Peer Revenue Publish or profit

Papers

Fresh from arXiv, typeset properly. Highlighted words trade on the market.

Computer Science Networking

cs.NI Watch Networking (sign in to use)

Wednesday 19 August

Networking · Cross-listed from cs.CR

Autonomous Cyber Defense in Connected Vehicles: A Multi-Agent Approach to V2X Security

A connected vehicle has roughly 100 milliseconds to decide whether an incoming Basic Safety Message is real or fabricated. If a false emergency braking alert reaches the planning pipeline in time, the car brakes - a safety failure triggered by a security failure. Existing intrusion detection systems are not designed to handle that coupling. They operate per vehicle, per message, with static rules - blind to attack patterns that only emerge across a fleet or over time, and blind to the fundamental tension between dropping a suspicious message and dropping a real emergency alert. We propose a three-tier multi-agent architecture that treats this timing constraint as a hard design requirement, not a performance target. At the vehicle level, an onboard agent classifies each incoming V2X message into one of four actions - Accept, Drop, Quarantine, or Escalate - within a 10-millisecond budget, deliberately biased toward Escalate when uncertain, passing ambiguous cases to the roadside edge agent rather than risking a dropped legitimate alert. The edge agent operates across a roadside unit zone with a 50-millisecond budget, fusing threat assessments from multiple vehicles and resolving safety-security conflicts using complementary sensor observations. The cloud tier refines detection models through Byzantine fault-tolerant federated learning and redistributes updated weights to the fleet. Every timing constraint derives directly from the 100-millisecond Basic Safety Message cycles mandated by SAE J2735 and ETSI EN 302 637-2. No existing framework simultaneously assigns standards-grounded latency budgets to all three deployment tiers while treating safety-security conflict resolution as a first-class design constraint. Remaining open problems - adversarial poisoning at the edge and the absence of regulatory frameworks for autonomous security response - are discussed as future work.
Read the full abstract

Networking · Cross-listed from cs.CR

VQC-ZTI: Variational Quantum Control for Zero Trust Protection of the Tactile Internet

Tactile Internet services couple cyber events directly to physical actuation, so security decisions must improve risk discrimination without perturbing the control path. This paper presents VQC-ZTI, a split-plane Variational Quantum Classifier framework for zero-trust protection of Tactile Internet services, in which an off-path VQC analyzes encrypted-flow telemetry while an on-path policy engine applies cached deterministic grant, restrict, step-up, and deny actions. By decoupling anomaly scoring from enforcement, VQC-ZTI preserves predictable control behavior and allows detector sensitivity and policy aggressiveness to be tuned independently. We evaluate the framework on CESNET-derived aggregated traffic using random, entity-group, and temporal holdouts with a hybrid PyTorch-PennyLane implementation. The full-hybrid Quantum Neural Network achieves mean areas under the receiver operating characteristic curve of 0.9981, 0.9974, and 0.9941 and reduces the false-positive rate relative to ExtraTrees by 44.6%, 49.6%, and 67.9%, respectively. A representative component-timing decomposition further illustrates that batched VQC scoring remains in the asynchronous evidence path rather than the immediate enforcement path.
Read the full abstract

Tuesday 18 August

Networking · Cross-listed from cs.CR

XNET: Intelligent Dynamic Sampling for High-Speed Network Security Monitoring

Growing network speeds, with 100GbE line rates becoming common in modern enterprise networks, pose challenges to operators and security applications, as they struggle to scale their operational efficiency accordingly, without relying on costly hardware, excessive sampling, or complex distributed deployments. Unintentional loss due to stochastic packet sampling often produces low-quality traffic, further risking missed detection of critical security incidents, particularly those hidden in typically low-rate traffic, such as APT/malware command-and-control communications. In this paper, we introduce XNET, a system that monitors traffic at line rate using commodity hardware and applies dynamic sampling to amplify the visibility of high security value traffic. XNET leverages Linux's XDP technology to process packets efficiently, classify them based on their security value, and sample them as per configured policies. The outcome is a reduced packet stream in which the security-relevant portion of the traffic is amplified at the expense of less interesting traffic segments. XNET is a highly flexible, scalable and dynamic system that can be adapted based on a network's needs. We deployed XNET in a large real-world network using only commodity hardware, where our results show that XNET can achieve up to 84% traffic reduction with no packet loss while increasing the visibility of otherwise negligible traffic fivefold. With controlled stress tests, we further demonstrate XNET's scalability up to 100Gbps. Additionally, we show that XNET sampling led to a detection rate of 99.6% in an IDS application.
Read the full abstract

All authors Thomas Papastergiou, Karthika Subramani, Joseph Reilly, Boladji Vinny Adjibi, Pierros-Christos Skafidas, Roberto Perdisci, Manos Antonakakis

Networking

Threat Aware Task Offloading and Caching for Secure UAV Assisted Vehicular Consumer Electronics

