arXiv 论文速递

IPv4 NAT has limited the spread of IoT botnets considerably by default-denying bots' incoming connection requests to in-home devices unless the owner has explicitly allowed them. As the Internet transitions to majority IPv6, however, residential connections no longer require the use of NAT. This paper therefore asks: has the transition from IPv4 to IPv6 ultimately made residential networks more vulnerable to attack, thereby empowering the next generation of IPv6-based IoT botnets? To answer this question, we introduce a large-scale IPv6 scanning methodology that, unlike those that rely on computationally intensive algorithms, can be run on low-resource devices common in IoT botnets. We use this methodology to perform the largest-scale measurement of IPv6 residential networks to date, and compare which devices are publicly accessible to comparable IPv4 networks. We received responses from 93,832,220 distinct IPv6 addresses, 14,901,892 of which are inside of residential networks (i.e., not the external-facing gateway IP). These residential network internal addresses span 4,412 ASes across 144 countries. These responses come from protocols commonly exploited by IoT botnets (including telnet and FTP), as well as protocols typically associated with end-user devices (including iPhone-Sync and IPP). Compared with IPv4, we reach 11x more HP printers over IPv6 than Shodan finds across the entire IPv4 Internet, and thousands of iPhones and smart lights whose services IPv4 NAT made unreachable by default. Collectively, our results show that NAT has indeed acted as the de facto firewall of the Internet, and the IPv4-to-IPv6 transition of residential networks is opening up new devices to attack. Finally, we discuss potential mitigations to prevent in-home network reachability as IPv6 adoption continues to grow.

IPv4 NAT has limited the spread of IoT botnets considerably by default-denying bots' incoming connection requests to in-home devices unless the owner has explicitly allowed them.

Network operators frequently encounter protocol divergence---where ICMP, TCP, and UDP experience different treatment along a path. Existing tools identify where divergence occurs but not why, forcing manual investigation that delays resolution. We present two contributions: (1) the AS-Boundary Divergence Score (ABDS), a metric that correlates protocol divergence locations with BGP topology to automatically classify causes as routing-policy-driven versus internal-policy-driven; and (2) the localhost response signature, an empirical finding that security appliances return 127.0.0.1 in TTL-exceeded messages to mask their IPs. We evaluate ABDS against 496 targets across 8 categories (Finance, Government, Education, Healthcare, Tech, E-commerce, Media, International), with multi-vantage validation from 10+ global locations confirming routing consistency. ABDS achieves 100% classification accuracy on verified divergent targets (50/50), significantly outperforming majority-class baseline (54%, McNemar's p < 0.001). The localhost signature achieves 100% precision (18/18, 95% CI: [82%, 100%]) in identifying security appliances across 9 categories including government (IRS, USPS, VA), finance, and healthcare. Our open-source Rust implementation enables automated escalation decisions, reducing mean-time-to-resolution for network operators.

Network operators frequently encounter protocol divergence---where ICMP, TCP, and UDP experience different treatment along a path.

Software-defined networking (SDN) separates the control and data planes, enabling programmable, centralized network management. A core SDN service is topology discovery --- a periodic process that identifies network links. However, our analysis of five open-source SDN controllers and ten discovery protocols shows that all remain vulnerable to at least one form of link-fabrication attack. The common root cause is their reliance on traditional Link Layer Discovery Protocol (LLDP) packets, whose static identifiers expose their discovery purpose and attract adversaries to exploit them. We propose ChameleonDisc, a dynamic link-discovery protocol that simultaneously prevents and detects topology-poisoning attacks by eliminating this root cause. Our key insight is that an SDN controller can infer topology without embedding meaningful information in discovery packets. ChameleonDisc removes targetable static LLDP signatures and employs a moving-target defense that combines decoy, obfuscation, and camouflage techniques instantiated dynamically at runtime to prevent topology poisoning and detect manipulation. We implement ChameleonDisc on OpenDaylight and demonstrate effectiveness against all identifier-based topology-poisoning attacks. On a 252-link topology, median convergence is 1.37--4.53\,s for legitimate link changes and 4.06\,s for malicious relay detection, with 13.0 percentage points of additional mean CPU and negligible retained-heap difference. Across topologies up to 816 links, ChameleonDisc provides a tunable security--performance trade-off; expanding discovery intervals reduces CPU and mapping state at the cost of increased attack-detection latency.

Software-defined networking (SDN) separates the control and data planes, enabling programmable, centralized network management.

This paper introduces LQ8, an open-source weak-signal digital mode for amateur radio that completes structured two-way contacts in 4 transmissions (60 s), achieving a 1.50x speedup over canonical 6-transmission exchanges (90 s) and 1.25x over 5-transmission RR73 exchanges (75 s) while preserving complete bidirectional exchange of Maidenhead grid locators, signal reports, and mutual acknowledgments. By replacing fixed-width message-type headers with variable-length prefix codes matched to physical-layer bit budgets, LQ8 packs the answering station's grid locator and measured signal report into a single 77-bit reply. In multi-station pileup operations, LQ8 confirms up to two answering stations simultaneously within a single-carrier 50.0 Hz transmission with a 0.0 dB RF power-splitting penalty, achieving a peak rate of 240 QSOs/h in continuous pileup (4x over single-carrier FT8; 480 QSOs/h dual-carrier) while retaining -21.0 dB SNR sensitivity. The protocol family also defines three extended profiles (LQ16, LQ4, and LQ2) tailored for extreme sensitivity, VHF/UHF contesting, and fast-burst channels.

This paper introduces LQ8, an open-source weak-signal digital mode for amateur radio that completes structured two-way contacts in 4 transmissions (60 s), achieving a 1.50x speedup over canonical 6-transmission exchanges (90 s) and 1.25x over 5-transmission RR73 exchanges (75 s) while preserving complete bidirectional exchange of Maidenhead grid locators, signal reports, and mutual acknowledgments.

Optical circuit switch (OCS) can reconfigure physical connectivity to match the predictable communication schedules of large language model (LLM) training. Although each OCS light path is physically simplex, existing demand-aware OCS schedulers allocate capacity in duplex-port pairs, forcing equal bandwidth in both directions and stranding capacity under asymmetric node-pair traffic. This paper present LACE, the first offline OCS schedule compiler that independently allocates transmit (TX) and receive (RX) lanes for LLM training. Without changing the selected collective algorithms, operation order, or rank placement, LACE reconstructs directed node-level demand, jointly determines which consecutive operations share a configuration and how many simplex circuits serve each direction, and realizes these allocations as physical lane bindings and optical paths under per-node lane-inventory and multi-OCS fabric constraints. Software acknowledgments carry feedback over independently provisioned return paths, while coordinated link configuration and recovery verify each configuration before communication resumes. On a separate three-server testbed using fixed topologies and matched per-port rate limits, LACE's asymmetric connectivity achieves $1.80\times$ speedup for communication replay and $1.27\times$ for GPT-2 training over a symmetric-topology baseline. At larger scale, simulations of LLaMA-3.1 70B and 405B schedules with sixteen 400-Gb/s ports per server show that LACE achieves $1.21$--$2.04\times$ communication speedup over the latest duplex OCS scheduler.

Optical circuit switch (OCS) can reconfigure physical connectivity to match the predictable communication schedules of large language model (LLM) training.

DNSSEC authenticates RRsets, but does not provide endpoint authentication or channel security. DNS-over-TLS (DoT) and DNS-over-QUIC (DoQ) can facilitate such needs, but were designed for the stub-to-resolver hop, where stable long-lived connections amortize the expensive initial setup. The recursive-to-authoritative path's high fan-in and nonuniform per-resolver query frequency invert said dynamics. Post- quantum primitives further sharpen this mismatch: an ML-DSA WebPKI certificate chain crosses TCP's initial window, a cold PQ DoQ may incur up to about 140 times the total bytes of the same query over UDP. A survey of TLD and 2LD nameservers further bounds connection lifetimes, with almost half surveyed imposing limits on even non-idle connections. We present Enc53 -- a stateless session ticket protocol enabling efficient authenticated authoritative DNS encryption. Enc53 splits DNS encryption into 2 phases: a short-lived, DNSSEC-anchored, TLS- authenticated provisioning on the initial query in the 1st, and a steady state of 1-RTT AEAD-encrypted UDP DNS queries in the 2nd. Enc53 is server-side stateless: recursive resolvers hold the traffic secret and session ticket, authoritative nameservers hold only a symmetric STEK. We implemented Enc53 in Knot DNS. After provisioning, a steady state Enc53 exchange costs about 570 B -- roughly 3 times a plain UDP query -- and lands within 1 ms of the unencrypted UDP baseline. Resumed PQ-ADoT pays 7.7 times the bytes and 3 times the latency; resumed PQ-ADoQ pays 10 times the bytes for the same latency. When evaluated against a root server query trace, Enc53 achieves 2-fold compute efficiency over ADoT/ADoQ, 3-fold memory efficiency over ADoT, and 12-fold memory efficiency over ADoQ. Finally, when deployed in conjunction with FN-DSA-512 PQ-DNSSEC, the joint Enc53-DNSSEC UDP datagram remains below the 1232B buffer limit.

