Papers

We analyse the data that the Apple App Store sends to and receives from Apple servers. We find that multiple cookies are sent by Apple servers and stored on the handset. Adverts with tracking identifiers are also stored on the handset, and we observe that adverts are selected by Apple servers using GDPR special category personal data such as sexuality, religious beliefs and health. User interactions with the Apple App Store (apps and adverts viewed, buttons clicked, searches made etc) are transmitted to Apple servers alongside identifiers linking this data to the individual user and device. We show that much of this data storage and transmission is not essential for the service requested by the user, namely to view, search and install apps. No consent is sought for any of this data storage and processing, and there is no opt out.

In recent years, Unmanned Aerial Vehicles (UAVs) or drones have been increasingly adopted in urban environments for applications such as parcel delivery, infrastructure inspection, emergency response, and drone light shows. A non-negligible issue is how to manage the increasing number of drones operated by different entities, to enable them to cooperatively avoid potential collisions and determine conflict-free short-term flight paths in urban airspace. This paper presents a Prediction-Based Short-Term Decentralized Greedy (PB-STDG) guidance algorithm for a structured Drone Road System (DRS). PB-STDG extends the original STDG algorithm by introducing a prediction mechanism that enables drones to anticipate the decisions of neighboring drones using additional information shared in beacon packets, aiming to address the over-conservative behavior observed in the STDG algorithm. Several simulation scenarios are conducted to evaluate and compare the proposed algorithm with STDG. The results show that PB-STDG improves traffic efficiency while maintaining a safety level comparable to that of STDG.

The synchronization of large-scale kinetic swarms with digital twin networks can generate substantial signaling overhead when predictable motion is repeatedly reported. To reduce such redundancy, we propose the thermodynamic digital twin (TDT), a physics-guided synchronization framework that combines field-based state extrapolation with event-triggered correction. For a closed domain with vanishing boundary flux, the divergence–entropy relation is used as a physical motivation for identifying structural changes in the reconstructed swarm field. Based on Reynolds decomposition, the hierarchical thermodynamic synchronization (HTS) protocol separates low-dimensional macroscopic drift updates from full-state microscopic corrections. A locally measurable smoothed-particle-hydrodynamics descriptor, combining velocity divergence and acceleration, provides an implementation-oriented early-warning trigger, while a transport-error analysis provides a short-interval rule for limiting silent extrapolation. The same extrapolation mechanism is further used as a predictor-like delay compensator in the closed-loop digital twin. Across the evaluated numerical settings, TDT reduces the generated edge-to-cloud synchronization payload relative to the considered baselines and exhibits a favorable empirical trade-off between tracking error and communication cost. The results also indicate improved delay tolerance in the evaluated control loop.

Many existing wireless digital twins (DTs) rely heavily on ray-tracing (RT)-based channel simulators to achieve scalability in large-scale environments. However, the geometric-optics (GO) approximations underlying RT become inaccurate in propagation regimes dominated by diffraction and refraction, which are prevalent at sub-6 GHz carrier frequencies. This paper presents a hybrid RT and physics-embedded physics-informed neural network (PE-PINN) framework that enhances site-specific wireless DTs with physics-consistent full-wave accuracy. Building on prior PE-PINN work, we introduce targeted architectural extensions, including a finite-length edge diffraction kernel and a lossy dielectric formulation based on complex wavenumbers, to accurately model electromagnetic wave interactions with realistic objects and materials. To balance accuracy and efficiency, we further propose a localized tunnel strategy that deploys PE-PINN models only along dominant propagation paths, selectively replacing or augmenting RT predictions in regions where GO assumptions break down. Comprehensive evaluations against full-wave COMSOL simulations demonstrate that the proposed framework closely matches reference solutions and significantly outperforms RT-only approaches in diffraction- and refraction-dominated scenarios. We further demonstrate seamless integration of the proposed approach into a realistic indoor wireless DT, highlighting its practicality and scalability for next-generation wireless network design.