Vehicular consumer electronics increasingly support computation-intensive and latency-sensitive services, imposing stringent efficiency, reliability, and security requirements on vehicular edge computing (VEC) systems. In dynamic vehicular environments, inference-based information leakage and anomalous communication behaviors further threaten system performance and data privacy. To address these challenges, this paper proposes a UAV-assisted cooperative VEC architecture that integrates threat-aware task offloading with intelligent spatiotemporal caching across roadside units (RSUs) and UAV edge nodes. A security-aware uplink transmission model is developed to capture potential information leakage risks and abnormal communication patterns, enabling adaptive offloading decisions. We formulate a joint optimization problem to minimize end-to-end task execution delay while improving cache utilization under limited computing and storage resources. To efficiently solve this problem, a Threat-Aware Joint Optimization (TAGO) framework is designed by combining proximal policy optimization for adaptive task offloading and a gradient-based caching update derived from the Frank-Wolfe algorithm to capture spatiotemporal service popularity. Simulation results demonstrate that the proposed approach significantly reduces task delay and improves cache efficiency compared with several baseline strategies, showing its effectiveness for secure and efficient UAV-assisted vehicular consumer electronics systems.
Read the full abstract

Networking

Array-Based Molecular Pulse Encoding for Neuro-Spike Communication in Intra-Body Nano-networks

In this paper, we investigate a neuro-spike communication system designed to bridge severed connections between damaged neurons using auxiliary nano-machines. Natural neuro-spike communication typically relies on instantaneous spike rates and temporal intervals to convey information. However, these temporal encoding schemes require exact time synchronization between the transmitter and receiver, a requirement that poses a significant challenge for resource-constrained nano-machines. To address this issue, it is imperative for future intra-body nano-networks to develop communication schemes that operate under reduced-order synchronization (e.g., symbol-synchronized). In this paper, we propose a novel neuro-spike array-based communication scheme where information is encoded through the specific arrangement of distinct molecular pulses emitted by nano-machines. By distinguishing symbols based on the sequence of these emissions rather than their exact timing, the need for stringent time synchronization is eliminated. We theoretically analyze the performance of the proposed scheme by deriving expressions for the probability of inter-symbol interference (ISI), error probability, and the achievable communication rate. Analytical and numerical results demonstrate that our array-based scheme significantly outperforms previously proposed symbol-synchronized models, providing a 75% - 150% enhancement in the communication rate across various diffusion coefficients.
Read the full abstract

Networking

Completion-Path Credits: Multi-Resource Control for Scale-Up Fabrics

Scale-up fabrics connecting GPUs and AI accelerators carry tensor transfers together with remote reads, writes, atomics, and notifications over shared target-side receiver resources. Byte-denominated credits protect link buffers and streaming HBM traffic, but poorly represent small operations dominated by Atomic execution or response injection. This paper presents SemaCredit, a receiver controller that admits each remote-memory operation against a vector of target-resource demands and returns each component when its corresponding HBM, Atomic, or response stage completes. In a deterministic event simulator with multipath queues, eight HBM partitions, a serialized Atomic engine, and a response engine, SemaCredit matches a strong per-resource byte baseline on HBM-hotspot traffic while reducing small-operation P99 latency by 52.4% under Atomic contention and 10.2% under response incast. Application-shaped mixes show 57.7% and 14.5% P99 latency improvements for AllReduce-shaped and remote-read-shaped traffic while matching byte credits on HBM-dominated MoE traffic.
Read the full abstract

All authors Fan Yang, Jiaqi Liu, Tao Jiang, Zhan Wang

Networking

Predict Before Replay: Joint FEC and Flight Control for Reliable Scale-Up Links

Scale-up accelerator fabrics send latency-sensitive flits over serial links at hundreds of gigabits per second. Their reliability pipeline first relies on FEC, then detects residual failures and replays unacknowledged data. At these line rates, delayed feedback lets later flits enter the replay window before a residual failure is reported, so standard replay can amplify one corrupted flit into a suffix retransmission. This paper presents PREFACE, a pre-FEC controller for temporally correlated burst errors. A two-state Bayesian filter converts corrected-symbol observations into a next-flit burst posterior and jointly selects FEC strength with an outstanding-flit cap. We implement PREFACE in ns-3 with publicly verifiable UALink 200G 1.0 replay semantics. PREFACE improves goodput by 10.52%, lowers P99 latency by 50.75%, cuts replay by 47.52%, and improves modeled ring AllReduce by 13.1–27.0%.
Read the full abstract

