Detecting deviations in building time series data is essential for robust heating, ventilation, and air conditioning (HVAC) operation and energy-efficient facility management. In practice, however, building management system (BMS) data are often incomplete, heterogeneous, and lack reliable fault labels.This paper presents a benchmarking and feasibility study of data-driven anomaly detection on multivariate air-handling unit (AHU) time series data under realistic deployment constraints. We construct a unified dataset and define a domain-informed rule-based baseline as an interpretable operational reference and source of weak labels. We further evaluate classical unsupervised methods and representation-learning approaches using Temporal Convolutional Network (TCN) and Time Series Mixer (TSMixer) autoencoders, considering both a joint multivariate representation of all selected sensors and subsystem-based representations in which sensors are grouped by AHU function. Additionally, SHapley Additive exPlanations-based (SHAP) attribution is used to improve interpretability by identifying the sensor-level contributions to detected deviations.The results show that rule-based methods capture explicitly defined conditions, while data-driven approaches identify additional statistically unusual and temporally structured deviations, with representation-learning models flagging 1.1–1.4% of windows in the global setting and up to 4.7% in subsystem-based analyses. High-consensus events (~0.8%) occur during temporally localized episodes with agreement across multiple models, indicating robust, structured deviations. These detections represent candidate anomalies that require further validation. Our results show that combining rule-based, classical, and representation-learning methods provides complementary insights into AHU behavior and helps screen for relevant deviations in performance and energy use.

Phishing remains one of the most pervasive cybersecurity threats, often countered with deep learning and reference-based systems that are computationally expensive and difficult to scale. PHISHGRAPH is a lightweight framework that achieves state-of-the-art performance using only the structural information contained in webpages' HTML content. It models webpages through complementary Document Object Model (DOM) and Hyperlink graphs, from which it extracts structural, entropy-based, and link-level features. Across public benchmarks, shallow tree-based models (e.g., XGBoost) reach $\approx \mathbf{9 9 \%}$ recall in cross-validation and 95% precision/93% recall under out-ofdistribution (OOD) evaluation, while running over an order of magnitude faster than modern generative-AI, reference-based detectors. PHISHGRAPH is extensively benchmarked against 13 deep-learning and reference-based models, demonstrating on-par or superior detection performance across datasets and model families. The use of simple graph-derived features enables interpretability, with SHAP analysis confirming that dominant signals such a link diversity and structural information align with established phishing patterns. PHISHGRAPH shows that HTML graph simplicity can outperform complex architectures, offering a fast, explainable, and scalable solution for real-time phishing defense.

Phishing remains the most pervasive threat to the Web, enabling large-scale credential theft and financial fraud through deceptive webpages. While recent reference-based and generative-AI-driven phishing detectors achieve strong accuracy, their reliance on external knowledge bases, cloud services, and complex multimodal pipelines fundamentally limits practicality, scalability, and reproducibility. In contrast, conventional deep learning approaches often fail to generalize to evolving phishing campaigns. We introduce SpecularNet, a novel lightweight framework for reference-free web phishing detection that demonstrates how carefully designed compact architectures can rival heavyweight systems. SpecularNet operates solely on the domain name and HTML structure, modeling the Document Object Model (DOM) as a tree and leveraging a hierarchical graph autoencoding architecture with directional, level-wise message passing. This design captures higher-order structural invariants of phishing webpages while enabling fast, end-to-end inference on standard CPUs. Extensive evaluation against 13 state of the art phishing detectors, including leading reference-based systems, shows that SpecularNet achieves competitive detection performance with dramatically lower computational cost. On benchmark datasets, it reaches an F1 score of 93.9

Predictive maintenance is essential in the wind energy sector due to the high costs and complexity of maintaining wind turbines operating in remote and harsh environments. This paper presents a proactive fault detection framework for wind turbine generators (WTGs) to enable early intervention, improve reliability, and minimize downtime associated with generator failures. The study is based on six years (2019–2024) of SCADA measurements from a wind farm with 10 WTGs in Greece, where generator failures account for a significant portion of major component breakdowns. The proposed approach leverages well-known shallow learning models, including the Quantile Regression Model (QRM), CatBoost, XGBoost, and LightGBM, to predict the normal operating range of generator bearing temperature using covariates derived from current and future SCADA signals. Anomalies are identified by analyzing the residuals between predicted and observed temperatures within a sliding window framework. The paper details critical preprocessing steps, such as filtering out data during and after failures and considering only effective wind speed and power production conditions. The experimental evaluation assesses the performance of different models in generator bearing temperature prediction and anomaly detection, emphasizing the impact of post-processing techniques on detection accuracy. The results demonstrate the effectiveness of the proposed approach in identifying early warning signs of generator failures but also indicate the current challenges due to low precision.

