@INPROCEEDINGS{IFIPNet25_Ali2505_DDoS, AUTHOR="EL kamel Ali", TITLE="{DDoS} Attack Detection using a combination of {GNNs} and {Meta-Active} Ensemble Learning", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="This paper proposes an efficient GNN-based approach to detect DDoS attacks when flows are partially labeled. It involves a sequential application of multiple GNN layers to compute flow embeddings, a meta-active ensemble learning model to label remaining unlabeled flows, and a readout function to deliver an efficient, ready-for-use, classification model which recognizes flows as benign or malicious. The experimental results demonstrate the efficiency of the proposed approach, showing notable improvements in key performance metrics such as accuracy, precision, and F1-score." } @INPROCEEDINGS{IFIPNet25_Rask2505_Monitoring, AUTHOR={Florian Raskob and Wilton Arthur Poth and Tobias Meuser and Bj{\"o}rn Scheuermann}, TITLE="Monitoring {6G} {UPFs:} A Software-based Network Tomography Framework", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="6G; mobile networks; resilience; monitoring; network tomography", ABSTRACT="The architecture of 6G networks comprises many software-based Network Functions (NFs) that can run on and migrate between different devices. To make future 6G networks resilient, a flexible framework is needed to detect failures in individual NFs. In this work, we present a software-based Network Tomography (NT) monitoring framework for 6G NFs, enabling flexible real-time monitoring. As a case study, we measured the performance of the User Plane Function (UPF), which is responsible for forwarding user traffic in the core network. To determine packet loss and latency, the framework matches ingress and egress packets of UPFs while it monitors packet and data rates by analyzing only the egress packets. In our evaluation, we demonstrated the framework's accuracy of a Mean Percentage Error (MPE) of 0.2\% for packet rates, 0.13\% for packet loss, and 0.05\% for data rates. Latencies were measured with 1.86 µs precision. Our findings demonstrate that software-based monitoring can achieve high-precision performance measurements, which is fundamental for enabling resilience in future 6G networks." } @INPROCEEDINGS{IFIPNet25_Muha2505_AI, AUTHOR="Mamdouh Muhammad and Kanwardeep Singh and Reinhard German", TITLE="{AI-driven} Anomaly Detection with {ICS} Protocols in Smart Grids", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Smart grids are a modern approach to implementing and managing power grids, requiring the integration of Information Technology (IT) and Operational Technology (OT). This integration involves the use of Industrial Control System (ICS) protocols not only within air-gapped networks but also in networks connected to the internet. However, this advancement introduces cybersecurity vulnerabilities, making anomaly detection crucial for protecting grid infrastructure. Traditional detection methods, which rely on predefined signatures and static thresholds, struggle to counter evolving cyber threats. This paper proposes an AI-based anomaly detection framework tailored for ICS protocols in Smart Grids, with a specific focus on the Manufacturing Message Specification (MMS) protocol (IEC 61850). The system employs a Machine Learning (ML) model trained on simulated Smart Grid networks to identify deviations from normal patterns and detect cyber attacks in the form of Denial of Service (DoS) attacks. The experimental results demonstrate that the proposed approach improves anomaly detection evaluation metrics compared to statistical and other ML methods. This research contributes to Smart Grid security by leveraging AI techniques to detect subtle patterns of anomalies and offers a scalable, adaptive, and AI-driven solution for identifying cyber threats." } @INPROCEEDINGS{IFIPNet25_Aygu2505_LAPRAD, AUTHOR="Rustem Can Aygun, Rustem and Yehuda Afek and Anat Bremler-Barr and Leonard Kleinrock", TITLE="{LAPRAD:} {LLM-Assisted} {PRotocol} Attack Discovery", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="DNS; Large language models; LLM; Security; Network Protocols; DNSSEC", ABSTRACT="With the goal of improving the security of Internet protocols, we seek faster, semi-automatic methods to discover new vulnerabilities in protocols such as DNS, BGP, and others. To this end, we introduce the LLM-Assisted Protocol Attack Discovery (LAPRAD) methodology, enabling security researchers with some DNS knowledge to efficiently uncover vulnerabilities that would otherwise be hard to detect. LAPRAD follows a three-stage process. In the first, we consult an LLM (GPT-o1) that has been trained on a broad corpus of DNS-related sources and previous DDoS attacks to identify potential exploits. In the second stage, a different LLM automatically constructs the corresponding attack configurations using the ReACT approach implemented via LangChain (DNS zone file generation). Finally, in the third stage, we validate the attack's functionality and effectiveness. Using LAPRAD, we uncovered three new DDoS attacks on the DNS protocol and rediscovered two recently reported ones that were not included in the LLM's training data. The first new attack employs a bait-and-switch technique to trick resolvers into caching large, bogus DNSSEC RRSIGs, reducing their serving capacity to as little as 6\%. The second exploits large DNSSEC encryption algorithms (RSA-4096) with multiple keys, thereby bypassing a recently implemented default RRSet limit. The third leverages ANY-type responses to produce a similar effect. These variations of a cache-flushing DDoS attack, called SigCacheFlush, circumvent existing patches, severely degrade resolver query capacity, and impact the latest versions of major DNS resolver implementations." } @INPROCEEDINGS{IFIPNet25_Abbu2505_XAI, AUTHOR="Mahesh Abburi and Arunita Jaekel", TITLE="{XAI} Based Technique for Detecting and Understanding Position Falsification Attacks in {VANET}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Vehicular ad hoc network (VANET); Explainable AI (XAI)", ABSTRACT="Vehicular Ad-Hoc Networks (VANETs), an emerging technology for vehicle-to-vehicle communication, has brought about significant advancements in road safety and traffic management into modern Intelligent Transportation Systems (ITS). However, it has also introduced critical security concerns, particularly regarding the integrity of data exchanged among vehicles. In this paper, we propose a machine learning based approach to detect position falsification attacks in VANETs, where malicious entities broadcast fictitious location information to disrupt traffic flow and compromise road safety. A key focus of our approach is not only to develop robust detection models but also to integrate XAI to enhance the interpretability of the outcomes. The goal is to make the underlying decision-making processes transparent and understandable, fostering trust and facilitating more accessible validation by human experts." } @INPROCEEDINGS{IFIPNet25_Petr2505_Improving, AUTHOR="Matthieu Petrou and Bastien Tauran and Laurent Chasserat and Matthieu Destruhaut and Moujahed Rebhi and David Pradas", TITLE="Improving User Experience in Hybrid {SATCOM} with Deep {Q-Learning}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="In recent years, the number of Low Earth Orbit (LEO) satellites in orbit has drastically increased. Internet service providers are exploring the hybridization of LEO and GEO satellite links to enhance user connectivity. However, efficient hybridization requires intelligent routing management due to the distinct characteristics of these links: while LEO offers lower latency, it also experiences greater variability in performance, whereas GEO provides more stable but higher-latency connections. Additionally, accurately gauging traffic flows to their impact on user-perceived Quality of Experience (QoE) remains a complex challenge. To address this, we investigate reinforcement learning to optimize routing over dual satellite links (LEO and GEO). We train a Deep Q-Learning (DQL) agent, based on a LSTM model, to manage routing decisions with the objective of maximizing users' QoE for VoIP calls, YouTube streaming, web browsing, and data transfers. We compare our approach with the Minimum Sending Delay Scheduler and evaluate its real-time feasibility. Results show that our method provides a scalable routing solution, capable of efficiently handling a large number of flows while significantly improving user experience." } @INPROCEEDINGS{IFIPNet25_Forg2505_Faster, AUTHOR="Orso Forghieri", TITLE="Faster Latency Constrained Service Placement in Edge Computing with Deep Reinforcement Learning", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="To enhance the user experience on mobile devices, Mobile Edge Computing (MEC) is a paradigm which integrates computing capabilities directly within access networks. However, designing efficient computation offloading policies in MEC systems remains a challenge. In particular, the decision on whether to process an incoming computation task locally on the mobile device or offload it to the cloud must intelligently adapt to dynamic environmental conditions. This article presents a novel approach to address an edge computing optimization problem by modeling it as a combinatorial optimization problem combining multi-commodity flow and linear latencies constraints. We then develop an equivalent linear formulation of the Service Placement Problem, allowing us to use traditional Integer Linear Programming (ILP) methods. Facing the problem complexity, we develop a use-case-based heuristic that provides a first practical placement solution. We also propose a Reinforcement Learning (RL) methodology to model the network configuration under orchestration actions. This framework allows us to explore these diverse network configurations and to transfer learning across pre-training of the agent. We evaluate the capacity of the RL approach on both static and dynamic context, first to deal with large instances, and second to adapt to dynamic configurations. This practical comparison not only reveals that ILP cannot solve large instances, but also highlights that the RL agent can use previously seen situations to reach, on average, 75\% of the optimal objective in new network services." } @INPROCEEDINGS{IFIPNet25_Knap2505_Explaining, AUTHOR="Aleksandra {Knapińska} and Krzysztof Walkowiak", TITLE="Explaining Aggregated Network Traffic Predictors", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="traffic prediction; data aggregation; machine learning; explainable AI", ABSTRACT="Network traffic prediction is essential for the intelligent management of modern backbone networks. In application-aware settings, it becomes crucial to generate detailed forecasts for each traffic class to ensure they are handled with appropriate care. To address scalability and survivability challenges, models built using data aggregation techniques offer an effective solution. In this paper, we examine how such models operate to make successful forecasts for diverse traffic classes in real and semi-synthetic data, incorporating Explainable Artificial Intelligence (XAI) tools. The analysis reveals interesting trends in how various regressors capture cross-class intricacies and correlations, highlighting the potential of aggregated models." } @INPROCEEDINGS{IFIPNet25_Cari2505_Analyzing, AUTHOR="Davide {Di Monda} and Alfredo Nascita and Raffaele Carillo and Antonio Pescap{\'e}", TITLE="Analyzing the Impact of Encryption on Traffic Classification through Explainable {AI}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="traffic classification; eXplainable AI; encrypted traffic; few-shot learning", ABSTRACT="Traffic Classification (TC) plays a crucial role in modern network management and monitoring. The increasing adoption of encrypted protocols-most notably TLS 1.3-poses serious challenges to traditional TC methods as it reduces the visibility of traditionally employed traffic features. At the same time, Few-Shot Learning (FSL) models are emerging as a promising solution for low-data TC scenarios (as in the case of new encrypted protocols), yet their lack of interpretability remains an open issue, especially under encrypted conditions. In this work, we study the impact of encryption on both the performance and interpretability of FSL-based traffic classifiers. Relying on a recently proposed FSL model, META MIMETIC, we simulate the progressive removal of plaintext features and assess the impact on TC. We then apply Integrated Gradients, a well-known eXplainable AI technique, to analyze how encryption alters byte-level feature importance. Our findings shed light on how encryption reshapes model behaviors and the relevance of input features for classification." } @INPROCEEDINGS{IFIPNet25_Delz2505_Sloth, AUTHOR="Clement Delzotti and Pol Maistriaux and Tom Barbette", TITLE="Sloth: A {Kernel-Bypass} Scheduler Maximizing Energy Efficiency under Latency Constraints", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="DVFS; NFV; DPDK; energy efficiency; networking", ABSTRACT="In recent years, multi-hundred-gigabit networking applications such as Virtual Network Function (VNF) and Key Value Store (KVS) implementations have relied on kernel-bypass and polling to achieve maximum throughput. However, this performance improvement comes at the expense of high CPU usage and power consumption. This paper first analyses the trade-off between the power consumption, the latency and the throughput of VNF applications. We then present Sloth, an energy-aware scheduler that adapts the number of cores used by an application and their frequency. Sloth uses the information gathered in a training phase to maximize the energy reduction in real time while maintaining a user-provided service-level objective. Sloth manages to reduce CPU power consumption by up to 50\% compared to the classical DPDK polling approach with only a 30 μs latency increase. Sloth also saves up to milliseconds of latency compared to state-of-the-art solutions at equivalent power consumption." } @INPROCEEDINGS{IFIPNet25_Land2505_Finding, AUTHOR="Shir {Landau Feibish} and Eitan Stein and Lior Zeno", TITLE="Finding Global {Top-K} Flows in the Data Plane", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Monitoring network traffic is crucial for most network tasks, such as, identifying and blocking attacks, pinpointing failures and engineering and rerouting heavy traffic to maintain high throughput. One important metric when monitoring the traffic is finding the top-k heavy flows, that is the k heaviest flows in the traffic. Programmable networks allow performing advanced network analysis right in the data plane. In recent years, various solutions have been proposed for efficiently finding the top-k heavy flows within a single switch. However, at times we may need to find the global top-k flows. Existing solutions for global top-k detection use a centralized controller that collects and aggregates the measurements performed in each of the switches. Yet, the process of sending information to the control plane and then having the collector send back the information to the switches can be very lengthy. In order to be able to detect and mitigate short-lived events, solutions that work completely within the data plane are needed. In this paper we present NODE, a network-wide top-k detection algorithm that operates exclusively in the data plane. NODE allows the switches to aggregate information from all other switches in the network, and ensures that eventually all switches hold an identical global top-k table. We show that NODE manages to detect global top-k flows on both synthetic and real traces, with a recall rate of over 95\% while using less than 300KB per switch." } @INPROCEEDINGS{IFIPNet25_Land2505_Finding, AUTHOR="Eitan Stein and Lior Zeno and Shir {Landau Feibish}", TITLE="Finding Global {Top-K} Flows in the Data Plane", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Monitoring network traffic is crucial for most network tasks, such as, identifying and blocking attacks, pinpointing failures and engineering and rerouting heavy traffic to maintain high throughput. One important metric when monitoring the traffic is finding the