All authors Fan Yang, Jiaqi Liu, Tao Jiang, Zhan Wang

Networking

LoRIS: LoRaWAN-based IoT Platform for Sustainability Monitoring in Hotels

The hospitality sector is a major source of global greenhouse gas emissions, water stress, and waste generation, yet sustainability reporting in hotels remains constrained by coarse, manually collected operational data. We present LoRIS (LoRaWAN-based IoT platform for sustainability monitoring in hotels), a LoRaWAN-based sensing system that delivers high-resolution measurements of resource consumption, environmental conditions, and guest behaviour across geographically distributed hotel properties. The architecture follows the canonical LoRaWAN reference model and is built for the operational realities of hospitality deployments: restrictive hotel IT policies, guest privacy expectations, rapid and reversible installation, and multi-year battery operation. Privacy-by-design guides modality selection and deployment zoning, and end-to-end encryption protects data from sensor to dashboard. This system has been running since February 2022 and currently spans 850 sensors of 19 types across 21 sites in Australia and Slovenia, covering both the AU915 and EU868 regulatory regions. The platform has generated over 202 million sensor records and ingests approximately 245,000 uplink messages per day on managed serverless infrastructure. Our system has been successfully used for seven field studies spanning food waste, energy consumption, and water consumption, including controlled intervention experiments that measure environmental outcomes and guest satisfaction in parallel. This system shows that LoRaWAN sensing can be deployed at scale in operational hotels without compromising guest experience or privacy.
Read the full abstract

All authors Yash Pandey, Angus Gray, Reza Serati, Oscar Zhu, Emil Juvan, Anna Zinn, Danyelle Greene, Qingqing Chen, Sarah MacInnes, Siamak Layeghy, Sara Dolnicar, Marius Portmann

Monday 17 August

Networking

An O-RAN-Assisted MARL Approach for Dynamic Sidelink and Infrastructure Selection in V2X Communications

Future applications in the 6G-based Internet of Vehicles will leverage sidelink (SL) transmissions in Vehicle-to-Everything (V2X) scenarios. However, SL-based direct communication can significantly increase interference among vehicles and between vehicles and other entities of the Intelligent Transportation System. Thus, both Vehicle-to-Vehicle communications and Vulnerable Road Users (VRUs) uplink resources may be degraded or subject to starvation. Existing solutions primarily focus on improving resource allocation and pair selection. Nonetheless, they lack a comprehensive approach to tackle the communication modes and the entire network. To address these challenges, this paper leverages Open RAN to manage V2X communication and proposes a multi-agent reinforcement learning (MARL) resource-aware system. Open RAN provides control loops through a global view of the network and also an open interface-based framework for machine learning models applied to resource decision-making. Meanwhile, the MARL model aims to mitigate interference, optimize resource usage, and enhance quality of service by optimally selecting between sidelink and network transmissions. To reduce system complexity, this work employs a clustering strategy. Each agent manages a group of pairs, rather than assigning one agent to each pair. The solution supports this design by adopting a centralized training with decentralized execution approach, empowered by Open RAN. The strategy uses offline training and an off-policy approach, in which each agent stores experience for fine-tuning. Results indicate that the MARL approach reduces average loss by 21% and latency by 19% in Vehicle-only scenarios. In coexistence VRU scenarios, loss and latency drop by 18% and 30%, respectively, compared to the single-agent approach.
Read the full abstract

Networking · Cross-listed from cs.CR

Quantum-Safe Web Service Architecture Using Time-Based One-Time Passwords

One-Time Passwords (OTPs) have become a common option for multi-factor authentication in several applications. For instance, during website login processes, OTPs are often used in conjunction with traditional text-based usernames and passwords to verify whether the access request originates from a legitimate human user rather than an automated agent. However, in scenarios involving automated connections and system-to-system interoperability, Time-Based One-Time Passwords (TOTPs) may be required to establish secure connections and access Web Services (WSs). Therefore, this study focuses on exploring the development of a quantum-safe web service architecture. The proposed approach achieves transmission security management by implementing Transport Layer Security (TLS) and HyperText Transfer Protocol Secure (HTTPS) based on Post-Quantum Cryptography (PQC). Furthermore, web service security management is realized through the construction of keyed-Hash Message Authentication Code (HMAC)-driven TOTPs. Within the experimental environment, this study evaluates and compares the computational performance of the Secure Hash Algorithm-2 (SHA-2), SHA-3, Ascon-Hash256, and SM3. The required computation time under different hardware resource conditions is analyzed for future web service deployment.
Read the full abstract

Networking · Cross-listed from eess.SP

ECO-ID: Event-Camera based Optical System for Secure Multi-User Ultra-Low Latency Identification

Time-critical interactive systems increasingly require ultra-low-latency device identification for multiple users, yet prevailing approaches such as passwords, QR codes, and RFID/NFC are constrained by human input, frame-based sensing, or near-contact range. This paper presents ECO-ID, an event-camera-based optical system for multi-user, ultra-low-latency identification over visible light communication (VLC). Leveraging microsecond-resolution, asynchronous observations of brightness transitions, ECO-ID employs a spatiotemporal coding design: disjoint LED subsets provide spatial separation among users, while user-specific timing delays encode identities without inter-user synchronization. The optical channel and event-driven sensing reduce full-scene capture relative to frame cameras and limit the RF attack surface, while enabling rapid token verification with freshness and replay protection. We implement a prototype and demonstrate that ECO-ID can practically achieve approximately 99.8% localization and 98.7% identification with 0.64 ms mean latency, while theoretically supporting identification at the scale of tens of concurrent users. Overall, ECO-ID provides a fast, privacy-conscious, and security-aware alternative for scalable multi-user identification in time-critical interactive environments.
Read the full abstract