DNSSEC authenticates RRsets, but does not provide endpoint authentication or channel security.

Software-defined vehicular networks (SDVNs) under high mobility and fluctuating traffic demand offer programmable, centralized control for latency-sensitive intelligent transportation systems. However, data-plane Quality of Service (QoS) is often degraded by control-plane overload due to frequent handovers and dense vehicle-to-infrastructure (V2I) contacts. To address this, we propose two lightweight mechanisms for low-latency control-plane resizing in multi-controller SDVNs. The first - \textit{Control-plane Centric Control-plane Resizing Mechanism} - proactively offloads roadside units from overloaded controllers to underloaded or idle ones when a predefined load threshold is exceeded, preventing prolonged overload with minimal decision latency. The second - \textit{Data-plane Centric Control-plane Resizing Mechanism} - triggers resizing based on observable data-plane QoS degradation, such as average round-trip time exceeding a QoS threshold, aligning control-plane adaptation with V2I service experience. Both mechanisms are implemented and evaluated on Mininet-WiFi emulation testbeds with realistic worst-case vehicles mobility. Compared to fixed single-controller and static multi-controller benchmarks, the proposed algorithms significantly reduce end-to-end delay and packet loss while improving load balancing rate.

Software-defined vehicular networks (SDVNs) under high mobility and fluctuating traffic demand offer programmable, centralized control for latency-sensitive intelligent transportation systems.

Next-generation connectivity depends on data traversing multiple physical media within a single end-to-end path, yet research in optical fibre, free-space optical and radio wireless, non-terrestrial networks, and underwater communications has advanced largely in isolation. This fragmentation has a wider adverse impact on communication performance, deployment and adaption as the most demanding open problems in next-generation connectivity, cross-medium channel characterisation, transport-layer protocol design across heterogeneous latency regimes, and cross-domain orchestration, sit at the boundaries between domains and can only be addressed by bringing these challenges together in cross-domain systems. Space-air-ground integrated network research has begun to treat three domains analytically, and its recent extension to the sea surface represents the most ambitious multi-domain framework proposed to date, yet neither has produced experimental results, a deployed system, or a standards engagement. The subsurface and maritime domain remains absent from both. This paper proposes the connected heterogeneous all-medium integrated network (CHAIN), a framework that treats the undersea, maritime, terrestrial, aerial and space domains as a single design space. We identify an all-photonic network backbone as the unifying physical infrastructure, Artificial intelligence (AI)-driven orchestration as the cross-domain control layer, and the joints between domains as a unification challenge. We survey the state of the art across all domains and the existing cross-domain literature, develop the CHAIN framework and its technical pillars, characterise the five core open problems the field must resolve, and set out a research roadmap from near-term measurement campaigns and testbed validation through cross-medium field trials to global-scale deployment.

Next-generation connectivity depends on data traversing multiple physical media within a single end-to-end path, yet research in optical fibre, free-space optical and radio wireless, non-terrestrial networks, and underwater communications has advanced largely in isolation.

A cryptographically relevant quantum computer will break the elliptic-curve cryptography behind Bitcoin and its Lightning Network, the most widely used payment channel network. Even a post-quantum consensus upgrade of Bitcoin would not cover Lightning's off-chain surfaces, so its gossip, peer transport, invoices, payment onions, and offers need separate protection. An adversary can already record Lightning's encrypted traffic today and decrypt it once such a computer exists. Lightning can therefore move to post-quantum cryptography now, without waiting for Bitcoin, and stop such harvest-now-decrypt-later attacks along with node impersonation, invoice forgery, and payment deanonymization. In this paper, we propose PQLN, a hybrid post-quantum extension of Lightning that protects all of these surfaces with the lattice-based standards ML-DSA and ML-KEM. PQLN distributes post-quantum node identities through Lightning's gossip, hybridizes the transport handshake, adds post-quantum signatures to invoices, commits post-quantum keys in offers, and makes payment onions hybrid. Since post-quantum material is much larger than its elliptic-curve counterpart, we introduce techniques that fit it into Lightning's existing message formats and size limits. We analyze the security of PQLN against a quantum adversary and implement it in rust-lightning, a major Lightning implementation. Our evaluation with real Lightning nodes shows that PQLN nodes interoperate with unmodified nodes. The added cryptographic operations take at most 0.33 milliseconds, and the main cost is communication, since gossip data grows about tenfold with ML-DSA and about fourfold with the smaller Falcon. To our knowledge, PQLN is the first post-quantum design, implementation, and evaluation for Lightning.

A cryptographically relevant quantum computer will break the elliptic-curve cryptography behind Bitcoin and its Lightning Network, the most widely used payment channel network.

This paper presents the design implementation and evaluation of NetMon a hybrid network monitoring system designed for Kubernetes-based 5G packet core deployments specifically evaluated on Ericssons Access and Mobility Management Function AMF clusters NetMon combines eBPF-based passive kernel-level traffic observation with active TCP probing and centralized correlation to detect and localize network degradation within seconds The evaluation results demonstrate that the system detects faults as subtle as 10ms of added latency or 5 packet loss correctly attributes them to the affected infrastructure component and maintains this capability under application loads up to 50 simulated UE load The total resource overhead of 34 millicores CPU and 45 MiB memory per pod suggests that the approach is promising for further validation without impacting the monitored workload The hybrid approach addresses a gap in existing monitoring tools standard health checks cannot detect partial degradation scrape-based systems introduce detection delays measured in tens of seconds and purely passive tools cannot verify idle network paths By combining these complementary techniques and centralizing the analysis the system provides the early detection and fault localization capabilities required for maintaining service quality in cloud-native 5G infrastructure.

This paper presents the design implementation and evaluation of NetMon a hybrid network monitoring system designed for Kubernetes-based 5G packet core deployments specifically evaluated on Ericssons Access and Mobility Management Function AMF clusters NetMon combines eBPF-based passive kernel-level traffic observation with active TCP probing and centralized correlation to detect and localize network degradation within seconds The evaluation results demonstrate that the system detects faults as subtle as 10ms of added latency or 5 packet loss correctly attributes them to the affected infrastructure component and maintains this capability under application loads up to 50 simulated UE load The total resource overhead of 34 millicores CPU and 45 MiB memory per pod suggests that the approach is promising for further validation without impacting the monitored workload The hybrid approach addresses a gap in existing monitoring tools standard health checks cannot detect partial degradation scrape-based systems introd

Distributed Denial-of-Service (DDoS) attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. Recent work has yet to study the impact of the hosting software architecture on network monitoring solutions, or to assess recent algorithms for improving attack detection. This paper presents a Network Intrusion Detection System (NIDS) for DDoS detection in transport networks, developed in collaboration with Ericsson. Building on a statistical baseline, we improve detection effectiveness with an Isolation Forest trained on a wider set of flow features, extracted by GoFlowMeter, our open-source Go implementation of CICFlowMeter, and we integrate eBPF/XDP so that the NIDS filters real traffic at the kernel level. We further compare three deployments, monolithic, Kafka-based, and gRPC-based microservices, on a Raspberry Pi 5 testbed replaying the CIC-DDoS2019 dataset as real network traffic. Detection quality is governed mainly by the choice of detector rather than by the transport: the Isolation Forest raises recall and F1 score (0.965 live in the monolithic variant) over the baseline by flagging low-volume attack windows that the baseline misses. The transport is not neutral, however: gRPC reaches almost the same accuracy as the monolithic variant while adding less than 2 milliseconds of transport time per window, whereas the asynchronous Kafka pipeline trails by roughly nine percentage points and adds about 27 milliseconds. These findings clarify the trade-off between detection quality and architectural overhead when deploying a NIDS on resource-constrained hardware.

Distributed Denial-of-Service (DDoS) attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target.