top-k heavy flows, that is the k heaviest flows in the traffic. Programmable networks allow performing advanced network analysis right in the data plane. In recent years, various solutions have been proposed for efficiently finding the top-k heavy flows within a single switch. However, at times we may need to find the global top-k flows. Existing solutions for global top-k detection use a centralized controller that collects and aggregates the measurements performed in each of the switches. Yet, the process of sending information to the control plane and then having the collector send back the information to the switches can be very lengthy. In order to be able to detect and mitigate short-lived events, solutions that work completely within the data plane are needed. In this paper we present NODE, a network-wide top-k detection algorithm that operates exclusively in the data plane. NODE allows the switches to aggregate information from all other switches in the network, and ensures that eventually all switches hold an identical global top-k table. We show that NODE manages to detect global top-k flows on both synthetic and real traces, with a recall rate of over 95\% while using less than 300KB per switch." } @INPROCEEDINGS{IFIPNet25_Delz2505_Sloth, AUTHOR="Clement Delzotti and Pol Maistriaux and Tom Barbette", TITLE="Sloth: A kernel-bypass applications scheduler maximizing energy efficiency under latency constraints", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="DVFS; NFV; DPDK; energy efficiency; networking", ABSTRACT="Kernel-bypass networking and polling have recently been shown as a solution to cope with multi-hundred-gigabit networking applications such as Virtual Network Functions (VNFs) or Key Value Stores (KVSs). However, polling fails to exploit hardware and software implementation of Dynamic Voltage and Frequency Scaling (DVFS) as it forces the CPU to stay at its highest frequency. This paper investigates solutions to reduce the energy consumption of network-intensive applications, leveraging the ability to slow down CPU frequency and lower the power supply and exploring multiple duty cycling strategies to compensate for the required polling in high-speed applications. The paper also explores tradeoffs between service-level objectives and possible energy reductions. We show that significant energy savings can be achieved through precise frequency and CPU scaling to avoid wasting CPU cycles when no packets are received. Finally, we present Sloth, an energy-aware scheduler that adjusts each core frequency in real time depending on the measured throughput without requiring any modification from the running application. Sloth manages to reduce the power consumption of the CPU by up to 40\% compared to state-of-the-art approaches while keeping the latency under constraint, and 50\% compared to the classical DPDK polling approach with only a marginal latency increase." } @INPROCEEDINGS{IFIPNet25_Kahs2505_Enhanced, AUTHOR="Henok Kahsay and Omar Alhussein and Jie Liang and Cheng Li and Ernesto Damiani", TITLE="Enhanced {Open-Source} {NWDAF} for {Event-Driven} Analytics in {5G} Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="5G Core Network; NWDAF; open-source testbed; event-driven analytics", ABSTRACT="he network data analytics function (NWDAF) has been introduced in the fifth-generation (5G) core standards to enable event-driven analytics and support intelligent network automation. However, existing implementations remain largely proprietary, and open-source alternatives lack comprehensive support for end-to-end event subscription and notification. In this paper, we present an open-source NWDAF framework integrated into an existing Free5GC implementation, which serves as an open-source 5G core implementation. Our implementation extends the session management function to support standardized event exposure interfaces and introduces custom-built notification mechanisms into the SMF and the access and mobility management function for seamless data delivery. The NWDAF subscribes to events and generates analytics on user equipment (UE) behavior, session lifecycle, and handover dynamics. We validate our system through a two-week deployment involving four virtual next-generation NodeBs (gNBs) and multiple virtual UEs with dynamic mobility patterns. To demonstrate predictive capabilities, we incorporate a mobility-aware module that achieves 80.65\% accuracy in forecasting the next gNB handover cell. The framework supports reliable UE registration, state tracking, and cross-cell handovers." } @INPROCEEDINGS{IFIPNet25_Afsh2505_Dynamic, AUTHOR="Shima {Afshar Borji} and Roberto Bruschi and Chiara Lombardo and Cristina Emilia Costa", TITLE="Dynamic {Energy-Efficient} User Plane Function Selection in {5G} Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="User Plane Function (UPF) is the most demanding component in the 5G Core for computational resources and energy consumption. Static UPF deployments struggle with dynamic traffic patterns, leading to significant energy waste during off-peak hours or potential performance bottlenecks during peak times. This paper proposes a framework for dynamic selection of heterogeneous UPF implementations that leverages traffic prediction and UPF profiling to optimize energy efficiency while maintaining service performance. We profile two distinct UPF implementations characterizing their power consumption and performance across various offered loads. A lightweight Long Short-Term Memory (LSTM) model is employed to predict near-term traffic load-based on historical patterns. A utility function, weighting both predicted performance score and power efficiency, guides the selection between the two UPFs. Switching logic incorporating hysteresis and hold-down timers are exploited to minimize excessive transitions. Simulation results over a 7-day period using scaled historical traffic data demonstrate that the proposed dynamic strategy can achieve energy savings of approximately 10.46\% compared to the best static UPF deployment without significantly impacting performance. The framework provides a practical approach to enhancing the energy efficiency and sustainability of 5G network operations." } @INPROCEEDINGS{IFIPNet25_Hami2505_Dissecting, AUTHOR="Virgil Hamici-Aubert and Julien Saint-Martin and Renzo E Navas and Georgios Z. Papadopoulos and Guillaume Doyen and Xavier Lagrange", TITLE="Dissecting {5G} {New-Radio} Latency: Interacting Layers and {Latency-Generating} Operations", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="5G; Radio Access Network; Latency; OpenAirInterface; Diagnostic", ABSTRACT="The fifth-generation (5G) mobile network improvements in the Radio Access Network (RAN), including low latency, reliability, and massive connections, are key enablers for emerging technologies and applications, such as smart grids, factory automation, and metaverse. Latency on the RAN relies on a multiplicity of 5G parameters that can be configured as needed. Current End-to-End (E2E) latency diagnostic capabilities are unsatisfactory in understanding the RAN involvement, and exhibit the importance of improving our diagnostic capabilities for 5G RAN implementations. In this paper, we aim to dissect the Uplink (UL) RAN latency in order to understand the origins of latency generation. An extensive experimental campaign on a 5G open-source implementation (OpenAirInterface) allows us to study the UL E2E latency through several bitrates. We mark each packet in its payload, and use the identifiers of each New Radio (NR) layers to track its E2E latency at the protocol level. We identify the layers mainly involved in the RAN latency composition, exhibit their operations, and explain their origin. This work leverages the collected information and latency measurements through all NR protocol layers to improve the understanding and diagnostics of the UL E2E latency through the RAN. Last but not least, the source code and experimental data are publicly available." } @INPROCEEDINGS{IFIPNet25_Sabb2505_Slices, AUTHOR="Andrea Sabbioni and Armir Bujari and Paolo Bellavista", TITLE="The Slices Cloud Continuum Blueprint: a Resilient Infrastructure to Support Large-scale Cloud Continuum Experiments", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Cloud Continuum; Cloud Edge; Cloud Models; Kubernetes; Research Infrastructure; Platform Engineering", ABSTRACT="Cloud computing has undergone a profound transformation in recent years, evolving to a comprehensive computing platform catering to the specific needs of verticals, with an increasing number of deployment, ownership, and service models continuously emerging in the market. The simultaneous exploitation of multiple cloud and computing models, commonly referred to as the Cloud Continuum (CC), is gaining increasing interest among researchers and practitioners. In this context, the Slices Research Infrastructure (Slices-RI) aims to provide a community infrastructure that supports researchers in their experiments and the development of new technologies in the CC. In this work, we present the CC Blueprint (CCBP), which focuses on providing the community with a replicable set of software, hardware, and methodologies to conduct experimental research in cutting-edge distributed environments. The CCBP is built with composability at its core, offering a clear abstraction over services and resources across multiple sites, while centralizing user authentication and experiment configuration through a unified endpoint. The blueprint is rigorously tested to ensure its functionalities and assess its adaptability to host and control resources and services, from large-scale deployments to constrained ones, made available by Slices-RI partners." } @INPROCEEDINGS{IFIPNet25_Garl2505_Reinforcement, AUTHOR="Filippo Ansalone and Ioannis Chatzigiannakis and Vincenzo Taormina and Domenico Garlisi", TITLE="A Reinforcement Learning Approach to Demand Balancing and Tariff Optimization in {Blockchain-Based} Smart Water Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Reinforcement Learning; Smart Contracts; Water Distribution Networ; Digital Twin; Internet of Things", ABSTRACT="The increasing complexity of Water Distribution Networks (WDN), combined with the need for energy efficiency, requires innovative solutions to optimize resource management and reduce operational inefficiencies. This paper introduces a Reinforcement Learning (RL) based framework designed to optimize water consumption patterns and tariff selection for users in smart WDNs. The proposed system leverages smart contracts to dynamically apply tariffs set by suppliers, while users are equipped with water storage tanks that can be filled using consumption patterns aligned with lower tariffs. By distributing diverse consumption patterns among users, driven by dynamic tariffs, the framework mitigates demand peaks at specific times, ensuring balanced network demand throughout the day. The RL algorithm functions using the EPANET simulation, which is fed by real data obtained from the Digital Twin (DT) states, showcasing the actual status of meters interconnected via the Internet of Things (IoT) network. This work demonstrates the potential of combining RL, smart contracts, DT, IoT and distributed consumption patterns to create a resilient and efficient smart WDNs, addressing both user-centric and operator-centric challenges in modern water management systems." } @INPROCEEDINGS{IFIPNet25_Leon2505_Enhanced, AUTHOR="Daniele Ugo Leonzio and Paolo Bestagini and Marco Marcon and Stefano Tubaro", TITLE="Enhanced Water Leak Detection with Convolutional Neural Networks and {One-Class} Support Vector Machine", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Water is a critical resource that must be managed efficiently. However, a substantial amount of water is lost each year due to leaks in Water Distribution Networks (WDNs). This underscores the need for reliable and effective leak detection and localization systems. In recent years, various solutions have been proposed, with data-driven approaches gaining increasing attention due to their superior performance. In this paper, we propose a new method for leak detection. The method is based on water pressure measurements acquired at a series of nodes of a WDN. Our technique is a fully data-driven solution that makes only use of the knowledge of the WDN topology, and a series of pressure data acquisitions obtained in absence of leaks. The proposed solution is based on an feature extractor and a one-class Support Vector Machines (SVM) trained on no-leak data, so that leaks are detected as anomalies. The results achieved on a simulate dataset using the Modena WDN demonstrate that the proposed solution outperforms recent methods for leak detection." } @INPROCEEDINGS{IFIPNet25_Amat2505_Centrality, AUTHOR="Federico Amato and Antonino Pagano and Gabriele Restuccia and Ilenia Tinnirello", TITLE="{Centrality-Aware} Machine Learning for Water Network Pressure Prediction", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES=6, ABSTRACT="Water Distribution Networks (WDNs) frequently face operational challenges due to leakage and inefficient resource management. The inherent nonlinearities of these systems further complicate the accurate prediction of pressures and leakages. We propose a novel methodology that employs established Deep Neural Networks (DNNs) architectures, specifically Multilayer Perceptrons (MLPs) and Convolutional Neural Networks (CNNs), combined with a minimal set of carefully selected features. Our core innovation lies in the feature selection strategy rather than the models themselves: standard hydraulic parameters, such as node demand, are combined with node centrality metrics: degree, betweenness, and closeness, that quantify a node's structural importance and influence within the network. This approach provides an implicit structural representation of the WDN without requiring direct topological coordinates, allowing the DNN to remain unchanged and adaptable to network topology variations. We validate the proposed approach using simulation- based datasets generated via EPANET and Water Network Tool for Resilience (WNTR) on the Fossolo, Hanoi, Modena, and Net3 networks. Comparative analysis of MLP and CNN performance across these networks and different demand patterns demon- strates high prediction accuracy (up to R2 = 0.9999). These results highlight the effectiveness of our novel feature-selection strategy and suggest potential for future work exploring the role of centrality in Machine Learning (ML)-based predictions." } @INPROCEEDINGS{IFIPNet25_Chai2505_Flash, AUTHOR="Thitipoom Chailert and Mark A Trigg and Abdulrahman Altahhan and Evangelos Pournaras", TITLE="Flash Flood Forecasting and the Role of Catchment Response Time: Predictions via {Rainfall-Runoff} and Deep Learning Models", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="River Level Forecasting; Flash Flood Forecasting; LSTM; GRU; Probability-Distributed Model (PDM); Catchment Response Time", ABSTRACT="River level forecasting plays a critical role in water resources management, hydropower operations, and flood risk mitigation. Short-term forecasts are especially critical in the context of flash floods, which can develop rapidly-often within six hours of intense rainfall. Although previous research on data-driven models for river level forecasting has focused on single-step daily or monthly forecasts which typically achieve high accuracy, the influence of rainfall and river level response time has received limited attention. In this study, we evaluate the performance of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models for short-term river level forecasting at 1, 3, and 6 hour lead times using 15 minute resolution data. We also investigate how forecast accuracy varies across three catchments with different response times. Results indicate that both LSTM and GRU outperform the Probability-Distributed Model (PDM) and a naïve baseline in terms of RMSE, NSE, and MAPE. Notably, LSTM demonstrates higher accuracy at shorter lead times (1 hour), while GRU performs better at longer horizons (6 hours). Furthermore, the findings suggest that catchment response time serves as a practical upper limit for effective forecasting, with accuracy decreasing