arXiv 论文速递

In this paper, we introduce Gnomon, a physics-informed system that forecasts user-perceived low-Earth-orbit (LEO) downlink throughput, uplink throughput, and round-trip time (RTT) under different levels of trace availability. Gnomon's physics layer reconstructs the serving geometry and four-leg bent-pipe attenuation from public weather, orbital, routing, and licensing data. Based on what is available, Gnomon conditions on the target terminal's own history (Mode 1), measurements from nearby publicly reachable dishes (Mode 2), or the physical covariates alone (Mode 3) to predict the link state: Modes 1 and 2 share a fine-tuned time-series foundation model, while Mode 3 uses a compact boosted-tree estimator. All three modes expose a common output interface and can be selected without retraining. We evaluate Gnomon using 8,260 minutes of 1 Hz measurements collected at nine sites across five states in the U.S. We train on three sites and hold out the remaining six sites and their serving beams. On these unseen sites, the own-trace mode reduces downlink-throughput and RTT prediction error by 17% and 11% relative to the strongest published baseline and, to our knowledge, provides the first LEO uplink forecasts. The neighbor-trace mode requires no on-site hardware, while the covariate-only mode reduces downlink-throughput and RTT error by 24.6% and 78.8% relative to the only prior covariate-only forecaster. Moreover, experiments show that Gnomon provides calibrated quantile bands and improves adaptive-bitrate streaming driven over real TCP flows on replayed Starlink links.

In this paper, we introduce Gnomon, a physics-informed system that forecasts user-perceived low-Earth-orbit (LEO) downlink throughput, uplink throughput, and round-trip time (RTT) under different levels of trace availability.

Ensuring safety and scalability in Collective Perception Service (CPS) remains a key challenge for Cooperative Intelligent Transport Systems (C-ITS). Conventional CPS enhances perception by broadcasting Collective Perception Messages (CPMs). However, its reliance on transmitting a potentially large volume of context-irrelevant information at high frequency leads to network congestion, processing delays, and poor scalability. We propose a Context-Aware Adaptive Filter that dynamically adjusts CPM content and transmission frequency based on contextual relevance and situational criticality. By prioritizing safety-critical objects and interactions, the proposed approach prevents information overload while preserving timely updates for decision-making. An end-to-end SUMO--Artery simulation evaluates safety, decision-making efficiency, and communication cost under different computational capacity tiers and transmission rates. Results show that the proposed adaptive filtering mechanism achieves safety performance comparable to conventional CPMs transmitted at the maximum allowed frequency (10~Hz), while reducing communication volume by over 93\% and preventing queue saturation. This demonstrates that context-aware adaptivity enables CPS to remain both scalable and safety-compliant across heterogeneous computing platforms.

Ensuring safety and scalability in Collective Perception Service (CPS) remains a key challenge for Cooperative Intelligent Transport Systems (C-ITS).

Optical Circuit Switching (OCS) offers high bandwidth density and energy efficiency for LLM training, but incurs a non-negligible reconfiguration delay. Prior work typically schedules optical circuit switches independently of compute, using aggregate traffic demand to determine which circuits to provision and when. We argue that this separation creates a fundamental inefficiency: reconfigurations that ignore the compute timeline can stall communication, resulting in low circuit utilization and large buffer requirements. In this paper, we present Flux, a scheduler that optimally schedules optical circuit switches based on the structure of the entire workload. Flux remains effective across a wide range of switching speeds by reusing circuits and amortizing reconfiguration delay behind compute and communication. We show that Flux reduces training iteration time by up to $10\times$ and peak NIC buffer requirements by more than three orders of magnitude compared to traditional periodic schedulers.

Optical Circuit Switching (OCS) offers high bandwidth density and energy efficiency for LLM training, but incurs a non-negligible reconfiguration delay.

Reinforcement learning (RL) has become a dominant post-training paradigm, driving the emergence of high-performance RL systems such as veRL for autoregressive large language models (LLMs). In parallel, diffusion-oriented RL algorithms, e.g., DanceGRPO and FlowGRPO, have rapidly expanded the scope of RL from language reasoning to diffusion-based visual and flow-based generation. However, efficient RL systems for diffusion generative LLMs remain underexplored. Existing implementations, e.g., veRL-Omni, still rely on colocated execution, which simplifies synchronization but couples rollout and training resources, limits heterogeneous deployment, and constrains independent scaling. To this end, we introduce DigenRL, a disaggregated RL framework for diffusion-based generative LLMs that supports flexible resource allocation, accommodates heterogeneous GPUs, and facilitates efficient task scheduling. To maximally reduce the execution bubbles in the disaggregated architecture, we propose: 1) a generation-axis pipeline (GAP) and time-step parallelism (TSP) in the diffusion architecture to enable finer-grained pipelining between rollout and training; 2) an elastic trainer-assisted generation (TAG) approach to enable the trainer GPU resources to dynamically assist in executing rollout generations; and 3) a tightly one-step constrained asynchronous strategy to further utilize the tail bubble in the pipeline. Extensive experiments are conducted on three hardware testbeds with 16-32 GPUs using HunyuanVideo-13B, Wan2.1-14B, FLUX.1-12B, and QwenImage-20B generative models. Experimental results show that DigenRL achieves 1.56-2.10x throughput improvements over state-of-the-art diffusion RL systems, veRL-Omni and GenRL.

Reinforcement learning (RL) has become a dominant post-training paradigm, driving the emergence of high-performance RL systems such as veRL for autoregressive large language models (LLMs).

Vector databases are increasingly deployed in distributed settings where different users, sites, or domains maintain vector data. Existing vector databases rely on a coordinator to record which shards store which parts of the vector space and to route each query to those shards. In a decentralized setting, peers may join, leave, or move data without a trusted node tracking every change, and outdated routing information can therefore send queries to the wrong peers or require contacting many peers, reducing vector retrieval recall and increasing network latency. We present Semord, a decentralized vector search overlay system that achieves high recall by routing each ANN query to a small set of relevant peers, without relying on a centralized coordinator. Semord addresses this problem by making semantic locality routable: 1) We propose VHash to place semantically related vectors near each other in the overlay key space while avoiding load imbalance, so that each query only needs to contact a small neighborhood of peers for distributed local ANN ranking. 2) We design VecDHT, a communication protocol that maintains decentralized routing, region metadata, churn resilience, and VHash updates under membership and workload changes. Our extensive experiments on a real testbed show that Semord improves recall by more than 15% and reduces contacted peers by over 60% compared with decentralized baselines. Semord also approaches the recall and latency of a centralized oracle baseline while reducing peak peer-local ANN index memory by more than 2X. Controlled large-scale simulations further show that Semord scales across real-world embedding workloads and remains robust under churn for scoped vector retrieval as a decentralized overlay.

Vector databases are increasingly deployed in distributed settings where different users, sites, or domains maintain vector data.

Weight transfer - the propagation of updated parameters from trainers to rollout generators - is becoming an important performance bottleneck in reinforcement learning (RL) systems for LLMs. The central challenge is supporting the diverse trainer and rollout layouts and synchronization requirements of modern RL workloads without sacrificing efficiency. Existing solutions are efficient under some configurations but perform poorly or lack support under others. We present WeightBridge, a flexible, efficient weight-transfer library designed to deliver high performance across diverse RL configurations. WeightBridge first automatically extracts the correspondence between trainer and rollout weight layouts, then plans and executes redundancy-free and load-balanced weight transfer. It exposes a small, general API while coordinating workers across diverse synchronization modes. Across configurations spanning different models, parallelization layouts, and synchronization modes, WeightBridge reduces average GPU stall time by up to 42$\times$ over the state-of-the-art open-source RL framework and achieves high performance in all settings. A coding agent was able to integrate WeightBridge into two different RL frameworks without manual guidance, demonstrating the generality and ease of use of its APIs.

Weight transfer - the propagation of updated parameters from trainers to rollout generators - is becoming an important performance bottleneck in reinforcement learning (RL) systems for LLMs.

The transition to virtualized Radio Access Networks (vRAN) enables dynamic power control through fine-grained CPU resource management. However, existing approaches treat gNB as a monolithic entity, failing to exploit the heterogeneous computational characteristics of different protocol layers. This paper proposes ALARM, a layer-aware adaptive resource management framework for constrained 5G vRAN. ALARM decomposes the gNB into functional layers representing distinct RAN tasks with heterogeneous computational demands, and controls CPU resources at the layer level based on processing weights. The framework monitors per-layer performance to detect violations and responds by scaling only the affected layer. This targeted adaptation avoids the over-provisioning inherent in traditional uniform scaling approaches. Experimental validation on two constrained platforms demonstrates up to 33% power reduction versus non-optimized baseline and 19% beyond uniform approaches, with dynamic adaptation achieving 9.8% additional savings while preserving strict real-time guarantees.

