative process guides repair tools to find configuration parameters that satisfy change intents without introducing undesired side effects. We evaluate the effectiveness and scalability of ISR on real network topologies. We first demonstrate that ISR successfully guides three repair tools (SMT/Simulation/LLM-based) to generate configurations that satisfy change intents without introducing undesired side effects in OSPF and BGP networks. Second, the scalability evaluation shows that ISR completes a refinement iteration within seconds for varying numbers of side effects on the topologies with up to 200 nodes.
Machine learning has given encrypted traffic classification a new momentum. Yet, once deployed, models often fail due to hidden shortcut features, i.e., spurious correlations learned from training data that do not hold in new environments. Prior work has shown their negative impact through costly manual intervention. Here, we present ShortcutCatcher, an automated, model-agnostic framework that detects and mitigates shortcuts with the help of explainable AI. The key idea is to contrast model behaviour on two datasets: a large training dataset and a separate verification dataset that differs in scenario but shares the same feature schema. ShortcutCatcher integrates feature explanation with cross-scenario evaluation in a closed loop, iteratively removing those critical features that would not be valid in deployment. Across multiple encrypted traffic classification tasks and model architectures, ShortcutCatcher uncovers shortcut dependencies and improves cross-scenario generalisation, up to three times over standard training. In addition, ShortcutCatcher exposes dataset limitations where collection artefacts act as silent shortcuts that have gone so far unnoticed, allowing us to finally expose realistic performance without assuming that the underlying task is intrinsically easy
Current 5G core networks expose user identities after authentication, allowing tracking and session correlation across home and roaming networks. Prior works to reduce this exposure are impractical as they require mobile device modifications, roaming-partner coordination, or break support for lawful interception. We present PECA, a Privacy-Enhanced Core Architecture that decouples permanent identities from location management using a novel temporary identifier, the Anonymized Mobile Subscriber Identity (AMSI). PECA maintains full compatibility with existing infrastructures, user devices, legacy SIM cards, and network components, enabling seamless integration without requiring standardization or broad ecosystem support. A prototype deployment as part of a 5G testbed demonstrates that a single operator can deploy our system to protect users locally and while roaming with minimal overhead: less than 1% increased session-setup latency, 41~bytes of extra per-subscriber storage, and no impact on data-plane and handover performance. These results establish PECA as a practical, independently deployable solution for stronger privacy in 5G and future generation mobile networks.
Distributed tracing is essential for monitoring and debugging services deployed on top of microservice architectures. However, existing solutions face a fundamental trade-off between non-intrusiveness, language/protocol independence, overhead, and accuracy. We present ChainScope, a distributed tracing system that leverages eBPF to establish a universal tracing framework within the kernel. By implementing kernel-level context propagation, ChainScope enables trace-level sampling in a non-intrusive manner, effectively controlling overhead while maintaining high accuracy across diverse service processing models. Evaluation results show that ChainScope achieves better accuracy-overhead trade-offs than existing non-intrusive tracing approaches with up to 2.2× better accuracy, and 1.6× higher end-to-end service throughput in complex scenarios such as asynchronous processing and RPC (Remote Procedure Call) protocols. Furthermore, we demonstrate that ChainScope accurately identifies the root cause of long-tail latency in a realistic use case.
Efficient hardware-supported packet scheduling is a cornerstone of fine-grained packet prioritization in modern networking systems. Algorithms such as Weighted Fair Queuing and Shortest Job First offer theoretical guarantees for achieving flow fairness and minimal flow completion times; however, their underlying priority-queue operation is difficult to implement at line rate due to its complexity. In this paper, we propose Dancing-Q, a line-rate dynamic approximation of a priority queue that is supported by current hardware and provides optimality guarantees. Essentially, Dancing-Q mimics the packet-sorting operation of a priority queue by distributing packets according to their ranks across multiple dynamically assigned FIFO queues. Key to the optimality guarantee are dynamic queue bounds that map ranges of packet ranks to the FIFO queues which are served using a strict priority scheduler. To minimize rank inversions, i.e., out-of-order scheduling when compared with an ideal priority queue, we introduce a per-queue local optimization strategy that rapidly drives queue bounds to optimal values based on the empirically observed packet ranks. Owing to the per-queue locality and a low memory and computation overhead, this optimization strategy allows prototyping Dancing-Q on programmable switches and SmartNICs. We demonstrate the priority queue emulation of Dancing-Q on a Tofino-based ASIC and use large-scale ns-3 experiments to show that compared to standard methods such as SP-PIFO, Dancing-Q (i) attains the optimal rank inversions, (ii) mimics the queuing delays of a priority queue on a significantly larger rank range, and (iii) curbs large flow starvation. Empirical evaluations show that Dancing-Q minimizes the flow completion time within a 4.4% overhead of the ideal priority queue.
