Papers

In a distributed Internet of Agents (IoA) without centralized routing control, routing tasks to capability-matched executors is challenging because destinations are not predetermined and agents have bounded local service views. Discover-then-forward approaches, by contrast, select an executor before network forwarding and therefore do not directly support reselection when additional candidates become visible downstream. We introduce Semantic Potential Field Routing (SPFR), a distributed IoA routing algorithm that integrates executor discovery and reselection into hop-by-hop forwarding. SPFR represents each executor visible in a local semantic forwarding information base (FIB) as a task-conditioned semantic potential source, with utility setting its strength and hop distance inducing exponential attenuation. At each hop, the forwarding agent recomputes these potentials, reselects the dominant executor, and forwards the task one hop toward it. Under task-consistent frozen-FIB conditions, we prove loop freedom and finite-hop termination and derive an explicit additive error bound under bounded visibility relative to the full-visibility objective. Extensive simulations on real-world topologies show that SPFR approaches the realized utility of distributed utility-greedy routing and request-triggered global discovery while using fewer forwarding hops and substantially fewer request-triggered messages, and remains robust under network and service dynamics.

In uncrewed aerial vehicle (UAV)-relayed mobile edge computing (MEC) networks, computation tasks generate traffic with diverse latency requirements and data sizes. Routing decisions therefore need to adapt to both traffic characteristics and changing network conditions. Compared with single-path routing, multipath routing is better suited to such heterogeneous traffic because it provides multiple forwarding options and enables flexible traffic splitting. However, conventional multipath routing usually splits traffic over predefined end-to-end paths, making it difficult to respond quickly to link fluctuations and topology changes in UAV networks. To address this issue, we propose a traffic-adaptive per-hop multipath routing method for multi-hop UAV networks, in which each UAV dynamically distributes traffic among multiple candidate next hops. We formulate the routing problem to improve the on-time packet delivery ratio while reducing the packet loss ratio, and model it as a decentralized partially observable Markov decision process (Dec-POMDP). To solve this problem, we develop a multi-agent reinforcement learning (MARL) algorithm, termed Multi-Agent Proximal Policy Optimization with Dirichlet Modeling (MAPPO-DM). MAPPO-DM follows the centralized-training-and-decentralized-execution framework and models continuous traffic-splitting actions using a Dirichlet distribution. Simulation results show that MAPPO-DM outperforms the baseline methods and maintains robust performance under various network conditions.

As one of the layers in campus network, core layer or backbone network should provide interconnectivity and routing between internal and external networks, including other campus networks or the Internet. With that requirement, designing this layer to be highly available to interconnect and route traffic is a high priority. By using software-defined networking (SDN) paradigm, we attempt to design core layer in campus network employing best practices of network topology and routing protocol at the layer with a use case of core layer in a university campus network. We use RouteFlow as the SDN platform supporting a traditional routing protocol, i.e. Open Shortest Path First (OSPF), over OpenFlow (OF) network infrastructure. The experimental testbed/environment consists of two virtual machines (VMs). The first VM is used as the SDN/OF data plane with Open vSwitch in Mininet network emulator, and the second one representing SDN control plane comprising RouteFlow with POX controller. We evaluated the design by testing the interconnectivity using ping for the OF switches in the topology and hosts that are connected to the switches. We also tracked the route of the packets by monitoring traffic passed through all network interfaces of the switches using tcpdump. This case was evaluated since we need to make sure that packets were routed with the shortest path from source to destination using OSPF that was implemented in the virtual network at the top of the SDN platform.

Battery-free sensors expose short, stochastic communication windows and may lose timing state whenever their main energy domain browns out. MagPie combines a microampere wake-up radio (WuR) with a separately backed low-power real-time clock (LP-RTC): the WuR widens the first-contact window, while the LP-RTC preserves the acquired phase for later exchanges. Energy gates, epoch-versioned schedules, and idempotent slot allocation extend this mechanism to static, single-hop All-to-One collection without a powered control anchor. The analysis accounts for role selection and duty-cycled listening, and bounds scheduled-retry tails only under explicit conditional quantile coverage. Evaluation separates three scopes. In independent, administratively censored simulation trials, MagPie completes 100/100 first rendezvous events in each of five trace-parameterized harvesting scenarios; Find completes 36-100/100. A single-collision-domain slotted-Aloha study shows that adaptive K is necessary at high contender density and reports mean, P95, and confidence intervals through 120 components. Finally, controlled STM32WL33 experiments validate alignment, clock persistence, and six-device slot execution, including an 11.05-hour functional run. The study does not claim measured end-to-end energy, ambient-harvesting performance, or multi-hop scalability; highly variable harvesting still limits collection because coordination cannot create missing energy.