The transition to virtualized Radio Access Networks (vRAN) enables dynamic power control through fine-grained CPU resource management.

The fifth generation of mobile networks was standardised with an explicit mandate to close long-standing privacy and security gaps, mandating the concealment of the subscriber's permanent identity, resistance to generational downgrade, and protection against location tracking. Assessing whether these guarantees hold in operational networks, however, requires separating two sources of residual exposure that prior studies do not distinguish and do not evaluate in the wild: protocol-design limitations, which remain exploitable even against a fully specification-compliant deployment, and implementation gaps, which arise from incomplete or non-compliant implementations. We present 5G-Shark, a security assessment tool and methodology that turns a legitimate mobility procedure against the subscriber. Rather than relying on active jamming or malformed-packet injection, 5G-Shark manipulates the standardised cell-reselection criterion to pull a target User Equipment onto a self-created rogue cell, establishing an attack vantage with minimal service disruption. Then, the proposed methodology effectively performs the required interactions to expose the security risks of the system under test, classifying them into the aforementioned categories. Built solely from open-source stacks and Software Defined Radio hardware and evaluated against commercial 5G Standalone deployments, 5G-Shark requests subscriber identifiers, forces Radio Access Technology downgrade via crafted Registration Reject codes, and induces denial-of-service states. For each vector, we attribute the root cause to protocol design or deployment non-compliance. We further provide empirical evidence that in several commercial deployments, temporary identifiers are re-allocated in near-sequential steps that keep successive values linkable, a weakness that enables persistent user tracking despite correct subscriber ID concealment.

The fifth generation of mobile networks was standardised with an explicit mandate to close long-standing privacy and security gaps, mandating the concealment of the subscriber's permanent identity, resistance to generational downgrade, and protection against location tracking.

The disaggregation and softwarization introduced by the Open Radio Access Network (O-RAN) architecture enable multi-vendor innovation but also expose the RAN Intelligent Controller (RIC) ecosystem to new runtime security risks. Existing O-RAN specifications define strong safeguards for onboarding, authentication, identity management, and secure communication; however, they do not provide a concrete mechanism for verifying whether deployed rApps and xApps remain in their intended, untampered state during operation. This paper introduces rApp/xApp attestation as a RIC-native O-RAN security use case for runtime integrity verification. Rather than proposing a new cryptographic protocol, the work defines how existing integrity verification techniques can be integrated into O-RAN through attestation modules, attestation agents, RIC application interfaces, and SMO-driven policy coordination. We map the use case to relevant O-RAN Alliance working groups, identify required standardization extensions, and demonstrate feasibility through a lightweight hash-based prototype implemented on the Near-RT RIC platform. Experimental results show attestation latencies below 40 ms across multiple cryptographic hash functions, indicating that runtime attestation can be performed without disrupting time-sensitive RIC operations when appropriately scheduled. Finally, we discuss remaining technical and standardization challenges, including trusted verification, known-good runtime states, scalability, mitigation policies, and future hybrid attestation mechanisms.

The disaggregation and softwarization introduced by the Open Radio Access Network (O-RAN) architecture enable multi-vendor innovation but also expose the RAN Intelligent Controller (RIC) ecosystem to new runtime security risks.

Edge inference is a promising paradigm to provide large language model (LLM) inference services in next-generation mobile networks. LLM inference mainly relies on two approaches: Autoregressive decoding (AD) generates output tokens sequentially, resulting in long latency; Speculative decoding (SD) accelerates inference by using a small language model (SLM) to generate multiple draft tokens for LLM verification, but incurs extra memory costs. Due to this latency-memory tradeoff, neither approach alone can efficiently serve users with heterogeneous demands under limited edge computing resources. To address this challenge, we propose a hybrid autoregressive-speculative inference (BALANCE) framework for edge LLM inference. In BALANCE, an edge server hosts both an SLM and an LLM, admits users, assigns each admitted user to the AD or SD mode, and performs the two modes simultaneously. To maximize the number of served users, we formulate a task throughput maximization problem to jointly determine user admission and computing resource allocation between AD and SD under user latency requirements and server memory constraints. Since the problem is NP-hard, we develop a polynomial-time algorithm that transforms the original problem into two sub-problems and obtains a sub-optimal solution with a constant approximation guarantee. Experiments demonstrate that BALANCE consistently outperforms conventional AD and SD and significantly improves task throughput.

Edge inference is a promising paradigm to provide large language model (LLM) inference services in next-generation mobile networks.

Remote source monitoring is a key use case for Internet of things (IoT) applications, calling on efficient communications protocols to ensure timely data delivery. In this paper, we consider a practically inspired scenario in which an IoT device reports sensor readings to a gateway over a correlated, lossy channel, receiving feedback on the transmission outcome only after some delay. For this setting, we investigate practical threshold-based reporting strategies for monitoring a Markov process, and evaluate two approaches: a reactive strategy where the node awaits feedback after an update, and a proactive strategy that preemptively transmits a second update. Leveraging Markov renewal processes, we provide an exact performance analysis in terms of the mean squared error (MSE). Our study characterizes the fundamental trade-off between estimation error and communication rate, revealing that proactive transmissions significantly improve MSE even under strict IoT rate constraints.

Remote source monitoring is a key use case for Internet of things (IoT) applications, calling on efficient communications protocols to ensure timely data delivery.

This study presents a custom near-field communication (NFC) system with software-defined protocol implementation for wearable sensors distributed across the body. Conventional wired implementations can degrade wearability because of mechanical constraints, whereas radio-based wireless approaches such as Bluetooth are affected by body-induced signal attenuation and limited communication coverage. The proposed system is compatible with previously demonstrated fabric-integrated meander coils, which provides a feasible path toward garment-scale NFC communication areas. The system combines a microcontroller unit with compact modulation and demodulation circuits, allowing medium access control and other communication protocols to be implemented in software. Experimental results demonstrate continuous acquisition of three-axis acceleration data from three sensor tags, achieving a per-tag polling rate of $222\,\mathrm{Hz}$ and an effective throughput of approximately $16\,\mathrm{kbps}$, delivering $156$ valid samples per second per tag at a measured packet error rate of $30\%$.

This study presents a custom near-field communication (NFC) system with software-defined protocol implementation for wearable sensors distributed across the body.

Agentic artificial intelligence is a candidate enabler of Level-4 autonomy in sixth-generation (6G) networks, but agents reasoning over a shared memory inherit its distortions. We study cross-domain radio access network (RAN)--edge orchestration in which a RAN agent minimizing energy and an edge agent minimizing latency negotiate, validate proposals against a digital twin (DT), and share a collective memory. Such a memory is a sampling device: what agents retrieve, not what they store, determines what they do. We define the Retrieval Bias Index, a divergence between the induced retrieval law and a representative reference, decomposed along temporal, confirmation and availability axes, and show that additive retrieval scoring is an exponential tilt of the undebiased law, yielding a closed form for the failure-amplification weight and a saturation floor set by the store's own composition; a further result bounds excess service level agreement (SLA) violation additively in retrieval bias and DT mismatch. On a tandem queue for which stochastic network calculus supplies a feasible region, an oracle and a Nash bargaining reference, the operator attains a $12.7\times$ bias reduction over a recency store and the smallest distance to the bargaining solution among six memory architectures.

Agentic artificial intelligence is a candidate enabler of Level-4 autonomy in sixth-generation (6G) networks, but agents reasoning over a shared memory inherit its distortions.

Meeting stringent Time-To-First-Token (TTFT) requirements is crucial for LLM applications. To improve efficiency, modern LLM serving systems adopt disaggregated architectures with diverse parallelisms, introducing complex multi-stage workflows involving reusable KV-block retrieval, collective communication, and P2D transfer. Flows from dependent stages overlap within and across requests on shared bottleneck links, making TTFT highly susceptible to network contention and necessitating stage-aware scheduling. Unfortunately, most existing works schedule flows in a stage-agnostic manner, leading to uncoordinated contention that constitutes a primary cause of SLO violations. In this paper, we present Nuska, a holistic multi-stage flow scheduling mechanism designed to maximize TTFT SLO attainment. At its core, Nuska approximates the Least-Laxity-First (LLF) scheduling policy without requiring precise knowledge of a request's remaining slack. It achieves this through a Defer-and-Promote principle implemented through a Reverse Multi-Level Queue (RMLQ) structure. By dynamically promoting task precedence as effective laxity diminishes, Nuska prioritizes flows with less laxity while preventing requests with loose SLOs from prematurely consuming network bandwidth. We implement Nuska as a pluggable module integrated into vLLM, and evaluate it on an 8-server, 32-GPU testbed as well as through large-scale simulations. Our results demonstrate that Nuska effectively outperforms state-of-the-art baselines, improving the TTFT SLO attainment by 1.2x-2.4x.