Traffic classification (TC) is crucial to secure Internet of Things (IoT) networks, whose edge nodes often operate under privacy, bandwidth, and energy constraints. Yet, encrypted payloads and limited computing power make accurate, real-time TC a challenging task. Existing learning-based TC approaches often fix the input configuration a priori, even though it directly influences both predictive performance and computational cost. This paper presents RepTC, a representation-aware hardware-constrained strategy that addresses session-level TC through joint model and input optimization. The method co-optimizes network architecture, session length, and header preprocessing; this enables joint control of model complexity, input scale, and data representation within a unified resource-constrained design space. The proposed approach enforces microcontroller-class constraints on memory, model size, and computation, and yields compact models deployable on low-power edge devices. A gateway monitors traffic by aggregating sessions and either performs inference locally or offloads to a low-power edge node. Both scenarios are validated on heterogeneous embedded hardware, including a Raspberry Pi 3B+, STM32 Nucleo-F401RE, and XIAO ESP32-C3, spanning Cortex-A, Cortex-M, and RISC-V processor architectures; measured inference latency ranges from 0.63 to 18.59 ms, with MCU-side inference energy between 0.50 and 1.41 mJ per session. RepTC yields configurations that achieve high accuracy on a variety of established benchmarks: 96.21% on ISCX VPN-nonVPN, 99.62% on USTC-TFC2016, and 99.97% on Edge-IIoTset; at the same time, model size and computational requirements were reduced by up to three orders of magnitude compared with state-of-the-art methods. The results show that representation-aware optimization can improve efficiency while preserving competitive classification performance.

This paper studies distortion-aware clustering for uplink fronthaul-limited cell-free MIMO networks employing maximum ratio combining (MRC). While MRC is appealing for its low-complexity, its performance is limited by interference, fronthaul distortions, and channel imperfections. This motivates clustering strategies that compensate for these impairments through coordination of access points. Since instantaneous small-scale fading-based optimization is not scalable in large systems, and is impractical due to frequent channel variations, we instead optimize an objective depending only on large-scale fading coefficients. To this end, asymptotic analysis is used to derive deterministic equivalent expressions for the average network sum rate, with focus on quantization distortion, leading to a quadratic-over-linear objective. Although maximizing such an objective under binary constraints is non-convex, we exploit its structure to develop a polynomial time scheme that attains the global optimum. Numerical results show that the proposed clustering method provides performance gains over improved variants of existing literature, and remains competitive with the small-scale fading-based global optimum obtained via exhaustive search.

Segment routing (SR) involves routing requests through shortest paths or a limited number of segments, which are themselves the shortest paths between their endpoints. While this flexibility makes segment routing attractive for traffic engineering (TE) in IP/MPLS networks, it becomes challenging to update when some links become unavailable (e.g., maintenance) and routing decisions must adapt while limiting the number of configuration changes between two consecutive periods. We address the problem of dynamically selecting SR-TE configurations for multiple traffic demands with the objective of minimizing the maximum link utilization (MLU). In addition, a reconfiguration budget is imposed in order to limit the number of segments modified. Based on this representation, we develop a MLU column-generation optimization framework. It allows to jointly consider traffic distribution, SR configuration complexity, and temporal reconfiguration costs in time-varying IP/MPLS networks. The numerical results are obtained using realistic datasets provided by Orange, with topologies containing up to 1,263 nodes and 15,000 traffic demands. The optimality gap (i.e., accuracy) is below 5% in 80.45% of the 133 instance-time evaluations.

Most federated learning (FL) studies implicitly assume that training data is readily available at participating edge devices. In practice, this data must first be acquired through heterogeneous sensors with potentially different measurement modalities, and the quality and cost of this acquisition process can directly affect the learning performance. This dependence creates a coupled relationship among sensing, computation, and communication, necessitating a system model that captures their joint effect on resource efficiency and learning accuracy. This paper develops such a unified treatment for an over-the-air (OTA) FL system in which each device configures its sensing modality, power, resolution, and sample size, with aggregations conducted OTA at the server. We derive models for sensing noise, energy consumption, latency, and OTA aggregation distortion, and establish a non-convex convergence bound quantifying how these factors influence the global model trajectory. Guided by this analysis, we formulate a per-round optimization that balances energy, latency, and learning quality under physical device constraints. The resulting mixed optimization is addressed through an alternating procedure with closed-form and one-dimensional updates for continuous variables and a lightweight discrete search. Numerical experiments corroborate the advantage of jointly optimizing sensing, computation, and communication decisions.