BGP hijacking remains a persistent threat as existing defenses, including RPKI/ROV suffer from a fundamental incentive misalignment: the networks best positioned to filter malicious announcements bear operational costs but receive no direct benefit, while the victim prefix owner captures all the value. We advocate a market-based alternative in which prefix owners post standing bounties for filtering invalid announcements of their prefixes, turning filtering from altruism into a private transaction. Our insight is that neither a propagating hijack nor its absence can hide from public route collectors, whose committed routing tables could become an independent root of trust for releasing funds of the bounty. We build on this insight to design BGPay, an escrow protocol in which filterers and monitors commit before either reveals, and a smart contract pays out on evidence rather than on the prefix owner's judgment. Analyzing 1K real hijack incidents, we find that today's collectors already provide enough visibility where it matters: ASes that are more important for containing the hijack are also highly visible from the public monitors. Hence, setting rewards proportionately to containment impact discourages misbehavior.

Ultralow-latency communication is critical for emerging next-generation applications such as XR, real-time control, and distributed sensing. We present ECO-COMM, an event-camera-based optical communication system for ultra-low-latency device association and lightweight information exchange. By exploiting the asynchronous sensing and microsecond-level temporal resolution of event cameras, ECO-COMM captures high-frequency optical signals without frame-based acquisition delays. We identify and analyze key hardware-induced challenges in event-camera communication, including timestamp inconsistency, readout contention, trailing effects, and the inevitable refractory period, and develop hardware-aware mitigation techniques to address them. Focusing on a single transmitter-receiver optical link, ECO-COMM establishes the feasibility of practical ultra-low-latency event-camera communication using commercially available hardware.A prototype implementation using an eight-LED transmitter and an off-the-shelf event camera achieves device association within 15 microseconds, symbol latency as low as 100 microseconds, and end-to-end latency below 8 milliseconds for 32-byte payloads at 0.1% bit error rate. ECO-COMM establishes a practical and complementary communication paradigm for ultra-low-latency systems where responsiveness and temporal precision are paramount.

Industrial services in beyond-fifth-generation (B5G) and sixth-generation (6G) networks are increasingly executed as multi-phase workflows whose quality-of-service (QoS) demands change across ordered phases. Existing exposure, analytics, and policy-control functions can provide capability information and enforce QoS treatment, but they do not track the admitted QoS agreement between a workflow and the network. This paper studies this missing coordination function in the software control plane. We propose a Capability Broker that represents each admitted trajectory as a lifecycle-managed QoS commitment, including the workflow demand, network capability, validity time, and enforcement state. The Broker operates above existing exposure and policy-control interfaces and enforces capability freshness, duplicate-safe admission, legal state transitions, per-commitment event ordering, recovery routing, and Broker–network state consistency. Prototype results with microbenchmarks, fault injection, ablation, and controlled message loss show that the full Broker preserves commitment consistency with microsecond-level local processing overhead, while removing individual Broker functions exposes duplicate commitments, stale admissions, illegal transitions, lost-update divergences, or Broker-network inconsistency.

The paper presents an efficient approach to the semantic enrichment of measured sensor data in Wireless Sensor Networks (WSNs), by bridging techniques from Model-driven Software Development (MDSD) and Semantic Web Technology (SWT). Our approach reinforces data interoperability, fostering data sharing and reuse, by utilizing SWT. Model-based and type-agnostic configuration reduces the overall effort for WSN setup and maintenance, which are traditionally complex and time-consuming tasks. The presented approach addresses the problem of large-scale WSN management through the application of SWT in WSN configuration and management without requiring expert knowledge. Additionally, we present a generic architecture and an implementation which is also supplemented by hands-on descriptions of an illustrative use case. Our experimental results demonstrate that our model-based approach provides non-intrusive semantic enrichment with sub-millisecond computational overhead, as well as partially automated configuration of WSNs.