Cybersecurity increasingly requires advanced methods to identify and counter threats arising from resource misuse. A key challenge is abuse detection, which focuses on distinguishing between benign and malicious interactions that could lead to exploitation. Bipartite graphs provide a versatile framework for modeling such problems, particularly when interactions occur between distinct entity types, broadly categorized as users and resources. In these heterogeneous representations, nodes correspond to users and resources, while edges depict interactions that could signal potential malicious behavior. One relevant abuse detection application for this representation framework is the problem of review bombing, a form of online abuse where users leave abnormally low ratings on products for reasons unrelated to their quality - e.g., Amazon reviews are vulnerable to review bombing. This phenomenon, often driven by political or cultural motivations, distorts product perceptions and marketplaces. Traditional approaches, such as NLP-based methods focusing on the content of reviews, struggle to capture the relational and temporal patterns inherent in review bombing behavior. In this paper we propose BRIDGE - Bipartite Review bombIng Detection using Graph nEural Networks (GNNs), an approach to review bombing detection based on temporal GNNs. By modeling review data as a bipartite graph, BRIDGE analyzes temporal relationships between users and products while incorporating sentiment extracted from review text analysis. BRIDGE leverages the dynamic and relational properties of bipartite graphs to effectively identify abusive behavior, building on previous work on spatiotemporal GNNs for abuse detection. The central complexity we tackle is the large-scale, highly imbalanced topology of the bipartite representations, which consists of hundreds of thousands of users and only tens of products. Empirical results on the analysis of a real, large scale review bombing dataset from the popular gaming platform STEAM show that BRIDGE realizes high detection performance of publicly exposed review bombing cases (AUROC values above 96%), outperforming more traditional approaches based on temporal GNNs by as much as 30 %.

The rapid expansion of the Internet has enabled cybercriminal operations at unprecedented scale. A recurring tactic is the use of algorithmically generated domains (AGDs) created by domain generation algorithms (DGAs) to orchestrate botnet command-and-control, host phishing content, and distribute malware. Traditional defenses such as blocklists and heuristic rules are brittle against new domains and evolving attacker strategies. We present DeepDGA, a hybrid deep learning architecture that fuses character-level and word-level representations to detect both pseudo-random and dictionary-based DGAs. Character-level embeddings processed by a BiLSTM capture subword patterns and entropy; word-level embeddings derived from a dom2words tokenization and Word2Vec capture linguistic regularities exploited by dictionary-based DGAs. Evaluations on a public benchmark with more than 670,000 domains, including 25 DGA families and benign top-popular domains, demonstrate the superiority of DeepDGA. The model achieves precision and recall above 0.97 for dictionary-based DGAs, and even higher (above 0.98) for pseudo-random DGAs, consistently outperforming state-of-the-art methods across multiple metrics. DeepDGA’s effectiveness, particularly in detecting the more challenging dictionary-based DGAs, highlights the benefit of combining diverse embedding strategies into the same deep learning architecture.

Reference-based approaches have risen to prominence in phishing detection, attributed to their aptitude for extracting brand intention, performing comparisons with established references, and utilizing advanced tools. Despite their notable success, such methods are typically underpinned by highly specialized frameworks that are sophisticated yet burdensome in terms of scale, technological requirements, and cost, factors that substantially hinder their practicality, scalability, and maintainability. In this paper, we revisit the necessity of reference-based techniques and contend that the under-performance of conventional machine learning (ML) algorithms stems not from the absence of references, but from inherent model limitations. To this end, we propose a graph neural network (GNN)-based approach that capitalizes on the intrinsic properties of webpages, the domain and the document object model (DOM) tree hierarchy. We formalize a binary classification problem, and our model achieves competitive performance without relying on intricate architectures or unattainable resources/infrastructures, in contrast to reference-based counterparts.