Programmable Data Plane (PDP) switches enable flexible packet processing but remain limited in scheduling capabilities, particularly for priority-based policies that require strict ordering of packets according to user-defined ranks. An earlier work, called Push-in First-out (PIFO), proposed a priority queue that enables ordering enqueued packets based on their priority. It provided an ideal abstraction for programmable packet scheduling; however, its requirement for line-rate packet sorting makes it impractical at high network speeds (100 Gbps and beyond). Approximate schedulers such as SPPIFO, AIFO, and RIFO reduce complexity but introduce priority inversions, thus degrading latency, fairness, and Flow completion times (FCTs) since they rely on First-in First-out (FIFO) queues or use Active Queue Management (AQM) as a substitute for scheduling. To address the scalability limitations of accurate schedulers while avoiding the correctness issues of approximate schedulers, this work proposes two packet queuing architectures, Parallel Processing for Priority Ordering (P3PO) and Parallel PIFO Queuing Architecture (PPQA). Both architectures decompose a large global priority queue into multiple smaller bounded-capacity priority queues that operate in parallel. P3PO uses a cascading set of priority queues with priority-based bounds to ensure that packets are inserted into the earliest queue capable of maintaining ordering. PPQA distributes packets across multiple independent priority queues based on occupancy, using a demultiplexer for balanced queuing and a multiplexer for globally selecting the highest-priority packet at dequeue. The architectures are implemented in the NetBench packet-level simulator and evaluated using empirical datacenter workloads (Web-search and Data-mining).

Recent advances in artificial intelligence-radio access network (AI-RAN) are placing large language model (LLM)-driven agents within the open RAN (O-RAN) control hierarchy. A promising deployment for this agentic AI-RAN co-locates LLM inference with physical-layer (PHY) communication processing over the same accelerated compute pool for infrastructure sharing, data locality, and low control latency. However, this co-location induces bidirectional control-compute coupling, as the agent competes with PHY processing for compute, while its reasoned gNB control actions may alter future PHY workload and hence the compute available to its next inference. To this end, this article proposes the control-compute contract, a coordination protocol linking AI-RAN workload governance with O-RAN control execution. Specifically, we first expose direct compute contention on an over-the-air (OTA) O-RAN testbed, where continuous LLM inference increases the PHY decoding time approximately eightfold. We then formulate the contract as three protocol rules with operator-requirement protection, and map it onto O-RAN and AI-RAN functions as a five-stage workflow. Afterward, an OTA-calibrated case study of simulated uplink gNB control indicates that the contract keeps the proportion of slots violating the PHY time budget below $0.9\%$, against $20.7\%$ under ungoverned co-location, while achieving faster gNB control than a fixed compute reservation benchmark. Finally, we identify several open issues and outlooks for its practical deployment.

Disasters can overload cellular control-plane signaling within minutes, yet fine-grained Radio Resource Control (RRC) or Next Generation (NG) Application Protocol (NGAP) telemetry is privacy-sensitive and costly to collect for analytics. Many emergency monitoring pipelines therefore rely on coarse Call Detail Record (CDR) aggregates. We treat Internet activity in CDR grids as a practical proxy for hidden signaling stress under that constraint. We train a lightweight convolutional neural network (CNN) on stylized overload injections, stress-test it with diffusion-synthesized surges that preserve normal traffic structure, and adapt the detector by retraining on hard synthetic samples. Under stress-test conditions, the default alert threshold fails even though receiver operating characteristic (ROC) curves stay strong: the detector still assigns overloaded cells a larger overload probability than normal cells, but those probabilities fall below the default cutoff 0.5 and are labeled normal, so the F1-maximizing threshold – selected post hoc on the same stress-test grids (oracle $\tau^*$) – shifts by $0.32 \pm 0.03$ (operating-point drift). Across three random seeds, hard-sample adaptation raises thresholded performance (F1) from 0% (no alerts at the default cutoff 0.5 on any seed) to $85.67 \pm 14.37$% and ranking from ROC-AUC $0.886 \pm 0.040$ to $0.99996 \pm 0.00007$. Diffusion-synthesized surges expose threshold fragility that matched-condition training – training and testing on the same stylized injections – hides, and hard-sample adaptation restores usable alerts at the default cutoff. Together, these steps define a reusable pre-deployment stress test for emergency monitors. Internet-only CDR input further supports lightweight AI-native workflows that combine monitoring, recalibration, and adaptation.