when the lead time exceeds the catchment response time." } @INPROCEEDINGS{IFIPNet25_Loca2505_Dyn, AUTHOR="Pierluigi Locatelli and Tiziana Cattai and Simone Palumbo and Francesca Cuomo", TITLE="{Dyn-WNTR:} Dynamic Network Adaptive Extension for Hydraulic Simulations with {WNTR}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="The Water Network Tool for Resilience (WNTR) is a Python package widely used for the simulation and analysis of Water Distribution Networks (WDNs), providing tools such as network modification, pressure-dependent demand simulation, and resilience evaluation. Although it produces time-varying data reflecting WDN activity, it requires the complete parameter configuration at the beginning of the simulation and it requires a full restart when modifying network parameters such as pipe leaks or demand variations. Here, we present Dyn-WNTR, an extension that enables dynamic adaptation of network parameters during simulation. By integrating novel functions for real-time network updates, Dyn-WNTR allows modifications, such as the introduction of leaks or demand variations, without requiring a simulation restart. This significantly improves the flexibility of hydraulic simulations, allowing more efficient scenario testing, real-time optimization, and adaptive control strategies. We also release a dataset with dynamic simulations under diverse operating conditions and network events. To encourage a broad use and future developments, the source code of Dyn-WNTR and the dataset are publicly available. By reducing computational costs and improving flexibility, Dyn-WNTR extends the capabilities of WNTR towards more advanced and real-time frameworks, particularly suited for reinforcement learning applications and digital twin modeling, where continuous interaction with the simulation environment is essential." } @INPROCEEDINGS{IFIPNet25_Stei2505_Performance, AUTHOR="Philipp Steininger and Rastin Pries and Yash Deshpande and Kaan Aykurt and Chia-Yu Chang and Koen {De Schepper} and Wolfgang Kellerer", TITLE="Performance Evaluation of {L4S} in {XR} Scenarios", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Low Latency, Low Loss, Scalable Throughput (L4S) is a network protocol designed to provide ultra-low queuing delays, minimal packet loss, and scalable throughput, which are key factors for real-time applications such as streaming, online gaming, and Extended Reality (XR). With the rise of advanced XR applications and the increasing adoption of various XR headsets, remote rendering has become a common practice due to the hardware limitations of these devices. This study evaluates the performance of L4S in multi-device XR scenarios, focusing on its impact on latency, packet loss, and throughput. Unlike traditional congestion control mechanisms, which rely on reactive loss-based methods, L4S employs Explicit Congestion Notification (ECN) to signal congestion along with fast congestion control algorithms to minimize packet loss. This proactive approach enables rapid adaptation to network conditions, ensuring consistently low latency and improved stability. L4S was integrated into the network infrastructure between a streaming application and an XR headset. The performance was tested under varying network conditions to assess its effectiveness. The results show that L4S significantly reduces packet loss and latency while maintaining high throughput, leading to enhanced XR streaming quality and real-time interactions. These findings demonstrate the potential of L4S to improve real-world XR applications, with implications for broader adoption in low-latency networking." } @INPROCEEDINGS{IFIPNet25_Gu2505_Joint, AUTHOR="Meng Gu and Yaxi Liu and Xulong Li and Jiahao Huo and Wei Huangfu", TITLE="Joint Resource Allocation and Trajectory Planning in {Air-Ground} Collaborative Edge Computing Power Offloading Network", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Unmanned aerial vehicle (UAV); internet of things (IoT); 6th Generation Mobile Communication Technology (6G); trajectory planning; computation offloading", ABSTRACT="UAV-enabled computation offloading network where the internet of things (IoT) devices transmit to UAVs to help further process data. However, there are still some limitations in the existing UAV-enabled computation offloading network. They merely consider homogeneous aerial nodes to help offload computing tasks. This scheme faces the risk of air link damage, such as visibility conditions, energy depletion, etc. Motivated by this, we propose an edge computing power offloading network where not only the aerial nodes (i.e., the UAVs) but also the ground nodes (i.e., the newly introduced auxiliary vehicles) cooperatively help computation offloading from IoT devices and mobile devices. We establish an optimization with the goal of the task offloading failure penalty to optimize the UAV/vehicle trajectories, task offloading ratio, task association indicator, transmit power of IoT devices, and the CPU frequency of IoT devices and mobile devices, subject to boundary constraint, energy constraints, and power constraints. Such an optimization is complicated with complex objective functions, and various optimization variables are coupled, which increases the difficulty of solving this problem. We convert this optimization into a Markov decision process (MDP), and propose two state-of-the-art DRL algorithms, say the Soft Actor-Critic (SAC) and Proximal Policy Optimization (PPO), to accurately and efficiently solve this MDP. Experiments show the convergence and effectiveness of the proposed framework in edge computing power offloading networks. In addition, the proposed SAC and PPO outperform the other state-of-the-art algorithms. Furthermore, the newly introduced auxiliary vehicles significantly reduce the task offloading failure penalty." } @INPROCEEDINGS{IFIPNet25_Colo2505_GRANT, AUTHOR="Luca Mastrandrea and Alessandro Priviero and Ioannis Chatzigiannakis and Stefania Colonnese", TITLE="{GRANT:} Genetic-based {RAN} orchestration Tuning for latency sensitive {XR} verticals", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="In next-generation networks, verticals such as industrial automation, remote surgery, and first-responder training demand ultra-low latency mobile services, often accompanied by high throughput requirements, particularly for extended reality applications. To address these demands, we propose a genetic algorithm-based orchestration framework for Radio Access Network (RAN) resource management, leveraging collaborative scheduling across multiple base stations and tailored to extended reality scenarios. After defining a latency-sensitive cost function for resource allocation using a graph-based service model, we introduce Genetic-based RAN Orchestration Tuning (GRANT) to optimize resource distribution. This approach controls orchestration complexity while requiring minimal knowledge of user subscription data. Numerical simulations show that our method outperforms existing state-of-the-art solutions, delivering improved quality of experience, especially for latency-critical services such as extended reality." } @INPROCEEDINGS{IFIPNet25_Li2505_TPOTI, AUTHOR="Menglei Li and Chao Wu and Wentian Zhao and Tian Song", TITLE="{TPOTI:} A {Triplet-Network-based} Obfuscated Tor Traffic Identification", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Tor anonymous network; Obfuscated traffic identification; Triplet network; Flow interaction; Imbalanced data", ABSTRACT="Tor and obfuscated Tor traffic have brought significant challenges to network traffic analysis. The dynamic and often fragmented nature of network communication makes session continuity difficult to maintain, while the high dimensional features extracted from all packets within a complete session lead to high computational overhead. Furthermore, the inherent imbalance in network traffic data can hinder accurate classification and limit practical applicability in real-world environments. To reduce the computation overhead and improve the classification accuracy, we propose a TriPlet-network based Obfuscated Tor traffic Identification model (TPOTI). Specifically, to preprocess the network traffic data, we propose a Time-aware Session Slicing strategy to slice the traffic session by using a time threshold to identify the connection actions. Such strategy effectively captures the traffic information as comprehensively as possible while reducing the feature overhead. We then construct a triplet network for feature extraction and traffic classification, which combines CNN and LSTM to capture spatial and timing features simultaneously. By reducing the distance between intra-class samples and increasing the gap between inter-class samples, the triplet network effectively differentiates normal traffic from Tor traffic and mitigates the data imbalance problem. Experimental results indicate TPOTI provides a low-cost viable solution for detecting Tor traffic and its obfuscated variants, achieving a classification accuracy of 99.23\%, which outperforms the existing methods." } @INPROCEEDINGS{IFIPNet25_Chen2505_Sybil, AUTHOR="Ye Chen and Yingxu Lai", TITLE="A Sybil Attack Traceability Detection Scheme Adapted to Vehicle Pseudonym Change Strategy", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Sybil attacks; VANET; Traceability; Vehicle behaviors; Spatiotemporal features", ABSTRACT="In Vehicular Ad hoc Networks (VANETs), Sybil attacks can persistently occur while vehicles are moving at high speeds, posing a serious threat to cooperative driving. Existing detection schemes primarily focus on identifying Sybil nodes while neglecting the traceability of the attackers, which hinders timely prevention of attacks and leads to further damage. Additionally, vehicles employ periodically changing pseudonyms to protect sensitive private information, enhancing the stealthiness of Sybil attacks and complicating detection. To address these challenges, we propose a scheme that integrates vehicle behavior with spatiotemporal features, combining the core characteristics of attack behavior with three-dimensional data regarding time, space, and communication within the traffic flow into graph-structured data. This approach emphasizes the abnormal behavior of attackers and comprehensively reveals the dynamic interactions among vehicles, enabling near real-time detection of Sybil nodes and accurate traceability of attackers. Experimental results demonstrate that our proposed scheme can accurately track over 92.7\% of attackers on average, with superior detection and tracking capabilities compared to existing schemes, effectively preventing ongoing Sybil attacks in VANETs." } @INPROCEEDINGS{IFIPNet25_Wung2505_Squatspotting, AUTHOR="Wei-Shiang Wung and Calvin Kranig and Eric Pauley and Paul Barford and Mark Crovella and Joel Sommers", TITLE="Squatspotting: Towards the Systematic Measurement of Typosquatting Techniques", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="DNS; network security; typosquatting", ABSTRACT="Typosquatting-the practice of registering a domain name similar to another, usually well-known, domain name-is typically intended to drive traffic to a website for malicious or profit-driven purposes. In this paper we assess the current state of typosquatting, both broadly (across a wide variety of techniques) and deeply (using an extensive and novel dataset). Our breadth derives from the application of eight different candidate-generation techniques to a selection of the most popular domain names. Our depth derives from probing the resulting name set via a unique corpus comprising over 3.3B Domain Name System (DNS) records. We find that over 2.3M potential typosquatting names have been registered that resolve to an IP address. We then assess those names using a framework focused on identifying the intent of the domain from the perspectives of DNS and webpage clustering. Using the DNS information, HTTP responses, and Google SafeBrowsing, we classify the candidate typosquatting names as resolved to private IP, malicious, defensive, parked, legitimate, or unknown intents. Our findings provide the largest-scale and most-comprehensive perspective to date on typosquatting, exposing potential risks to users. Further, our methodology provides a blueprint for tracking and classifying typosquatting on an ongoing basis." } @INPROCEEDINGS{IFIPNet25_Rett2505_Securing, AUTHOR="Sean Kloth and Paulo Henrique Rettore and Philipp Zissner and Bruno Pereira dos Santos and Peter Sevenich", TITLE="Securing {Software-Defined} Tactical Networks: A Cyber Defense System", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="The deployment of Software-defined Networking (SDN) in Tactical Networks (TNs) enables communication in adverse and heterogeneous scenarios. However, SDN is vulnerable to cyber threats, particularly at the edge. This article addresses the critical issue of mitigating cyber attacks in networked environments by proposing a comprehensive framework comprising three distinct agents: Cyber Attack Agent (CAA), Cyber Defense Agent (CDA), and Network Manipulation Agent (NMA). The CAA simulates sophisticated attacks, including network reconnaissance, flow table flooding, and Distributed Denial-of-Service (DDOS) attacks, with the capability of evaluating the success of their attack. The CDA leverages either a threshold-based mechanism or machine learning model, such as Long Short-Term Memory (LSTM), for robust anomaly detection and response mechanisms. The NMA enhances the capabilities of the CDA by stimulating network conditions in TN. The proposed framework is evaluated across multiple network topologies, and metrics such as anomaly detection accuracy, attack efficiency, and system adaptability are analyzed by comparing the threshold-based and learning-based mechanisms." } @INPROCEEDINGS{IFIPNet25_Holz2505_Forward, AUTHOR={Kilian Holzinger and Daniel Petri and Stefan Lachnit and Marcel Kempf and Henning Stubbe and Sebastian {Gallenm{\"u}ller} and Stephan {G{\"u}nther} and Georg Carle}, TITLE="Forward Error Correction and Weighted Hierarchical Fair Multiplexing for {HTTP/3} over {QUIC}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES=9, KEYWORDS="QUIC; Forward Error Correction; Multiplexing", ABSTRACT="Web applications are ubiquitous and increasingly use HTTP/3. Their performance is affected by the underlying QUIC transport protocol. An important performance metric is the transmission delay impacted by the standardized loss recovery and resource prioritization. To improve the robustness against packet loss, we extend QUIC's recovery mechanism by the convolutional Forward Error Correction scheme Tetrys. For better control over the order of sent data, we use a round-robin scheduler that provably ensures hierarchical max-min fairness of the multiplexed streams at a byte-granular level. We extend its functionality to support strict priorities within a scheduling tree of weighted classes, integrating it into the Extensible Prioritization Scheme for HTTP/3. Measurements of a prototype implementation demonstrate that transmission delays improve under common web workloads and that the scheduler can deliver important assets earlier with the newly specified parameters." } @INPROCEEDINGS{IFIPNet25_Koni2505_Examining, AUTHOR={Michael {K{\"o}nig} and Sebastian Rust and Martina Zitterbart and Bj{\"o}rn Scheuermann}, TITLE="Examining the Heterogeneous Throughput Performance Landscape of {QUIC} Implementations", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="QUIC; Transport Protocols; Performance; Benchmarks", ABSTRACT="QUIC, a UDP-based transport protocol that integrates TLS for security and reduces connection latency, has gained widespread adoption and is now underpinning a substantial share of data traffic for major platforms like Cloudflare, Google, and Facebook. Given its growing deployment across major Internet platforms, there is growing attention on the performance potential of QUIC implementations. This paper provides an in-depth study of different QUIC implementations on a hardware testbed with 10 Gbit/s links. Our focus is on the achievable goodput in different scenarios and with different implementations. In contrast to other performance studies of QUIC, we investigated QUIC together with multiple