Networking

Expanding Access, Exposing Risk: A Short Study of Exposed Starlink Hosts

In this very short paper, we present a measurement-driven analysis of the security characteristics of Starlink-connected hosts and uncover several concerning trends. We find that Starlink hosts are more likely to run outdated or vulnerable operating systems and network protocols than non-Starlink hosts. Regions like Latin America, Southeast Asia, and Eastern Europe show disproportionately higher risk. Our findings raise important questions for the Internet measurement and policy communities.
Read the full abstract

All authors Omar Elamri, Isaac-Neil Zanoria, Jacob Zhi, Ben Du, Liz Izhikevich

Networking

OVS Meets PQ-TLS: Exploring Post-Quantum TLS for SDN's Southbound API

Software-defined networking (SDN) is a novel networking paradigm that enables network programmability and centralized control for network devices. The southbound application programming interface (API) is used to control and manage the underlying data plane devices. The existing southbound API relies on TLS with legacy cryptographic algorithms such as RSA and ECDSA. In this paper, we explore the performance of the southbound API with postquantum TLS (PQ-TLS) support. We present a proof-of-concept of using PQ-TLS in SDN's southbound API. We study the performance of pure and hybrid PQ-TLS modes across different security levels and compare them with legacy TLS in terms of latency and CPU utilization. We also compare the performance of different post-quantum signature and key establishment schemes.
Read the full abstract

Networking · Cross-listed from cs.CR

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs. The framework models user activity as chronological timelines and incorporates retrieval-augmented generation (RAG) to provide personalised behavioural context from each user's historical activity. Rather than performing end-to-end classification directly from raw logs, it first generates structured, interpretable sets of threat-specific risk indicators, which are then classified jointly across temporal sequences to capture attack patterns spanning multiple windows.The framework is evaluated on two benchmark datasets, CERT r5.2 for insider threat detection and PicoDomain for APT detection, using four combinations of two open-weight LLMs under both retrieval and non-retrieval settings. All configurations outperform the previous state-of-the-art LLM-based framework (GABM), with the best configuration improving the F1-score by 11.40 percentage points on CERT r5.2 and 31.50 percentage points on PicoDomain. Results further show that retrieval mainly benefits weaker LLMs by generating more discriminative risk indicators, whereas stronger models achieve comparable performance without retrieved context. The most effective assignment of LLMs to the two stages depends on the dataset. These findings show that the quality of the generated risk indicators is the main driver of zero-shot cyber threat detection performance.
Read the full abstract

Networking

Towards the Interplanetary Internet: An IoT Perspective

Public administrations and private companies have announced plans to deploy networking infrastructure to support future robotic and human presence on or near space targets, such as the Moon and Mars. While using an IP protocol stack for deepspace communication had been neglected, recent events have motivated the reconsideration of IP to enable the Interplanetary Internet. This new paradigm facilitates the integration of IP-based Internet of Things (IoT) protocols for deep-space environments. This paper illustrates the similarities between deep-space and IoT scenarios, presents related IETF standardization work, and discusses opportunities and future directions for IP-based IoT protocols in the Interplanetary Internet.
Read the full abstract

Networking

SbDN: Source-based TSN-Grade Deterministic Networking using Commodity Switches

Deterministic networking is essential for safety-critical applications in automotive, industrial, and aerospace systems, where bounded end-to-end latency must be guaranteed for time-critical traffic. Time-Sensitive Networking (TSN) provides the mechanisms to achieve such guarantees, but its deployment requires expensive TSN-capable switches at every hop and complex per-switch configuration that hinders runtime reconfiguration. This paper presents SbDN, a Multi-Agent Source-based architecture that achieves TSN-grade determinism using commodity Ethernet switches. SbDN moves all scheduling intelligence to a centralized controller composed of three cooperating agents and enforces the computed configurations exclusively at the source endpoints, leaving switches as simple forwarding elements. We propose two methods: Temporal Network Partitioning (TNP), which provides strict temporal isolation on pure FIFO switches, and Traffic Prioritization (TP), which leverages strict-priority queuing at switches to enable work-conserving best-effort traffic. Both methods are formally proven to guarantee that all admitted time-critical flows meet their end-to-end deadlines. Evaluation across 40 benchmark configurations on two topologies shows that TNP and TP achieve 100% admission of time-critical traffic in every scenario, with scheduling times in the low-millisecond range suitable for safe runtime reconfiguration. Compared to a standard TSN baseline, SbDN delivers superior time-critical latency at a fraction of the switch infrastructure cost, while offering competitive best-effort throughput through the choice between the two methods.
Read the full abstract