Meeting stringent Time-To-First-Token (TTFT) requirements is crucial for LLM applications.

Natural-language service requests can require a language-model decision before execution starts, consuming part of the request's latency budget. We integrate Jev's decision-oriented application programming interface (API) into edge service orchestration to reduce this overhead while retaining service completion. The integration extracts four bounded intent fields and applies a shared validator, admission policy, and scheduler, accounting for decision waiting throughout the request timeline. We compare Jev with a short, structured-output DeepSeek deployment using live API measurements followed by modeled execution, and then a real two-node optical character recognition (OCR) service with self-hosted Qwen and rule-based references. Across three consecutive measurement blocks, Jev reduces median client decision latency by 15.9-26.5%. In eight paired OCR conditions, Jev matches DeepSeek's correct, on-time completion count in seven and exceeds it in one. Without caching, median end-to-end latency on requests completed correctly by both systems is 11.1-25.3% lower; API fees per correct completion are 69.0-70.6% lower. Repeated-request caching largely removes the latency difference. The results demonstrate that decision-model substitution can lower both response latency and API fees in the tested service path, and identify fresh interpretation as the main opportunity for latency savings.

Natural-language service requests can require a language-model decision before execution starts, consuming part of the request's latency budget.

Large Language Model (LLM) agents are increasingly trusted to operate live networks: they read state, change configuration, and verify the result. A first-order question is left implicit: at which level of abstraction should the agent operate? We make the interface-abstraction level an explicit, controlled experimental variable, organizing agent-network interfaces into a spectrum from raw CLI (A0) through bounded wrappers (A1) and standardized model-driven configuration (A2) to typed transactional service intent (A3-T), reconciled source-of-truth automation (A3-R), and their combination (A4). We present ANI-Gamut, a reproducible, open-source playground that exposes the same task at several levels on a single, densely populated brownfield substrate, where many coexisting services share resources and collateral damage actually arises. We instantiate and measure four points of the spectrum and describe the others only at the conceptual level, and record three dependent variables as the substrate is stressed by injected faults: task reliability, collateral damage against pre-existing tenants, and operational cost. In a pilot with small run counts (n=20, n=6 and n=4 per level), the interface level moves reliability and cost sharply: on a live change-set task a raw-shell agent fails on all six seeds while a typed transactional interface succeeds on all six (paired McNemar p=0.031, on six discordant pairs), at roughly an order of magnitude less cost, as the engineering effort migrates from the agent to a reusable transaction layer. Collateral damage, by contrast, is absent at every level, whether benign or under faults: in a tenant-isolated substrate the agents fail safe, and the blast radius is held by the substrate's isolation, which moves the safety question from the agent to the substrate.

Large Language Model (LLM) agents are increasingly trusted to operate live networks: they read state, change configuration, and verify the result.

The Precision Time Protocol (PTP) provides the time and phase synchronization required by disaggregated Open Radio Access Networks (O-RAN). Yet, in current open fronthaul deployments, PTP traffic lacks mandatory authentication and integrity protection, leaving synchronization vulnerable to spoofing, replay, and delay manipulation attacks that can degrade radio access performance. Existing protections are poorly suited to this setting: they either add excessive latency, do not support multicast dissemination efficiently, or fail to contain key exposure under partially trusted RUs. This paper analyzes the security risks of unprotected O-RAN PTP and develops a threat model for open fronthaul deployments. We then introduce PRTESLA-C, a lightweight synchronization protection mechanism that combines per-round delayed key disclosure with ASCON-based message authentication. PRTESLA-C uses an apply-then-verify-and-correct paradigm: timing samples are applied immediately to preserve real-time control, verified after key disclosure, and removed from persistent synchronization state if authentication fails. This design maintains sub-microsecond synchronization accuracy, provides strong protection against spoofing and replay, and bounds the impact of delay manipulation with minimal computational and latency overhead.

The Precision Time Protocol (PTP) provides the time and phase synchronization required by disaggregated Open Radio Access Networks (O-RAN).

Large language models (LLMs) increasingly rely on external sources when answering questions that require proprietary information or up-to-date live web content, through both traditional single-shot retrieval-augmented generation (RAG) and multi-turn agentic RAG. Yet today's web infrastructure is still built for human clients. Given a query, current search services return a list of URLs and snippets ranked for generic relevance; content delivery networks (CDNs) cache URL-addressed objects (texts, images, videos, etc.) without knowing which passage an agent needs. LLMs, in contrast, consume short, semantically coherent passages, hereafter "chunks", selected for downstream task utility rather than similarity alone, and may retrieve statefully across reasoning turns. Uncoordinated agents also repeat search, data acquisition, and semantic processing, duplicating work that could be shared. We argue that semantic chunk retrieval should become a first-class network-delivery abstraction. We propose Semantics Delivery Network (SemDN): an origin-authorized, hierarchical edge substrate that indexes, searches, and smart-caches web content at chunk granularity. SemDN serves agents on behalf of participating websites, amortizes data acquisition and processing across agents, and supports tenant-specific retrieval policies. Because, unlike URL caching, semantic retrieval provides no explicit miss signal, SemDN must estimate when its enrolled corpus may be incomplete or stale and trigger scoped discovery or refresh. It raises open questions about shareable retrieval state, hierarchical caching, coverage risk, and deployment. Our preliminary probes reveal a large gap between page content processed and chunks consumed, substantial task-local reuse, and higher answer quality per context token from chunk delivery.

Large language models (LLMs) increasingly rely on external sources when answering questions that require proprietary information or up-to-date live web content, through both traditional single-shot retrieval-augmented generation (RAG) and multi-turn agentic RAG.

Automotive Ethernet carries heterogeneous multi-protocol traffic in modern in-vehicle networks, where labeled attack data are rarely available and the strongest prior unsupervised detector still relies on handcrafted traffic features. This article presents X-SPUR, an explainable, surprisal-based, protocol-aware unsupervised reasoning framework that instead represents raw packet fields as token sequences, learns benign traffic patterns through causal language modeling, and detects anomalies from per-token cross-entropy surprisal. To incorporate temporal context, we introduce a bimodal fusion architecture that combines payload-token embeddings with inter-packet timing through additive fusion and a Hadamard interaction. To handle the heterogeneous score distributions of different protocol families, we further propose a dual top-$k$% per-protocol $Z$-score calibration that jointly captures moderately distributed and sparse anomaly signatures. On the TOW-IDS dataset, X-SPUR achieves an AUC of 0.9987. This is marginally higher than the 0.9969 reported for AERO. X-SPUR also eliminates handcrafted feature engineering. We train a separate CarDS model using the same architecture and training hyperparameters. This model retains strong performance on the second automotive Ethernet dataset. Beyond detection, per-token surprisal provides fine-grained explainability by attributing anomaly scores to specific protocol fields, supporting interpretable security analysis in heterogeneous in-vehicle networks.

Automotive Ethernet carries heterogeneous multi-protocol traffic in modern in-vehicle networks, where labeled attack data are rarely available and the strongest prior unsupervised detector still relies on handcrafted traffic features.

AI-driven penetration testing has been demonstrated with premium frontier models such as GPT-4, but the per-engagement token cost makes continuous, automated testing unaffordable for the smaller organisations that need it most. This paper presents PentestChain, a ten-phase automated penetration testing framework that couples a curated, deterministic exploit map with a cost-aware AI cascade-a local Ollama model (qwen2.5-7b) first, then free-tier OpenRouter and Cerebras, with a rule-based fallback that always produces output-and exposes the full pipeline through a Model Context Protocol (MCP) server with eleven tools. We make three contributions. First, we treat US-dollar cost per engagement as a measured, first-class evaluation metric and show that a 7B-parameter local model, kept off the critical path by a deterministic backbone, sustains end-to-end operation at zero measured paid-API cost. Second, we analyse the attack surface that an MCP-exposed offensive engine introduces, grounding a four-position threat model in the 2025 MCP incident record (the CVE-2025-6514 remote-code-execution flaw in mcp-remote, the postmark-mcp supply-chain backdoor, and the tool-poisoning-rug-pull-line-jumping class), and contribute four mitigations. Third, we specify a reproducible, containerised evalua-tion protocol aligned with the standardised testbeds now expected at top-tier venues-AutoPenBench, a Cybench subset, and the PentestGPT 182-sub-task benchmark-with multi-trial statistics (more than 10 trials per configuration, pass-at-k, non-parametric significance tests and effect sizes) and direct, same testbed reproduction of the PentestGPT and PentestAgent baselines rather than citation of their published numbers. On the legacy targets measured to date, the framework detected 26 services, enriched 34 CVEs, produced

AI-driven penetration testing has been demonstrated with premium frontier models such as GPT-4, but the per-engagement token cost makes continuous, automated testing unaffordable for the smaller organisations that need it most.