LLM inference applications are gaining significant traction. The demand for inference is growing exponentially, and the GPU usage of inference is increasingly surpassing that of training. Due to the mobility penalty, edge-side inference fails to deliver satisfactory performance. Consequently, most inference service providers currently rely on cloud-based inference, which incurs substantial, not sustainable costs for enterprises, and is even increasing in the agentic paradigm. Therefore, our goal is to enable powerful computing capabilities as server-grade GPUs on mobile devices. We propose Wireless GPU Computing Infrastructure (WiCi) in this paper. Through WiCi, mobile devices can wirelessly access server-grade GPUs, running inference tasks on mobile clients but offloading GPU-related computations to a nearby GPU via WiFi. WiCi introduces a series of designs to make sure the infrastructure is scalable with different applications, compatible with different mobile devices, and has comparable performance to running on a physical GPU. We test WiCi from mobile devices and find that WiCi can reduce time to first token by up to 90%, improve the token rate by approximately 39x compared to local inference on mobile devices for the same model, and support much larger models. WiCi also achieves up to nearly 80% of the native performance of the server-grade GPU across different applications.

The Quantum Internet operates on entanglement, a non-local, non-copyable, stateful network resource, which motivates protocol organization beyond classical layering. We present a first executable specialization of the Dynamic Kernel/QPacket logic from the beyond-layering protocol suite, targeting entanglement distribution over a linear quantum repeater chain. The implementation builds on Q2NS, an ns-3-based quantum-network simulation module available through the ns-3 App Store. It realizes QPacket meta-headers with service intent and append-only action-commit stamps processed by node-local Dynamic Kernels organized as a Planner–Executor–Engine pipeline, while being deliberately scoped to an analytically verifiable service and policy. Within this scoped setting, we study node heterogeneity through a link-preparation policy that accounts for pre-distributed entanglement and uneven entanglement-generation support across nodes, including delegation via QPacket forwarding. Simulations verify analytical link-resolvability models and expose signaling load, forwarding behavior, and QPacket meta-header growth. Results show that QPacket overhead is shaped by more than just encoding, including policy choices and available network resources. Overall, this study demonstrates how the Q2NS/ns-3 substrate can support reproducible, policy-specific evaluation of quantum-native protocol-suite concepts.

Excessive queueing delays constitute a significant impediment to latency-sensitive network applications. Although effective deployment of Active Queue Management (AQM) strategies has been proposed as a necessary solution, deployment remains sparse. This paper studies AQM deployment in a specific class of networks where routers/switches have a topological hierarchy, form acyclic paths, and adopt multipath routing. Our approach rests on the well-established premise that AQM deployment impacts packet-forwarding dynamics in networks carrying TCP flows, thus establishing a direct link between stability and network performance. We use fluid models for TCP and queue dynamics in the network, along with a simple threshold-based queue policy to outline a closed-loop model for the network. Stability analyses reveal that while the network is vulnerable to instability as the average round-trip time (RTT) of the TCP flows increases, it tolerates a much larger RTT without losing stability when the threshold-based AQM is deployed in an appropriate router. We then define a Katz centrality-based metric to choose the most appropriate router for AQM deployment, and argue that doing so ensures the greatest stabilising effect. Finally, packet-level simulations corroborate that the proposed deployment strategy ensures low-latency operation of the network.

Wireless embedded systems increasingly rely on wireless channel information for decision making, yet practical platforms operate under severe constraints, including few antennas, narrow bandwidth, and sparse, noisy measurements. While neural field based approaches inspired by Neural Radiance Fields (NeRFs) have recently been explored for continuous wireless channel modeling, existing approaches depend on dense measurements or external priors such as known geometry, visual context, or angle-of-arrival (AoA) information, limiting their practicality in real-world deployments. We present WiNeRF, a neural field framework that learns a spatially continuous, complex-valued wireless channel representation directly from sparse channel state information (CSI) collected by commodity WiFi devices. WiNeRF embeds intrinsic system constraints, such as antenna geometry, limited spatial resolution, and phase uncertainty, as inductive biases through a 3D conical wave sampling model, a multi-resolution implicit scene representation, and a differentiable optimization framework for complex-valued channel learning. Across diverse indoor environments with non-line-of-sight (NLoS) regions, WiNeRF achieves a median prediction SNR of 5.3 dB, outperforming prior neural baselines by 4.9 dB on average (approximately 3x higher prediction SNR), and produces a task-agnostic channel representation that can be directly reused in standard signal-processing pipelines, including beamforming, AoA estimation, and RSSI coverage mapping, without modifying existing hardware or wireless protocols.