Status updates let a receiver track a changing process, but a sender that controls when they are sent can steer the receiver's estimate without misreporting. We study competition between two such senders with opposing preferences, who report on a binary continuous-time Markov chain using state-dependent Poisson rates under individual budgets. The receiver follows the reports through a zero-order-hold estimator only if this yields at least the long-run weighted correct-estimation utility of a prior-based default estimate. We model the interaction as a Stackelberg game in which the sender favored by this default leads, the opposing sender follows, and the receiver then selects its estimator. We characterize the pure-strategy equilibria in closed form. When the follower can obtain positive utility against a silent leader, limited state-$0$ reporting by the leader merely frees part of the follower's budget for state-$1$ reports, so every optimal leader policy is either silence or full-budget state-$0$ reporting, depending on explicit budget thresholds. A single sender with the same total budget leaves the receiver at its default utility, whereas the full-budget intervention outcome makes the receiver's participation constraint slack and strictly improves its utility. At the intervention threshold, silence and full-budget intervention yield identical sender payoffs but different receiver utilities. Numerical results illustrate these regimes and compare equilibrium performance with a receiver-optimal reporting benchmark.

Directed Diffusion (DD), uses mechanisms such as data aggregation and in-network processing to suppress the additional data overhead however there is no guarantee that paths from nearby sources join after a few hops. Also for path construction, each source floods a distinct exploratory data (ED) packet through the network which is not necessary for nearby sources. In this paper an efficient data-gathering protocol (EDAP) is proposed to address the problems of late-aggregation and distinct ED-flooding through using a virtual sink (VS) node nearby the sources which plays the role of sink node and broadcasts local interest messages and routed gathered data toward destination. Also in this protocol, multiple paths are constructed between virtual sink and the sink node which leads to load-balancing and increase in the life-time of the network nodes. Our routing protocol can produce more than one disjoint or braided path and spread the gathered data properly between constructed paths according to their length and remaining energy. Simulation results shows that in this way a significant amount of energy can be saved and the network lifetime will be increased considerably (up to 75% better than DD).

Integrated Sensing and Communication (ISAC) will allow 6G networks to provide both sensing and communication services through shared infrastructure and spectrum resources. However, network slicing that views these services as distinct slices with distinct objectives and performance requirements will inevitably miss the emergent value of integrating them. By considering Sensing-Assisted Communication (SAC) and Communication-Assisted Sensing (CAS), which create interdependencies between services, we can observe trade-offs in resources dimensioned to support each slice and, ultimately, the ISAC slicing performance. As such, this paper proposes a performance analysis of an ISAC slicing framework that accounts for resource allocation and sensor density, as well as SAC and CAS, dimensioned to achieve slice-specific Service-Level Agreement (SLA) satisfaction. Numerical simulations, across different bandwidth allocations, sensor deployments, and demand scenarios, show that ISAC slicing performance is fundamentally constrained by sensing resolution, shaped by demand, and scaled by sensor deployment. These findings provide insights for the design of future ISAC slicing mechanisms.

Large low-earth orbit (LEO) satellite constellations are revolutionizing network access globally by delivering potential high-capacity, low-latency communication, fueling innovation and accelerating research in advanced space-based non-terrestrial network architectures. Consequently, a research testbed that allows flexibility in designing realistic network routing schemes, traffic load balancing and inter-shell communication methods to emulate real-world multi-shell network becomes an important tool for industry developers and academic researchers. This study broadens the scope of the SpaceNet testbed, now including emulation of multi-shell constellations and computation of routes with the existing global web of terrestrial terminals. Furthermore, the testbed produces accurate trends in return trip time (RTT) and throughput metrics due to its support of high-level congestion modeling and the necessary local and global congestion routing. To evaluate the efficacy of the testbed, the network performance of emulated results for the Starlink constellation is evaluated and compared with data from real Ping and iPerf tests between Starlink terminals. Two important communication scenarios have been discussed that highlight the testbed's potential for realistic multi-shell topology generation and handling various types of traffic distribution with well-informed congestion routing. Predictions of network performance using SpaceNet accurately addresses temporal behaviors for different traffic levels with strong temporal predictability in its throughput and RTT time-series, as well as enhanced ground truth coverage within a 95% confidence interval.