All authors Mohammadparsa Karimi, Majid Nabi, Andrew Nelson, Kees Goossens, Twan Basten

Networking · Cross-listed from cs.CV

TISC: A Text-Driven Image Semantic Communication System for Faithful Reconstruction

Generative image semantic communication converts an image into a text description and then performs text-to-image reconstruction at the receiver via diffusion-based generative models. This paradigm has attracted broad attention due to its extremely low bandwidth cost. However, existing methods still face two critical bottlenecks across image-to-text (I2T) semantic extraction at the transmitter and text-to-image (T2I) semantic reconstruction at the receiver: (i) semantic loss and distortion in I2T, where holistic image descriptions may omit fine-grained object attributes and spatial-position information, causing the generated text to deviate from the original image semantics; and (ii) insufficient semantic faithfulness in T2I, where even with the same semantically faithful text description, different initial noise settings may lead diffusion-based reconstruction to produce images with different levels of semantic consistency with the original image. These issues jointly limit the semantic faithfulness of image reconstruction. To address them, we propose TISC, a text-driven image semantic communication framework tailored for faithful reconstruction. TISC incorporates two key designs: (1) Tree-Structured Attribute Semantic Extraction (TSASE), which decomposes semantic extraction into global scene, background, and object-level attribute descriptions, covering spatial position, shape/pose, color, material, and other physical attributes for each detected object; and (2) an Initial Noise Optimization (INO) mechanism, which selects an initial noise seed at the transmitter according to a comprehensive similarity score that jointly considers visual and semantic consistency. Experiments on multiple datasets show that TSASE improves object-position recovery and semantic description faithfulness, while the INO parameter study supports the adopted configuration for noise selection.
Read the full abstract

All authors Feifan Zhang, Yuyang Du, Xiaoyan Liu, Soung Chang Liew

Networking · Cross-listed from eess.SP

Rainfall Sensing via Mobile Communication Signals

Rainfall monitoring is important for hydrological observation, disaster warning, and environmental sensing, but conventional rain gauges and weather radars suffer from sparse deployment and high infrastructure costs. This paper proposes PMN-RainSense, a rainfall sensing framework using sub-6-GHz mobile communication signals that supports practical single-antenna deployment. Unlike attenuation-based approaches, which are unreliable at sub-6 GHz because rain-induced attenuation over short mobile access links is only on the order of hundredths of a decibel, the proposed framework exploits fine-grained dynamics. A spectral-temporal channel state information (CSI) compensation method suppresses packet-wise timing and phase distortions while preserving sensing-relevant information. Rainfall-sensitive features are extracted from the delay-Doppler domain to mitigate environmental interference, with angle-domain filtering as an optional extension for multi-antenna receivers. Under bandwidth and antenna constraints, rainfall-correlated Doppler fluctuations serve as the dominant sensing signature, while Doppler-domain normalization improves robustness across links and deployments. Controlled WiFi experiments demonstrate rainfall-associated Doppler broadening and achieve a three-class classification accuracy of 95.48% using a random forest classifier. Long-Term Evolution (LTE) CSI measurements collected from cellular base stations over 11 carrier frequencies from 0.763 to 2.68 GHz yield a mean absolute error (MAE) of 0.25-0.27 mm/h for rainfall intensity estimation using a one-dimensional convolutional network.
Read the full abstract

All authors Zhongqin Wang, J. Andrew Zhang, Kai Wu, Y. Jay Guo

Sunday 16 August

Networking

Scaling the Lightning Network with Practical Set Reconciliation

The Lightning Network (LN) utilizes gossip to share network topology, channel announcements and updates, and node announcements among its local constituents. Yet, our measurements show that this flooding-based gossip reconciliation is fundamentally inefficient. We propose, instead, to use set reconciliation protocols for sharing this information, and we systematically evaluate existing approaches under realistic network conditions. We further propose ADAPTIVEIBLT, a novel adaptive IBLT (Invertible Bloom Lookup Table) protocol with a partial-decoding enhancement. By simulating reconciliation in Core-Lightning and evaluating real gossip snapshots, we demonstrate the practical benefits of reconciliation in scaling gossip reconciliation from hours down to a few minutes.
Read the full abstract

All authors Xingyu Chen, Anish Sinha, David Starobinski, Ari Trachtenberg

Networking

WiFiSpectralJam: A Large-Scale Open Wi-Fi Spectral Scan Dataset with Controlled RF Jamming