The behavior of Internet applications is shaped by congestion dynamics at bottleneck links, yet data capturing application behavior across diverse bottleneck regimes remains scarce. Bridging this gap requires a data-generation substrate that simultaneously provides controllability, composability, fidelity, and replicability, capabilities that existing approaches struggle to achieve together. This paper introduces NetReplica, a programmable substrate for bottleneck-centric data generation guided by progressive disaggregation. NetReplica (i) decouples bottleneck intent from execution, (ii) separates static bottleneck attributes from dynamic congestion pressure, and (iii) disaggregates observed demand dynamics from their original trace context through Cross-Traffic Profiles (CTPs). CTPs transform passive packet traces into reusable, composable pressure signals that can be selected and transformed to specify dynamic bottleneck behavior. Our evaluation shows that NetReplica provides all four capabilities simultaneously and, in an ABR case study, generates datasets that remain realistic while expanding coverage of underrepresented regimes, improving the performance of trained models. In particular, NetReplica reduces transmission-time prediction error for the well-explored Fugu model by up to 47%. Together, these results demonstrate that NetReplica is a practical, fully programmable bottleneck-centric data-generation substrate for developing production-ready protocols, applications, and learning artifacts.

The behavior of Internet applications is shaped by congestion dynamics at bottleneck links, yet data capturing application behavior across diverse bottleneck regimes remains scarce.

As digital commerce ecosystems expand into low-end consumer electronics (CE), hardware constraints-specifically limited CPU duty cycles and volatile heap fragmentation-become significant bottlenecks for complex transactional flows. Traditional on-device middleware requires high "network chattiness" to manage multi-step state machines, leading to increased latency and potential transaction failure on unstable residential networks. This paper proposes a novel Transactional Backend-for-Front-End (T-BFF) Orchestration Framework designed for resource-constrained embedded platforms. By migrating the transactional state machine and microservice orchestration to a cloud-side layer, we achieve a significant reduction in client-side overhead. Our framework introduces a "Double-Handshake" protocol utilizing non-volatile flash memory for state recovery after hardware reboots. Experimental results on an ARM Cortex-A53 platform demonstrate a 35% reduction in maximum heap usage and a 40% improvement in end-to-end transaction latency. This framework provides a scalable, sustainable blueprint for maintaining transactional integrity on legacy hardware in the 2026 IoT landscape.

As digital commerce ecosystems expand into low-end consumer electronics (CE), hardware constraints-specifically limited CPU duty cycles and volatile heap fragmentation-become significant bottlenecks for complex transactional flows.

Modern networks are large in scale and heterogeneous in configuration, making manual policy management increasingly impractical. Intent-Based Networking (IBN) addresses this by automating the translation of high-level operator goals into low-level network configurations. Yet existing IBN systems rely on static heuristics and fixed-feature classifiers that generalize poorly to distribution shifts such as new service definitions or evolving phrasing in operator requests. Large Language Models (LLMs), with strong reasoning and translation capabilities demonstrated across many domains, are a natural candidate for IBN policy generation. However, it is unclear whether LLMs can be reliably applied to this task, nor whether their use mitigates or worsens the underlying security risk. In this work, we show that while fine-tuned LLMs excel at intent translation, they exhibit false negative rates when checking whether a proposed intent violates an existing security policy. The root cause is not a lack of logical reasoning capability, but LLMs lack of persistent grounding in network topology and group hierarchy. Motivated by this finding, we introduce NetInspector, a three-layer agentic framework that enforces a verify-then-act protocol, decoupling information retrieval from reasoning so that the LLM focuses on symbolic reasoning while every policy decision is grounded in verifiable network facts retrieved from a live Environment Layer before approval. On NetInspector-Bench, a 2,224-sample synthetic benchmark spanning campus, enterprise, and WAN topologies, NetInspector reduces FNR by over 30\% relative to ungrounded baselines and remains robust under linguistic distribution shifts.

Modern networks are large in scale and heterogeneous in configuration, making manual policy management increasingly impractical.

Connected-vehicle safety evaluations rely on coupled traffic and network simulations, but standard channel models ignore radio resource competition in 5G NR sidelink Mode-2, reporting unrealistically high message delivery in dense traffic. This study introduces resource-competition losses without requiring full protocol reimplementation. We labeled 10.5 million reception outcomes from ns-3 5G-LENA traces (calibrated on 3GPP scenarios and driven by SUMO trajectories) to fit NS3Learn - a closed-form model capturing half-duplex loss, scheduling collisions, receiver capture, and decoding. Evaluation spanned two signalized urban networks, six penetration levels (1-100%), and five random seeds per condition. NS3Learn achieved a mean absolute deviation of 0.06 in per-instant delivery compared to ns-3 5G-LENA, outperforming alternative models (0.44 and 0.55 deviation). Fitted parameters transferred to a distinct intersection with only 20% additional error. Crucially, using realistic communication models reversed simulated traffic speed trends and more than doubled predicted hard-braking events. The framework transfers reception realism between simulators via model distillation instead of full reimplementation. Every stage maps directly to an explicit physical mechanism. Researchers and transportation agencies can maintain existing simulation pipelines while accurately accounting for dense-traffic packet loss and denial-of-service impacts. Adapting to new radio configurations requires only offline refitting rather than code modification.

Connected-vehicle safety evaluations rely on coupled traffic and network simulations, but standard channel models ignore radio resource competition in 5G NR sidelink Mode-2, reporting unrealistically high message delivery in dense traffic.

LEO satellite networks feature dynamic topologies, time-varying links, and diverse service requirements, which make conventional routing schemes difficult to support fine-grained quality-of-service (QoS) provisioning. Existing studies mainly optimize routing over network states with predefined objectives, but rarely address the practical challenge of translating unstructured natural-language service requests into adaptive routing decisions. To bridge this gap, we propose STR-Agent, an LLM-driven framework for QoS-aware routing in LEO satellite networks. The key innovation of STR-Agent lies in unifying intent perception, tool-based execution, experience accumulation, and reflection-based policy adaptation within a single agent architecture. Specifically, the Perception Module converts natural-language requests into structured routing semantics, while the Reflection Module dynamically adjusts the service-to-routing-policy mapping according to real-time congestion conditions and historical routing outcomes, rather than relying on a fixed routing objective. In addition, we develop a specialized perception model, and construct a domain-specific supervised fine-tuning dataset for LEO service understanding. Simulation results in a Walker-Delta constellation show that STR-Agent significantly outperforms conventional baselines: it reduces end-to-end delay by up to 60% compared with DQ-Dijkstra, improves average intent-understanding accuracy from 45.4% to 92.45% after supervised fine-tuning, and the Reflection Module further reduces the delay by 120 ms at 600 Mbps. These results demonstrate the potential of LLM-driven agent architectures to enable service-aware and adaptive QoS routing in future LEO satellite networks.

LEO satellite networks feature dynamic topologies, time-varying links, and diverse service requirements, which make conventional routing schemes difficult to support fine-grained quality-of-service (QoS) provisioning.

Large Language Models (LLMs) transform vast collections of unstructured text into semantic patterns used for language generation and reasoning tasks. Behind their ease of use lies a complex process: words become tokens, tokens become vectors, and vectors ultimately give rise to streams of bits that flow through High-Performance Computing (HPC) systems. As modern LLMs grow to billions or trillions of parameters, this path increasingly unfolds across thousands of interconnected accelerators, making the underlying communication fabric a critical and often opaque component of model training. This tutorial aims to walk the reader through the journey from words to network traffic, shedding light on how language is translated into communication flows within HPC training systems. Using concrete examples from Dante's Divine Comedy, we illustrate how model architecture, tokenization, embeddings, and parallelization strategies shape the volume, structure, and timing of data exchanged across the network. We combine architectural analysis with analytical traffic models and numerical examples to characterize the communication requirements of LLM training. We try to demystify how words travel across the network and provide practical insights into the network requirements needed to support the journey from text to trained model.

Large Language Models (LLMs) transform vast collections of unstructured text into semantic patterns used for language generation and reasoning tasks.