Distributed Fiber Optical Sensing (DFOS) leverages optical backscattering signals to predict failure events and enable proactive Just-In-Time (JIT) restoration. Modern network infrastructures have optical components and fibers as key enablers of high throughput and low latency. The integration of sensing features in this optical infrastructure adds features such as network diagnosis, spatial positioning and sensing, and opens up opportunities for the implementation of intelligent network control expected for the next-generation networks. In this paper, we study how the quantity and the placement of the DFOS devices in an all-optical network can mitigate failure events. In our evaluation, we consider metropolitan and data center elastic optical networks. This work also evaluates sensing devices with various prediction time capabilities, in order to assess their effectiveness when considering a variable number of deployed devices and different placement heuristics. The evaluation uses key performance metrics, including the bandwidth blocking rate, number of affected circuits by failure events, and the service downtime. Simulation results demonstrate that the Greedy Shortest Path Coverage (GSPC) heuristic substantially reduces the number of circuits affected by failure when DFOS devices cover only 5% of links, while 25% coverage shows a performance gain comparable to the full coverage scenario, which is an opportunity for significant cost reduction. Finally, for the 5% sensing coverage scenarios, our results illustrate that prediction windows of 15 ms and 7.5 ms are sufficient for JIT restoration in metropolitan and data center networks, respectively.

Ensuring fault tolerance in the User Plane Function is essential to maintain service continuity in 5G networks, particularly as latency-sensitive applications become more prevalent. This paper presents a novel mechanism for dynamic UPF failure detection and recovery within an OpenAirInterface-based 5G core environment. The approach introduces an application-layer session restoration mechanism to ensure service continuity and minimize disruptions during UPF failures. Experimental results demonstrate that the proposed mechanism reduces UPF downtime while maintaining low packet loss and enabling rapid service recovery. In tests with TCP and UDP traffic, connectivity was restored within a few seconds, minimizing service degradation. Furthermore, our failure-aware UPF selection mechanism improves long-term system resilience by considering recent failure history. The results highlight the effectiveness of our lightweight framework in improving the overall reliability of 5G networks, making it a valuable contribution to network robustness.

One of the promising applications of wireless sensor networks (WSNs) is monitoring of the human body for health concerns. For this purpose, a large number of small sensors are implanted in the human body. These sensors altogether provide a network of wireless sensors (WBANs) and monitor the vital signs and signals of the human body; these sensors will then send this information to the doctor. The most important application of the WBAN is the implementation of the monitoring network for patient safety in the hospital environment. In this case, supporting patients' mobility is one of the basic needs, which has been underestimated in recent studies. The problem that involves providing the required energy for the units used in this type of network is challenging; for this reason, sent/received units with very low power consumption and with a very small radius are used in order to save energy. The resulting small sending range leads to the lack of support for patients' mobility. In this paper, the ad hoc mode is suggested for use to establish a network and a multipath routing algorithm for the purpose of supporting patients' mobility in a hospital setting. The results of the simulation show that, in addition to supporting patients' mobility, the use of the proposed idea instead of previously presented protocols reduces delays in data transmission and energy consumption; it also increases the delivery rate depending on the destination and the lifetime of the network, while increasing routing overhead.

Large language model (LLM) agents are moving from chat interfaces into infrastructure operations, where they read telemetry, call tools, generate and execute code, and change the state of production Kubernetes clusters. This collapses a boundary that conventional cloud-native security assumes: the boundary between data and control. Content that an agent merely reads (a log line, a ticket, a tool description) can redirect what it does. This paper argues that the model must not be treated as a security boundary and that agent safety on Kubernetes is therefore an infrastructure problem: every guarantee must continue to hold under the assumption that the agent is fully compromised by prompt injection. We contribute (i) a threat model and ten-class threat taxonomy for agents operating on and within Kubernetes, aligned with emerging OWASP guidance for agentic applications; (ii) nine design principles, centered on complete mediation at the tool boundary and on breaking the combination of untrusted input, sensitive access, and external egress; (iii) a seven-layer defense-in-depth framework that maps each principle to native or widely adopted Kubernetes mechanisms: workload identity, RBAC and ValidatingAdmissionPolicy, gVisor/Kata sandboxing via the SIG Apps Agent Sandbox project, FQDN-aware egress policy, an agent/MCP gateway with policy-as-code over tool arguments, and eBPF runtime enforcement; (iv) a reference architecture with concrete policy artifacts and per-layer bindings for Amazon EKS, Azure Kubernetes Service, and Google Kubernetes Engine; and (v) a qualitative evaluation comprising a threat-control coverage matrix and four attack walkthroughs, with a proposed empirical methodology. We report no measured attack-success or overhead figures; instead we identify residual risks and the measurements needed to validate the framework.