WiFiSpectralJam is a Wi-Fi spectral-scan dataset comprising 14.52 GB, 96,090 CSV files, and 522,771,130 ordered spectral observations using commodity Wi-Fi sensing hardware. Measurements were acquired with a Raspberry Pi Compute Module 4 equipped with a Qualcomm Atheros QCA9880 802.11ac network interface and the Linux ath10k spectral-scan interface. The dataset spans active and passive scan modalities across the 2.4 and 5 GHz bands and includes real-world benign background captures, benign RF-chamber floor captures, and controlled RF-jamming captures generated with a HackRF One. Jamming conditions vary by transmit power, target channel, and, in the active subset, waveform type. The release provides the raw spectral-scan records together with a file-level metadata manifest, derived spectral-summary features, validation outputs, and reproducible benchmark protocols. These resources support reuse in RF interference characterisation, jamming detection, spectrum monitoring, distribution-shift evaluation, and machine-learning studies using commodity-NIC spectral measurements. The dataset is publicly available at: https://www.kaggle.com/datasets/daniaherzalla/radio-frequency-jamming/data.
Read the full abstract

All authors Dania Herzalla, Govind Singh, Willian T. Lunardi, Martin Andreoni

Networking

Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling

Identification of IoT device types from passive traffic is increasingly used for security management in enterprise and ISP networks. However, the performance of machine learning-based classifiers gradually degrades under concept drift as device behavior evolves. Therefore, maintaining classification performance requires periodic retraining with newly labeled deployment traffic. The operational challenge is determining how much and which deployment traffic instances to label for maintaining classification performance. We show that these two decisions should be treated separately. While retraining solely on instances selected by a drift detector is prone to systematically overlooking parts of the emerging behavioral space, uniformly sampled deployment traffic captures more representative behavioral changes. Instead, drift detection is more effective at determining the amount of deployment traffic that should be labeled. We make three contributions. (1) We conduct a two-year longitudinal study of IoT traffic and characterize how behavioral evolution manifests across device classes and how retraining with newly labeled traffic restores classification performance. (2) We develop a conformity-based drift detector that captures class-conditional behavioral models directly from raw traffic features and provides feature-level explanations of behavioral evolution. (3) We demonstrate that adjusting the traffic labeling rate according to the observed behavioral evolution, combined with uniform traffic sampling, maintains classifier performance more effectively than detector-guided sample selection and is beneficial to managing the traffic labeling effort. We further show that this strategy performs comparably to confidence-guided adaptation while providing feature-level explanations. Our evaluation uses 3.8 million IPFIX flow records collected from 21 IoT types over more than 2 years.
Read the full abstract

All authors Shayan Azizi, Norihiro Okui, Masataka Nakahara, Ayumu Kubota, Gustavo Batista, Hassan Habibi Gharakaheili

Saturday 15 August

Networking · Cross-listed from eess.SY

Holonic Graceful Transitions Across Centralized, Decentralized, Distributed, and Local Control in DER-rich Cyber-Power Distribution System

The increasing penetration of distributed energy resources (DERs) in distribution system necessitates adaptive coordination frameworks. These frameworks must remain optimal during normal operation and resilient under cyber physical disturbances. Existing coordinated control approaches are typically deployed as static architectures with limited ability to adapt when communication degrades, local instability emerges, and operating conditions become spatially heterogeneous. This work addresses the gap by proposing a DER service-independent edge autonomous holonic adaptive coordination framework. In this framework, each DER controller executes its own control actions and transitions among centralized, distributed, decentralized, and local autonomous coordination modes without always relying on static coordination commands from the grid operator. The framework preserves coordination continuity across modes by retaining local controller states while reconfiguring only the coordination topology, information exchange pattern, and fallback action associated with the active DER service. Graceful transitions are enabled through dwell timers, rate limiting, and safety overrides to prevent dynamic instability during mode changes. Volt VAR control is used as a representative distribution automation application to validate the proposed architecture in a cyber-physical Hardware-in-the-loop (HIL) testbed. The proposed approach is evaluated under diverse cyber-physical event-based scenarios, showing region-confined adaptation under localized disturbance, reduced coordination traffic during coordination switching, and node-confined mitigation under cyber attack through edge anomaly detection and neighbor-corroborated impact estimation.
Read the full abstract

Networking

ST-NDT: A Topological Framework for Reducing Communication Overhead in Network Digital Twins

Next-generation networks (NGN) are becoming increasingly complex, especially with the increasing size of topologies. To manage this complexity requires the adoption of frameworks that enable real-time monitoring, optimization, and “what-if” case scenario analysis. Network Digital Twins (NDTs) have emerged as a key enabler technology for supporting these capabilities because of their ability to provide digital replicas of physical networks operations, enabling scenario testing without interfering with the live network. Although NDTs are considered a key enabler technology, maintaining continuous synchronization with the Physical Twin (PT) introduces considerable communication overhead and excessive bandwidth utilization, limiting sustainability in resource-constrained networks. This paper proposes a topological signal processing framework for sparse network monitoring in NDTs. We represent network edge flows as signals defined on a cell complex, and exploit the Hodge spectral structure of the graph to identify a minimal set of maximally informative sensor edges, thereby reducing the measurement overhead between the physical network and its digital twin replica. Results show that the proposed Sparse Topological Network Digital Twin (ST-NDT) framework consistently outperforms all four baseline frameworks across most of the edge monitoring budgets. For example, at a 20% monitoring budget (48 of 243 edges monitored), ST-NDT achieves improvements of 10.85%, 11.24%, 7.36%, and 6.15% over degree-based, core-number, betweenness centrality, and random-selection frameworks, respectively.
Read the full abstract