The Model Context Protocol (MCP) standardizes communication between autonomous Artificial Intelligence (AI) agents and remote tools over Streamable HTTP. This shift introduces a class of machine-generated, authenticated, and high-frequency JSON-RPC traffic directly into enterprise networks. Enterprise network defenders have historically relied on machine-like cadence as an Indicator of Compromise (IoC). In this study, we show that without explicit network-layer indication, MCP traffic structurally and temporally resembles Command and Control (C2) beaconing behavior, specifically the polling architectures used by advanced persistent threats like Cobalt Strike. Counter to theoretical assumptions about machine-generated polling, our measurements reveal a visibility gap: standard enterprise Intrusion Detection Systems (IDS) and behavioral beacon-scoring frameworks do not classify MCP remote tool usage as anomalous within our testbed scope. Through a controlled Docker-based testbed simulating eleven mathematically defined traffic profiles across three TLS conditions (Opaque, TLS-Inspected, and Cleartext), we evaluate Suricata signature matching and RITA behavioral scoring against MCP JSON-RPC patterns. Our results show that MCP traffic, regardless of temporal smearing (jitter) or TLS inspection visibility, evades detection within this configuration, yielding a consistent 0.0 behavioral beacon score and near-zero IDS content alerts under the Emerging Threats (ET) Open ruleset. While opaque TLS obscures HTTP content, it exposes agent traffic to flow-level temporal analysis; however, NIDS heuristics tuned to identify traditional malware do not flag the lognormal inter-arrival distributions characteristic of generative AI reasoning loops. To address this gap, we propose an agent-native network indication standard including Agent-Native ALPN and standardized out-of-band headers.

The Model Context Protocol (MCP) standardizes communication between autonomous Artificial Intelligence (AI) agents and remote tools over Streamable HTTP.

3D Gaussian Splatting (3DGS) enables photorealistic novel view synthesis, but transmitting gigabyte-scale scene data remains challenging for immersive applications. Traditional HTTP Adaptive Streaming over TCP introduces Head-of-Line (HOL) blocking and coarse segmenting ill-suited to fine-grained 3DGS delivery. We propose MoQSplat, which maps 3DGS content onto the Media over QUIC (MoQ) transport hierarchy. MoQSplat partitions scenes into spatial Tracks, clusters splats into semantically coherent Groups, and constructs progressive-quality Subgroups mapped to independent QUIC streams to eliminate connection-level HOL blocking. Using a stateless, subscriber-driven adaptation loop, clients dynamically request spatial regions and quality tiers based on six degrees of freedom (6-DoF) frustum visibility, distance, and foveal alignment. We evaluate the core components on a prototype implementation, showing that opacity-based pruning outperforms scale-based pruning for progressive delivery. The source code is available at https://github.com/emanuele-artioli/MoQSplat.

3D Gaussian Splatting (3DGS) enables photorealistic novel view synthesis, but transmitting gigabyte-scale scene data remains challenging for immersive applications.

Conventional video metrics such as PSNR, SSIM, and VMAF measure visual distortion or perceptual quality, but they do not directly capture semantic preservation: whether compression retains a video's objects, actions, and temporal narrative. Existing Quality-of-Experience (QoE)-driven bitrate-selection and resource-allocation methods primarily aim to minimize rebuffering and bitrate switching while maximizing perceptual video quality, without explicitly considering semantic preservation. To address this gap, we introduce video semantic fidelity (SF), a metric that quantifies how well a compressed video preserves the semantic content of its source. An offline multimodal large language model (MLLM) generates structured descriptions of the reference and compressed versions of the video, and a separate text-only large language model (LLM) evaluates their semantic correspondence. The resulting content-dependent SF--bitrate profiles are cached and queried by the online bitrate selector without invoking MLLMs at runtime. Evaluations on three subjective QoE benchmarks show a consistent positive association between SF and mean opinion scores (MOS). A separate human semantic-rating study evaluates semantic preservation and shows that SF correlates more strongly with human judgments than conventional video metrics. We then embed these profiles into a 5G MEC-assisted video-on-demand (VoD) resource-allocation framework at the base station. When wireless resources cannot support high bitrate levels for all users, the framework uses the SF--bitrate profiles to select bitrate levels jointly across users and reduce the semantic loss caused by the required bitrate reductions. NS-3 simulations with the 5G NR module show that the proposed framework achieves higher average and worst-user SF than the evaluated baselines, with a widening advantage as the wireless resources available to each user decrease.

Conventional video metrics such as PSNR, SSIM, and VMAF measure visual distortion or perceptual quality, but they do not directly capture semantic preservation: whether compression retains a video's objects, actions, and temporal narrative.

Radio Dynamic Zones (RDZs) allow wireless experiments to operate outside conventional spectrum regulations while continuously guaranteeing protection for incumbent users. Existing RDZ prototypes automate this task procedurally, through handcrafted rules and predefined workflows, and become brittle when experiments encounter hardware impairments, user workflows and devices, or interference mechanisms not anticipated at design time. This paper introduces the agentic RDZ (A-RDZ), which, to the best of our knowledge, is the first RDZ realization in which agents use Large Language Models (LLMs) to perform spectrum management, experiment management, policy interpretation, and zone orchestration. Built on the GENESIS agentic framework, the architecture pairs autonomous reasoning with a deterministic policy gate and near-real-time (near-RT) reflexes, so that agents can improve outcomes but never weaken the zone's protection guarantee. We validate the A-RDZ on a hardware-in-the-loop Frequency Range 3 (FR3) (7.125-24.25 GHz) Open Radio Access Network (O-RAN) testbed in which a 5G New Radio (NR) experiment coexists with an emulated Fixed Satellite Service (FSS) earth-station incumbent. In an end-to-end use case, the monitoring agent detects an emission violation from live spectrum evidence, the orchestrator selects a mitigation that restores the interference budget while keeping the experiment running, and the action is applied and verified through the O-RAN control plane. We report the detection-to-mitigation latency decomposition and discuss the practical limits of agentic operation, including non-deterministic reasoning and decision-to-action translation.

Radio Dynamic Zones (RDZs) allow wireless experiments to operate outside conventional spectrum regulations while continuously guaranteeing protection for incumbent users.

IPv4 NAT has limited the spread of IoT botnets considerably by default-denying bots' incoming connection requests to in-home devices unless the owner has explicitly allowed them. As the Internet transitions to majority IPv6, however, residential connections no longer require the use of NAT. This paper therefore asks: has the transition from IPv4 to IPv6 ultimately made residential networks more vulnerable to attack, thereby empowering the next generation of IPv6-based IoT botnets? To answer this question, we introduce a large-scale IPv6 scanning methodology that, unlike those that rely on computationally intensive algorithms, can be run on low-resource devices common in IoT botnets. We use this methodology to perform the largest-scale measurement of IPv6 residential networks to date, and compare which devices are publicly accessible to comparable IPv4 networks. We received responses from 93,832,220 distinct IPv6 addresses, 14,901,892 of which are inside of residential networks (i.e., not the external-facing gateway IP). These residential network internal addresses span 4,412 ASes across 144 countries. These responses come from protocols commonly exploited by IoT botnets (including telnet and FTP), as well as protocols typically associated with end-user devices (including iPhone-Sync and IPP). Compared with IPv4, we reach 11x more HP printers over IPv6 than Shodan finds across the entire IPv4 Internet, and thousands of iPhones and smart lights whose services IPv4 NAT made unreachable by default. Collectively, our results show that NAT has indeed acted as the de facto firewall of the Internet, and the IPv4-to-IPv6 transition of residential networks is opening up new devices to attack. Finally, we discuss potential mitigations to prevent in-home network reachability as IPv6 adoption continues to grow.

IPv4 NAT has limited the spread of IoT botnets considerably by default-denying bots' incoming connection requests to in-home devices unless the owner has explicitly allowed them.

Network operators frequently encounter protocol divergence---where ICMP, TCP, and UDP experience different treatment along a path. Existing tools identify where divergence occurs but not why, forcing manual investigation that delays resolution. We present two contributions: (1) the AS-Boundary Divergence Score (ABDS), a metric that correlates protocol divergence locations with BGP topology to automatically classify causes as routing-policy-driven versus internal-policy-driven; and (2) the localhost response signature, an empirical finding that security appliances return 127.0.0.1 in TTL-exceeded messages to mask their IPs. We evaluate ABDS against 496 targets across 8 categories (Finance, Government, Education, Healthcare, Tech, E-commerce, Media, International), with multi-vantage validation from 10+ global locations confirming routing consistency. ABDS achieves 100% classification accuracy on verified divergent targets (50/50), significantly outperforming majority-class baseline (54%, McNemar's p < 0.001). The localhost signature achieves 100% precision (18/18, 95% CI: [82%, 100%]) in identifying security appliances across 9 categories including government (IRS, USPS, VA), finance, and healthcare. Our open-source Rust implementation enables automated escalation decisions, reducing mean-time-to-resolution for network operators.

Network operators frequently encounter protocol divergence---where ICMP, TCP, and UDP experience different treatment along a path.