versions of HTTP and used multiple streams for the data transfer. Our results show that merely choosing a different application protocol (i.e., HTTP/3 versus HTTP/0.9) can reduce goodput by as much as 27 \%. Dedicated traffic generators can further significantly boost achievable goodput, in cases more than doubling the throughput obtained via HTTP. Moreover, our analysis reveals that increasing the number of QUIC streams may potentially double the throughput of multi-segment data transfers, depending on the implementation. Additionally, certain QUIC implementations can saturate a 10 Gbit/s link by increasing packet sizes, indicating that QUIC packet processing speed, rather than raw transmission capacity, is a primary bottleneck. These findings highlight QUIC's capabilities, limitations, and implementation heterogeneity. The differences between QUIC and QUIC+HTTP throughput emphasize the need for dedicated performance tests. Understanding these distinctions is crucial for analyzing, optimizing, and maximizing QUIC's performance." } @INPROCEEDINGS{IFIPNet25_Sand2505_VGPrio, AUTHOR="Constantin Sander and Ike Kunze and Dario Veltri and Klaus Wehrle", TITLE="{VGPrio:} Visually Guided {HTTP/3} Prioritization", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="HTTP Resource Prioritization; Web Performance; SpeedIndex; Bayesian Optimization", ABSTRACT="HTTP prioritization allows to signal the priority of web resources to aid and speed up the webpage loading process. However, setting optimal resource priorities is challenging. Typically, generalized priority strategies are used to achieve good performance for most websites, but the strategies struggle in certain scenarios reducing human-perceivable performance. Thus, we propose VGPrio, an approach that automatically optimizes resource priorities w.r.t. visual metrics / human-perceivable performance. VGPrio uses a Bayesian optimization-based method to learn prioritization strategies for websites that specifically improve the human-perceivable SpeedIndex. Through its sample-efficient method, VGPrio only requires few iterations while our evaluation on a public website corpus shows that it can improve the SpeedIndex by up to 50\% compared to default strategies evading strong detriments and being more widely applicable than related work aiming at similar goals. As such, VGPrio represents a promising option to improve human-perceivable web performance beyond manual optimization." } @INPROCEEDINGS{IFIPNet25_Verv2505_First, AUTHOR="Steffen Sassalla and Vasilis Ververis and Vaibhav Bajpai", TITLE="A First Look on Discovery of Designated Resolvers", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="DNS is crucial for the Internet but vulnerable due to plaintext traffic. Despite efforts to standardize DNS encryption, its adoption remains limited. Users often lack awareness of privacy risks and the knowledge needed to enable encryption. To address this, the IETF standardized a new protocol; Discovery of Designated Resolvers (DDR), enabling automatic discovery and upgrade from unencrypted to encrypted DNS traffic. As such, we conduct a large-scale measurement of 27 480 002 DNS resolvers in the IPv4 and IPv6 address space to evaluate DDR support. We show that 301 780 of these DNS resolvers support DDR while one in three advertised encrypted resolvers fails to reply on DNS queries. Among DDR-supported resolvers, DNS over HTTPS (DoH)/2 is the most popular advertised protocol (99.95 \%), whereas DNS over QUIC (DoQ) is the least prevalent (0.84 \%). Despite recent studies demonstrating the performance and privacy benefits of DoQ, this new protocol is still advertised via DDR with the lowest priority overall. Finally, 93 \% of DDR resolvers share identical configurations that redirect clients to major cloud DNS providers, such as Google and Cloudflare, thereby raising critical concerns about the effectiveness of DDR deployment in addressing end-user privacy and DNS centralization." } @INPROCEEDINGS{IFIPNet25_Xylo2505_Secure, AUTHOR="Yannis Thomas and Nikos Fotiou and Iakovos Pittaras and George Xylomenos", TITLE="Secure and Efficient Data Spaces over Named Data Networking", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="NDN; NGSI-LD; Data Spaces", ABSTRACT="We propose the Secure and Efficient Data Spaces (SeEDS) architecture, which provides a content brokering service for decentralized data sharing. Our brokering service is built on top of Named-Data Networking (NDN), leveraging NDN's native request aggregation and caching. We support legacy HTTP-based content providers and consumers by building a SeEDS proxy that implements ETSI's NGSI-LD data spaces API. Our proxy receives API requests over HTTP(S) and translates them into the appropriate NDN messages. In order to fully support NGSI-LD operations, we design protocols that extend the core publish/subscribe communication pattern of NDN with advanced query processing. We present a prototype implementation of the SeEDS architecture and a preliminary evaluation and validation of its features. Our solution achieves significant performance gains, adding at the same time support for decentralization." } @INPROCEEDINGS{IFIPNet25_Liu2505_Embedded, AUTHOR="Dingming Liu and Tian Song and Wentian Zhao", TITLE="An Embedded Covert Channel Construction using {HLS} Protocol", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="HLS; covert channel; ts packet; self-created; embed", ABSTRACT="The main types of modern covert channels include streaming media covert channels like VoIP covert channels, blockchain covert channels, IPv6 covert channels, TCP/IP covert channels, etc. Each method faces different challenges and limitations in application. In the field of streaming media covert channels, avoiding video content interference and reducing the difficulty of steganalysis trace detection remains a problem. Thus, this work proposes an embedded covert channel construction based on the HLS protocol. This method uses self-created TS packets and original TS packets to embed information. This method not only ensures normal video playback, but also effectively reduces the risk of covert data detection. Through experimental comparative analysis, the covert channel scheme based on the HLS protocol has advantages in terms of load capacity, transmission rate, concealment, and robustness. In particular, compared with traditional TCP/IP and VoIP covert channels, the HLS protocol can provide a more efficient and concealed covert channel, with a transmission rate of up to 500 Kbps and a stealthiness score of 0.92 against machine learning-based detection." } @INPROCEEDINGS{IFIPNet25_Li2505_Lightweight, AUTHOR="Wanting Li and Maode Ma and Lijun Gao", TITLE="A Lightweight Authentication Protocol for {Wide-Range} Drone Communications", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Internet of Drones(IoD); Long Term Evolution(LTE); Unmanned Aerial Vehicles (UAVs); Multi-Domain; Security Protocol", ABSTRACT="The widespread potential of the Internet of Drones (IoD) across various domains is accelerating the development of technologies and innovative applications in multiple scenarios. Ubiquitous wireless connectivity makes it possible for Unmanned Aerial Vehicles (UAVs) to access real-time data in a difficult to reach or hazardous environment. Open network environments present a high security risk, which drastically reduces the success rate of UAVs in executing designated flight paths and transmitting real-time data. In order to address confidentiality and integrity in IoD communications, this paper proposes a lightweight and secure key negotiation protocol for wide-range UAV communications, called LAPW-DC. The protocol enables remote signaling between UAVs and Ground Stations (GS), as well as between UAVs, via Long-Term Evolution (LTE) networks, and solves the problem of independent use of the Physical Unclonable Function (PUF) technique for resisting physical capture over a wide area. Based on BAN logic and security evaluation against various common attacks, LAPW-DC is shown to enable secure communication in open network environments. Through a comparative study, we also demonstrate that LAPW-DC provides enhanced security with a lower communication and computational overhead compared to existing protocols." } @INPROCEEDINGS{IFIPNet25_Weav2505_Unsteady, AUTHOR="Mia J Weaver and Paul Barford and Fabian E. Bustamante and Esteban Carisimo and Lynne Stokes and Weili Wu", TITLE="Unsteady Underwater - On the Constancy of Submarine Path Properties", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="The world-wide submarine cable network (SCN) is one of the most costly, complex, and critical components in the Internet. In this paper, we describe a measurement study of packet dynamics on SCN paths. To conduct this study we built an active probe-based measurement system that harnesses looking glass nodes in strategic locations in service provider networks to gather data from 134 SCN paths. During the 18 month period of our study, we also tracked outage reports from online sources on a weekly basis. Our main finding is that key dynamic characteristics of the SCN including latency, loss, path stability, and outages vary widely. To provide perspective, we assess the operational constancy (i.e., remaining within bounds considered operationally equivalent) of SCN path properties and find a wide range of behavior. To further clarify these characteristics, we report the results of a cluster analysis and find that paths separate into distinct groups where behavior is either relatively stable or highly variable. Our findings have implications for operational practices, applications that utilize these paths, and for future measurement and monitoring of the SCN." } @INPROCEEDINGS{IFIPNet25_Wang2505_Argus, AUTHOR="Zhiquan Wang and Changqing An and Jilong Wang", TITLE="Argus Lens: Innovating Internet Measurement Infrastructure via Relay Services", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="measurement; relay; vantage point; VPN", ABSTRACT="This paper proposes an innovative approach to enhance network measurement by leveraging relay services as a complement vantage points (VPs) to existing infrastructures. Traditional methods, such as Looking Glass and cloud services, often face limitations in cost, geographic distribution, and operational flexibility. Our proposed framework enables researchers to easily conduct multi VP measurement studies with commercial relay services. The framework automatically manages relay connections and executes measurement tasks, while polygraph tests ensure the integrity of measurement data against potential negative impacts from dishonest relay servers. Based on our system, benchmark tests on two popular Internet measurement topics, topology discovery and IP geolocation, demonstrate the framework's effectiveness, revealing the protocol compatibility, geographic distribution, and impact of relay services on measurement results. The findings show that relay-based measurement systems offer unique perspectives and capabilities compared to traditional platforms. Our work introduces novel tools and methods, as well as valuable datasets and practical experiences, which will inspire the development of community." } @INPROCEEDINGS{IFIPNet25_Zare2505_Preserving, AUTHOR="Ahmad Zareie and Rizos Sakellariou", TITLE="Preserving Coreness while Reducing Connectivity in Network Graphs", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="coreness; network stability; network connectivity; network graphs; edge manipulation", ABSTRACT="Graphs, composed of nodes and edges, are widely used to model a variety of networks. On certain occasions, it is necessary to reduce connectivity within such network graphs to alleviate adverse effects, for instance, to contain undesirable or malicious events, such as the spread of viruses or rumours. However, such adjustments could alter a network's structure, potentially leading to the network's disruption and instability. In this paper, we address the problem of minimising network connectivity while ensuring that the network's coreness, a measure of its stability, remains intact. Given a graph and an integer b, the problem is to identify a set containing b edges whose removal minimises network connectivity while preserving its coreness. We outline a formal definition of the problem, establish its NP-hardness and, then, we introduce a naive greedy solution, which is improved by heuristics. A metric to assess the extent to which network connectivity can be reduced while maintaining network stability is also described. Experiments employing six real-world networks assess the effectiveness and efficiency of the proposed methods and demonstrate their suitability to solve the problem." } @INPROCEEDINGS{IFIPNet25_Rich2505_Breaking, AUTHOR="Robert Alexander Uwe Richter and Vasilis Ververis and Vaibhav Bajpai", TITLE="Breaking Through the Clouds: Performance Insights into Starlink's Latency and Packet Loss", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Starlink; Satellite Communication; Latency; Packet Loss; Traceroute", ABSTRACT="Our modern era is experiencing a rapid evolution in the area of satellite Internet access. However, it is unclear how well these systems actually work and what we can realistically expect from Internet access via satellites. Previous research has studied the performance and resilience of such systems, uncovering several drawbacks (e.g., high packet loss and unstable performance). In this work, we take a deeper look into the characteristics of the Starlink network. We scrutinize the TLS handshake latency, packet loss, and the diurnal latency variation aiming to establish a correlation between these factors. To achieve this, we utilize historic data measured by RIPE Atlas and Cloudflare Radar from 2022-01-01 to 2024-06-30. We find that there is no clear correlation between latency and packet loss in the Starlink's satellite network. However, we discover an intriguing pattern suggesting that Starlink serves specific latencies better than others. This finding contradicts recent research that claims a significantly poorer performance of Starlink with median latencies of significantly lower than 80 ms. Furthermore, our findings reveal substantial geographical variations, where even highly developed countries such as Germany experience packet loss ratios exceeding 10\%. Finally, we conclude our analysis with a further look on Starlink's routing behavior, which shows two sudden spikes in latency. The first spike results from the transition between satellite and terrestrial networks, while the second appears to be unrelated to Starlink." } @INPROCEEDINGS{IFIPNet25_Li2505_PASD, AUTHOR="Cong Li and Yuhan Cao and Xingxing Liao, Sr and Zilong Wang and Wei You and Xinsheng Ji", TITLE="{PASD-5GC:} A {Process-Based} Approach for Anomalous Signaling Detection in {5G} Core Network", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="5G Core Network; N4 Interface; Anomaly Detection; PFCP Session Process", ABSTRACT="The rapid evolution of 5G technology has driven the expansion of user-plane services, with the N4 interface playing a crucial role in managing signaling interactions between the control plane and the user plane. However, the architectural openness of the 5G Core Network (5GC) and the N4 interface's dependency on the Packet Forwarding Control Protocol (PFCP) expand anomalous signaling attack surfaces. Existing anomaly detection approaches for 5GC N4 interfaces focus on packet-level features while overlooking contextual process information, resulting in constrained detection effectiveness. This paper proposes a Process-based Anomalous Signaling Detection approach (PASD-5GC) that integrates PFCP business logic with behavioral patterns. The core model of PASD-5GC, termed DM-Net, is designed to capture both local and global features of signaling sequences. Extensive experiments demonstrated that, compared to existing methods, PASD-5GC achieves up to a 34\% improvement in abnormal signaling detection accuracy, validating the effectiveness and superiority of the proposed approach." } @INPROCEEDINGS{IFIPNet25_Rami2505_Interpretable, AUTHOR="Juan Marcos Ramirez and Pablo Rojo and Vincenzo Mancuso and Antonio {Fern{\'a}ndez Anta}", TITLE="Interpretable Outlier and Anomaly