Emerging experimental quantum network deployments are based on collaborations between research institutions and rely on telecommunications fiber infrastructure. Currently, such networks consist of mostly Dual Input Repeaters (DIRs) and can be viewed as composed of (mostly) line graphs. In order to evaluate the performance of such networks (e.g., in terms of Entangled Pair Rate, EPR, and average Fidelity) we developed a custom quantum network simulation platform that takes into account both the quantum and classical network components. To support the verification of the simulation results, we develop a novel approach for performance analysis of DIRs. We compare the simulation results to the analytical results for DIRs and to prior results for repeaters with more than two inputs. We observe that although the expected memory utilization cannot be bounded, a small DIR memory size is sufficient and leads to minimal performance degradation. For line networks with a single repeater and $3$ repeaters, we explore the dependency of incoming and outgoing memory size requirements on the number of nodes (network size), their connectivity (fiber length) and various quantum error settings (amplitude damping and phase flip channels). We evaluate the EPR and the average Fidelity for a sub-network of a deployed network with $3$ repeaters, using two alternative paths. We show that as the number of nodes increases or when the fiber lengths between nodes differ significantly, additional node memory is needed to maintain the same EPR (qubits are stored for longer duration to allow completion of entanglement across the network). We also show that the memory size should be above some minimum threshold to allow EP creation (EPR $>0$) as pair selection and swapping completion propagate across the network.

Generative and embodied AI services exchange token streams within continuing inference and control loops. Their communication requirements depend on each token set's purpose, useful timing, and execution context. This article organizes these properties into service, temporal, and stateful semantics and proposes a token service interface (TSI) between applications, radio access networks (RANs), and edge runtimes. TSI binds delivery requirements, readiness forecasts, and execution-state references to each schedulable token set, specifying field ownership, versioned updates, and admission feedback. A drone inspection case study over a decoupled RAN illustrates importance-aware radio allocation, advance preparation for timely delivery, and selective state migration that balances interruption against forwarding delay.

Within the shared industry vision of AI-RAN, AI-and-RAN seeks to co-locate virtualized radio access network (vRAN) workloads and AI services on shared GPUs. This sharing is inherently asymmetric: vRAN workload is latency-critical, whereas the machine learning (ML) workload is a throughput-oriented, best-effort co-tenant. We present Beaver, a GPU sharing system that jointly manages compute and memory resources while protecting the vRAN's strict processing deadline. Beaver sizes the vRAN's streaming multiprocessor (SM) allocation from each slot's scheduled workload, repartitions SM allocations at slot granularity, and rewrites compiled ML kernels to yield HBM bandwidth during the vRAN's memory-critical phases. We implement Beaver and evaluate it using NVIDIA Aerial with heterogeneous multi-cell workloads, real-world cellular traces, production inference kernels, and full-stack LLM serving. On an H200 GPU, Beaver keeps the vRAN's p99.9 latency within its 1.5ms uplink deadline while retaining 74% of Llama-3.3-70B serving throughput. It also incurs no observed deadline misses under replayed cellular traces, protects a 375us downlink deadline, and generalizes to other GPUs including A100, GB10 and GH200.

Energy saving has become a critical challenge in 5G and beyond networks. The rapid growth of connected devices has increased the overall network energy demand, driving operational expenditure to unsustainable heights. The Base Station (BS) accounts for the largest share of energy usage, typically consuming around 60-70% of the Radio Access Network (RAN)'s total energy. Therefore, to address this issue, this article optimizes the BS's energy usage while accounting for the dynamic behavior of User Equipment (UE). Deep Reinforcement Learning (DRL) is a natural candidate for determining effective energy saving policies, such as automatically switching BSs on or off when user density is low or adjusting transmission power to balance energy efficiency and Quality of Service (QoS). However, its heavy training burden and the exponential growth of state and action spaces in dense 5G environments make exploration increasingly difficult. To overcome these limitations, we introduce a novel Quantum Reinforcement Learning (QRL) algorithm that leverages quantum principles, including superposition and entanglement, through parameterized quantum circuits, enabling significantly faster convergence than DRL, which relies on conventional deep neural networks. Extensive simulations demonstrate that the proposed QRL can substantially reduce energy consumption while maintaining QoS, even when UEs are highly dynamic and frequently switch their association with BS antennas. Additionally, QRL consistently outperforms DRL and Q-Learning in both convergence speed and learning complexity.