We present TSGFM, a Time Series Graph Foundation Model for network monitoring data analysis, based on spatiotemporal Graph Neural Networks (GNN). Inspired by the success of foundation models in achieving generalization and adaptation, TSGFM leverages pretraining on diverse multivariate timeseries (MTS) data from multiple domains to enable effective zero-shot analysis in network monitoring tasks. We compare TSGFM performance against five state-of-the-art AI/ML models in seven zero-shot forecasting scenarios, using five MTS datasets from different domains. Evaluations demonstrate that TSGFM achieves superior performance in six out of seven zero-shot testing scenarios. Most notably, in zero-shot network monitoring analysis, TSGFM surpasses all competing models by at least 18%, even without training on any network monitoring data.

User association is crucial for optimizing the performance and utility of wireless networks, enhancing key aspects such as load balancing, spectrum efficiency, energy efficiency, and overall network performance. In this paper we tackle the user association challenge in wireless networks, particularly in resource-constrained connectivity scenarios. Our proposed approach, GROWTh (Graph Representation of Wireless systems Throughput fair), introduces a graph-based reinforcement learning framework that optimizes resource utilization through a fully decentralized algorithm. We validate GROWTh across diverse scenarios, including a 5 G deployment in densely populated areas characterized by high user density and traffic load, where it demonstrates significant improvements in various performance metrics. Notably, GROWTh achieves a substantial increase in system utility compared to traditional methods while simultaneously reducing user rejection rates. These findings highlight the effectiveness of GROWTh in managing user association in high-density environments and underscore its potential for real-world deployment.

We present TSGFM, a Time Series Graph Foundation Model for zero-shot network monitoring, leveraging spatiotemporal Graph Neural Networks (GNNs) to extract transferable representations across diverse multivariate time series (MTS) domains. Pretrained on heterogeneous time series datasets, TSGFM enables generalization without task-specific fine-tuning, addressing core challenges in dynamic network environments. TSGFM is benchmarked across five real-world MTS datasets and seven zero-shot forecasting scenarios, outperforming five state-of-the-art baselines in six out of seven tasks. Most notably, in zero-shot network monitoring analysis, TSGFM surpasses all competing models by at least 18%, even without any prior exposure to network monitoring data. We further compare TSGFM against leading Time Series Foundation Models (TSFMs), including TimeGPT and TimesFM. TSGFM achieves performance on par with TimeGPT, occasionally surpassing it, and consistently outperforms TimesFM, while using significantly less pretraining data and relying on a much simpler architecture. A detailed analysis of TSGFM’s learned spatial attention patterns reveals domain-specific connectivity structures. In particular, lower attention weights in network monitoring tasks suggest that dense spatial graphs may be unnecessary, opening opportunities for efficient spatial pruning without sacrificing accuracy. This challenges prevailing assumptions favoring fully connected spatiotemporal GNNs. To foster transparency and reproducibility, we release the complete implementation of TSGFM as open source, as well as the tested datasets.

We introduce GNN4Alloc, a learning-based framework for resource allocation in highly distributed Content Delivery Networks (CDNs). Focusing on the core challenges of content placement and routing, GNN4Alloc leverages Graph Neural Networks (GNNs) to enhance decision-making efficiency in dynamic and large-scale environments. Building on prior work that employs mathematical optimization and heuristic algorithms, we reformulate these problems using graph representation learning, leveraging the bipartite nature of content-to-node assignment and routing decisions in CDN resource allocation. The framework incorporates GNN-based modules - including neural algorithm executors and constrained optimization layers - to develop adaptive allocation policies that generalize across diverse network topologies and demand profiles. By doing so, GNN4Alloc aims to improve both the scalability and solution quality of content allocation strategies, contributing to the broader goal of advancing GNN-based control in distributed systems.

We investigate a novel approach to time-series modeling, inspired by the successes of large pretrained foundation models. We introduce FAE (Foundation Auto-Encoders), a foundation generative-AI model for anomaly detection in time-series data, based on Variational Auto-Encoders (VAEs). By foundation, we mean a model pretrained on massive amounts of time-series data which can learn complex temporal patterns useful for accurate modeling, forecasting, and detection of anomalies on previously unseen datasets. FAE leverages VAEs and Dilated Convolutional Neural Networks (DCNNs) to build a generic model for univariate time-series modeling, which could eventually perform properly in out-of-the-box, zero-shot anomaly detection applications. We introduce the main concepts of FAE, and present preliminary results in different multi-dimensional time-series datasets from various domains, including a real dataset from an operational mobile ISP, and the well known KDD 2021 Anomaly Detection dataset.