In recent years, large language models (LLMs) have driven substantial intelligent transformation across diverse industries. Commercial LLM training is typically performed over data center networks (DCNs) comprising hundreds to thousands of GPUs, with multiple devices collocated per node. As network scale expands, inter-node communication becomes a primary bottleneck to training efficiency. Network-state simulators therefore play a crucial role by enabling cost-effective evaluation of network configurations and parallelization strategies through faithful emulation of DCN dynamics during LLM training. However, existing simulators are constrained by a efficiency-fidelity tradeoff, as packet-level simulators (PLSs) incur prohibitive runtime overhead, whereas flow-level simulators (FLSs) compromise essential modeling accuracy. In this paper, we develop \texttt{HyGra}, a hybrid-granularity network-state simulator that exploits intrinsic network dynamics in LLM training to adaptively switch simulation granularity. Specifically, \texttt{HyGra} employs packet-level simulation during non-steady phases with transient fluctuations and flow-level simulation during steady phases with periodic patterns, thereby accelerating execution while preserving high fidelity. Moreover, it requires no specialized hardware, supports single-machine deployment, and is compatible with existing simulators. Experiments based representative commercial LLM workloads, including ChatGPT, DeepSeek, and Qwen, show that \texttt{HyGra} achieves up to 15.4$\times$ speedup under single parallelization strategy and 7.8$\times$ under hybrid parallelization strategies while maintaining high accuracy.

In recent years, large language models (LLMs) have driven substantial intelligent transformation across diverse industries.

Open-source fifth-generation (5G) and Open Radio Access Network (O-RAN) experiments span simulation, host operating system (host-OS) emulation, software-defined radio hardware-in-the-loop testing, Open Radio Unit fronthaul deployments, wireless digital twins, and accelerator-backed radio access network (RAN) runtimes. These environments may expose similar interfaces while preserving different timing, input/output, synchronization, buffering, transport, and observability; \emph{functional compatibility is therefore not timing fidelity}. This paper presents AtlasRAN, a claim-to-capability framework for deciding what an open-source 5G platform can credibly measure. It combines two reference paths, an execution-regime matrix, and a measurement-backed case study comparing OpenAirInterface (OAI) radio-frequency simulator (RFSim) with the Sionna Research Kit (Sionna-RK), which offloads low-density parity-check (LDPC) decoding to CUDA while retaining the surrounding OAI host-OS path. From one to six users, aggregate uplink goodput falls from 114.59 to 35.09~Mb/s for OAI and from 103.34 to 35.01~Mb/s for Sionna-RK. At six users, both RFSim real-time factors are approximately 0.55, despite estimated cumulative LDPC work of 1.09~ms per transport block for OAI and 0.37~ms for Sionna-RK. Timing-normalized service remains 60.7--63.6~Mb per emulated second across complete runs, while falling host and accelerator utilization is consistent with an under-fed decoder. A twelve-user run is retained only as failure-region evidence because end-of-test traffic summaries are absent. The practical takeaway is that integrated wireless testbeds, edge platforms, artificial-intelligence-enabled RANs, and digital twins should report timing discipline, transport path, memory movement, and observability as first-class experimental variables.

Open-source fifth-generation (5G) and Open Radio Access Network (O-RAN) experiments span simulation, host operating system (host-OS) emulation, software-defined radio hardware-in-the-loop testing, Open Radio Unit fronthaul deployments, wireless digital twins, and accelerator-backed radio access network (RAN) runtimes.

Autonomous network management requires systems that can evaluate Network Service Intents (NSIs) under varying conditions without manual implementation of analysis logic, as envisioned in TM Forum Level~4 (L4) autonomy. Behavioral Network Digital Twins (NDTs) enable such evaluation, but existing NDTs rely on pre-defined analytical logic, limiting adaptability for evolving closed-loop control. This paper introduces the NDT factory, a multi-agent software system that synthesizes executable behavioral NDTs on demand from semantic models using Large Language Model (LLM). We validate the system using a Call Admission Control (CAC) case study, where deterministic what-if analysis serves as the admission decision process. The NDT factory generates a complete CAC NDT through parallel synthesis and orchestration, achieving 100% compilation and test pass rates across multiple runs. Simulation over 300 NSIs shows 99.3% decision agreement with a reference implementation, 90% admission rate, and correct attribution of all rejections, demonstrating reliable synthesis with deterministic, verifiable execution.

Autonomous network management requires systems that can evaluate Network Service Intents (NSIs) under varying conditions without manual implementation of analysis logic, as envisioned in TM Forum Level~4 (L4) autonomy.

Considering sharing or coexistence from the perspective of spectrum alone fails to recognize that any spectrum-enabled service also requires (i) radio and processing infrastructure and (ii) a protocol stack, including waveforms and signal processing pipelines. The efficiency of spectrum coexistence frameworks such as Citizen Broadband Radio Service (CBRS) is thus limited to optimizing resource allocation across a single dimension. How to address this limitation, however, remains an open challenge, especially considering the diversity of requirements and operational modes across spectrum services (e.g., sensing, communications, navigation, or positioning). This article introduces Open Spectrum, an architecture that brings softwarization, programmability, and open interfaces to heterogeneous spectrum services, extending the open Radio Access Network (RAN) principles beyond wireless networking. We propose to combine spectrum, services, and infrastructure in a common pool. Its resources are shared and orchestrated by a Spectrum Intelligent Controller (SIC), with plug-and-play spectrum applications, i.e., Spectrum Applications (sApps), and data-driven Radio-Frequency Interference (RFI) modeling using Digital Twins (DTs). We describe the Open Spectrum architecture, shared infrastructure pool, and operational workflows for tenant onboarding and incentives, conflict resolution, and service sharing across sensing, radionavigation, radiolocation, and cellular systems. System-level simulations using the BostonTwin urban DT and Sionna ray tracing show that there exist performance-driven incentives in sharing infrastructure and sharing across multiple services, enabling increased access to spectrum and improvement in median Signal to Interference plus Noise Ratio (SINR) of up to 12 dB.

Considering sharing or coexistence from the perspective of spectrum alone fails to recognize that any spectrum-enabled service also requires (i) radio and processing infrastructure and (ii) a protocol stack, including waveforms and signal processing pipelines.

The open web ran on an unwritten bargain: sites admitted crawlers, and search engines sent visitors back. Public measurements show that bargain breaking under AI crawlers and agents. Automated clients now make up most requests, training dominates Cloudflare-classified crawling, and the largest AI platforms fetch thousands of pages for each visitor they return. The web's common control, robots.txt, cannot express identity, purpose, terms, or price, can be circumvented, and newer alternatives are largely proprietary CDN features. We specify terms.txt, a robots.txt-style file for per-path, per-purpose machine-access terms, plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. We define what the exchange can enforce, audit, and leave to contract. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

The open web ran on an unwritten bargain: sites admitted crawlers, and search engines sent visitors back.

Hurricane Helene produced the largest absolute cell-site outage in the public FCC record, peaking at 4562 sites. The conventional model is physical: towers destroyed. Helene did destroy over 1700 miles of fibre, but almost none of it was cell sites. We present the first cause-decomposed study of the FCC's Disaster Information Reporting System, reconstructing 80 state-days and 580 county-days from 24 daily filings by two reconciled independent extractions. Damage to cell sites is negligible: 1.1% of attributed cell-site-days across six states, at most 3.8% anywhere. The sites were standing. What took them out divides by terrain: pooled, power dominates at 63.2%, but in mountainous North Carolina severed transport (backhaul) reaches 52.2% against 47.3%, and in Tennessee 69.9%. North Carolina's transport share rises from 7.0% to 85.0% across the event (\r{ho} = 0.92). Seventeen days after landfall, on 15 October, 47 sites lost transport across six contiguous North Carolina counties with no rainfall, no power loss, no damage, and recovery by the next report. Independent active-probe measurement corroborates it: responsive /24s fall 1.02% for twelve hours while Tennessee stays flat. We release the dataset. Backup power is the standard resilience investment; here it addresses the smaller half of the problem.

Hurricane Helene produced the largest absolute cell-site outage in the public FCC record, peaking at 4562 sites.