Detection for Mobile Networks from Small Tabular Data", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="anomaly detection; drive-test data; interpretable machine learning; mobile networks; outlier detection", ABSTRACT="Outliers and anomalies in mobile networks refer to significant deviations of the Key Performance Indicator (KPI) from expected values, often degrading user experience. Therefore, detecting and understanding these atypical events is crucial for troubleshooting. To monitor network performance, operators continuously collect data using different testing strategies. One such strategy involves drive-tests that capture datasets with many parameters but limited sample sizes, rendering them unsuitable for deep learning approaches, which require large datasets for effective learning. This paper proposes ROAD (Interpretable Outlier and Anomaly Detection), an unsupervised machine learning methodology designed to detect and understand atypical operational scenarios in mobile networks from small-scale tabular data collected from drive-tests. This methodology includes a detection stage that does not require prior knowledge of outlier or anomaly proportions. In addition, ROAD introduces an interpretability module that is applied to outliers and anomalies separately. This module identifies variables and samples associated with atypical events, quantifies the degree of similarity between each variable and the anomaly pattern, and builds a decision tree to reveal the ranges of variables describing anomalous scenarios. We implemented the methodology in software and evaluated its performance using real drive-test data. Our method provides high accuracy in detecting outliers and anomalies separately, while reducing the identification of false positives (recall) between 39\\% and 63\\% compared to an existing explainable detection method." } @INPROCEEDINGS{IFIPNet25_Kouk2505_Self, AUTHOR="Ippokratis Koukoulis and Ilias Syrigos and Thanasis Korakis", TITLE="{Self-Supervised} Transformer-based Contrastive Learning for Intrusion Detection Systems", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Intrusion Detection; Transformer Encoders; Self-Supervised Learning; Contrastive Learning", ABSTRACT="As the digital landscape becomes more interconnected, the frequency and severity of zero-day attacks, have significantly increased, leading to an urgent need for innovative Intrusion Detection Systems (IDS). Machine Learning-based IDS that learn from the network traffic characteristics and can discern attack patterns from benign traffic offer an advanced solution to traditional signature-based IDS. However, they heavily rely on labeled datasets, and their ability to generalize when encountering unseen traffic patterns remains a challenge. This paper proposes a novel self-supervised contrastive learning approach based on transformer encoders, specifically tailored for generalizable intrusion detection on raw packet sequences. Our proposed learning scheme employs a packet-level data augmentation strategy combined with a transformer-based architecture to extract and generate meaningful representations of traffic flows. Unlike traditional methods reliant on handcrafted statistical features (NetFlow), our approach automatically learns comprehensive packet sequence representations, significantly enhancing performance in anomaly identification tasks and supervised learning for intrusion detection. Our transformer-based framework exhibits better performance in comparison to existing NetFlow self-supervised methods. Specifically, we achieve up to a 3\% higher AUC in anomaly detection for intra-dataset evaluation and up to 20\% higher AUC scores in inter-dataset evaluation. Moreover, our model provides a strong baseline for supervised intrusion detection with limited labeled data, exhibiting an improvement over self-supervised NetFlow models of up to 1.5\% AUC when pretrained and evaluated on the same dataset. Additionally, we show the adaptability of our pretrained model when fine-tuned across different datasets, demonstrating strong performance even when lacking benign data from the target domain." } @INPROCEEDINGS{IFIPNet25_Liu2505_Bandwidth, AUTHOR="Shu Liu and Hong Shen and Chan-Tong Lam and K. L. Eddie Law", TITLE="{Bandwidth-Aware} Adaptive Gradient Quantization for {Cross-Organization} Federated Learning", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Gradient quantization is an effective way of compressing gradient data to reduce communication overhead in federated learning (FL) across a wide-area network (WAN). Existing gradient quantization methods are either static adopting a uniform quantization strategy across all nodes or dynamic according to the training demands without taking into account link bandwidths available at different different nodes, which hinges the performance of FL due to the communication bottleneck. This bottleneck becomes severe for cross-organizational FL in a WAN due to the dynamic heterogeneity across different nodes. This paper proposes a bandwidth-aware adaptive gradient quantization method to tackle the communication bottleneck caused by bandwidth heterogeneity for FL in WANs. It performs gradient quantization by adaptively adjusting the bit-width of gradient quantization based on the bandwidth condition of each node - large on low-speed links to accelerate transmission and small on high-speed links to improve global model accuracy. We present the FL algorithm under our framework and show how to compute the bit-width of each node by determining the appropriate number of discretization levels for gradient quantization. The experimental results demonstrate that our method reduces communication overhead by approximately 87.5\% compared to non-quantized gradient methods, while achieving significantly higher gradient precision compared to fixed quantization methods such as 2-bit and 4-bit approaches. Furthermore, experimental evaluations on multiple federated learning datasets show that our method achieves convergence time acceleration ranging from 1.57 to 4.80 times compared to four existing schemes. These findings highlight the important application value of our method for WAN federated learning." } @INPROCEEDINGS{IFIPNet25_Zand2505_FORESIGHT, AUTHOR="Farid {Zandi Shafagh} and Manya Ghobadi and Yashar Ganjali", TITLE="{FORESIGHT:} Joint Time and Space Scheduling for Efficient Distributed {ML} Training", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Machine Learning Training; Routing; Load Balancing; Network Scheduling", ABSTRACT="The rapid growth of Machine Learning (ML) workloads has led to increased reliance on large-scale accelerator clusters, where distributed training jobs demand high-performance network communication. However, the independent execution of ML jobs on shared cluster resources results in network contention, degrading training performance. Existing solutions either focus on optimizing communication operations for isolated jobs or address network scheduling in the time and space dimensions separately, leading to suboptimal outcomes. In this paper, we introduce FORESIGHT, a system that jointly optimizes communication scheduling across both time (when to communicate) and space (where to route traffic) dimensions. By taking advantage of the predictable and repetitive nature of ML training workloads, we can forecast future network demands and better coordinate communication to reduce congestion. Our approach iteratively refines scheduling decisions based on routing feedback, making the optimization problem tractable, while achieving a contention-free schedule. Our extensive evaluations demonstrate that FORESIGHT improves network efficiency, causing up to 46\% improvement in ML job iteration times, without requiring modifications to existing network hardware or application frameworks. Our findings emphasize the importance of network-aware scheduling and provide a scalable solution for optimizing distributed ML training in shared cluster environments." } @INPROCEEDINGS{IFIPNet25_Dey2505_STAGS, AUTHOR="Saikat Dey and Mark K. Gardner and Jeff Lang and Wu-chun Feng", TITLE="{STAGS:} A {Graph-Sampling} Approach for {GNN-based} Network Anomaly Detection", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="graph sampling; graph neural network; network graphs; anomaly detection; spectral entropy", ABSTRACT="Graph neural networks (GNNs) are promising for network anomaly detection but face scalability challenges when applied to real-world network graphs. These graphs are typically large, dynamic, and attributed, leading to excessive memory consumption and training time when processed in full. While sampling can mitigate scalability issues, graph sampling is inherently difficult due to the need to capture the complex structural connectivity in large-scale dynamic attributed graphs. Moreover, ensuring scalability without sacrificing the accuracy of GNN-based network anomaly detection requires a sampling approach that identifies and preserves graph regions that are critical for anomaly detection. In large-scale dynamic attributed network graphs, this demands integrating not only structural connectivity but also temporal dynamics and attributes into the sampling process. To address these challenges, we propose STAGS (Structural, Temporal, and Attribute-aware Graph Sampling), a novel sampling method that improves both the scalability and accuracy of GNN-based network anomaly detection. STAGS preserves network graph regions that show significant temporal spectral entropy changes (a strong indicator of anomalies) into the sampled subgraph. Through extensive experiments on four state-of-the-art GNN-based anomaly detection models, using twenty-four synthetic and two real-world network graphs, we show that STAGS improves scalability by accelerating training time by a factor of 2.44x (compared to training on the full graph) and improves the accuracy (AUC-ROC) by up to 53\%." } @INPROCEEDINGS{IFIPNet25_Xiao2505_Constraint, AUTHOR="Guocheng Lin and Yang Xiao and Jun Liu", TITLE="{Constraint-Aware} Probabilistic Packet Forwarding Based on Deep Reinforcement Learning", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Probabilistic packet forwarding; deep reinforcement learning; routing optimization; quality of service", ABSTRACT="The growing demand for network resources has made routing optimization a critical challenge in ensuring quality of service requirements. Many researchers have introduced probability into forwarding to achieve finer control and have employed deep reinforcement learning (DRL) to enable autonomous control. However, current DRL-based probabilistic packet forwarding approaches are limited by the lack of constraints for forwarding and cross-comparisons with other routing approaches, which results in severe routing loops and a lack of effectiveness and persuasiveness. To address these issues, this paper proposes a constraint-aware probabilistic packet forwarding approach, which employs a novel joint graph attention network actor-critic structure and is trained using proximal policy optimization. Besides, this paper proposes a novel probabilistic packet forwarding protocol for forwarding constraints to ensure routing safety. To validate the effectiveness of the proposed approach, comprehensive experiments are conducted within the proposed network simulation framework based on knowledge-defined networking. The results across diverse topologies and loads show that the proposed approach significantly improves network quality of service and robustness compared to two state-of-the-art DRL-based probabilistic packet forwarding approaches, three state-of-the-art DRL-based routing approaches, and two conventional routing approaches." } @INPROCEEDINGS{IFIPNet25_Bess2505_EMATRO, AUTHOR="Andr{\'e} C{\'e}dric Bessala and Guilherme {Iecker Ricardo} and Gentian Jakllari", TITLE="{E-MATRO:} An Adaptive and {Energy-Efficient} Framework for Slicing within the {O-RAN} Architecture", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="The complexity of Open RAN (O-RAN) networks, driven by dynamic traffic and stringent Quality of Service (QoS) requirements, challenges traditional centralized control, leading to suboptimal resource allocation and high energy consumption. We address the problem of energy-efficient, slice-compliant Virtual Network Function (VNF) placement by formulating it as a flow-based optimization model. To solve it, we propose E-MATRO, a multi-agent reinforcement learning (MARL) framework that integrates decentralized dApps with a centralized xApp for adaptive and scalable control. Experiments on simulated O-Cloud networks show that E-MATRO efficiently learns optimal policies, minimizing energy consumption while ensuring QoS compliance. Among tested RL approaches, Deep Q-Learning demonstrates superior adaptability in complex scenarios, highlighting the potential of hybrid MARL-based control for O-RAN." } @INPROCEEDINGS{IFIPNet25_Kura2505_Geo, AUTHOR="Masayuki Kurata and Akio Ikami and Masaki Suzuki", TITLE="Geo-distributed and Dynamic Control Plane Management toward Green Mobile Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Mobile network; Signaling message; Control plane; Edge computing; Energy savings", ABSTRACT="The growing number of user equipment (UE) connections in mobile networks amplifies signaling messages (SMsgs) in the control plane (C-plane). Since a hierarchical site architecture is adopted, mobile networks strain site infrastructure and inter-site backhaul links, resulting in higher power consumption. To address this, we propose Dynamic Hybrid Distributed and Centralized C-plane Placement (D-HDCCP), which dynamically allocates UEs to geo-distributed C-plane sites based on mobility profiles. Specifically, moving UEs are allocated to central/regional C-plane sites to reduce total SMsgs during handovers, while stationary UEs are allocated to edge C-plane sites to minimize inter-site SMsgs for state management. When a mobility profile changes, D-HDCCP evaluates whether reallocation maximizes energy efficiency by an online, threshold-driven decision mechanism that considers resource constraints at edge sites. This assessment is critical when shifting from moving to stationary and facing resource limitations at edge sites, as improper migration can lead to energy inefficiencies. A handover-synchronized migration procedure minimizes SMsg overhead for reallocation if a migration is performed. Extensive simulations in urban commuter UE scenarios show that D-HDCCP, when fully deployed at edge sites, reduces power consumption by up to 11.0\% during peak hours and 5.2\% over a full day, compared to legacy C-plane placement." } @INPROCEEDINGS{IFIPNet25_Ioan2505_Deep, AUTHOR="Iacovos Ioannou and Christophoros Christophorou and Gussan Mufti and Charalambos Klitis and Vasos Vassiliou and Christos Verikoukis", TITLE="Deep {Learning-Driven} {Two-Stage} Distributed Radio Resource Allocation in {6G} {Cell-Free} Communication Systems", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="6G networks; cell-free communication; distributed radio resource allocation; deep clustering; classification models; machine learning", ABSTRACT={The densification of wireless networks in 6G introduces severe co-channel interference, making traditional centralised radio resource allocation (RRA) schemes ineffective. This issue is particularly challenging in cell-free architectures, where dense deployments of user equipment (UE) and distributed access points (APs) demand scalable, interference-aware, and latency-efficient solutions. To address this, we propose a novel two-stage distributed RRA framework that employs deep learning for dynamic frequency band (FB) assignment. In the first stage, a fully connected autoencoder extracts latent representations of the UEs' spatial distribution. These latent representations are then clustered using silhouette-optimised K-Means, which adaptively determines the number of clusters. The resulting cluster heads are selected to serve as UE-based virtual base stations (UE-VBSs). A novel {"}in-out{"} spectrum reuse policy is then applied to assign FBs based on cluster proximity to the central base station. In the second stage, extracted link and cluster features (such as SINR, data rate, and UE location) are used to train a generative adversarial network (GAN)-based classifier that predicts optimal FB allocations. This two-stage approach enables an efficient, scalable and interference-aware solution making it well-suited for real time RRA allocation in ultra-dense, cell-free 6G environments. Simulation results show that our K-Means--GAN pipeline achieves 89\\% FB assignment accuracy and minimizes residual interference to \(1.10 \times 10^{-7}\,\text{W}\), outperforming deep clustering (DTC, DCN) and alternative classifiers (MLP, Wide \\& Deep, Random Forest) across multiple network sizes.