We introduce FREKit, a novel network simulator tailored for research in congestion modeling, fast rerouting, and multi-protocol environments. Existing simulators are either too slow, lack multi-protocol support, or do not offer rich congestion-based metrics and aggregations, limiting their suitability for the type of research FREKit targets. Designed around the pipe-based abstraction - assuming known traffic matrices, FREKit evaluates system-wide behaviors with elastic and inelastic congestion computation models, providing fine-grained insights over interface-level loads. FREKit supports multiple protocols - including IPv4, IPv6, MPLS, and Segment Routing - along with various path search algorithms and rapid prototyping. Its probabilistic link failure framework enables congestion-aware resilience studies and advanced congestion metrics such as value-at-risk (VaR). The simulator is implemented in Python with efficient data structures (NumPy, NetworkX) and optimized via multiprocessing and dynamic programming. Despite being in active development, FREKit is already proving valuable in research on fast rerouting and source routing, demonstrating its potential to enable sophisticated congestion-aware network studies.

Modern network monitoring applications often rely on traditional machine learning models conceived for specific analysis tasks, which require extensive feature engineering, retraining for different use cases, and struggle with generalization. This lack of adaptability makes the deployment of AI/ML solutions in network monitoring a daunting task, as each new scenario requires significant reconfiguration, manual tuning, and retraining efforts, undermining the broader adoption of AI/ML for network traffic analysis.Time Series Foundation Models (TSFMs), pre-trained on vast and diverse time-series datasets, offer a promising alternative in the network monitoring realm by enabling zero-shot and few-shot adaptability across different monitoring scenarios. In this work, we explore the potential of TSFMs for network monitoring by evaluating their performance in a challenging analysis task: estimating video streaming Quality of Experience (QoE) from encrypted network traffic. Our study assesses the zero-shot and few-shot capabilities of state-of-the-art TSFMs, the impact of time-series granularity, and the role of common traffic features in performance.Using real-world video streaming QoE datasets, we show that TSFMs achieve competitive results in a zero-shot setting — plug-and-play approach, and that their performance can be easily and cost-effectively improved through few-shot learning techniques, even when applied on NetFlow-like features with coarse granularity. Beyond the specific video streaming QoE monitoring application, our findings demonstrate the viability and broader applicability of TSFMs to network monitoring tasks, opening the door to more scalable and generalizable network management solutions.

The rapid detection of Domain Generation Algorithm (DGA) and general phishing domains plays a critical role in mitigating malware propagation and its potential impact, as well as in limiting botnet activity coordination through command and control (C&C) servers. We assess a learning driven approach for accurate detection of DGA-generated and phishing domains, leveraging word embeddings learned from observed domain names in DNS queries or browsing URLs. Domain embeddings are constructed with Dom2Vec (D2V), a novel technique which builds on top of word embedding models (e.g., Word2Vec) to map words and tokens extracted from domain names into highly expressive representations. Through experimental evaluation on a large-scale dataset of almost 800,000 domains, comprising 25 distinct families of DGA domains and general phishing URLs, we demonstrate the goodness of D2V embeddings for phishing detection, in particular for the detection of DGAs.

Early decision-making at the network device level is crucial for network security. This entails moving beyond traditional forwarding functions towards more intelligent network devices. Integrating Machine Learning (ML) models into the data plane enables quicker processing and reduced reliance on the control plane. This paper explores the development of a ML-driven Intrusion Detection System (IDS) where network devices autonomously make security decisions or defer to an expert Oracle, relying on in-band and off-band traffic analysis. Programmable devices, such as those using P4, are essential to enable these functionalities and allow for network device re-training to adapt to changing traffic patterns. We introduce HALIDS, a prototype for in-band ML-IDS using P4, complemented with off-band Oracles which support in-network ML-driven classification with more confident classifications, targeting an active learning logic for more accurate in-band analysis. We implement HALIDS using the open source software switch BMv2, and show its operation with real traffic traces publicly available.