Indoor localization based on Wi-Fi typically relies on extensive collection of real-world received signal strength (RSS) fingerprints, making deployment costly and time-consuming. We present a ray-tracing-based framework that reduces this reliance by generating synthetic RSS fingerprints from a building model. We first calibrate the building model using a small amount of real RSS fingerprints through Bayesian optimization, followed by per-access-point calibration to account for residual errors in simulated RSS values. The calibrated model is then used to generate a large augmented dataset of synthetic RSS fingerprints at arbitrary locations. To effectively exploit these data for localization, we introduce novel binary and multivalued representations of RSS values and a ResNet-based localization architecture that supports cross-band fusion of 2.4 and 5 GHz measurements. We evaluate our localization method on a real campus building against a diverse set of four baselines. When trained exclusively on synthetic data, the proposed method with multivalued representation and upstream cross-band fusion achieves a mean localization error of 3.05m on a real-data test set, outperforming the best baseline by 33.6%. The results demonstrate that calibrated ray-tracing-based simulation can substantially reduce the need for real RSS fingerprints while enabling accurate deep-learning-based indoor localization.

How can we actively search and identify live C2 servers of botnets at scale? The scalability requirement introduces the need to utilize resources efficiently in terms of computation and number of probing packets. We propose BotScan, an approach for actively probing a large IP space to find the highest possible number of live C2 servers. The novelty of BotScan revolves around two insights, which we establish empirically. First, contrary to popular PC-centric observations, many modern IoT botnet communication protocols use packets with minimal customization, which we observe across six major families. Second, C2 servers exhibit exploitable behavioral patterns, such as strong spatial locality. We substantiate the first insight by developing a streamlined approach where, given malware binaries, we measure and taxonomize the "replayability" of its C2 communication protocol. Then, we introduce a behavior-adaptive probing strategy that: (a) exploits the spatial locality of C2 servers using a two-level segment-centric approach, and (b) adapts dynamically to the success of its probes. We validate the effectiveness of our method using 1,842 recently collected IoT binaries, and we explore a target space of 2.5M IP addresses. First, a replay-based method is applicable for at least 72% of the malware binaries. Second, our method outperforms baseline methods by finding approximately double the live C2 servers for the same number of probes. We also conduct two case-studies where we identify 896 live servers including 112 unreported C2 servers.

Unmanned aerial vehicle (UAV)-mounted 5G New Radio base stations (gNBs) can augment terrestrial networks with an on-demand, repositionable Frequency Range 2 (FR2) capacity layer. This flexibility, however, couples the physical network topology with radio-resource management: UAV movement reshapes blockage, channel quality, and the set of effectively served users, while traffic demand, queues, and service requirements evolve at a much faster timescale. Existing Open Radio Access Network (O-RAN)-enabled UAV studies optimize trajectory, deployment, association, or resource allocation, but typically in isolation, without coordinating slow aerial control with fast per-user scheduling. We instead exploit O-RAN disaggregation, Key Performance Indicator (KPI) monitoring, and multi-timescale RAN Intelligent Controller (RIC) control to address this coupling: a Non-Real-Time RIC rApp uses aggregated KPIs and radio-environment context to jointly control tethered UAV placement and the enhanced Mobile Broadband (eMBB)/Ultra-Reliable Low-Latency Communication (URLLC) slice budget, while a Near-Real-Time RIC xApp allocates per-user resources within that budget. We realize this xApp as a permutation-equivariant DeepSets Soft Actor-Critic (D-SAC) scheduler that treats the users as an unordered set, trained in a Sionna RT ray traced channel. The resulting hierarchical controller improves eMBB SLA satisfaction by up to 17% and URLLC on-time delivery by up to 42% over classical and learned schedulers; the learned rApp further raises URLLC on-time delivery by up to 20% over baselines.

Perimeter-based security appliances, such as firewalls or Intrusion Detection Systems, are ineffective against modern attacks that use pivoting, wherein attackers "pivot" traffic through compromised hosts to gain access to additional targets that would otherwise be inaccessible. Due to the legitimate appearance of the relayed traffic, pivoting is extremely difficult to detect. Although the consequences of these attacks are known to be severe, existing defenses suffer from drawbacks such as high processing delays, low accuracy, or reliance on network-wide participation, making them inconvenient or even ineffective. This work presents Stitch, a host-based system that uses the programmable kernel to detect pivoting in real time. By observing host-traversing flows, Stitch uses process tracing to effectively combine system and network-level information, connecting incoming and outgoing communications and identifying pivoting characteristics between them. Showing 31% gains in accuracy over state-of-the-art pivoting defenses and a maximum false positive rate of 0.006% over two separate real-world deployments, Stitch covers the gap in current pivot detection solutions by providing accurate, lightweight, and independent coverage for vulnerable hosts in a network.