} } @INPROCEEDINGS{IFIPNet25_Ojo2505_BlocBin, AUTHOR="Juliana Olubukola Ojo and Guilherme {Iecker Ricardo} and Gentian Jakllari", TITLE="{BlocBin:} {SLA-Compliant} and Efficient {RAN} Slicing in {Next-Generation} Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Efficient resource allocation in RAN Slicing poses significant challenges, particularly in meeting each slice's Service Level Agreements (SLAs) while ensuring isolation and customization. The choice of resource allocation method critically impacts the performance of users, slices, and the overall system. The inherent conflict between enforcing slice isolation and optimizing resource utilization makes the problem more difficult. We propose BLOCBIN, a channel-aware hierarchical downlink scheduling framework that ensures fairness relative to SLA across short- and long-term timescales while optimizing throughput. This framework effectively balances slice isolation with resource utilization efficiency and allows for customization. Simulation results show Blocbin improves SLA compliance by a factor of 1.5 compared to state-of-the-art solutions while maintaining the same spectral efficiency." } @INPROCEEDINGS{IFIPNet25_Rich2505_TROPIC, AUTHOR={Leon Richardt and Alexander Brundiers and Timmy {Sch{\"u}ller} and Nils Aschenbruck}, TITLE="{TROPIC:} {Traffic-Engineering-Oriented} Planning of {IP} Core Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Network expansion and traffic engineering (TE) are the two prevalent approaches for network operators to deal with the growth of Internet traffic. Although these are two complementary approaches, they are generally conducted completely independent of each other. In this paper, we argue for the importance of integrating routing and TE schemes already during expansion planning. For this, we introduce the 2SR Network Expansion Problem (2SR-NEP) that, given a network topology and a traffic forecast, aims for a minimum-cost network expansion that satisfies the projected demands under the 2-Segment Routing paradigm. We prove the NP-hardness of the 2SR-NEP and propose the TROPIC algorithm to solve it heuristically. An evaluation on a publicly available dataset shows the approach's ability to achieve cost savings of up to 60\% over a baseline approach." } @INPROCEEDINGS{IFIPNet25_Dai2505_Resilience, AUTHOR="Wenkai Dai and Klaus-Tycho Foerster and Stefan Schmid", TITLE="On the Resilience of Fast Failover Routing Against Dynamic Link Failures", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Resilience; Local Fast Failover; Dynamic Link Failures; Link Flapping; Graph Theory; Resilient Routing", ABSTRACT="Modern communication networks feature local fast failover mechanisms in the data plane, swiftly handling link failures with pre-installed rerouting rules. This paper explores resilient routing meant to tolerate \( \leq k \) link failures, ensuring packet delivery as long as the source and destination remain connected in the degraded network. While past theoretical works investigated failover routing under static link failures, i.e., links which permanently and simultaneously fail, real-world networks often experience link flapping-dynamic down states caused, e.g., by short-lived software-related faults. We categorize link failures into static, semi-dynamic (non-simultaneous), and dynamic (non-permanent and non-simultaneous) types, providing a comprehensive analysis of failover routing under these scenarios. We show that \(k\)-edge-connected graphs exhibit \((k-1)\)-resilient routing against dynamic failures for \(k\leq 5\), extendable to arbitrary \(k\) by rewriting \(\log k\) bits in packet headers. Rewriting \(3\) bits suffices to cope with \(k\) semi-dynamic failures. Furthermore, on general graphs, one dynamic failure can be handled without bit-rewriting. We complement our theoretical results with extensive simulations, comprised of over \(5\times 10^{6} \) evaluation runs." } @INPROCEEDINGS{IFIPNet25_Mizr2505_Non, AUTHOR="Tal Mizrahi and Shahar Belkar and Oren Spector and Reuven Cohen", TITLE="{Non-Shortest} Path Routing in Lossy Data Center Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Over the past decade, high-speed data center networks have evolved rapidly. Beyond traditional Clos and Fat-tree topologies, a variety of innovative architectures have gained prominence, driven by the escalating demand for high throughput and low latency in machine learning workloads. Conventional shortest-path routing approaches often prove inadequate for some of these topologies, leading to bottlenecks and congestion that reduce throughput. In this paper, we introduce a routing approach that leverages both shortest and non-shortest paths to enable high throughput across diverse data center topologies. Paths are selected using a lightweight measurement protocol that estimates the one-way delay over multiple paths and selects the most available one. Our approach is specifically designed for lossy networks that do not implement an L2 flow-control protocol, such as Priority Flow Control (PFC), thereby minimizing the risks of head-of-line blocking and the costs associated with deadlock prevention." } @INPROCEEDINGS{IFIPNet25_Irte2505_Efficient, AUTHOR="Hafiza Ramzah Rehman and Sana Mahmood and Syed Mohammad Irteza and Fahad Dogar and Ihsan Ayyub Qazi", TITLE="Efficient Datacenter Load Balancing with Microslices", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Load Balancing; Datacenters; Software-Defined Networking; Virtual Topologies; Rate Limiting", ABSTRACT="Efficient load balancing of traffic across multiple paths is crucial for fully utilizing the available bandwidth in datacenters. While solutions like packet spraying are simple and near-optimal in symmetric network settings, we still lack efficient solutions for scenarios when there are asymmetries in the network (e.g., link failures and topology asymmetry). In this paper, we propose Wino, a new network load balancing scheme for datacenters that is explicitly designed with asymmetry in mind. Wino uses the abstraction of a microslice to construct efficient virtual symmetric topologies. Wino combines SDN's rate limiting capability with per-packet load balancing to uniformly spray traffic over fine-grained microslices, thereby leading to efficient utilization of the available network bandwidth. Our results show that Wino achieves robust performance across a range of traffic scenarios and application workloads." } @INPROCEEDINGS{IFIPNet25_Oliv2505_Distributed, AUTHOR="Joaquín {Olivares Bueno} and H{\'e}ctor {Martínez P{\'e}rez} and Fernando {Leon Garcia} and Jose M. Palomares", TITLE="Distributed Fog Computing for {Real-Time} Surveillance", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Weapon detection; Face recognition; Distributed computing; Fog computing; Deep Learning", ABSTRACT="The increasing need for automated surveillance systems has led to the development of intelligent solutions that integrate artificial intelligence and distributed computing. This paper presents a Fog Computing-based surveillance system for real-time weapon detection and face recognition. Unlike traditional cloud-centric systems, the proposed model leverages Edge, Fog, and Cloud layers to optimize processing efficiency, reduce network congestion, and minimize power consumption. Distributing computing tasks across multiple layers significantly reduces transmitted data volume while ensuring fast and reliable threat identification. Experimental results suggest the proposed system can substantially reduce data transmission, preserving high detection accuracy. Adaptive and on-demand activation of the Edge, Fog, and Cloud processing layers contributes to improved efficiency and responsiveness, making the system a promising option for scalable and large-scale surveillance applications." } @INPROCEEDINGS{IFIPNet25_Khat2505_Modular, AUTHOR="Mohammad Saghali and Mahdi Naderibeni and Vikramajeet Khatri and Siwar Kriaa and Serge Papillon and Mehrnoosh Monshizadeh", TITLE="Modular {ML-Based} {IDS:} Layered Attack Detection via Header \& Payload Analysis", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Intrusion Detection System; Machine Learning; Classification; Clustering; Header Analysis; Payload Analysis", ABSTRACT="We present a demonstration of Hybrid Anomaly Detection Model (HADM), a machine learning based architecture that effectively identifies and filters malicious network activities. HADM comprises of a protocol analyzer as well as several classification and clustering algorithms. Through interactive visualizations and real-time analysis, we demonstrate the platform's effectiveness using various classification and clustering metrics, including precision, recall, and silhouette score. The demonstration highlights HADM's robust scalability in handling datasets of varying sizes and its adaptability to diverse attack patterns, validating it as a comprehensive solution for modern network security threats." } @INPROCEEDINGS{IFIPNet25_Mahr2505_Group, AUTHOR="Hendrik Mahrt and Martina Zitterbart", TITLE="Group-aware Resource and Path Discovery for Collaborative {Ultra-Low} Latency Applications", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Support for applications like collaborative extended reality and multi-sensory communication in 6G demands ultra-low end-to-end latency guarantees for a group of interacting users. Placement of such applications requires discovering appropriate edge resources and paths across mobile networks of different operators or Internet-based edge clouds. This poster outlines Sherpa, a novel distributed resource discovery mechanism that especially addresses finding latency-constrained, cross-provider paths to all users of a group." } @INPROCEEDINGS{IFIPNet25_Grin2505_Effectively, AUTHOR="Chen Griner", TITLE="Effectively Mimicking Datacenter Traffic Patterns Using Transformers", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Traffic modeling and synthesis; datacenters", ABSTRACT="Large language models (LLMs) learn patterns that enable them to generalize across diverse tasks. Given their nature as sequence predictors, can they also learn patterns from datacenter network traces? In this work, we introduce DTG-GPT, a packet-level Datacenter Traffic Generator (DTG), based on the generative pre-trained transformer (GPT) architecture used by state-of-the-art LLMs. We train our model on a small set of available traffic traces and offer a simple methodology to evaluate the fidelity of the generated traces to their original counterparts. We show that DTG-GPT can synthesize novel traces that mimic the spatiotemporal patterns found in real traffic traces. Our findings indicate the potential that, in the future, similar models to DTG-GPT will allow datacenter operators to release traffic information to the research community via trained GPT models." } @INPROCEEDINGS{IFIPNet25_Dass2505_Privacy, AUTHOR={Prajnamaya Dass and Yevhen Zolotavkin and Stefan {K{\"o}psell}}, TITLE="Privacy Preserving Integrated Sensing and Communication Architecture for {6G} Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Integrated sensing and communication; ISAC; 6G; Privacy; Consent; Transparency", ABSTRACT="Integrated sensing and communication (ISAC) technology allows sensing services alongside communications, supporting diverse 6G applications by detecting and analyzing the target areas. However, the collection and processing of sensing data containing personally identifiable information (PII) raises concerns about consent and transparency according to standard data protection regulations. To address this, in this poster, we integrate new functions into the 6G-ISAC architecture, focusing on transparency exposure, consent acquisition, and privacy enforcement. These functions ensure privacy and data regulatory requirements for each sensing request handled by the network. Furthermore, we explore various interface-based approaches to facilitate consent and transparency for users connected to the network, users from external networks, and users not connected to any network." } @INPROCEEDINGS{IFIPNet25_Cvet2505_D, AUTHOR="Darko Cvetkovski and Christoph Herold and Eckhard Grass", TITLE="{D-Band} {Line-of-Sight} {MIMO} Link Demonstration", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="D-Band; Dielectric Lens; Line-of-Sight MIMO; Spatial Multiplexing; Hardware-in-the-Loop; Demonstration", ABSTRACT="In this work, preliminary results from the prototyping phase of a 2x2 D-Band Line-of-Sight MIMO link are presented. Aiming to demonstrate ultra-high throughput for point-to-point fixed wireless links, line-of-sight MIMO is implemented and evaluated with the large modulation bandwidth that is available in the D-Band (110 - 170 GHz) of the millimeter-wave frequency range. The link demonstration is performed in a hardware-in-the-loop setup, at a 2 m range in an indoor conference hall environment. It is based on IHP's D-Band 130-nm SiGe BiCMOS analog front-ends operating at a carrier frequency of 135 GHz, in combination with dielectric lenses. In order to obtain a near-orthogonal MIMO channel in line-of-sight conditions, the setup is relying on optimal arrangement between the transmit and receive antennas, according to the Rayleigh criterion. By performing spatial multiplexing of 2 QPSK-modulated data streams with 4 GHz modulation bandwidth, an aggregated throughput of 16 Gb/s is achieved during a live link demonstration. As the system is in its early development phase, it is subject to ongoing work to further enhance the link range and throughput." } @INPROCEEDINGS{IFIPNet25_Maul2505_Detecting, AUTHOR="Riz Maulana and Habib Mostafaei and Nirvana Meratnia", TITLE="Detecting Stragglers in Programmable Data Plane", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT={Flow scheduling mechanisms in modern data centers aim to reduce flow completion time (FCT). However, scheduling mechanisms that operate without prior knowledge, such as PIAS, or with imprecise flow information like QClimb, can inadvertently introduce stragglers--packets within a flow that experience significantly higher queueing delays than others. These stragglers can lead to prolonged FCT, undermining the goals of flow scheduling. While existing network monitoring tools focus on root causes of performance bottlenecks, they lack mechanisms for detecting {"}victims{"} of such issues. In this paper, we present STRAGFLOW, a data-plane tool for straggler detection. STRAGFLOW monitors queueing delays at line rate, identifies stragglers in real time, and reports them to the control plane. We evaluate STRAGFLOW using real-world network traces and demonstrate that it can effectively detect stragglers across different scheduling schemes and various link conditions. Our results show that STRAGFLOW can provide valuable insights into straggler distribution, helping operators diagnose and mitigate flow scheduling issues to improve overall network performance.