Speeding up webpage loads is a crosslayer optimization problem that depends on webpage structure and network conditions. Yet, traditional HTTP resource prioritization forgoes combining resource dependency and network state data, resulting in varying performance. More sophisticated optimization approaches increasingly incorporate crosslayer data, but they usually gather it a-priori, questioning the practical applicability. We present xPrio, a reinforcement learning-based resource prioritization approach that provides a scalable middleground: it avoids costly a-priori knowledge, but still includes crosslayer data from browser and transport layer signals collected at runtime. xPrio turns this readily available information into actionable resource priorities that avoid detriments of traditional strategies and achieves mean SpeedIndex speedups above 15% on pages of the Alexa Top 500. As such, xPrio can widely improve performance with little overhead in use.
The Resource Public Key Infrastructure (RPKI) is the primary defense against BGP route misorigination. It offers some barriers against origin hijacks, flavors of route leaks, and misconfigurations. Since its deployment in 2011, the adoption of RPKI by Internet Service Providers has shown continuous growth, a trend that persists to this day. As this growth continues it is important to measure its effect on BGP stability. BGP is a chatty protocol with many updates that can result from a single configuration change on one router. For instance, the addition of a new Route Origin Authorization in the RPKI may result in a change in the validity of a route advertised in BGP, and consequently in different routing decisions that are then propagated in BGP. Here we aim to estimate the volume of updates observed in BGP upon such changes. We identify events resulting from ROA changes and estimate the amount of BGP updates observed in a public BGP repository during these events. We observe that as RPKI adoption rises, the volume of updates generated by RPKI-related changes grows at a similar rate. This growth also mirrors the expansion of the routing table, increasing as more address space is announced and protected by RPKI. However, we also have good news: despite this growth, RPKI-induced updates remain only a very small fraction, corresponding to less than 1% of the total volume of updates.
This paper describes and evaluates new techniques for network-originated retransmissions for end-to-end transport connections, yielding performance benefits for encrypted transport protocols in lossy settings. We use set-reconciliation techniques based on the Rateless IBLT to let receivers efficiently acknowledge encrypted packets to a middlebox, without modifying the sender or the underlying wire format. The scheme integrates awareness of in-network retransmissions within transport receivers, which delay some selective-acknowledgment ranges to reduce spurious end-to-end retransmissions. With these tools, transport receivers can receive protocol-agnostic, network-originated retransmissions for encrypted transport connections.
The Proceedings of the ACM on Networking (PACMNET) series showcases top-tier research in emerging computer networks and their applications. We welcome submissions introducing new technologies, innovative experiments, creative applications of networking technologies, and fresh insights gained through analysis. Supported by the ACM Special Interest Group on Communications and Computer Networks (SIGCOMM), the journal is backed by a distinguished Editorial Board composed of leading researchers in the field.
Multipath transport, which simultaneously utilizes Wi-Fi and cellular interfaces, is a promising approach to meet the stringent latency and reliability demands of real-time communication (RTC) applications such as cloud gaming, conferencing, and live streaming. Motivated by prior work demonstrating Quality of Experience (QoE) gains, we developed and deployed a multipath RTC transport using adaptive duplication. However, our large-scale production deployment did not replicate the improvements observed in testbed or emulationbased evaluations, prompting a deeper investigation. To systematically identify deployment bottlenecks, we introduce a seven-layer funnel model spanning user, device, and network layers. To our knowledge, this is the first large-scale deployment study that exposes real-world limitations of multipath RTC transport. Our five-month analysis across 30+ regions in China and over 40 million sessions reveals that sessions with >80% multipath usage achieve a 37.4% reduction in stall rate and a 20.4% decrease in end-to-end (E2E) latency on average. These results show that interpreting A/B outcomes for multipath requires accounting for deployment and session-level activation conditions.