We propose a variable and behavior-based node-specific proof-of-work (PoW) model for a directed acyclic graph (DAG)-based distributed ledger technology (DLT) network to mitigate decentralized network congestion control. Network congestion control for centralized communication systems is an established field of study, with detailed and continuous research being done on the subject. However, attention to congestion control in decentralized networks is relatively recent and underexplored, especially with DLT, such as blockchain and DAG-based networks. For the DLT networks, the network congestion is caused by factors such as transaction spamming, an increase in the user base, and the launch of new tokens. We focus on the congestion caused by the spamming of transactions within the blockchain and DAG-based DLT network. Based on the network throughput of transactions per second and consensus procedure, the DAG-based DLT needs to control network spamming more than the blockchain network. The PoW model within the DLT consensus framework is a limited deterrent against spamming. Our model provides equal opportunities for all stakeholders regardless of their computational resources. It prevents and penalizes any node that attempts to spam or dominate the network with more than the prescribed number of transactions. Since the system nodes compete to issue transactions with finite network resources, we display the system behavior through a non-cooperative game. Further, we show that our model enforces prescribed behavior amongst the nodes through the proof of the existence of Nash equilibrium in the game.

We propose a variable and behavior-based node-specific proof-of-work (PoW) model for a directed acyclic graph (DAG)-based distributed ledger technology (DLT) network to mitigate decentralized network congestion control.

LoRa-based non-terrestrial networks are rapidly becoming infrastructure for global IoT, with LEO satellites delivering direct-to-device connectivity and drone-mounted gateways serving precision agriculture, emergency response, and environmental monitoring. Both settings share a fundamental MAC-layer bottleneck: large coverage footprints cause thousands of devices to collide on the same channel, while gateway mobility induces rapid link variations, making link-unaware transmissions a persistent source of wasted airtime. These challenges demand random-access solutions, yet ALOHA provides no collision coordination, CSMA sensing fails beyond ~15 km, and BSMA's continuous busy tone consumes 80-90% of the channel capacity. We propose Free Signal Multiple Access (FSMA), a synchronization-free, gateway-controlled MAC protocol. Like a traffic signal, FSMA uses a single LoRa upchirp (FreeChirp) to indicate channel availability. By transmitting it at a lower spreading factor than the node uplink, FSMA implicitly filters weak-link nodes through channel reciprocity, reducing the collision window by 6-200x without synchronization, handshakes, or hardware modifications. Hardware experiments with 25 COTS LoRa nodes and a drone-mounted gateway demonstrate 2x higher throughput, 2.5-5x better packet reception ratio, and up to 5x improved energy efficiency. Large-scale simulations with real TLE-based satellite trajectories confirm scalability to 5000+ devices per satellite pass.

LoRa-based non-terrestrial networks are rapidly becoming infrastructure for global IoT, with LEO satellites delivering direct-to-device connectivity and drone-mounted gateways serving precision agriculture, emergency response, and environmental monitoring.

Prior work has shown that QoE-aware resource sharing for real-time interactive video can support up to three times more simultaneous sessions at acceptable quality compared to rate-fair allocation. However, the required capabilities (QoE-targeted encoding, runtime spatial complexity estimation, and rich application-network APIs) are not yet available in commercial deployments. In this paper, we take an evolutionary approach: we design a system that delivers QoE-aware resource allocation using only capabilities that can be assembled in a lab today. We extend the utility-based allocation framework to the radio resource domain by introducing composite spatial complexity, which combines a session's video spatial complexity with its time-variant spectral efficiency into a single resource demand function. To operate with commercial real-time video streaming applications that use rate-based congestion control and lack capability to measure QoE, we use external tooling for QoE measurements. We develop an incremental reallocation algorithm with per-interval limits that encode both the congestion control algorithm's speed constraint and that spatial complexity estimates are reliable only near the current rate. The resulting prototype combines external QoE measurements with congestion-signal-based rate steering and does not require modification to commercial applications. We chart an evolution path from this prototype toward full QoE-aware resource sharing, mapping emerging standards (IETF SCONE, CAMARA, Media over QUIC) to the progressive capabilities they enable.

Prior work has shown that QoE-aware resource sharing for real-time interactive video can support up to three times more simultaneous sessions at acceptable quality compared to rate-fair allocation.

KV cache management is essential for efficient LLM inference. To maximize utilization, existing inference engines evict finished requests' KV cache if new requests are waiting. This policy breaks for agentic workloads, which interleave LLM calls with tools, introducing pauses that prevent effective KV reuse across turns. Since many tool calls have much shorter durations than human response multi-turn chatbot, it would be promising to retain the KV cache in during these tools. However, many challenges remain. First, we need to consider both the potential cost of recomputation or reloading (if offloading enabled) as well as the increasing queueing delays after eviction from GPU. Second, due to the internal variance of tool call durations, the method needs to remain robust under limited predictability of tool call durations. We present Continnum, a serving system to optimize job completion time for multi-turn agent workloads by introducing time-to-live mechanism for KV cache retention. For requests that generate tool calls, Continnum selectively pins the KV cache in GPU memory with a time-to-live value determined by the reload cost and potential queueing delay induced by eviction. When the TTL expires, the KV cache can be automatically evicted to free up GPU memory, providing robust performance under edge cases. When combined with program-level first-come-first-serve, Continnum preserves multi-turn continuity, and reduces delay for agentic workflows. Evaluations on real-world agents (SWE-Bench, BFCL, OpenHand) with Llama-3.1 8B/70B, Gemma-3 12B, and GLM-4.5 355B shows that Continnum improves the average job completion times by over 8x while improving throughput.

KV cache management is essential for efficient LLM inference.

Modern microservices increasingly depend on high-performance remote procedure calls (RPCs) to coordinate fine-grained, distributed computation. As network bandwidths continue to scale, the CPU overhead associated with RPC processing, particularly serialization, deserialization, and protocol handling, has become a critical bottleneck. This challenge is exacerbated by fast user-space networking stacks such as DPDK, which expose RPC processing as the dominant performance limiter. While prior hardware accelerators have explored NIC-attached and FPGA-based offload, these approaches remain farther from the cache hierarchy, so the frequent data accesses during RPC processing each pay an extra interconnect traversal cost that inflates RPC time. Therefore, RPC handling should occur as close as possible to the cache; however, a near-cache solution must be small, hence practical and deployable. Our key insight to enable such a solution is taking advantage of a reconfigurable accelerator that can be configured specifically for the services currently running on the CPUs. We present Arcalís, a near-cache RPC accelerator that positions a lightweight hardware engine adjacent to the last-level cache (LLC). Arcalís offloads RPC processing to dedicated microengines that operate with cache-line latency while preserving programmability. By decoupling RPC processing logic, enabling microservice-specific execution, and positioning itself near the LLC, Arcalís achieves a 1.72-4.91$\times$ end-to-end speedup compared to the CPU baseline, significantly reduces microarchitectural overhead by up to 88\%, and achieves up to a 1.62$\times$ higher throughput than prior solutions. These results highlight the potential of near-cache RPC acceleration as a practical solution for high-performance microservice deployment.

Modern microservices increasingly depend on high-performance remote procedure calls (RPCs) to coordinate fine-grained, distributed computation.

As Sixth-Generation (6G) networks evolve towards a seamless Cloud-Edge-Internet of Things (IoT) continuum, autonomous orchestration across distributed compute and network domains becomes critical. Future 6G services will span multiple administrative and operator domains, making federation essential for ubiquitous, ultra-low-latency service continuity beyond individual footprints. This complexity demands AI-native mechanisms supporting intent-driven automation and closed-loop management. While the GSMA Operator Platform (OP) provides the architectural blueprint for multi-operator federation and network capability exposure, and the ETSI Software Development Group OpenOP (SDG OOP) offers a primary open-source reference implementation, current frameworks are limited by stateless API interactions and lack native intelligence. This paper proposes an Agentic-driven Intelligence extension for the GSMA OP architecture, using the OOP as the reference framework. We introduce an AI-native orchestration layer where autonomous agents manage persistent service contexts and enable closed-loop control via CAMARA APIs. By integrating a Declarative Monitoring and Alerting System (DeMAS) into the OOP stack and establishing a decentralised agent negotiation protocol, the proposed architecture enables real-time, intent-driven resource optimisation and autonomous cross-domain conflict resolution across federated domains. We validate our approach through a representative 6G use case involving Ultra-Reliable Low-Latency Communication (URLLC) and enhanced Mobile Broadband (eMBB) coexistence, demonstrating that an agentic OP framework autonomously reconciles stringent Service Level Agreements (SLAs) while enhancing infrastructure energy efficiency. Our findings establish a scalable blueprint for cross-domain Network-as-a-Service (NaaS) models that align standardised exposure with 6G autonomous requirements.

As Sixth-Generation (6G) networks evolve towards a seamless Cloud-Edge-Internet of Things (IoT) continuum, autonomous orchestration across distributed compute and network domains becomes critical.