Network monitoring data generally consists of hundreds of counters periodically collected in the form of time-series, resulting in a complex-to-analyze multivariate time-series (MTS) process. Traditional time-series anomaly detection methods target univariate time-series analysis, which makes the MTS analysis cumbersome and prohibitively complex. We present DC-VAE (Dilated Convolutional -Variational Auto Encoder), a novel approach to anomaly detection in MTS data, leveraging convolutional neural networks (CNNs) and variational autoencoders (VAEs). DC-VAE detects anomalies in MTS data through a single model, exploiting temporal information without sacrificing computational and memory resources. In particular, instead of using recursive neural networks, large causal filters, or many layers, DC-VAE relies on Dilated Convolutions (DC) to capture long and short-term phenomena in the data. We evaluate DC-VAE on the detection of anomalies in the TELCO TELeCOmmunication-networks dataset, a large-scale, multi-dimensional network monitoring dataset collected at an operational mobile Internet Service Provider (ISP), where anomalous events were manually labeled by experts during seven months, at a five-minutes granularity. We benchmark DC-VAE against a broad set of traditional time-series anomaly detectors from the signal processing and machine learning domains. We also evaluate DC-VAE in open, publicly available datasets, comparing its performance against other multivariate anomaly detectors based on deep learning generative models. Results confirm the advantages of DC-VAE, both in terms of MTS data modeling, as well as for anomaly detection. For the sake of reproducibility and as an additional contribution, we make the TELCO dataset publicly available to the community and openly release the code implementing DC-VAE.

The increasing complexity and frequency of cyber attacks require Network Intrusion Detection Systems (NIDS) that can adapt to evolving threats. Artificial intelligence (AI), particularly machine learning (ML), has gained increasing popularity in detecting sophisticated attacks. However, their potential lack of interpretability remains a significant barrier to their widespread adoption in practice, especially in security-sensitive areas. In response, various explainable AI (XAI) methods have been proposed to provide insights into the decision-making process. This paper investigates whether these XAI methods, including SHAP, LIME, Tree Interpreter, Saliency, Integrated Gradients, and DeepLIFT, produce similar explanations when applied to ML-NIDS. By analyzing consensus among these methods across different datasets and ML models, we explore whether an agreement exists that could simplify the practical adoption of XAI in cybersecurity, as similar explanations would eliminate the need for rigorous selection processes. Our findings reveal varying degrees of consensus among the methods, suggesting that while some align closely, others diverge significantly, highlighting the need for careful selection and combination of XAI tools to enhance trustworthiness in real-world applications.

We investigate a novel approach to time-series modeling, inspired by the successes of large pre-trained foundation models. We introduce FAE (Foundation Auto-Encoders), a foundation generative-AI model for anomaly detection in time-series data, based on Variational Auto-Encoders (VAEs). By Foundation Model (FM), we mean a model pre-trained on massive amounts of time-series data which can learn complex temporal patterns useful for accurate modeling and forecasting on previously unseen datasets. FAE leverages VAEs and Dilated Convolutional Neural Networks (DCNNs) to build a generic model for time-series modeling, which could eventually perform properly in out-of-the-box, zero-shot anomaly detection applications. We introduce the main concepts and ideas of this FM for time-series (TSFM), and present some preliminary results in a multi-dimensional mobile network monitoring dataset. We also present example results applying novel TSFMs to this dataset, both in a zero-shot manner and relying on fine-tuning, and show how complex it is in the practice to achieve accurate results.

Artificial Intelligence (AI), particularly Machine Learning (ML), has become prominent in network monitoring, yet its practical adoption, such as for anomaly and intrusion detection, remains limited. Standard AI/ML methods often exclude experts, reducing trust and hindering practical implementations. Active Learning (AL) allows to integrate admins and their expert knowledge into the ML loop by leveraging expert-labeled data. Together with self-training and automated decisions, AL can enhance model performance, trust, and the ability to adapt to system changes. In this work, we evaluate uncertainty-based AL in network monitoring, offering a comprehensive parameter study for best practices in real-world AI/ML adoption. To this end, we evaluate stream-based and pool-based AL across four datasets for various monitoring use cases and conduct a parameter study on ten uncertainty measures, thereby identifying scenarios benefiting from self-training. By analyzing the impact of admin competence on model performance, we offer actionable guidelines towards the practical implementation of AL.