} } @INPROCEEDINGS{IFIPNet25_K2505_Detecting, AUTHOR="Ranjitha K and Karuturi Havya Sree and Devansh Garg and Stavan Nilesh Christian and Dheekshitha Bheemanath and Rinku Shah and Praveen Tammana", TITLE="Detecting Manipulation to Table Rules in the Programmable Data Planes", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="table rule enforcement; detect unauthorized table update modification; detect attack; table rule validation", ABSTRACT="Network management systems built on programmable data planes enhance network performance, security, and reliability. However, these systems also increase the attack surface and, hence, are vulnerable to attacks not seen before. We focus on a problem that stems from the fact that a P4 switch data plane trusts the control messages (table update messages) from upper layers in the switch control plane (OS, SDK, drivers). Since the control messages update the packet forwarding behavior in the switch data plane (by updating table rules), any unauthorized modifications to the control messages by an adversary at any of these layers can lead to poor performance, privacy compromise, bypass security, or in the worst case network outage. In this paper, we present P4TVal, a P4 Table rule Validation system that detects unauthorized modifications to data plane table rules. Our key idea is early detection, where a table rule update is promptly followed by an authenticated rule validation. To realize this idea, we retrieve the data plane rule by sending custom packets from the controller without getting compromised by the adversary. We prototype P4TVal for Intel Tofino and BMV2 and demonstrate how P4TVal can detect unauthorized modifications to table rules. Our evaluation shows that P4TVal's early detection reduces the detection time by 10X when compared with the state-of-the-art approach." } @INPROCEEDINGS{IFIPNet25_Krac2505_Hocarest, AUTHOR="Timon Krack and Martina Zitterbart", TITLE="Hocarest: Host Cardinality Estimation {On-Switch} using Randomized Algorithm and {TCAM}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Monitoring the properties of network traffic, such as the number of different hosts actively sending traffic (host cardinality), is used to observe the behavior of a network and detect threats such as Distributed Denial of Service (DDoS) attacks. However, increasing data rates pose a scalability problem due to the packet processing overhead and excessive memory requirements. In this paper, we propose Hocarest, a novel randomized algorithm that efficiently estimates the host cardinality of the ingress traffic on a switch using its Ternary Content Addressable Memory (TCAM). Hocarest writes a constant number of flow rules to the TCAM. The rules probabilistically match IP source addresses. An estimation of the host cardinality is obtained solely from the match statistics tracked by the switch. No traffic needs to be mirrored and processed externally, and the memory requirements are independent of the traffic volume. We analyze the accuracy of the estimations using real-world traffic and a hardware testbed. Our results demonstrate that Hocarest provides accurate and scalable cardinality estimations with less than 5\% variance when using 4000 TCAM rules." } @INPROCEEDINGS{IFIPNet25_Mats2505_ReBARC, AUTHOR="Kazuhisa Matsuzono and Hitoshi Asaeda", TITLE="{ReBARC:} {Recovery-Budget-Aware} {In-Network} Retransmission Control in {ICN}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="ICN; NDN; in-network retransmission", ABSTRACT="Information-centric networking (ICN) is a promising approach to fulfilling future application requirements, such as high-quality, low-latency video streaming. Because data loss significantly affects the user experience of such applications, rapid loss recovery is central to ICN solutions. ICN works with hop-by-hop data transmission, which is beneficial for in-network data retransmission. However, sophisticated in-network retransmission mechanisms that can recover data losses effectively and efficiently have not been fully studied. In this paper, we propose recovery-budget-aware in-network retransmission control in ICN (ReBARC). ReBARC attempts successful loss recovery while satisfying latency requirements and suppressing duplicate data receptions in a fully distributed manner. Through receiver-driven hop-by-hop communication, receivers (e.g., consumers) allocate a maximum allowable recovery delay (recovery budget) to each link. For effective budget allocation, consumers recognize the budget consumption and request at each link in a network telemetry manner. Based on the allocated budget, each node adjusts the retransmission time-out value and methods of relaying recovery data without exchanging additional control messages with other nodes. Through comprehensive experimental evaluations, we confirm that ReBARC maintains higher video quality than existing methods by achieving more successful loss recoveries and fewer duplicate data receptions." } @INPROCEEDINGS{IFIPNet25_Dinh2505_End, AUTHOR="Lam Dinh and Sihem Cherrared and Xiaofeng Huang and Fabrice M. Guillemin", TITLE="Towards {End-to-End} Network Intent Management with Large Language Models", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Intent-based networking; Network automation; Large Language Models (LLMs); LLM evaluation", ABSTRACT="Large Language Models (LLMs) are likely to play a key role in Intent-Based Networking (IBN) as they show remarkable performance in interpreting human language as well as code generation, enabling the translation of high-level intents expressed by humans into low-level network configurations. In this paper, we leverage closed-source language models (i.e., Google Gemini 1.5 pro, ChatGPT-4) and open-source models (i.e., LLama, Mistral) to investigate their capacity to generate E2E network configurations for radio access networks (RANs) and core networks in 5G/6G mobile networks. We introduce a novel performance metrics, known as FEACI, to quantitatively assess the format (F), explainability (E), accuracy (A), cost (C), and inference time (I) of the generated answer; existing general metrics are unable to capture these features. The results of our study demonstrate that open-source models can achieve comparable or even superior translation performance compared with the closed-source models requiring costly hardware setup and not accessible to all users." } @INPROCEEDINGS{IFIPNet25_Hou2505_Min, AUTHOR="Yeqiao Hou and Han Yang and Xianglong Li and Ling Deng and Liang Du and Zongpeng Li and Yining Li", TITLE="{Min-Cost} Multicast Streaming with Network Coding in Edge Computing Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Live Video Streaming; Edge Computing Networks; Online Auction; Multicast Algorihtms; Network Coding", ABSTRACT="We study edge computing networks where selected routers are equipped with heterogeneous processors such as CPUs, GPUs and FPGAs, to enable in-network computing capabilities. Leveraging the IPv6-SRv6 paradigm, programmable networking integrates seamlessly with these hardware innovations, supporting application-defined compute-and-forward operations. Video streaming, a dominant application in edge networks, often involves edge routers performing replication, encoding/decoding, and transcoding tasks enroute to end users. These streams compete for limited computing and transmission resources, which is modeled as an online social welfare maximization problem. The proposed solutions employ key techniques that include: Firstly, a compact exponential algorithm framework that tackles the non-packing and non-covering structure of edge welfare maximization, by translating explicit algebraic constraints into implicit geometric constraints; Secondly, a primal-dual method that breaks down edge welfare optimization into simpler multi-round auctions; and Finally, a dual oracle leveraging network coding algorithms for efficient multicast optimization. Simulations studies demonstrate 61.2\\% social welfare improvement compared to benchmark algorithms, validating efficient coordination of resources while maintaining compatibility with edge infrastructure under dynamic workloads." } @INPROCEEDINGS{IFIPNet25_Gepp2505_Multicast, AUTHOR={Heiko Geppert and Frank {D{\"u}rr} and Simon Na{\ss} and Kurt Rothermel}, TITLE="Multicast-partitioning in Time-triggered Stream Planning for {Time-Sensitive} Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Multicast; time-sensitive networking; scheduling", ABSTRACT="Multicast allows sending a message to multiple recipients without having to create and send a separate message for each recipient. This preserves network bandwidth, which is particularly important in time-sensitive networks. These networks are commonly used to provide latency-bounded communication for real-time systems in domains like automotive, avionics, industrial internet of things, automated shop floors, and smart energy grids. The preserved bandwidth can be used to admit additional real-time messages with specific quality of service requirements or to reduce the end-to-end latencies for messages of any type. However, using multicast communication can complicate traffic planning, as it requires free queues or available downstream egress ports on all branches of the multicast tree. In this work, we present a novel multicast partitioning technique to split multicast trees into smaller multicast or unicast trees. This allows for a more fine-grained trade-off between bandwidth utilization and traffic scheduling difficulty. Thus, schedulability in dynamic systems can be improved, in terms the number of admitted streams and the accumulated network throughput. We evaluated the multicast partitioning on different network topologies and with three different scheduling algorithms. With the partitioning, 5-15\% fewer streams were rejected, while achieving 5-125\% more network throughput, depending on the scheduling algorithm." } @INPROCEEDINGS{IFIPNet25_Einz2505_Selective, AUTHOR="Hadar {Cochavi Gorelik} and Gil Einziger", TITLE="Selective Aggressive Caching in {DNS} Resolvers", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Volumetric attacks on the Domain Name System (DNS) are an escalating concern, particularly NXDomain attacks, in which attackers generate queries for nonexistent subdomains of a target domain. This tactic effectively bypasses resolver caches, degrading Internet performance for millions of users. Notably, RFC8198 proposes countermeasures to prevent attackers from circumventing resolver caching, significantly reducing the attack's effectiveness. However, RFC8198 requires resolvers to utilize DNSSEC-validated entries, which demand more computational resources than standard entries. As a result, implementing RFC8198 increases resolvers' resource consumption and reduces their effective throughput, both under normal conditions and during an attack. In essence, resolvers must allocate additional resources to shield authoritative name servers from attacks-a challenging proposition given that these servers are managed by separate entities with potentially conflicting interests. Our work reexamines the implementation of RFC8198 in resolvers and proposes self-optimizing strategies that enable resolvers to adopt the RFC while maximizing performance both during normal operation and under attack. Our solution increases throughput by approximately 40\\% during an attack and reduces average latency by a factor of two. Simultaneously, it maintains comparable peacetime performance and enhances protection for authoritative name servers against NXDomain attacks." } @INPROCEEDINGS{IFIPNet25_Zhan2505_Memory, AUTHOR="Xufeng Zhang and Sara Alouf and Giovanni Neglia", TITLE="Memory-efficient Online Caching Policies with Regret Guarantees", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Caching; Regret; Follow-the-Perturbed-Leader; Johnson-Lindenstrauss lemma", ABSTRACT="Online learning algorithms provide robust performance in caching problems but require substantial memory to store per-file historical data, limiting their scalability to large-catalog systems. To overcome this challenge, we propose a dimensionality reduction algorithm based on the Follow-the-Perturbed-Leader framework and the Johnson-Lindenstrauss lemma. Our method significantly reduces memory consumption while preserving sublinear regret, making it well-suited for caching under resource constraints. Experiments on both synthetic and real-world traces demonstrate its advantages over other memory-efficient approaches." } @INPROCEEDINGS{IFIPNet25_Andr2505_Holistic, AUTHOR="Andreas Andreou and Constandinos X. Mavromoustakis and George Mastorakis and Athina Bourdena and Evangelos K. Markakis", TITLE="A Holistic {3D} Deployment and Connectivity Framework for {IoT-Enabled} Environments", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="This article addresses the growing need for effective solutions supporting increasingly large and diverse Internet of Things (IoT) ecosystems. A holistic method is presented, starting with node placement generated by a Poisson Point Process (PPP) to ensure flexibility in highly varied indoor domains. The approach partitions the environment with spheres, transforming the space into Voronoi cells that allocate coverage responsibilities more reliably. A modified Genetic Algorithm (GA) then refines both node positions and connectivity profiles, focusing on continuous network integrity, mainly via Ceiling-Mounted Systems (CMS) placed overhead. These CMS operate as robust anchors for data aggregation and communication stability. In advanced medical scenarios, distributed Internet of Medical Things (IoMT) sensors work alongside CMS and Deep Reinforcement Learning (DRL), balancing resource usage, power consumption, and timeliness metrics such as data freshness. Simulation outcomes underscore the framework's ability to increase coverage effectiveness, enhance connectivity, and boost overall network resilience while also containing energy and node deployment costs. Because the method is equally applicable to complex, obstacle-laden environments, it holds promise for standard smart buildings and latency-sensitive healthcare contexts where continuous monitoring, quick analytics, and strict security are paramount." } @INPROCEEDINGS{IFIPNet25_Godk2505_LoRa++, AUTHOR="Shrutkirthi S. Godkhindi and Deeksha P Rao and R Venkatesha Prasad and T Venkata Prabhakar", TITLE="{LoRa++:} Mixed {Up-Down} {CSS} Modulation for Enhanced Scalability and Data Rate in {LPWANs}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="LoRa; IoT; CSS modulation; Scalability", ABSTRACT="LoRa has been widely used for various Internet of Things (IoT) applications because of its simplicity \& ease of deployment. However, LoRa suffers from low data rates and higher collisions. We propose \& implement a mixed index modulation scheme LoRa++ that carries two additional bits per symbol in each of the supported spreading factors. We do this by introducing UpDown and DownUp chirps to augment the existing Up and Down chirps. Modulation and demodulation are non-trivial, but we can easily incorporate them within the existing LoRa nodes and gateways. Our results show that SNR requirements for LoRa++ demodulation are within the 1-2 dB range from conventional LoRa. Moreover, LoRa++ performs equally well for inter-SF interference. Our simulation results show that LoRa++can accommodate more nodes due to the reduced time on air. Finally, we show that our hardware implementation on USRP is simple, and the results validate the performance of LoRa++. The performance of the new scheme in terms of BER is on par with that of conventional LoRa." } @INPROCEEDINGS{IFIPNet25_Lind2505_Measurement, AUTHOR="Simon {Lindståhl} and Alexandre Proutiere and Andreas Johnsson", TITLE="{Measurement-Efficient} Dynamics Change Detection in {On-Off} Models for Dynamic Spectrum Access", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="To maintain efficient scheduling for dynamic spectrum access problems, it is crucial to promptly detect changes in the statistical properties of spectrum occupancy. Compared to traditional change detection problems, this is complicated by the fact that measurements are not independent through time and can instead have Markovian dependencies. Moreover, classical change detection methods neglect the cost associated with measurements and do not consider the potential benefits of adapting the measurement schedule based on the observed state and the perceived likelihood of a change. This may result in high measurement overhead. In this paper, we study measurement-efficient change detection in Markovian models and demonstrate its applicability for spectrum access problems. In particular, we study problems with two states corresponding to spectrum occupancy, so called on-off models, and show important properties of these problems. For these problems, we establish fundamental limits that are imposed when the detection agent must maintain a sufficiently small false alarm rate. We also propose two classes of algorithms designed to adapt to different aspects of