Massively parallel GPU simulators train multi-robot policies in thousands of environments, and many fleets use private Fifth-Generation (5G) networks, where each robot's delay depends on its teammates' traffic. Network-in-the-loop training places a simulated 5G network inside this loop. However, GPU robot simulators reduce the network to an independent delay per message, while packet-level simulators run one scenario per CPU process and cannot keep pace with thousands of parallel environments. To bridge this gap, we present Isaac-Net, a GPU-batched 5G New Radio (NR) module that advances the uplink of thousands of environments in lockstep with Isaac Lab physics. Isaac-Net simulates every slot, the 0.5~ms interval in which the base station decides which robots transmit, for all environments at once. Extensive experiments confirm that its NR engine reproduces the median delay of ns-3 5G-LENA across loads, with a median delay 5–10% low on an unseen carrier and 9% high at 32 robots per environment in closed loop. The engine also reproduces the Age of Information (AoI), the age of each robot's newest delivered report, while an independent delay per message leaves the AoI tail about three times too light. In a configuration validated against 5G-LENA, Isaac-Net keeps the network in the loop for about one million robots on one GPU at 83% of the Isaac Lab rate without the network, measured under a random policy. Isaac-Net is open source at https://github.com/ZzZTripleZzZ/isaac-net

Commercial observability platforms rely on domain artifacts like distributed traces, topology maps, and baseline metrics. However, when troubleshooting proprietary software, enterprise operators are left with only raw, unannotated text logs. We explore the extreme boundary of log-only diagnosis: To what extent can we isolate failure propagation using strictly raw text logs? We present LOGOS, an unsupervised system that exploits entity-event co-occurrence and temporal precedence to collapse millions of raw log lines into a compact precedence forest. Evaluated across 25 production enterprise outages and 12 open-source issues, LOGOS operates with zero prior knowledge—requiring no seed queries, observed symptoms, or pre-defined incident boundaries. In a median wall-time of 4.5 minutes, LOGOS eliminates a median 99.8% of background noise, achieves 0.76 mean recall, and detects failure cascades with a 16-hour median diagnosis-verified lead time—consolidating alert floods 124x to enable 80% enterprise (100% open-source) zero-shot LLM root-cause accuracy.

The User Plane Function (UPF) of a 5G Standalone core terminates every GPRS Tunnelling Protocol user-plane (GTP-U) packet arriving from the radio access network, which makes its N3 interface both the busiest and the most exposed point of the mobile data path. As operators migrate the core onto Kubernetes and public cloud, the UPF increasingly shares a general-purpose Linux kernel with other workloads, and kernel-bypass frameworks such as DPDK become harder to operate. This paper presents GTP-Guard, a design for line-rate GTP-U admission control built on the eXpress Data Path (XDP) hook of the Linux kernel. GTP-Guard drops illegitimate tunnel traffic in the network driver, before socket-buffer allocation, using six ordered stages: peer allow-listing, GTP-U header validation, Tunnel Endpoint Identifier (TEID) admission against session state derived from the Packet Forwarding Control Protocol (PFCP), bounded extension-header parsing, inner-packet anti-spoofing with GTP-in-GTP detection, and per-session policing. We formalize stage ordering as a cost-minimization problem and show that sorting stages by the ratio of per-packet cost to rejection probability minimizes expected per-packet work, which motivates run-time reordering through tail-call program arrays when traffic mix shifts under attack. We further describe a Kubernetes deployment model based on a node-level DaemonSet with pinned eBPF maps that survive agent upgrades, discuss constraints specific to public-cloud virtual NICs, and define a reproducible evaluation methodology, with explicit hypotheses, for throughput, latency, CPU efficiency and attack resilience. This paper presents the design and methodology; experimental results will be reported in a subsequent version.