Networking · Cross-listed from cs.AI

OTel: Building Domain-Specialized Telecom LLM Foundations for Intelligent Networks

Frontier AI models have advanced rapidly, but they still struggle with telecom-specific tasks. We present Open Telco (OTel), an open telecom AI resource with derived datasets for retrieval, reranking, instruction tuning, and safety/abstention, plus 30 full-parameter post-trained baselines across embedding, reranking, and language models. The community has already engaged substantially with the resource: as of May 3, 2026, the released models have been downloaded over 16 million times, and the project has received 157+ pieces of media coverage worldwide. Building on prior open telecom datasets and benchmarks, OTel provides documented telecom data sources, held-out evaluation partitions, trained embedding models, rerankers, context-grounded LLMs, and safety/abstention data in one unified resource. OTel post-training improves performance across all three model families: embedding retrieval reaches 93.5% NDCG@10, reranking reaches 0.952 MRR@10, and language-model correctness reaches 88.2%. We release OTel as a reproducible starting point and invite the community to expand the data, improve embedding and reranking models, and build stronger context-grounded telecom LLMs.
Read the full abstract

All authors Farbod Tavakkoli, Roderic Paulk, Jorden Terrazas, Kenneth Church, Mark Austin, Louis Powell, Gregory Diamos, Lina Bariah, Syed Ali Raza Zaidi, Maryam Hafeez, Ali Maatouk, Imtiaz Karim

Networking

Adaptive Bridge: A Proxy-Based Decoupling Layer for Mitigating DDS Backpressure in ROS 2

In systems built on Robot Operating System 2 (ROS 2) and using Data Distribution Service (DDS), a single network-impaired or throttled subscriber on a RELIABLE topic can cause backpressure that degrades throughput and latency for all other subscribers, including safety-critical ones sharing the publisher, because the publisher's DDS writer can no longer accept new samples. We present Adaptive Bridge, a proxy-based layer that decouples critical subscribers from degraded or noncritical ones, thereby isolating the critical path through topic splitting and dynamic rate control. The proxy acts as a middleman and subscribes to the original topic and republishes the messages to two independent DDS writers: one RELIABLE writer for critical nodes and one BEST EFFORT writer for noncritical or degraded nodes, thus isolating the degraded nodes and safeguarding the publisher and critical nodes from backpressure. A probe-based classifier actively monitors subscriber health through sampling with hysteresis and adjusts subscriber rate limits in real time. We evaluate the system under a Gilbert-Elliott bursty wireless loss model using a reproducible Docker-based harness. The results show that using the Adaptive Bridge in our evaluation harness reduces the critical subscriber tail p95 latency from up to 15 s to 1.55 ms across all impairment severities while preserving the publisher's configured throughput.
Read the full abstract

Networking

Exploring the Suitability of QUIC for the Internet of Things

QUIC is an emerging transport-layer protocol that provides reliability and security. QUIC was designed to overcome issues from other protocol stacks used in the Internet, such as TCP/TLS, especially focusing on web traffic performance improvement. Therefore, QUIC was not conceived for Internet of Things (IoT) scenarios, which are characterized by significant resource constraints. However, as QUIC prominance increases, and the IoT continues to expand, QUIC may offer connectivity opportunities for IoT devices. In this paper, we explore the suitability of QUIC for IoT environments. Leveraging optional functionality, we propose, discuss, and evaluate a QUIC profile for IoT scenarios that is currently being considered for IETF standardization.
Read the full abstract

Networking

ISAC in 3GPP: Evolution Toward 6G

Integrated sensing and communication (ISAC) is emerging as an important direction in the Third Generation Partnership Project (3GPP) evolution toward 6G because it allows cellular networks to provide environmental awareness in addition to connectivity. This paper surveys the current 3GPP trajectory from Release~19 feasibility studies to Release~20 radio, protocol, and architecture studies, while distinguishing established requirements, ongoing study assumptions, and possible forward directions. The survey covers service requirements, sensing topologies, channel model evolution beyond 3GPP Technical Report (TR)~38.901, Radio Access Network Working Group~1 (RAN1) physical layer design, Radio Access Network Working Groups~2 and~3 (RAN2 and RAN3) system implications, and the role of sensing-assisted communication. It also synthesizes the main unresolved issues in waveform and reference signal design, multi-node coordination, sensing data reporting, service exposure, privacy, and implementation constraints. By connecting service-level motivations to physical layer, protocol, and architecture implications, the paper provides a standards-centric reading of how 3GPP may evolve toward practical 6G ISAC support.
Read the full abstract