Homomorphic-encryption blockchain frameworks for IoT sensor aggregation generally rely on classical cryptographic hardness assumptions and seldom account for network topology in liveness and performance analysis. This work introduces Phi-PHE-BC, a topology-aware homomorphic blockchain architecture for secure and privacy-preserving IoT sensor data aggregation. The framework combines threshold Paillier decryption with graph-parameterized security and performance analysis, linking protocol behavior to the validator graph. On-chain Paillier ciphertexts support homomorphic aggregation while providing IND-CPA confidentiality under the Decisional Composite Residuosity assumption, and authentication signatures provide EUF-CMA transaction integrity. Threshold partial-decryption shares are protected by a noise-flooding wrapper that provides information-theoretic privacy under the configured statistical-hiding condition. Under partial synchrony and Byzantine fault-tolerance assumptions, liveness requires validator connectivity kappa(Gv) >= f+1. We derive topology-dependent throughput bounds for tree, star, mesh, and scale-free networks, together with a per-block communication-cost model. A game-theoretic analysis shows that honest validator participation is a dominant strategy under the stated utility model, yielding an all-honest Nash equilibrium. Experiments on Hyperledger Fabric 2.5 show lower end-to-end latency than the selected traditional PHE-blockchain baseline while maintaining controllable threshold-decryption overhead. Results across topology scaling, validator sensitivity, threshold decryption, and Byzantine-load experiments indicate that Phi-PHE-BC is a practical architecture for secure, privacy-preserving, and topology-aware IoT sensor aggregation.

The massive adoption of Internet of Things (IoT) devices across critical domains such as healthcare, smart cities, industrial automation, and critical infrastructure introduces significant cybersecurity and regulatory challenges. Current and forthcoming European regulations, including the Cyber Resilience Act (CRA) and the NIS2 Directive, require manufacturers, operators, and other organizations to ensure secure-by-design devices, continuous vulnerability management, and resilient operation throughout the device lifecycle. Traditional certification mechanisms remain static, manual, and difficult to scale across heterogeneous IoT ecosystems. This paper presents CERTIoT-6G, a Security-as-a-Service (SECaaS) framework that enables automated cybersecurity certification and continuous compliance monitoring of IoT devices operating in 5G and future 6G networks. The framework integrates automated compliance analysis, real-time traffic monitoring, and adversarial testing capabilities. We validate the CERTIoT-6G framework on different IoT device categories operating in an advanced 5G testbed. Evaluation results reveal critical compliance gaps, particularly in traffic encryption and availability under unstable conditions, and demonstrate that the framework produces actionable verdicts mapped to regulatory requirements across heterogeneous device types. Furthermore, we show that the monitoring pipeline has a negligible impact on live 5G traffic.

Large language model (LLM) agents are increasingly attractive for automating network configuration, yet their reliability and failure patterns are poorly understood. An essential prerequisite is to assess such agents in a realistic but risk-free environment. Existing benchmarks, however, fall short: they often treat configuration as static command generation or rely on overly simplified settings. Such evaluations understate the core challenges of network configuration, where correctness requires reasoning about protocol complexity and topology dependence. We present NetConfArena, an executable benchmark for evaluating LLM agents in closed-loop network configuration. NetConfArena places agents in emulated multi-device networks, provides a standardized and compact action interface for task execution, and evaluates the resulting network behavior with hidden task-specific executable test cases. The benchmark relies on an LLM-assisted, emulation-grounded pipeline, which converts human-oriented network materials into reusable parameterized task templates. We evaluate representative LLM agents on 480 task instances instantiated from 96 protocol-focused task templates, yielding 3840 execution trajectories, and show that failures are not limited to command errors. The failures also reveal gaps in task-specification adherence and robust planning and execution. These findings suggest two future directions: using validated trajectories as supervision signals to improve foundation models, and designing harness mechanisms that make agent execution more reliable and accountable.