While the literature on blockchain-assisted intrusion detection and prevention systems (IDS/IPS) for Internet of Things (IoT) and Industrial Internet of Things (IIoT) networks is mature, existing systematic reviews suffer from two critical limitations: they overlook the structural shift toward modern Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) architectures, and they conflate blockchain's distinct functional roles into a single monolithic category. This Systematization of Knowledge (SoK) addresses these gaps by proposing a three-axis taxonomy that classifies proposals by detection-system class (NIDS, HIDS, EDR/XDR), blockchain functional role, and response-automation maturity. Synthesizing research published in high-impact venues between 2019 and 2026, we provide a rigorous gap analysis exposing why a genuine per-endpoint blockchain-anchored response loop remains nearly nonexistent due to latency, deployment, and community mismatches. Furthermore, we evaluate structural, cross-cutting challenges persisting across the literature, including consensus latency on constrained devices, post-quantum cryptographic vulnerability, smart-contract attack surfaces, and the adversarial vulnerability of evolving LLM-based detection engines. Finally, we outline a comprehensive research agenda centered on hybrid on-chain/off-chain orchestration to bridge the gap between decentralized trust and rapid response automation.

Recent 3GPP releases have extended 5G New Radio (NR) Sidelink (SL) to support device-to-device (D2D) relay and multi-hop capabilities. This paper presents SL-RFSIM, a component-based experimentation framework extending OpenAirInterface (OAI) with scalable multi-hop NR SL capabilities. SL-RFSIM replaces the legacy OAI RF simulator with a broker-based publish/subscribe architecture enabling arbitrary peer-to-peer connectivity while preserving compatibility with the OAI protocol stack. The framework further integrates pluggable mobility, propagation, reception, and monitoring services, and supports Layer-2 mesh networking through BATMAN-adv. Experimental evaluation on the SLICES-RI research infrastructure validates the proposed architecture through representative mesh networking scenarios and identifies the current software bottlenecks limiting scalability. SL-RFSIM provides an open-source foundation for reproducible experimental research on 5G NR SL and future multi-hop cellular mesh networks.

Credential-based Extensible Authentication Protocol (EAP) authentication cannot distinguish a legitimate credential holder from an adversary using compromised credentials. Physical Layer Deception (PLD) complements credential-based authentication by exposing a deceptive primary object over a primary transport while a separate recovery object travels with differentiated reliability over a secondary channel. Existing PLD studies remain, to our knowledge, at the physical/link-model level; using PLD's activation/deactivation mechanism as an authentication gate creates an authentication-specific design requirement, since an all-inactive attempt would exercise no recovery path. We present a batched PLD-based re-verification step for Enterprise Wi-Fi's TEAP/RADIUS/IEEE 802.11 authentication chain, implemented end to end across the server, access point, and device in the open-source hostap 2.12 codebase. Each attempt carries three rounds, at least one active, with no dedicated activation flag. Across four campaigns totaling 1593 attempts, the prototype evaluates batched recovery behavior, rejects the implemented naive credential-bearing attacker in all 30 attempts, measures successful-path latency, and evaluates the security-reliability trade-off for one, two, and three active rounds under two modeled recovery regimes. The evaluation exercises the protocol and software-MAC behavior directly and analyzes informed and retry-seeking attackers under the software recovery model.

Unmanned aerial vehicle (UAV) swarms increasingly rely on language-model agents to provide adaptive mission-level reasoning in uncertain environments. Fully distributed control, in which each UAV hosts an independent Small Language Model (SLM), removes reliance on a centralized coordinator but introduces an information-management problem: long-running interaction histories can degrade the reasoning context, while indiscriminate information dissemination increases communication and inference overhead. We address these challenges with a distributed UAV-agent architecture that enables continuous local SLM control through an event-driven reason-act-observe lifecycle. Runtime knowledge is represented as structured atomic notes and organized into core, local, and peer-specific memory. A deterministic interest-aware gossip engine selectively disseminates these notes according to recipient-specific semantic novelty and recency. We evaluate the architecture using ten UAVs in a simulated search-and-rescue mission. Our approach completes all experimental runs, whereas unrestricted flooding messages completes only 70-85%, and delegating forwarding decisions to the SLM prevents mission completion in every run. Compared with unrestricted flooding, our approach approximately halves inference-token consumption, reduces transmitted data, and achieves lower survivor-count error.