Software-defined networking (SDN) separates the control and data planes, enabling programmable, centralized network management. A core SDN service is topology discovery --- a periodic process that identifies network links. However, our analysis of five open-source SDN controllers and ten discovery protocols shows that all remain vulnerable to at least one form of link-fabrication attack. The common root cause is their reliance on traditional Link Layer Discovery Protocol (LLDP) packets, whose static identifiers expose their discovery purpose and attract adversaries to exploit them. We propose ChameleonDisc, a dynamic link-discovery protocol that simultaneously prevents and detects topology-poisoning attacks by eliminating this root cause. Our key insight is that an SDN controller can infer topology without embedding meaningful information in discovery packets. ChameleonDisc removes targetable static LLDP signatures and employs a moving-target defense that combines decoy, obfuscation, and camouflage techniques instantiated dynamically at runtime to prevent topology poisoning and detect manipulation. We implement ChameleonDisc on OpenDaylight and demonstrate effectiveness against all identifier-based topology-poisoning attacks. On a 252-link topology, median convergence is 1.37--4.53\,s for legitimate link changes and 4.06\,s for malicious relay detection, with 13.0 percentage points of additional mean CPU and negligible retained-heap difference. Across topologies up to 816 links, ChameleonDisc provides a tunable security--performance trade-off; expanding discovery intervals reduces CPU and mapping state at the cost of increased attack-detection latency.

Software-defined networking (SDN) separates the control and data planes, enabling programmable, centralized network management.

This paper introduces LQ8, an open-source weak-signal digital mode for amateur radio that completes structured two-way contacts in 4 transmissions (60 s), achieving a 1.50x speedup over canonical 6-transmission exchanges (90 s) and 1.25x over 5-transmission RR73 exchanges (75 s) while preserving complete bidirectional exchange of Maidenhead grid locators, signal reports, and mutual acknowledgments. By replacing fixed-width message-type headers with variable-length prefix codes matched to physical-layer bit budgets, LQ8 packs the answering station's grid locator and measured signal report into a single 77-bit reply. In multi-station pileup operations, LQ8 confirms up to two answering stations simultaneously within a single-carrier 50.0 Hz transmission with a 0.0 dB RF power-splitting penalty, achieving a peak rate of 240 QSOs/h in continuous pileup (4x over single-carrier FT8; 480 QSOs/h dual-carrier) while retaining -21.0 dB SNR sensitivity. The protocol family also defines three extended profiles (LQ16, LQ4, and LQ2) tailored for extreme sensitivity, VHF/UHF contesting, and fast-burst channels.

This paper introduces LQ8, an open-source weak-signal digital mode for amateur radio that completes structured two-way contacts in 4 transmissions (60 s), achieving a 1.50x speedup over canonical 6-transmission exchanges (90 s) and 1.25x over 5-transmission RR73 exchanges (75 s) while preserving complete bidirectional exchange of Maidenhead grid locators, signal reports, and mutual acknowledgments.

Optical circuit switch (OCS) can reconfigure physical connectivity to match the predictable communication schedules of large language model (LLM) training. Although each OCS light path is physically simplex, existing demand-aware OCS schedulers allocate capacity in duplex-port pairs, forcing equal bandwidth in both directions and stranding capacity under asymmetric node-pair traffic. This paper present LACE, the first offline OCS schedule compiler that independently allocates transmit (TX) and receive (RX) lanes for LLM training. Without changing the selected collective algorithms, operation order, or rank placement, LACE reconstructs directed node-level demand, jointly determines which consecutive operations share a configuration and how many simplex circuits serve each direction, and realizes these allocations as physical lane bindings and optical paths under per-node lane-inventory and multi-OCS fabric constraints. Software acknowledgments carry feedback over independently provisioned return paths, while coordinated link configuration and recovery verify each configuration before communication resumes. On a separate three-server testbed using fixed topologies and matched per-port rate limits, LACE's asymmetric connectivity achieves $1.80\times$ speedup for communication replay and $1.27\times$ for GPT-2 training over a symmetric-topology baseline. At larger scale, simulations of LLaMA-3.1 70B and 405B schedules with sixteen 400-Gb/s ports per server show that LACE achieves $1.21$--$2.04\times$ communication speedup over the latest duplex OCS scheduler.

Optical circuit switch (OCS) can reconfigure physical connectivity to match the predictable communication schedules of large language model (LLM) training.

DNSSEC authenticates RRsets, but does not provide endpoint authentication or channel security. DNS-over-TLS (DoT) and DNS-over-QUIC (DoQ) can facilitate such needs, but were designed for the stub-to-resolver hop, where stable long-lived connections amortize the expensive initial setup. The recursive-to-authoritative path's high fan-in and nonuniform per-resolver query frequency invert said dynamics. Post- quantum primitives further sharpen this mismatch: an ML-DSA WebPKI certificate chain crosses TCP's initial window, a cold PQ DoQ may incur up to about 140 times the total bytes of the same query over UDP. A survey of TLD and 2LD nameservers further bounds connection lifetimes, with almost half surveyed imposing limits on even non-idle connections. We present Enc53 -- a stateless session ticket protocol enabling efficient authenticated authoritative DNS encryption. Enc53 splits DNS encryption into 2 phases: a short-lived, DNSSEC-anchored, TLS- authenticated provisioning on the initial query in the 1st, and a steady state of 1-RTT AEAD-encrypted UDP DNS queries in the 2nd. Enc53 is server-side stateless: recursive resolvers hold the traffic secret and session ticket, authoritative nameservers hold only a symmetric STEK. We implemented Enc53 in Knot DNS. After provisioning, a steady state Enc53 exchange costs about 570 B -- roughly 3 times a plain UDP query -- and lands within 1 ms of the unencrypted UDP baseline. Resumed PQ-ADoT pays 7.7 times the bytes and 3 times the latency; resumed PQ-ADoQ pays 10 times the bytes for the same latency. When evaluated against a root server query trace, Enc53 achieves 2-fold compute efficiency over ADoT/ADoQ, 3-fold memory efficiency over ADoT, and 12-fold memory efficiency over ADoQ. Finally, when deployed in conjunction with FN-DSA-512 PQ-DNSSEC, the joint Enc53-DNSSEC UDP datagram remains below the 1232B buffer limit.

DNSSEC authenticates RRsets, but does not provide endpoint authentication or channel security.

Software-defined vehicular networks (SDVNs) under high mobility and fluctuating traffic demand offer programmable, centralized control for latency-sensitive intelligent transportation systems. However, data-plane Quality of Service (QoS) is often degraded by control-plane overload due to frequent handovers and dense vehicle-to-infrastructure (V2I) contacts. To address this, we propose two lightweight mechanisms for low-latency control-plane resizing in multi-controller SDVNs. The first - \textit{Control-plane Centric Control-plane Resizing Mechanism} - proactively offloads roadside units from overloaded controllers to underloaded or idle ones when a predefined load threshold is exceeded, preventing prolonged overload with minimal decision latency. The second - \textit{Data-plane Centric Control-plane Resizing Mechanism} - triggers resizing based on observable data-plane QoS degradation, such as average round-trip time exceeding a QoS threshold, aligning control-plane adaptation with V2I service experience. Both mechanisms are implemented and evaluated on Mininet-WiFi emulation testbeds with realistic worst-case vehicles mobility. Compared to fixed single-controller and static multi-controller benchmarks, the proposed algorithms significantly reduce end-to-end delay and packet loss while improving load balancing rate.

Software-defined vehicular networks (SDVNs) under high mobility and fluctuating traffic demand offer programmable, centralized control for latency-sensitive intelligent transportation systems.

Next-generation connectivity depends on data traversing multiple physical media within a single end-to-end path, yet research in optical fibre, free-space optical and radio wireless, non-terrestrial networks, and underwater communications has advanced largely in isolation. This fragmentation has a wider adverse impact on communication performance, deployment and adaption as the most demanding open problems in next-generation connectivity, cross-medium channel characterisation, transport-layer protocol design across heterogeneous latency regimes, and cross-domain orchestration, sit at the boundaries between domains and can only be addressed by bringing these challenges together in cross-domain systems. Space-air-ground integrated network research has begun to treat three domains analytically, and its recent extension to the sea surface represents the most ambitious multi-domain framework proposed to date, yet neither has produced experimental results, a deployed system, or a standards engagement. The subsurface and maritime domain remains absent from both. This paper proposes the connected heterogeneous all-medium integrated network (CHAIN), a framework that treats the undersea, maritime, terrestrial, aerial and space domains as a single design space. We identify an all-photonic network backbone as the unifying physical infrastructure, Artificial intelligence (AI)-driven orchestration as the cross-domain control layer, and the joints between domains as a unification challenge. We survey the state of the art across all domains and the existing cross-domain literature, develop the CHAIN framework and its technical pillars, characterise the five core open problems the field must resolve, and set out a research roadmap from near-term measurement campaigns and testbed validation through cross-medium field trials to global-scale deployment.

Next-generation connectivity depends on data traversing multiple physical media within a single end-to-end path, yet research in optical fibre, free-space optical and radio wireless, non-terrestrial networks, and underwater communications has advanced largely in isolation.