the problem. We analyze the behavior of these algorithms and evaluate them, using both synthetic data as well as real Wi-Fi spectrum data." } @INPROCEEDINGS{IFIPNet25_Chil2505_SAGE, AUTHOR="Shanti Chilukuri and Vinayaka Shashank Varanasi and Kalyana Chakravarthy C", TITLE="{SAGE:} Transmission Power Management for Deadline-aware, Multihop {IoT} Edge Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="Wireless networks with resource-constrained end devices are useful for a diverse range of applications, but create a need for reduction of the energy consumed by the devices. In addition, such networks have to meet application-imposed Quality of Service requirements such as low, bounded delay and reliable communication. Edge networks with Time Division Multiple Access (TDMA) reduce collisions and provide bounded end-to-end packet delay, but finding deadline-aware TDMA schedules is an NP-hard problem, even without focusing on the energy expenditure. In this paper, we propose SAGE, a Deep Reinforcement Learning-based strategy for learning transmiSsion power management for deAdline-aware multihop IoT edGE networks. The transmission power plan created by SAGE determines the time slot and adaptive transmission power to be used by each end device to transmit/relay data, such that the number of packets missing their deadlines is minimized, while also minimizing the total energy spent in packet transmission and reception. This is achieved by a carefully crafted reward function of the DRL agent that leads to the sequential optimization of these two goals. Extensive evaluations of SAGE for a number of network scenarios show that it can result in up to 48\\% energy savings compared to baseline and other recent deadline-aware scheduling and routing schemes, while performing equally well or better in terms of timely packet delivery." } @INPROCEEDINGS{IFIPNet25_Pazh2505_Reminis, AUTHOR="Parsa Pazhooheshy and Soheil Abbasloo and Yashar Ganjali", TITLE="Reminis: A Simple and Efficient Congestion Control Scheme for {5G} Networks and Beyond", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="5G cellular networks are anticipated to support diverse emerging services with stringent delay requirements, ranging from 20 ms for VR/AR to 100 ms for immersive video streaming. However, the highly variable and unpredictable nature of 5G access links poses challenges for existing end-to-end (e2e) congestion control (CC) schemes, resulting in suboptimal performance. This paper demonstrates that a simple yet effective e2e CC scheme for 5G networks can be achieved by blending non-deterministic exploration techniques with straightforward proactive and reactive measures. Our proposed scheme, Reminis, is designed to achieve high controllable performance while possessing provable properties. Through extensive experiments on emulated and real-world 5G networks from different vendors, with different network configurations and mobility scenarios, we illustrate the performance benefits of Reminis in 5G networks compared to state-of-the-art CC schemes and its generalizability to 3G and 4G networks. For instance, in 5G Standalone (SA) scenarios, Reminis achieves a 2.2 times lower 95th percentile delay compared to a recent design by Google (BBR2) while maintaining the same link utilization." } @INPROCEEDINGS{IFIPNet25_Yang2505_PVD, AUTHOR="Ying Yang and Yang Xiao and Jun Liu", TITLE="{PVD-TD3:} A {Latency-Oriented} {Multi-Agent} Reinforcement Learning Algorithm for Multipath Routing in {DetNet}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="deterministic networking; multi-agent deep reinforcement learning; multipath routing", ABSTRACT="The growing demand for ultra-reliable low-latency communication (URLLC) in real-time and mission-critical applications necessitates more rigorous deterministic networking (DetNet) in network traffic engineering. However, DetNet still struggles with routing optimization ensuring efficient resource allocation under growing quality-of-service (QoS) requirements. To address this issue, we propose a multi-agent deep reinforcement learning (MADRL)-based multipath routing method for effective flow scheduling in DetNet. Specifically, we design a novel partially value decomposition (PVD) and twin delayed deep deterministic policy gradient (TD3) algorithm, termed PVD-TD3. The proposed algorithm decomposes the joint action-value function within the neighborhood of each agent, thus enhancing scalability and minimizing communication overhead. Additionally, we introduce a latency-oriented weight calculation mechanism to assess the importance of each agent, enabling the weighted aggregation of value functions and improving adaptability to DetNet. Experimental results demonstrate that our proposed PVD-TD3 algorithm significantly outperforms benchmark methods. Compared to the average performance of the baseline methods, PVD-TD3 reduces the end-to-end (E2E) delay by 48.03\% and the packet loss rate by 22.91\%." } @INPROCEEDINGS{IFIPNet25_Bles2505_Insights, AUTHOR="Roland Bless and Lukas Lihotzki and Martina Zitterbart", TITLE="Insights into {BBRv3's} Performance and Behavior by Experimental Evaluation", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES=9, KEYWORDS="Congestion Control; BBRv3; Performance Evaluation", ABSTRACT="This paper investigates the performance of BBRv3. BBRv3 aims at achieving high throughput with low latency and low packet loss rates. We evaluate BBRv3's performance in a Linux-based testbed and, beyond pure descriptive observations, we also identify and explain causes of the observed behavior. In contrast to existing work, we investigate BBRv3's behavior at bottleneck data rates of 100 Mbit/s-10 Gbit/s and delve deeper into the issue of self-induced queuing delay. We also study the impact of delay jitter on performance. Moreover, we investigate the performance of many concurrent short flows taken from a real-world traffic trace. BBRv3 does not really achieve its low delay goal: while it is able to limit queuing delay in large buffers, it regularly adds 0.95 RTTmin queuing delay in a single flow scenario and more than 1 RTTmin over 50\% of the time with multiple BBR flows (RTTmin: round-trip time without queuing delay). We also observe fairness problems and slow convergence that already existed with BBRv2. BBRv3 flows are not strongly susceptible to delay jitter, though it adversely affects queuing delay and fairness behavior to a certain degree (but not to starvation). In our experiments with short flows from the real- world traffic, BBRv3 performs only slightly, but consistently better than CUBIC." } @INPROCEEDINGS{IFIPNet25_Fran2505_Demand, AUTHOR="Matthias Bentert and Max Franke and Darya Melnyk and Arash Pourdamghani and Stefan Schmid", TITLE="{Demand-Aware} {Multi-Source} {IP-Multicast:} Minimal Congestion via Link Weight Optimization", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="Multicast; Congestion control; Algorithm design", ABSTRACT="Multicast is a fundamental communication primitive that can improve the efficiency of many distributed systems. However, current algorithms to construct multicast trees only consider link capacities and are oblivious to the bandwidth demands of senders. Such demand-oblivious approaches can result in suboptimal resource allocations and congestion. In this work, we initiate the study of a demand-aware multi-source IP-multicast. In particular, we consider how an operator can optimize link weights to minimize congestion along multiple (and hence possibly overlapping) multicast trees. We show that this problem is NP-hard even in very restricted settings such as (i) where there are only two possible link weight values or (ii) where the graph contains only a single receiver. To obtain optimal solutions as well as a baseline for comparison, we also present a mixed integer linear program. We then suggest two fast heuristics, DA-Picky and DA-Hybrid, based on maximum-bottleneck spanning trees. Our empirical results, based on real-world data, show that our algorithms outperform today's demand-oblivious approach and scale to large networks." } @INPROCEEDINGS{IFIPNet25_Sarp2505_BBRs, AUTHOR="Fatih Berkay Sarpkaya and Ashutosh Srivastava and Fraida Fund and Shivendra Panwar", TITLE="{BBR's} Sharing Behavior with {CUBIC} and Reno", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="TCP; BBR; Congestion Control", ABSTRACT="TCP BBR's behavior has been explained by various theoretical models, and in particular those that describe how it co-exists with other types of flows. However, as new versions of the BBR protocol have emerged, it remains unclear to what extent the high-level behaviors described by these models apply to the newer versions. In this paper, we systematically evaluate the most influential steady-state and fluid models describing BBR's coexistence with loss-based flows over shared bottleneck links. Our experiments, conducted on a new experimental platform (FABRIC), extend previous evaluations to additional network scenarios, enabling comparisons between the two models and include the recently introduced BBRv3. Our findings confirm that the steady-state model accurately captures BBRv1 behavior, especially against single loss-based flows. The fluid model successfully captures several key behaviors of BBRv1 and BBRv2 but shows limitations, in scenarios involving deep buffers, large numbers of flows, or intra-flow fairness. Importantly, we observe clear discrepancies between existing model predictions and BBRv3 behavior, suggesting the need for an updated or entirely new modeling approach for this latest version. We hope these results validate and strengthen the research community's confidence in these models and identify scenarios where they do not apply." } @INPROCEEDINGS{IFIPNet25_Kapo2505_Predicting, AUTHOR="Somiya Kapoor and Ethan Witwer and David Hasselquist and Mikael Asplund and Niklas Carlsson", TITLE="Predicting Video {QoE} from Encrypted Traffic: Leveraging Video Fingerprinting and Providing {System-Level} Insights", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES=10, ABSTRACT="Accurate Quality of Experience (QoE) estimation is both important and challenging for network operators: important since it is crucial for improving user satisfaction and challenging due to end-to-end encryption preventing them from accessing critical application-level metrics, such as video quality and buffering, forcing them to rely on indirect network-level data for QoE assessment. In this work, we address the challenge of predicting QoE from encrypted video traffic through two key contributions. First, we adapt state-of-the-art video fingerprinting techniques, originally developed for content identification, to accurately predict QoE in encrypted settings. We demonstrate that our best tested model achieves high prediction accuracy across diverse and fluctuating network conditions, establishing it as a reliable QoE predictor. These findings underscore the potential of deep learning-based classification techniques for predicting QoE from network traffic, offering a practical tool for QoE management across diverse streaming environments. Second, we conduct a systematic analysis of essential system-level factors to provide practical guidance for network operators. Here, we examine the impact of training data composition, varying network conditions, and model generalizability across sites. Our results reveal that robust QoE prediction is possible with our best tested model even with limited training data and varying conditions, making our approach feasible for real-world deployment. By enabling QoE prediction without requiring access to encrypted video content, our approach stands to support network operators in proactively managing QoE and dynamically adjusting network resources, ultimately enhancing user satisfaction." } @INPROCEEDINGS{IFIPNet25_Fami2505_Precise, AUTHOR="Alireza Famili and Tolga O Atalay and Angelos Stavrou", TITLE="Precise Positioning for Healthcare Robotics with Retroreflective Tags in {5G} Small Cell Networks", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", ABSTRACT="The deployment of service robots in healthcare facilities-ranging from autonomous medication delivery carts to patient-assisting mobile platforms-is expanding across diverse applications. To carry out these tasks effectively, there is a pressing need for precise indoor positioning. While global navigation satellite system (GNSS) reliably supports outdoor localization, their performance degrades significantly in indoor settings. In this work, we introduce REFINE: Retroreflective FR2 Indoor Navigation Engine, a high-accuracy localization scheme for indoor robotics leveraging low-cost 5G small cells operating in high-frequency bands in conjunction with retroreflective tags. Our approach effectively mitigates synchronization challenges and multipath interference by exploiting the 5G positioning reference signal (PRS) and the unique Van Atta array properties of the tags. We conduct a comprehensive simulation campaign using realistic system parameters and channel models for 5G-enabled deployments in hospital environments. Our results demonstrate that REFINE achieves superior accuracy compared to conventional 5G-based localization techniques, consistently delivering positioning errors below 5 cm in the majority of tested scenarios." } @INPROCEEDINGS{IFIPNet25_LeFl2505_Zone, AUTHOR="Antonin {Le Floch} and Rahim Kacimi and Pierre Druart and Yoann Lefebvre and Andr{\'e}-Luc Beylot", TITLE="{Zone-Fingerprinting:} Unlocking the Power of Fingerprinting for Indoor Localization in {5G}", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="5G; Indoor Localization; Zone-Fingerprinting; Pedestrian Dead Reckoning; Experimentations", ABSTRACT="Indoor localization is either achieved through dedicated radio networks or opportunistically by leveraging existing networks. The preferred method is to compare the received signal strength (RSSI) with a reference map, commonly known as Fingerprinting. However, as network operators often space out radios to minimize costs and maximize spectral efficiency, large areas exist where the radio pattern remains similar, leading to significant inaccuracies in Fingerprinting results. To address this issue, we propose changing the paradigm by not predicting a single point with an uncertainty area, but rather the exact zone where the user is located. To further refine the positioning of the user within this zone, we integrate the Zone-Fingerprinting technique with pedestrian dead reckoning, enabling us to determine the specific subpart of the zone where the user is located. Our goal is to locate at-risk workers in hospitals, and to achieve this, experiments were conducted in both a hospital environment and an office environment, utilizing a 5G private network. The results indicate that Zone-Fingerprinting is more reliable than traditional Fingerprinting." } @INPROCEEDINGS{IFIPNet25_Hula2505_Transferability, AUTHOR="Matej {Hul{\'a}k} and V{\'a}clav Barto{\v s} and Tomas Cejka", TITLE="Transferability of {TCP/IP-based} {OS} fingerprinting models", BOOKTITLE="2025 IFIP Networking Conference (IFIP Networking 2025), Limassol, Cyprus, May 26-29, 2025", PAGES="", url="", KEYWORDS="OS fingerprinting; machine learning; traffic monitoring; model transferability", ABSTRACT="OS fingerprinting provides valuable information about devices connected to a network infrastructure. Machine Learning (ML) models are presented as a feasible technology in existing studies. However, there is a lack of high-quality datasets to train a well-performing classifier that can be successfully transferred to different network environments. This paper proposes an improved annotation process to create more reliable datasets. Additionally, the paper showcases a new feature, TCP Maximum Segment Size (MSS), that proves to improve passive flow-based OS fingerprinting. The new datasets are used to train and evaluate ML classifiers for OS fingerprinting that are more transferable, with an average F1-score of 86 \%. Furthermore, we conducted a thorough analysis, testing models across different networks and scenarios to identify key factors affecting performance. Along with the paper, we publish five annotated datasets that can be used for further research on this topic." }