Routing algorithms are crucial for efficient computer network operations, and in many settings they must be able to react to traffic bursts within milliseconds. Live telemetry data can provide informative signals to routing algorithms, and recent work has trained neural networks to exploit such signals for traffic-aware routing. Yet, aggregating network-wide information is subject to communication delays, and existing neural approaches either assume unrealistic delay-free global states, or restrict routers to purely local telemetry. This leaves their deployability in real-world environments unclear. We cast telemetry-aware routing as a delay-aware closed-loop control problem and introduce a framework that trains and evaluates neural routing algorithms, while explicitly modeling communication and inference delays. On top of this framework, we propose LOGGIA, a scalable graph neural routing algorithm that predicts log-space link weights from attributed topology-and-telemetry graphs. It utilizes a data-driven pre-training stage, followed by on-policy Reinforcement Learning. Across synthetic and real network topologies, and unseen mixed TCP/UDP traffic sequences, LOGGIA consistently outperforms shortest-path baselines, whereas neural baselines fail once realistic delays are enforced. Our experiments further suggest that neural routing algorithms like LOGGIA perform best when deployed fully locally, i.e., observing network states and inferring actions at every router individually, as opposed to centralized decision making.

Routing algorithms are crucial for efficient computer network operations, and in many settings they must be able to react to traffic bursts within milliseconds.

Machine learning has shown its largest gains in the band below 10 ms inside a 3GPP new radio (NR) 5G distributed unit (DU): link adaptation, per-slot scheduling, channel estimation, and the receiver itself. No open platform has let independently built software run there. Prior dApp frameworks reached the band only as external observers of an export stream. This paper is a guided introduction to the OCUDU dApp platform, an open runtime and E3 interface under which signed AI-RAN applications execute inside a production DU under three timing contracts: resident on the GPU receive chain (Class A), inside the scheduler's 100 us admitted deadline (Class B), or as never-blocking observers whose results the scheduler consumes (Class C). The conventional path is never displaced, and every authority is typed, validated, and operator-bounded. The paper explains how the runtime, the embedded E3 agent, and the three public repositories fit together; shows a dApp's source, its signed package, and its lifecycle state machine; defines the contracts a module is written against; and shows how one management surface serves a Python script, an operator's console, and an LLM agent. On a GB10 gNB with attached handsets, dApps of all three classes, including an out-of-tree neural equalizer, ran together on a live cell without a single fallback, and equalizer variants were compared over the air by lifecycle operations alone. Every measured checkpoint is reported with its conditions and its gaps. Platform, SDK, and a zero-hardware quickstart are public under BSD-3-Clause-Clear as a preview release of the OCUDU AI-RAN Working Group 2, inviting feedback, new use cases, and independent vetting ahead of upstreaming into the OCUDU mainline.

Machine learning has shown its largest gains in the band below 10 ms inside a 3GPP new radio (NR) 5G distributed unit (DU): link adaptation, per-slot scheduling, channel estimation, and the receiver itself.

Distributed applications (dApps) bring AI to the microsecond-to-millisecond band beside the 5G distributed unit (DU), but every public dApp framework realizes them the same way: an external process that receives an indication and returns a control message. That boundary is right for sensing and advisory workloads. It cannot express a neural receiver that must finish inside a slot, and it cannot hold a scheduling decision the MAC is waiting on. This paper asks what a dApp interface must deliver, in latency and bandwidth, for the AI-RAN use cases now filed under that name to be realized as dApps at all. It treats the coupling between a dApp and the DU as a design axis with two legitimate ends, a C ABI inside the DU process and a protocol-standard E3AP association over SCTP, and places the three OCUDU dApp classes on it. An audited corpus of 39 runtime AI-RAN use cases, sized by 5G NR timing, shows that more than half cannot cross the observer boundary: inline PHY work because an indication has no return path into the same slot, and bounded control because of the tail under load. Measuring the mechanisms each framework actually uses, on a quiet host and with a live cell on the air, shows that every carrier meets a 100 us control deadline on an idle host and that only the in-process paths still do once the DU is running. The asynchronous use cases remain feasible at every position, so the protocol-standard end is kept as a first-class option; what in-process placement adds for them is accountable staleness and an observation-to-decision path with no message on it. These measurements derive the released ABI, a stream for inline work, a validated call for bounded control, and a choice of lease, supervised ring, or portable E3 client for observation, and four dApps of all three classes are validated together on one over-the-air cell.

Distributed applications (dApps) bring AI to the microsecond-to-millisecond band beside the 5G distributed unit (DU), but every public dApp framework realizes them the same way: an external process that receives an indication and returns a control message.

Deterministic networking spans heterogeneous domains. At each boundary, two domains must agree on an assume--guarantee contract: what traffic the client may inject, and the QoS the carrier will hold for it. Composing such contracts into an end-to-end guarantee is standardized, but deriving each domain's contract is not. Today they are hand-crafted, static, and over-provisioned. The difficulty rises when traffic changes and the contract must become dynamic. We present a framework that automatically synthesizes the per-domain contract for both static and dynamic classes, along with the registration the dynamic one rests on. Two reasoning modules implemented with large language models (LLMs) drive it: an agent takes the client's traffic declaration and searches the carrier's configuration mechanisms, and a handler builds the network model from a typed disclosure of the substrate. The handler calls a network-calculus kernel for the model's hard terms, and an independent oracle---a faithful simulator, testbed, or live network---which verifies each candidate and discovers what lacks an a-priori algebraic form: when a reconfiguration is safe, and the instant to apply it. We synthesized a dynamic contract for uplink 5G fronthaul over a TDM-PON, grounded against a packet-level simulator. Across six draws from two LLM families, every synthesis produced a feasible, verified contract tight to ${\sim}1.2\,μ$s, holding a $100$-$μ$s deadline that reactive scheduling cannot meet, at up to $3.5$ times the bandwidth efficiency of static over-provisioning. Tasked instead with computing the worst-case delay directly, the LLMs were unsound in five of six attempts---evidence for the division of labor: LLMs construct the model, formal tools hold numeric authority. The same framework, unchanged, synthesized a static 5G--TSN bridge contract on a second substrate.

Deterministic networking spans heterogeneous domains.

QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.

QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks.

Self-hosted large language model (LLM) serving is emerging as a distinct category of Internet service, but we still know little about how these deployments appear and change on the public Internet. We present a 365-day longitudinal measurement of exposed Ollama endpoints (port 11434) from February 2025 to February 2026, combining daily active probing with GeoIP/ASN enrichment, PTR and port-443 host observations, and survival analysis. Across 362 observation days and approximately 4.8 million IP$\times$day observations, 26.4% of the 152,137 cumulative IPs appear for a single day; across five selected CVEs, only 0.43-2.90% of below-fix IPs upgraded in place; the top five countries/regions account for over 70% of weighted observations; and cloud and hosting providers dominate the top ASNs. These results characterize exposed Ollama as a structural exposure surface: persistent, growing, and heavily concentrated. At the same time, old versions, common model choices, cloud and hosting ASNs, PTR categories, and TLS certificate patterns remain visible across the year, indicating recurring insecure deployment practices in cloud infrastructure and the potential reach of provider-level mitigation.

Self-hosted large language model (LLM) serving is emerging as a distinct category of Internet service, but we still know little about how these deployments appear and change on the public Internet.

Connected and automated vehicle platoons require reliable dissemination of task-relevant hazard information to enable appropriate downstream responses, with unresolved situations additionally requiring remote human intervention. However, the limited channel bandwidth of V2X communication makes high-volume sensor data transmission challenging, motivating the exchange of only task-relevant information rather than raw sensor data. This paper proposes an integrated semantic and task-oriented communication framework for cooperative hazard response and remote operation in automated vehicle platoons. The framework combines onboard instance segmentation and monocular depth estimation for task-oriented hazard decision-making with Stable Diffusion Variational Autoencoder (SD-VAE)-based semantic scene compression. Task-relevant hazard information and the compact semantic representation are jointly disseminated through a broadcast-based Emergency Semantic Message (ESM) over the existing V2X protocol stack. Evaluation demonstrates that SD-VAE consistently outperforms JPEG and JPEG 2000 on task-relevant reconstruction metrics, exhibiting graceful degradation rather than a sharp cliff effect under low-SINR conditions, demonstrating its feasibility for remote scene reconstruction when human intervention is required. Moreover, an extensive campaign of 7,290 simulation runs shows a low overall inter-vehicle collision rate of 0.99%, with collisions occurring mainly under extreme high-speed and short-gap conditions.