A cryptographically relevant quantum computer will break the elliptic-curve cryptography behind Bitcoin and its Lightning Network, the most widely used payment channel network. Even a post-quantum consensus upgrade of Bitcoin would not cover Lightning's off-chain surfaces, so its gossip, peer transport, invoices, payment onions, and offers need separate protection. An adversary can already record Lightning's encrypted traffic today and decrypt it once such a computer exists. Lightning can therefore move to post-quantum cryptography now, without waiting for Bitcoin, and stop such harvest-now-decrypt-later attacks along with node impersonation, invoice forgery, and payment deanonymization. In this paper, we propose PQLN, a hybrid post-quantum extension of Lightning that protects all of these surfaces with the lattice-based standards ML-DSA and ML-KEM. PQLN distributes post-quantum node identities through Lightning's gossip, hybridizes the transport handshake, adds post-quantum signatures to invoices, commits post-quantum keys in offers, and makes payment onions hybrid. Since post-quantum material is much larger than its elliptic-curve counterpart, we introduce techniques that fit it into Lightning's existing message formats and size limits. We analyze the security of PQLN against a quantum adversary and implement it in rust-lightning, a major Lightning implementation. Our evaluation with real Lightning nodes shows that PQLN nodes interoperate with unmodified nodes. The added cryptographic operations take at most 0.33 milliseconds, and the main cost is communication, since gossip data grows about tenfold with ML-DSA and about fourfold with the smaller Falcon. To our knowledge, PQLN is the first post-quantum design, implementation, and evaluation for Lightning.

A cryptographically relevant quantum computer will break the elliptic-curve cryptography behind Bitcoin and its Lightning Network, the most widely used payment channel network.

This paper presents the design implementation and evaluation of NetMon a hybrid network monitoring system designed for Kubernetes-based 5G packet core deployments specifically evaluated on Ericssons Access and Mobility Management Function AMF clusters NetMon combines eBPF-based passive kernel-level traffic observation with active TCP probing and centralized correlation to detect and localize network degradation within seconds The evaluation results demonstrate that the system detects faults as subtle as 10ms of added latency or 5 packet loss correctly attributes them to the affected infrastructure component and maintains this capability under application loads up to 50 simulated UE load The total resource overhead of 34 millicores CPU and 45 MiB memory per pod suggests that the approach is promising for further validation without impacting the monitored workload The hybrid approach addresses a gap in existing monitoring tools standard health checks cannot detect partial degradation scrape-based systems introduce detection delays measured in tens of seconds and purely passive tools cannot verify idle network paths By combining these complementary techniques and centralizing the analysis the system provides the early detection and fault localization capabilities required for maintaining service quality in cloud-native 5G infrastructure.

This paper presents the design implementation and evaluation of NetMon a hybrid network monitoring system designed for Kubernetes-based 5G packet core deployments specifically evaluated on Ericssons Access and Mobility Management Function AMF clusters NetMon combines eBPF-based passive kernel-level traffic observation with active TCP probing and centralized correlation to detect and localize network degradation within seconds The evaluation results demonstrate that the system detects faults as subtle as 10ms of added latency or 5 packet loss correctly attributes them to the affected infrastructure component and maintains this capability under application loads up to 50 simulated UE load The total resource overhead of 34 millicores CPU and 45 MiB memory per pod suggests that the approach is promising for further validation without impacting the monitored workload The hybrid approach addresses a gap in existing monitoring tools standard health checks cannot detect partial degradation scrape-based systems introd

Distributed Denial-of-Service (DDoS) attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. Recent work has yet to study the impact of the hosting software architecture on network monitoring solutions, or to assess recent algorithms for improving attack detection. This paper presents a Network Intrusion Detection System (NIDS) for DDoS detection in transport networks, developed in collaboration with Ericsson. Building on a statistical baseline, we improve detection effectiveness with an Isolation Forest trained on a wider set of flow features, extracted by GoFlowMeter, our open-source Go implementation of CICFlowMeter, and we integrate eBPF/XDP so that the NIDS filters real traffic at the kernel level. We further compare three deployments, monolithic, Kafka-based, and gRPC-based microservices, on a Raspberry Pi 5 testbed replaying the CIC-DDoS2019 dataset as real network traffic. Detection quality is governed mainly by the choice of detector rather than by the transport: the Isolation Forest raises recall and F1 score (0.965 live in the monolithic variant) over the baseline by flagging low-volume attack windows that the baseline misses. The transport is not neutral, however: gRPC reaches almost the same accuracy as the monolithic variant while adding less than 2 milliseconds of transport time per window, whereas the asynchronous Kafka pipeline trails by roughly nine percentage points and adds about 27 milliseconds. These findings clarify the trade-off between detection quality and architectural overhead when deploying a NIDS on resource-constrained hardware.

Distributed Denial-of-Service (DDoS) attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target.

In recent years, large language models (LLMs) have driven substantial intelligent transformation across diverse industries. Commercial LLM training is typically performed over data center networks (DCNs) comprising hundreds to thousands of GPUs, with multiple devices collocated per node. As network scale expands, inter-node communication becomes a primary bottleneck to training efficiency. Network-state simulators therefore play a crucial role by enabling cost-effective evaluation of network configurations and parallelization strategies through faithful emulation of DCN dynamics during LLM training. However, existing simulators are constrained by a efficiency-fidelity tradeoff, as packet-level simulators (PLSs) incur prohibitive runtime overhead, whereas flow-level simulators (FLSs) compromise essential modeling accuracy. In this paper, we develop \texttt{HyGra}, a hybrid-granularity network-state simulator that exploits intrinsic network dynamics in LLM training to adaptively switch simulation granularity. Specifically, \texttt{HyGra} employs packet-level simulation during non-steady phases with transient fluctuations and flow-level simulation during steady phases with periodic patterns, thereby accelerating execution while preserving high fidelity. Moreover, it requires no specialized hardware, supports single-machine deployment, and is compatible with existing simulators. Experiments based representative commercial LLM workloads, including ChatGPT, DeepSeek, and Qwen, show that \texttt{HyGra} achieves up to 15.4$\times$ speedup under single parallelization strategy and 7.8$\times$ under hybrid parallelization strategies while maintaining high accuracy.

In recent years, large language models (LLMs) have driven substantial intelligent transformation across diverse industries.

Open-source fifth-generation (5G) and Open Radio Access Network (O-RAN) experiments span simulation, host operating system (host-OS) emulation, software-defined radio hardware-in-the-loop testing, Open Radio Unit fronthaul deployments, wireless digital twins, and accelerator-backed radio access network (RAN) runtimes. These environments may expose similar interfaces while preserving different timing, input/output, synchronization, buffering, transport, and observability; \emph{functional compatibility is therefore not timing fidelity}. This paper presents AtlasRAN, a claim-to-capability framework for deciding what an open-source 5G platform can credibly measure. It combines two reference paths, an execution-regime matrix, and a measurement-backed case study comparing OpenAirInterface (OAI) radio-frequency simulator (RFSim) with the Sionna Research Kit (Sionna-RK), which offloads low-density parity-check (LDPC) decoding to CUDA while retaining the surrounding OAI host-OS path. From one to six users, aggregate uplink goodput falls from 114.59 to 35.09~Mb/s for OAI and from 103.34 to 35.01~Mb/s for Sionna-RK. At six users, both RFSim real-time factors are approximately 0.55, despite estimated cumulative LDPC work of 1.09~ms per transport block for OAI and 0.37~ms for Sionna-RK. Timing-normalized service remains 60.7--63.6~Mb per emulated second across complete runs, while falling host and accelerator utilization is consistent with an under-fed decoder. A twelve-user run is retained only as failure-region evidence because end-of-test traffic summaries are absent. The practical takeaway is that integrated wireless testbeds, edge platforms, artificial-intelligence-enabled RANs, and digital twins should report timing discipline, transport path, memory movement, and observability as first-class experimental variables.

Open-source fifth-generation (5G) and Open Radio Access Network (O-RAN) experiments span simulation, host operating system (host-OS) emulation, software-defined radio hardware-in-the-loop testing, Open Radio Unit fronthaul deployments, wireless digital twins, and accelerator-backed radio access network (RAN) runtimes.

Autonomous network management requires systems that can evaluate Network Service Intents (NSIs) under varying conditions without manual implementation of analysis logic, as envisioned in TM Forum Level~4 (L4) autonomy. Behavioral Network Digital Twins (NDTs) enable such evaluation, but existing NDTs rely on pre-defined analytical logic, limiting adaptability for evolving closed-loop control. This paper introduces the NDT factory, a multi-agent software system that synthesizes executable behavioral NDTs on demand from semantic models using Large Language Model (LLM). We validate the system using a Call Admission Control (CAC) case study, where deterministic what-if analysis serves as the admission decision process. The NDT factory generates a complete CAC NDT through parallel synthesis and orchestration, achieving 100% compilation and test pass rates across multiple runs. Simulation over 300 NSIs shows 99.3% decision agreement with a reference implementation, 90% admission rate, and correct attribution of all rejections, demonstrating reliable synthesis with deterministic, verifiable execution.