Spectrum exclusively licensed to each mobile network operator (MNO) is scarce, and assigning it in fixed, frequency-orthogonal blocks leaves much of it idle under heterogeneous, time-varying traffic. Large antenna arrays offer an alternative: an operator can spend part of its spatial degrees of freedom (DoF) serving its own users and part suppressing interference toward others' users (nullforming), letting competing networks reuse the same band. This raises two questions: does trading DoF for interference suppression beat orthogonal partitioning, and how much coordination is needed to realize the gain? We cast inter-operator sharing as a continuum of cooperation "shades" of a single null-forming MU-MIMO precoding and interference-constrained scheduling primitive, spanning orthogonal partitioning, non-cooperative reuse, cooperative cross-operator protection, and a scheduling-aware bound exploiting foreign scheduling decisions. Evaluated on a ray-traced digital twin of a real multi-operator deployment with 27 base stations sharing a 7 GHz carrier, the cooperative shades deliver more than a 2.5$\times$ median per-user rate gain over both non-cooperative reuse and orthogonal splitting. Crucially, most of this gain requires only minimal inter-operator information exchange, indicating that a modest, standardizable metadata exchange, rather than tight joint processing, unlocks most of the value of shared-spectrum operation.

This paper investigates a multiple uncrewed aerial vehicles (UAVs)-enabled distributed mobile edge computing (MEC) framework, where the set of collaborative UAVs dynamically varies over time due to their energy states and service loads. The joint optimization of trajectory planning and resource allocation is formulated as a Stackelberg game, where UAVs and mobile terminals (MTs) are modeled as leaders and followers, respectively. UAVs aim to maximize their benefits by balancing executed workload, energy cost, and resource allocation revenue, while MTs seek to minimize their total overhead, composed of computing delay and resource costs, through offloading and resource-request decisions. A hierarchical joint optimization algorithm is developed within a multi-agent deep reinforcement learning (MADRL) framework to coordinate UAVs and MTs in a distributed manner. At the leader level, UAVs jointly determine their trajectories, task migration ratios, MT-UAV association, and unit computing resource pricing. Each UAV is modeled as an agent in a partially observable Markov decision process, and the agents are jointly trained via multi-agent proximal policy optimization (MAPPO) under the centralized-training-and-decentralized-execution paradigm. At the follower level, MTs determine their optimal task offloading ratios and requested computing resources using a two-stage iterative algorithm. Simulation results demonstrate stable convergence under dynamic UAV participation. Compared to the no-collaboration benchmark, the proposed algorithm improves UAV efficiency by 18.58% through inter-UAV task migration and reduces average MT overhead by 33.77% over the fully offloading scheme. It also outperforms other benchmarks under varying network scales and capabilities by jointly optimizing UAV operations and resource utilization.

Dynamic spectrum access must coordinate secondary users under bursty primary-user activity while preserving packet reliability and delay. We present TACAN, a centralized policy that represents each channel as a token containing occupancy history and automatic-modulation-classification entropy; a context token supplies queue class, delay and user identity. A Transformer encoder is warm-started from an occupancy-greedy policy and refined with proximal policy optimization. The frozen policies were trained to maintain a channel assignment in every slot, including when queues were empty. We therefore replay them on held-out trajectories and distinguish standby assignment success from packet-present access and packet delivery. In a 20-channel network with 60 primary devices and 4 secondary users, TACAN achieves 92.53% +/- 0.47 packet-present access success, compared with 89.94% for Greedy and 83.53% for PPO+MLP. Its paired gain over Greedy is 2.59 points (parametric 95% CI 1.89-3.29), with wins in all five seeds; the exact two-sided sign-test value is 0.0625. The gain rises from 0.57 points at normal primary-user load to 7.67 points at extreme load. TACAN also reduces mean delivery delay from 1.208 to 1.123 slots and the conditional user-reliability gap from 9.69 to 3.15 points. Delivered packets per SU-slot remain arrival-limited (30.12% versus 30.11%), so no packet-throughput gain is claimed.

For next-generation air interfaces, two-sided artificial intelligence (AI) models have received growing attention, with AI models deployed at both the transmitter and receiver for efficient channel feedback and data communication. However, their practical deployment is complicated by assumptions commonly made in existing studies, including isolation from legacy users, training under predefined channel conditions, and gradient-based fine-tuning requiring substantial cross-vendor communication. This article revisits these assumptions and presents practical alternatives. First, for legacy coexistence, we integrate two-sided model processing into the 5G New Radio (NR) protocol stack and validate its operation alongside conventional NR on a real-world testbed. Second, instead of training under a massive number of predefined channel conditions, we construct a compact model table by jointly optimizing two-sided models with trainable surrogate channels, and select the best model according to the current channel condition to enable channel adaptation with high task performance and low training/storage overhead. Finally, unlike existing fine-tuning that exchanges large gradient vectors containing potentially private model information, we present gradient-free zeroth-order fine-tuning that requires only scalar feedback, facilitating multi-vendor interoperability. Together, these approaches advance the practical deployment of two-sided AI models while highlighting key open challenges.