Networking · Cross-listed from eess.SP

Diffused-Beam Laser-Diode LiFi Under Realizable Receiver, Noise, and Safety Constraints: Design-Space Analysis and an Open Cross-Verified Simulation Framework

Link-budget studies of indoor optical wireless systems frequently assume receiver parameter sets–large photodetector area, large transimpedance, and wide bandwidth simultaneously–that violate basic circuit constraints, and noise budgets that omit dominant amplifier and laser noise. This paper develops a realizability-constrained design-space analysis of a diffused-beam laser-diode (LD) LiFi link anchored to a hardware prototype. The analysis couples the generalized Lambertian channel of a holographic-diffuser source to a receiver model that enforces the transimpedance-amplifier gain-bandwidth/capacitance constraint and carries a complete noise budget: shot, feedback-resistor thermal, input current noise, capacitance-driven voltage-noise gain, and laser relative intensity noise (RIN). Against this budget we evaluate unipolar M-PAM under two FEC tiers (7%-overhead hard-decision at $3.8 \times 10^{-3}$, 20%-overhead soft-decision at $2 \times 10^{-2}$), first-bounce diffuse multipath, and a quantitative extended-source eye-safety assessment. The full model predicts 140 Mb/s net at the prototype's demonstrated 14-m range with 6.7 dB margin (OOK, HD tier), 240 Mb/s at the zero-margin 4-PAM/SD reach boundary of 14.0 m, and 480-558 Mb/s at 5 m–a factor 3.9-6.6 below what the same link yields under a naive textbook budget, quantifying how strongly idealized assumptions inflate LiFi projections. First-bounce analysis shows the downfacing-source/up-facing-receiver geometry confines multipath to a worst-case LOS-to-diffuse ratio of 4.2 dB and delay spreads below 0.13 ns, and the 500-mW source remains a factor $\ge 7.8$ under the Class-1 eye-safety limit. All models are released as an ns-3 module and Python engine backed by automated testing.
Read the full abstract

All authors Hussain Ahmad, Saleem Aslam, Ammara Nasim, Syed Muhammad Talha Gillani, Toheed Omer

Networking · Cross-listed from cs.IT

ICL-SEC: Iterative Cross-Layer Semantic Error Correction

Iterative decoding has been central to the success of modern channel coding, where reliability information is repeatedly exchanged across decoding components to approach fundamental performance limits. This paper brings the same principle to semantic error correction by proposing iterative cross-layer semantic error correction (ICL-SEC), a framework that closes the loop between physical-layer soft channel decoder and application-layer language-model-empowered semantic decoder. In the proposed framework, a soft-input soft-output channel decoder first produces bit-level posterior probabilities, from which word-level reliabilities are derived. Words deemed reliable are exposed to a masked language model as semantic context, while unreliable words are masked. The language model then produces contextual word likelihoods, which are leveraged to generate extrinsic bit-level priors and fed back to the channel decoder for the next iteration. This iterative refinement progressively expands the set of confidently recovered words. A key contribution is our Confirm prior-update rule: once a word is judged reliable, its bits are assigned deterministic priors with probability one in subsequent iterations, making the word fully resolved side information for both the channel decoder and the language model. This successive-confirmation mechanism prevents oscillatory unmask-mask behavior and yields a reliability interpretation consistent across layers. Simulations over text transmission demonstrates that ICL-SEC substantially outperforms both conventional channel decoding and non-iterative CL-SEC. In particular, the proposed Confirm scheme reduces the bit error rate by more than two orders of magnitude relative to non-iterative CL-SEC, while also significantly improving the other five performance metrics.
Read the full abstract

Networking

Agentic AI-Enabled Solar-Powered High-Altitude Platforms for Sustainable SAGINs

Space-Air-Ground Integrated Networks (SAGINs) can extend connectivity, but their communication, computing, and platform operations create tightly coupled energy demands. Solar-powered High-Altitude Platforms (HAPs) offer a promising middle layer by combining persistent regional coverage, renewable-energy harvesting, and onboard computing. However, realizing this potential requires more than optimizing individual links or processors, as radio transmission, task execution, backhaul use, and battery preservation share a common energy budget. Therefore, we introduce a HAP-native Agentic AI framework. It continuously perceives communication, computing, energy, mobility, and mission states; invokes quantitative tools for prediction and verification; and coordinates executable actions through a closed control loop. Then, a multi-timescale design separates fast radio control from task orchestration and long-term energy planning. Furthermore, a disaster-recovery case study illustrates how the framework responds to backhaul congestion, traffic surges, and declining solar generation, improving energy efficiency, task completion, and latency over other baselines. We finally identify trustworthy control, collaborative multi-HAP orchestration, and digital-twin-assisted lifelong adaptation as key steps toward deployable, sustainable, and resilient SAGIN intelligence.
Read the full abstract