Autonomous network management requires systems that can evaluate Network Service Intents (NSIs) under varying conditions without manual implementation of analysis logic, as envisioned in TM Forum Level~4 (L4) autonomy.

Considering sharing or coexistence from the perspective of spectrum alone fails to recognize that any spectrum-enabled service also requires (i) radio and processing infrastructure and (ii) a protocol stack, including waveforms and signal processing pipelines. The efficiency of spectrum coexistence frameworks such as Citizen Broadband Radio Service (CBRS) is thus limited to optimizing resource allocation across a single dimension. How to address this limitation, however, remains an open challenge, especially considering the diversity of requirements and operational modes across spectrum services (e.g., sensing, communications, navigation, or positioning). This article introduces Open Spectrum, an architecture that brings softwarization, programmability, and open interfaces to heterogeneous spectrum services, extending the open Radio Access Network (RAN) principles beyond wireless networking. We propose to combine spectrum, services, and infrastructure in a common pool. Its resources are shared and orchestrated by a Spectrum Intelligent Controller (SIC), with plug-and-play spectrum applications, i.e., Spectrum Applications (sApps), and data-driven Radio-Frequency Interference (RFI) modeling using Digital Twins (DTs). We describe the Open Spectrum architecture, shared infrastructure pool, and operational workflows for tenant onboarding and incentives, conflict resolution, and service sharing across sensing, radionavigation, radiolocation, and cellular systems. System-level simulations using the BostonTwin urban DT and Sionna ray tracing show that there exist performance-driven incentives in sharing infrastructure and sharing across multiple services, enabling increased access to spectrum and improvement in median Signal to Interference plus Noise Ratio (SINR) of up to 12 dB.

Considering sharing or coexistence from the perspective of spectrum alone fails to recognize that any spectrum-enabled service also requires (i) radio and processing infrastructure and (ii) a protocol stack, including waveforms and signal processing pipelines.

Adaptive demodulation reference signal (DM-RS) placement in 5G New Radio (NR) trades pilot overhead against channel-tracking robustness, making a single static density suboptimal across heterogeneous mobility and propagation regimes. This paper studies a lightweight per-UE controller intended for O-DU-side distributed application (dApp) execution. The controller consumes eleven deployable uplink-CSI statistics and selects among six standards-derived PDSCH DM-RS configurations. Rather than optimize oracle-class accuracy, we train an 11-128-64-32-6 multilayer perceptron with a utility-aware objective that preserves the throughput structure of all candidate actions. In a large-scale trajectory-disjoint evaluation covering 294 channel/speed/SNR conditions and 7,056 observations, the proposed U-SoftCE policy significantly improves throughput over a training-selected best fixed pattern by 1.30, 0.86, and 1.13 percentage points on in-distribution, CDL channel-OOD, and 300-km/h mobility-OOD splits, respectively; paired 95% bootstrap intervals exclude zero in all three cases. An independent bit-accurate Sionna NR LDPC validation over 36 held-out conditions and 50 transport blocks per candidate retains a +1.21-point gain with a 95% cluster-bootstrap interval of [0.27, 2.13]. A native C++ implementation uses 12,070 dense parameters and requires 5.59 microseconds mean inference time, while a FlexRIC-based emulated O-DU prototype demonstrates sub-10-ms closed-loop operation. These results support utility-aware objectives for compact adaptive PHY controllers while exposing the limits of exact class-accuracy optimization.

Adaptive demodulation reference signal (DM-RS) placement in 5G New Radio (NR) trades pilot overhead against channel-tracking robustness, making a single static density suboptimal across heterogeneous mobility and propagation regimes.

The open web ran on an unwritten bargain: sites admitted crawlers, and search engines sent visitors back. Public measurements show that bargain breaking under AI crawlers and agents. Automated clients now make up most requests, training dominates Cloudflare-classified crawling, and the largest AI platforms fetch thousands of pages for each visitor they return. The web's common control, robots.txt, cannot express identity, purpose, terms, or price, can be circumvented, and newer alternatives are largely proprietary CDN features. We specify terms.txt, a robots.txt-style file for per-path, per-purpose machine-access terms, plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. We define what the exchange can enforce, audit, and leave to contract. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

The open web ran on an unwritten bargain: sites admitted crawlers, and search engines sent visitors back.

Hurricane Helene produced the largest absolute cell-site outage in the public FCC record, peaking at 4562 sites. The conventional model is physical: towers destroyed. Helene did destroy over 1700 miles of fibre, but almost none of it was cell sites. We present the first cause-decomposed study of the FCC's Disaster Information Reporting System, reconstructing 80 state-days and 580 county-days from 24 daily filings by two reconciled independent extractions. Damage to cell sites is negligible: 1.1% of attributed cell-site-days across six states, at most 3.8% anywhere. The sites were standing. What took them out divides by terrain: pooled, power dominates at 63.2%, but in mountainous North Carolina severed transport (backhaul) reaches 52.2% against 47.3%, and in Tennessee 69.9%. North Carolina's transport share rises from 7.0% to 85.0% across the event (\r{ho} = 0.92). Seventeen days after landfall, on 15 October, 47 sites lost transport across six contiguous North Carolina counties with no rainfall, no power loss, no damage, and recovery by the next report. Independent active-probe measurement corroborates it: responsive /24s fall 1.02% for twelve hours while Tennessee stays flat. We release the dataset. Backup power is the standard resilience investment; here it addresses the smaller half of the problem.

Hurricane Helene produced the largest absolute cell-site outage in the public FCC record, peaking at 4562 sites.

We propose a variable and behavior-based node-specific proof-of-work (PoW) model for a directed acyclic graph (DAG)-based distributed ledger technology (DLT) network to mitigate decentralized network congestion control. Network congestion control for centralized communication systems is an established field of study, with detailed and continuous research being done on the subject. However, attention to congestion control in decentralized networks is relatively recent and underexplored, especially with DLT, such as blockchain and DAG-based networks. For the DLT networks, the network congestion is caused by factors such as transaction spamming, an increase in the user base, and the launch of new tokens. We focus on the congestion caused by the spamming of transactions within the blockchain and DAG-based DLT network. Based on the network throughput of transactions per second and consensus procedure, the DAG-based DLT needs to control network spamming more than the blockchain network. The PoW model within the DLT consensus framework is a limited deterrent against spamming. Our model provides equal opportunities for all stakeholders regardless of their computational resources. It prevents and penalizes any node that attempts to spam or dominate the network with more than the prescribed number of transactions. Since the system nodes compete to issue transactions with finite network resources, we display the system behavior through a non-cooperative game. Further, we show that our model enforces prescribed behavior amongst the nodes through the proof of the existence of Nash equilibrium in the game.

We propose a variable and behavior-based node-specific proof-of-work (PoW) model for a directed acyclic graph (DAG)-based distributed ledger technology (DLT) network to mitigate decentralized network congestion control.

LoRa-based non-terrestrial networks are rapidly becoming infrastructure for global IoT, with LEO satellites delivering direct-to-device connectivity and drone-mounted gateways serving precision agriculture, emergency response, and environmental monitoring. Both settings share a fundamental MAC-layer bottleneck: large coverage footprints cause thousands of devices to collide on the same channel, while gateway mobility induces rapid link variations, making link-unaware transmissions a persistent source of wasted airtime. These challenges demand random-access solutions, yet ALOHA provides no collision coordination, CSMA sensing fails beyond ~15 km, and BSMA's continuous busy tone consumes 80-90% of the channel capacity. We propose Free Signal Multiple Access (FSMA), a synchronization-free, gateway-controlled MAC protocol. Like a traffic signal, FSMA uses a single LoRa upchirp (FreeChirp) to indicate channel availability. By transmitting it at a lower spreading factor than the node uplink, FSMA implicitly filters weak-link nodes through channel reciprocity, reducing the collision window by 6-200x without synchronization, handshakes, or hardware modifications. Hardware experiments with 25 COTS LoRa nodes and a drone-mounted gateway demonstrate 2x higher throughput, 2.5-5x better packet reception ratio, and up to 5x improved energy efficiency. Large-scale simulations with real TLE-based satellite trajectories confirm scalability to 5000+ devices per satellite pass.

LoRa-based non-terrestrial networks are rapidly becoming infrastructure for global IoT, with LEO satellites delivering direct-to-device connectivity and drone-mounted gateways serving precision agriculture, emergency response, and environmental monitoring.