5G networks employ multiple radio channels to meet growing demands for bandwidth and high-resolution video streaming for emerging applications. However, existing multipath video systems are largely designed around monolithic codecs, which require sufficiently complete chunk delivery, or layered codecs, which depend on timely base-layer delivery. Under fast-varying 5G conditions with blockage, handovers, and heterogeneous path capacities, we observe that decoding dependencies in existing codecs make multipath delivery fragile: transient under-delivery of critical video data can directly trigger stalls and degrade QoE. This paper proposes NeuralMDC, a neural multiple-description video codec co-designed with multipath streaming for dynamic 5G networks. NeuralMDC encodes each video chunk into independently decodable and mutually refinable description streams, each spanning the full chunk. This design changes the multipath delivery unit from dependent packets or layers to independent chunk-level streams, so missing streams primarily reduce quality rather than making the chunk undecodable. Built on NeuralMDC, we develop a user-space multipath streaming system that maps description streams to heterogeneous 5G paths with simple yet effective scheduling logic. Across trace-driven emulation and operational 5G experiments, NeuralMDC improves QoE by 26%-44% over existing monolithic, layered, and neural streaming systems, improves video quality by up to 41.8%, and keeps stall ratios below 0.32%.

Border Gateway Protocol (BGP) security is critical to Internet infrastructure, yet progress in routing anomaly detection has been limited by the scarcity of publicly available incident datasets, which contain only 18 recorded cases. We observe that public operator mailing lists, e.g., NANOG and AusNOG, contain abundant yet largely untapped reports of real-world routing anomalies. To leverage this source, we develop an LLM-assisted extraction pipeline that identifies 244 candidate incidents from historical discussion threads. After expert validation, we curate a verified benchmark containing 232 confirmed routing anomaly events, making it 11.89X larger than existing dataset. Using this benchmark, we show that existing routing anomaly detection systems generalize poorly to diverse real-world incidents. At the same time, we find that some general-purpose LLMs without routing-specific adaptation can identify a subset of routing anomalies, but their performance varies across models and remains insufficient for reliable routing anomaly detection. Motivated by this observation, we design ROUTELLM, an LLM-based routing anomaly detector that integrates BGP-semantic-aware tokenization, routing-domain adaptation, and time-aware routing evidence retrieval. Experimental results show that ROUTELLM achieves 87.13% event-level accuracy and 94.65% message-level accuracy, outperforming the strongest baselines by 55.30% and 68.50%, respectively. We open-source the verified routing anomaly benchmark, fine-tuned model, and implementation code to support future research on BGP security.

Quantum Error Correction~(QEC)-protected direct transmission is a fundamental approach to preserve fragile quantum states while they are physically forwarded across noisy quantum networks. When a logical qubit traverses multiple hops, selected QEC-capable nodes may recover the encoded state before it continues along the route. The feasibility and cost of the final transmission strategy therefore depend on how we jointly choose the path, the recovery locations, and the protection schemes. In this paper, we formulate and analyze a cross-layer spatio-temporal path optimization problem for block-style stabilizer-code-protected direct transmission. Our main results include fixed-scheme and flexible-scheme single-flow routing algorithms, as well as a multi-flow routing algorithm. The framework developed in this paper can serve as an algorithmic building block for QEC-aware routing under logical-error and logical-lifetime constraints. Simulations show that it reduces single-flow average routing cost by approximately 25–30% over Decode-Always and lowers multi-flow throughput-normalized congestion by approximately 28–31% over Greedy-Assignment.

As the use of Artificial Intelligence (AI) and Large Language Models (LLMs) is becoming common in everyday applications, their ability to interpret natural language has increased significantly. An emerging application of AI is integration with network management and orchestration practices. An instance of this integration is LLM-enhanced intent-based networking, where network operators will control a network using natural language. This work presents the use of dynamic routes with a semantic router to identify an intent from a network operator's prompt and extract necessary details for intent fulfillment in intent-based 5G+ core networks. Furthermore, the performance of static route selection is assessed by evaluating multiple encoders and dynamic route detail extraction accuracy against a series of realistic operator prompts. The presented results show that static and dynamic routes are successful in detail extraction and schema formatting.