Connected and automated vehicle platoons require reliable dissemination of task-relevant hazard information to enable appropriate downstream responses, with unresolved situations additionally requiring remote human intervention.

One way to increase the Energy Efficiency (EE) of 6G wireless networks is to utilize existing network infrastructure more efficiently. This can be achieved by introducing User-Centric Cell-Free Massive Multiple-Input-Multiple-Output (UCCF MMMIMO), which allows for simultaneously serving a single user by multiple Base Stations (BSs). From this perspective, the key challenge is to decide which BSs should serve a given user, known as the Serving Cluster Formulation (SCF). In this paper, we propose to deal with this problem by using an Artificial Intelligence (AI) agent based on a Large Language Model (LLM), targeting improvement of EE. We evaluated the proposed AI agent using a complex, 3D Ray Tracer-based, cellular network simulator, comparing a few GPT models and state-of-the-art algorithms. The results show up to 32% gain in EE of the proposed AI agent compared to the baseline.

One way to increase the Energy Efficiency (EE) of 6G wireless networks is to utilize existing network infrastructure more efficiently.

High altitude platform stations (HAPSs) are becoming a key component of future non-terrestrial networks (NTNs). HAPSs can serve a larger area than uncrewed aerial vehicles (UAVs) and offer lower propagation latency, maintenance expense, and energy costs than satellites. A major application of HAPSs is to serve the areas where terrestrial network (TN) deployment is infeasible, especially in hard-to-reach areas and post-disaster areas. For instance, in the Amazon rainforest, the Mediterranean region, and deserts, TN deployment is severely constrained by geographical and environmental conditions. Only areas close to transportation networks or coastlines can be covered, while large areas remain uncovered. Such coverage holes in hard-to-reach areas are typically overlooked in existing literature. Motivated by these realistic cases, in this paper, we use tools from stochastic geometry to mathematically model hard-to-reach areas where cellular terrestrial infrastructure only exists at their perimeter. We propose to deploy a HAPS constellation over this hard-to-reach area to enhance connectivity. For that setup, we derive the downlink (DL) and uplink (UL) coverage performance of the considered user equipment (UE) as a function of the location of the UE inside the coverage hole. Our results show how the number of HAPSs, beamwidth, and HAPS altitude affect the DL and UL coverage probabilities. Finally, we provide multiple useful guidelines for future HAPS deployment.

High altitude platform stations (HAPSs) are becoming a key component of future non-terrestrial networks (NTNs).

The deployment of Low Earth Orbit (LEO) satellite constellations is an important step toward global-scale quantum networking. However, evaluating satellite quantum network protocols under spatiotemporal orbital dynamics and quantum physical constraints remains computationally expensive and challenging. In this paper, we propose QUASAR, a lightweight simulator for evaluating entanglement distribution in satellite-based quantum networks. QUASAR provides a decoupled architecture that integrates dynamic orbital topologies, time-varying optical transmittance, and quantum memory decoherence into network- layer attributes. To demonstrate its capabilities, we abstract and implement two representative hardware architectures: Simultaneous Downlink and On-Orbit Stitching. We further introduce an Entanglement Distribution Rate (EDR)-Aware Spatiotemporal Routing (EASR) heuristic as a reference workload. Our case study examines how QUASAR supports different satellite architectures, routing workloads, realistic orbital traces, concurrent requests, and scalable event-driven execution. With over 85% lower network-layer update latency than continuous polling, QUASAR provides a practical and extensible framework for future satellite quantum network protocol evaluation.

The deployment of Low Earth Orbit (LEO) satellite constellations is an important step toward global-scale quantum networking.

We present methods and applications for the development of digital twins (DT) for urban traffic management. While the majority of studies on the DT focus on its ``eyes," which is the emerging sensing and perception like object detection and tracking, what really distinguishes the DT from a traditional simulator lies in its ``brain," the prediction and decision making capabilities of extracting patterns and making informed decisions from what has been seen and perceived. In order to add value to urban transportation management, DTs need to be powered by artificial intelligence and complement with low-latency high-bandwidth sensing and networking technologies, in other words, cyberphysical systems. This paper can be a pointer to help researchers and practitioners identify challenges and opportunities for the development of DTs; a bridge to initiate conversations across disciplines; and a road map to exploiting potentials of DTs for diverse urban transportation applications.

We present methods and applications for the development of digital twins (DT) for urban traffic management.

Intent-based networking realization starts by translating high-level intents into low-level network configurations. Recent approaches have shifted toward LLM-based translation. Despite promising results, most studies focus on translation accuracy and overlook risks associated with deploying the resulting configurations. In this work, we investigate the pre-deployment translation risk of LLM-generated configurations by analyzing the model's uncertainty. We propose to use two uncertainty signals, namely sampling-based predictive uncertainty for translation-risk ranking and token-level entropy for ambiguity-source localization. We evaluate these signals on an ambiguity-controlled test set across different context types and sampling budgets, using a Llama-3.1-8B-Instruct model fine-tuned for intent translation on a vendor-specific switch platform (Juniper EX3300). The results demonstrate that predictive uncertainty provides a useful signal for ranking translations by risk across context types and sampling budgets, albeit with substantial miscalibration under less informative contexts. Moreover, we show that parameter-token entropy correlates with parameter-sourced ambiguity and keyword-token entropy correlates with description-sourced ambiguity. These results indicate the potential of using uncertainty signals in an LLM-generated configuration deployment pipeline, where predictive uncertainty can support selective deployment, while token-level entropy can identify sources of ambiguity.

Intent-based networking realization starts by translating high-level intents into low-level network configurations.

From pre-training to query-time augmentation, web-scraped data helps to improve the quality and contextual relevancy of content generated by large language models (LLMs). However, large-scale web scraping to feed LLMs can affect site stability and raise legal, privacy, or ethics concerns. If website owners wish to limit LLM-related web scraping on their site, due to these or other concerns, they may turn to scraper access control mechanisms like the Robots Exclusion Protocol. To be most effective, such mechanisms require site owners to first identify the scrapers that they wish to restrict (e.g., via User-Agent strings). Existing mechanisms to identify LLM-related scrapers rely on voluntary disclosure by companies, one-off experiments by researchers, or crowd-sourced reports -- methods that are neither reliable nor scalable. This paper proposes a novel technique for accurately and automatically inferring LLM-related scrapers. We host dynamic websites that serve unique canary tokens to each visiting scraper, then prompt LLMs for information about our sites. If an LLM consistently generates outputs containing tokens unique to a scraper, it provides evidence of exposure to that scraper. Via experiments across 22 production LLM systems, we demonstrate that our approach can reliably identify which scrapers feed which LLM, including several that are not publicly known or disclosed by the companies. Our approach provides a promising avenue for unprivileged third parties to infer which scrapers serve data to which LLMs, potentially enabling better control over unwanted scraping.

From pre-training to query-time augmentation, web-scraped data helps to improve the quality and contextual relevancy of content generated by large language models (LLMs).

The Distributed Coordination Function (DCF)---the underlying channel access protocol in Wi-Fi, based on Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) and Binary Exponential Backoff (BEB)---is simple and effective, but its performance can degrade with increasing contention due to collisions. Collision-free backoff algorithms replace randomization with deterministic channel access, potentially improving efficiency and predictability. But are collision-free methods, with all their implications in terms of protocol design, sufficient to improve Wi-Fi performance under realistic non-full-buffer traffic with both uplink and downlink transmissions? We investigate this question by comparing three collision-free algorithms, CSMA/ECA (ECA), CSMA/E2CA (E2CA), and deterministic backoff (DetBO), with standard and single-stage BEB. Using system-level simulations, we evaluate full-buffer traffic, non-full-buffer ON/OFF traffic with both uplink and downlink transmissions, and coexistence with legacy BEB stations. Under full-buffer traffic, collision-free operation provides only modest throughput gains, up to 6.3\%. With non-full-buffer traffic, delay is governed primarily by the contention window (CW) rather than by collision avoidance, and collision-free access can even degrade performance under downlink-heavy traffic. Stations fall back to a random backoff at least 93\% of the time, so a collision-free schedule rarely forms outside the AP.

The Distributed Coordination Function (DCF)---the underlying channel access protocol in Wi-Fi, based on Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) and Binary Exponential Backoff (BEB)---is simple and effective, but its performance can degrade with increasing contention due to collisions.

Generative AI (GenAI) creates full content based on compact encodings. While GenAI has been used for applications where the generated content is returned to the encoding sender, it can also extend the capacity of communication networks by transmitting compact encodings through capacity-limited links, then generating and forwarding approximations from the GenAI node to the destination. This poses the challenge of evaluating approximation quality as a function of the rate between the source and GenAI node, while accounting for the communication overhead of learning. We present a method- and modality-agnostic initialization protocol for learning rate-quality functions in GenAI-aided networks, defining three variants: source-, node-, and destination-oriented, each with different messaging flows based on where quality is measured. The protocol augments node discovery protocols (e.g., MCP, A2A) when sources lack confidence in advertised model performance. We illustrate operation via a minimum estimation budget calculated using a distribution-free tolerance limit , and validate using a case study on image transmission under quality constraints. Results confirm the calculated budget meets the target quality requirement, with positive gains over JPEG after around 20 post-learning transmissions for a perceptual metric and more than 100 for a goal-oriented metric, providing a practical foundation for GenAI-based network compression.

Generative AI (GenAI) creates full content based on compact encodings.

This paper investigates collaborative mobile edge computing (MEC) servers for large language model (LLM) inference under soft deadline constraints. In this system, to improve the quality of service, computations are expected to be completed within their deadlines. However, due to dependencies among tasks or subtasks, any missed deadline can lead to catastrophic consequences for the entire request. In this context, this work proposes an extended deadline mechanism with constrained flexibility. The main challenges lie in handling large-scale computations under strict latency constraints while limiting the number of allowable deadline extensions, especially in the presence of task dependencies within each request. To tackle these challenges, we develop a transformer-enhanced proximal policy optimization (PPO) framework that enables efficient collaboration among MEC servers. The proposed approach aims to maximize the number of tasks completed within their deadlines while minimizing the use of deadline extensions. By capturing temporal dependencies and cross-server interactions, the transformer improves decision-making for task migration. Simulation results demonstrate that the proposed method significantly outperforms conventional PPO and heuristic-based approaches in terms of task completion rate and overall system efficiency.

This paper investigates collaborative mobile edge computing (MEC) servers for large language model (LLM) inference under soft deadline constraints.

Timely delivery of delay-sensitive information over dynamic, heterogeneous networks is essential for NextG interactive applications, yet providing strict End-to-End (E2E) peak latency guarantees remains an open challenge. Two obstacles limit the adoption of learning-based network control in this setting: traditional volume-based routing metrics, while highly effective for general traffic management, are not designed to capture traffic urgency; and Deep Reinforcement Learning (DRL) controllers trained from scratch suffer from sample inefficiency, long training times, and early-stage exploration volatility. This paper introduces a deployment-focused network control framework that addresses both obstacles. First, we present Effective Congestion (EC), a deadline-aware metric family that quantifies interface congestion by packet urgency and proactively filters non-viable traffic, coupled with a Uniform Path Grouping (UPG) distribution heuristic promoting robust load-balancing; the resulting policies are embedded into Multi-Agent Deep Reinforcement Learning Effective Congestion ($p^*$) (MADRL EC ($p^*$)), a hybrid architecture combining a distributed scheduler with a centralized RL-based router. Second, we introduce a unified training objective that generalizes existing policy-learning paradigms---behavioral cloning, offline Reinforcement Learning (RL), online RL, and offline-to-online schemes---as special cases, combining a live-reward term, a pre-collected-reward term, and a policy-imitation term. From this objective, we derive the Model-Guided Annealed Reinforcement Learning (MGA-RL) protocol, instantiated on a Deep Deterministic Policy Gradient (DDPG) backbone: a deployment-oriented, demonstration-driven training approach that generalizes conventional Offline-to-Online (O2O) schemes, in which trajectories from a lightweight [...]

Timely delivery of delay-sensitive information over dynamic, heterogeneous networks is essential for NextG interactive applications, yet providing strict End-to-End (E2E) peak latency guarantees remains an open challenge.

The transition toward semantic-aware communication offers a paradigm shift for next-generation mobile networks, promising to decouple information significance from raw data transmission. Despite advances in semantic extraction, the integration of semantic intelligence into the Medium Access Control (MAC) layer remains underexplored, particularly in exploiting spatial correlations among users. To address this, we introduce a novel multiple access scheme designed for uplink-dominant network services. This framework optimizes the trade-off between spectrum utilization and sustainability by formulating variable-packet-length access as distinct $α$-fairness and energy efficiency problems. A key innovation of our approach is the quantification of spatial redundancies through novel metrics of self-throughput and assisted-throughput, which account for the semantic correlation of data across user equipment. We analyze these formulations to identify optimal bounds before proposing PRISM (Protocol for Redundancy Identification in Semantic Multiple-access). Grounded in Model-free Multi-Agent Deep Reinforcement Learning (MADRL), PRISM enables devices to autonomously govern spectrum access using only local observations. Extensive evaluations demonstrate that PRISM successfully leverages redundancies to outperform semantic-oblivious schemes, achieving up to \({90\%}\) of the centralized optimal benchmark and improving both objectives by up to \({2\times}\) across diverse user-semantic association matrices. These results validate PRISM as a viable candidate for future distributed mobile network applications, complemented by orthogonal Multiple Access Schemes where signals are multiplexed in the semantic domain.

The transition toward semantic-aware communication offers a paradigm shift for next-generation mobile networks, promising to decouple information significance from raw data transmission.

Real-time control loops in Open RAN are increasingly colocated with the gNB, where dApps, i.e., programmable applications with sub-millisecond access to PHY- and MAC-layer signals, enable latency-critical use cases such as spectrum sharing, channel-aware scheduling, and integrated sensing. What turns dApps from a per-vendor mechanism into a portable component of the emerging AI-RAN ecosystem is the E3 interface: this interface defines how a dApp subscribes to RAN telemetry, receives indications, and issues control actions back to the RAN. To date, E3 has been implemented on OpenAirInterface and on NVIDIA Aerial; OCUDU, i.e., the Linux Foundation's open-source CU/DU project, has lacked a comparable E3 path. We close that gap with an open-source E3Controller for OCUDU, designed as a sidecar daemon so the E3 protocol stack, service-model logic, and dApp interactions live entirely outside RAN core processing, which is touched only through well-defined instrumentation hooks. We validate the controller with two reference service models, Spectrum and L1, that deliver O-RAN fronthaul I/Q samples to a spectrum-sensing dApp over a Foxconn RPQN 4800 radio unit. Our evaluation shows that the E3 path imposes no measurable throughput penalty on the OCUDU RAN, demonstrating that a real-time dApp/RAN interface is feasible on production-grade open RAN software.

Real-time control loops in Open RAN are increasingly colocated with the gNB, where dApps, i.e., programmable applications with sub-millisecond access to PHY- and MAC-layer signals, enable latency-critical use cases such as spectrum sharing, channel-aware scheduling, and integrated sensing.

The Train Real-time Data Protocol (TRDP) is widely used on rolling stock but it provides limited native support for cryptographic protection. Furthermore, the multicast traffic profile used in TRDP Process Data to exchange critical information between onboard subsystems makes the introduction of cryptographic protection a challenge. This paper presents a lightweight security layer for secure TRDP communication that implements a number of security profiles built around modern cryptographic algorithms. This additional layer relies on an On-board Key Management System (OKMS) for both security profile negotiation, dynamic key distribution and key lifecycle management. The security profiles allow for cryptographic agility and flexibility, ranging from simple authentication to Authenticated Encryption with Associated Data (AEAD) algorithms. The security profile negotiation procedure guarantees all TRDP End Devices (ED) on a common Communication ID (ComID) share the same security profile and can therefore process each other's messages. A prototype implementation based on mbedTLS and Arm Platform Security Architecture (PSA) was developed and evaluated. Experimental results demonstrate manageable overhead, suitable for the real-time and time-sensitive communication found on rolling stock.

The Train Real-time Data Protocol (TRDP) is widely used on rolling stock but it provides limited native support for cryptographic protection.