The rapid growth of Low Earth Orbit satellite constellations has created increasing demand for efficient and scalable downlink services. Ground Station as a Service (GSaaS) provides an on-demand access model for satellite operators, but commercial GSaaS providers must schedule limited ground-station bandwidth among multiple satellites with heterogeneous data demands, overlapping visibility windows, strict deadlines, and strategic bidding behaviors. This paper studies GSaaS resource scheduling from a ground-station-centric perspective, where the provider jointly determines task admission, ground-station assignment, bandwidth allocation, and payments. Under satellite orbital dynamics, bandwidth constraints, and downlink task deadlines, maximizing the provider's revenue is NP-hard. To address this challenge, we propose STAR-GS, a truthful and feasibility-aware scheduling mechanism that combines bid-aware admission control, best-fit ground-station assignment, Earliest Deadline First (EDF)-based bandwidth scheduling, and critical-payment pricing. By integrating auction theory with schedulability analysis, STAR-GS incentivizes task owners to truthfully report their private valuations while ensuring that admitted tasks can be feasibly completed before their deadlines. Simulations using Ansys Systems Tool Kit (STK) show that STAR-GS consistently achieves higher revenue than heuristic baselines, obtains near-MILP performance with substantially lower runtime, and scales smoothly to workloads containing up to 900 tasks.

Managed Kubernetes pod deployment is often presented as a choice between VPC-native and overlay networking. Public EKS documentation describes prefix-mode capacity and configuration, while prior CNI studies primarily measure steady-state throughput and latency. This paper presents an operational measurement study of fleet-scale pod deployment across three VPC-native modes on Amazon EKS: individual secondary-IP allocation, ENI preallocation, and IPv4 prefix delegation, using Cilium and Calico as overlay baselines. We compare representative mode-specific warm-pool settings, so the results describe combined operating points. At 400 nodes, the tested three-address secondary-IP warm pool required 7,403 seconds to place 80,000 pods. With the tested ENI-preallocation and prefix-delegation settings, the same workload completed in approximately 495 seconds, moving address provisioning off the pod-creation critical path. In the reported 400-node runs, prefix delegation achieved approximately 162 pods/s, within the same observed range as the fastest overlay baseline and ENI-preallocation runs, while requiring fewer successful EC2 provisioning calls per pod than individual-IP allocation by allocating addresses in /28 blocks. Because each /28 contains 16 addresses and occupies one IPv4 slot, an interface with 30 slots carries 29 prefixes, representing up to 464 potential pod addresses, compared with approximately 30 IPv4 slots per ENI for individual-IP allocation when kubelet and CNI limits are configured accordingly. Prefix delegation also has lower documented network-address usage and retains direct VPC reachability and flow-log visibility but the trade-off is that /28 allocations require contiguous subnet space.

Software systems have traditionally been organized around applications where human users act as principal decision-makers. Recent developments in agentic capabilities alter this paradigm: software agents now autonomously translate high-level goals into structured tasks, orchestrating tools, services and sub-agents to execute complex workflows. This evolution gives rise to an agent economy where these autonomous agents capture real economic value. However, the infrastructure required to support the agent economy fails across three critical dimensions: the absence of persistent identity infrastructure prevents systemic accountability in agentic workflows; capability claims remain self-declared not backed by verifiable execution evidence; and the disconnect between creator identities, agent performance, and project value hinders the economic valuation of agents as assets. While existing registries provide naming and discovery, unifying these features around a persistent identity anchor remains largely unaddressed. TessIndex is a capability-verified identity system for agent primitives that utilizes a dual-plane architecture: the blockchain records compact commitments for identity, ownership, and verification, while centralized servers maintain dynamic metadata for discovery, commerce, and reputation. It establishes: persistent identities across agent primitives to enforce systemic accountability in autonomous workflows; a predicate-based verification process replacing self-declared claims with cryptographic capability proof; an identity infrastructure that links agent performance to both project and creator identities while capturing value through tokenization. Ultimately, TessIndex serves as an integrated infrastructure that binds an agent's existence across capabilities, execution, and reputation into a single persistent identity.