In the era of sixth-generation (6G) wireless communication, numerous applications are expected to be realized, including environmental monitoring, smart agriculture, remote education, security protection, and intelligent transportation systems. These scenarios require large-scale, continuous Internet services in forests, rivers, oceans, and road networks, to name a few, where optical cables are difficult to deploy. High-altitude platform stations (HAPSs) emerge as a promising solution, offering low-latency, high-capacity services while facilitating the establishment of vertical heterogeneous networks (vHetNets) in fiber-less areas. This article investigates three HAPS-based solutions, where HAPSs can serve wireless devices directly or via gateway (GW) networks: the HAPS-to-device (H2D) scheme, the HAPS-to-GW-to-device (H2G2D) scheme, and the hybrid scheme. Leveraging percolation theory, we study the feasibility of large-scale continuous Internet coverage, where the key performance indicator (KPI) is the percolation probability. We discuss the subcritical and supercritical cases in different coverage schemes, and prove that the phase transition from zero to nonzero percolation probability appears when increasing the HAPS density or GW density. Numerical results verify that the curve of the critical condition of the phase transition exists between the derived lower bound and upper bound, which can help reduce the upfront cost of HAPS-based vHetNet solutions.

In the era of sixth-generation (6G) wireless communication, numerous applications are expected to be realized, including environmental monitoring, smart agriculture, remote education, security protection, and intelligent transportation systems.

Encrypted traffic classification infers semantics beyond the flow record from transport-layer observables, and supervised training rests on labels that hold for the individual flow they are attached to. Recent systematizations scrutinize model in- puts and data splits; we systematize the complementary label side. Across 14 audited benchmark entries, we identify two recurring label-side strategies: coarse inheritance, which risks labelling flows the evidence does not cover, and overstrict filtering, which keeps only self-attesting flows and risks dis- carding relevant ones. No audited entry exposes a countable pre-selection population, and the task objects downstream papers attach to the same labels disagree with the recovered record in 8 of 23 referenced cells. Under strict side-channel features we derive a representation-relative ceiling on bal- anced accuracy for any classifier restricted to those features: on the public benchmarks that inherit, it ranges from 0.56 to 0.76. On the filtering side, only 24.95% of connections in our fully captured corpus carry an observable SNI of their own; yet the discarded connections raise macro accuracy from 0.44 to 0.65 through same-run co-occurrence features. We end with recommendations for benchmark builders and users.

Encrypted traffic classification infers semantics beyond the flow record from transport-layer observables, and supervised training rests on labels that hold for the individual flow they are attached to.

Future 6G networks will rely on Large Language Model (LLM) agents to manage the Radio Access Network (RAN). However, current architectures assume inter-agent messages convey objective facts. A message is instead a \emph{trace} of the sender's reasoning: it carries a subjective conclusion, so a syntactically valid report can propagate an AI hallucination and trigger a cascading outage invisible to protocol validation. Reading such a trace requires a Theory of Mind (ToM)---before acting, the receiver must model what the peer believes, and what a peer in that position should have believed. Modeling these interactions as cognitive channels on a cellular sheaf, we obtain a unified framework for resilient multi-agent systems, from which five design principles emerge: (i) a message is evidence of the sender's hidden reasoning; (ii) trust is a continuous cognitive Signal-to-Noise Ratio (SNR)---asserted precision over deviation from the modeled peer belief; (iii) network-wide consistency and resistance to hallucination contagion are computable via the sheaf's Laplacian; (iv) peer-modeling must halt at exactly two levels to conserve compute and survive mutual information decay; and (v) credible capacity is bounded by operational goal alignment, not link bandwidth. A signaling-storm study on locally deployed 1B-parameter telecom language models validates it: cognitive SNR isolates a hallucinating peer that three of its four neighbors agree with, where a divergence gate ranks every wrong peer above the right one; only depth two ToM recovers the correct action; and the spectral gap decides whether a topology reaches consistency inside the near-real-time budget.

Future 6G networks will rely on Large Language Model (LLM) agents to manage the Radio Access Network (RAN).

Vehicles and roadside infrastructure are increasingly equipped with sensors capable of perceiving their surroundings. Sharing this information through vehicle-to-everything (V2X) communications is a key enabler of Day-2 applications and is supported by the ETSI collective perception service (CPS). While CPS is expected to play a fundamental role in future intelligent transportation systems, its operation may significantly increase channel load, posing challenges in terms of radio resource utilization, communication reliability, and information management. This paper reviews the current status of CPS standardization and investigates its impact in dense deployment scenarios where connected vehicles communicate through fifth-generation (5G) New Radio-V2X (NR-V2X) sidelink (SL) communications. The main contribution is a realistic evaluation of communication reliability, latency, channel occupancy, and information usefulness under different object-selection strategies for collective perception messages. The analysis is conducted through a network-level simulation framework integrating empirical object traces derived from real-world datasets, thereby avoiding the limitations of synthetic traffic models. Results show that perception message generation and radio access mechanisms are tightly coupled and should be jointly designed to maximize the benefits of collective perception services.

Vehicles and roadside infrastructure are increasingly equipped with sensors capable of perceiving their surroundings.

Network slicing in multidomain 5G environments introduces critical challenges in guaranteeing Service Level Agreements (SLAs) under dynamic resource variability and heterogeneous service requirements. This article presents TriSLA, a closed-loop, preventive, SLA-aware architecture designed to evaluate feasibility at request time and continuously ensure SLA compliance during operation. The architecture combines ontology-driven semantic intent interpretation, multidomain machine learning feasibility risk inference, Explainable Artificial Intelligence (XAI) feature attribution, and closed-loop runtime SLA assurance into a unified operational pipeline. A fully operational prototype was evaluated in a multi-node cloud-native environment integrating Radio Access Network (RAN), Transport Network (TN), and 5G Core (5GC) domains with real-time telemetry collection. Experimental evaluation demonstrates that TriSLA guarantees a 100% SLA satisfaction rate for admitted slices, completely eliminating post-deployment violations compared to reactive (51.2%) and static threshold (80.4%) admission baselines. The predictive feasibility assessment achieved a classification accuracy of up to 99.51% (98.68% for the default explainable Random Forest classifier), enabling preventive admission decisions before infrastructure commitment. Furthermore, the cognitive admission pipeline introduces minimal processing overhead, requiring 25.37 ms for ontology-driven semantic parsing and 231.66 ms for XAI-assisted feasibility inference. Concurrently, the closed-loop assurance engine resolves 100% of runtime telemetry anomalies within a 4.22 s recovery cycle. These results demonstrate that TriSLA provides reliable, explainable, transparent, and preventive SLA management through integrated predictive admission and closed-loop runtime assurance for next-generation 5G networks.

Network slicing in multidomain 5G environments introduces critical challenges in guaranteeing Service Level Agreements (SLAs) under dynamic resource variability and heterogeneous service requirements.

Quantum-safe IPsec through hybrid key establishment is practical, but creates a critical operational challenge: how to maintain tunnel availability when the QKD infrastructure becomes unavailable. In this paper, we present the design, implementation, and experimental evaluation of a quantum-safe key establishment mechanism for an IPsec tunnel that combines X25519, ML-KEM, and ETSI GS QKD 014 keys through the RFC 9370 multiple key exchange mechanism, and that degrades gracefully when the QKD key delivery fails. Our open-source StrongSwan plugin uses a sentinel-based coordination protocol, thereby permitting us to complete the handshake even if the QKD leg fails, instead of aborting, restoring the QKD share at the next rekey. On a testbed connected to a metropolitan QKD link over 33 km of deployed fiber, we evaluated five configurations, from a classical X25519 with RSA baseline to a hybrid one that adds ML-KEM-1024 and a QKD key. The full hybrid authentication costs 103 ms against 61 ms for the baseline, the QKD retrieval itself adds only about 7 ms. Failure injection experiments confirm that the tunnel survives a complete KME outage without any interruption of the protected traffic.

Quantum-safe IPsec through hybrid key establishment is practical, but creates a critical operational challenge: how to maintain tunnel availability when the QKD infrastructure becomes unavailable.

Anonymity and accountability are essential properties for our everyday activity on the Internet. However, they appear contradictory, and their reconciliation remains far from reality. Existing approaches fall short in this regard, as they either rely on an on-path trustee, per-packet authorization, per-packet public-key cryptography, or per-session intervention by a central authority. We propose Lacan, a protocol that reconciles anonymity and accountability within a realistic design. In Lacan, a sender enjoys anonymity provided by on-path relays, as long as she complies with a contract established with the receiver. Upon a contract violation, the verifier, an off-path trustee on behalf of the receiver, links the malicious message to the sender's identity indirectly via the packet, path, and session, thereby reducing public-key operations from per-packet to per-session. This linkage remains robust even against malicious relays and receivers, grounded in our novel chain of successor proofs for accountable path reconstruction, together with traceable signatures, path validation, and key-committing encryption. We analyze the anonymity and accountability, implement the protocol, and evaluate the performance.

Anonymity and accountability are essential properties for our everyday activity on the Internet.