Per-flow measurement of priority-heterogeneous traffic underpins cloud service-level agreement (SLA) enforcement, anomaly detection, and distributed AI training in high-speed networks, yet remains challenging in the fast L1/L2-cache memory regime where high-priority flows are vastly outnumbered. We propose Charon, a priority-aware sketch that replaces the structural separation used by prior methods with stratified admission sampling: a single, online-adaptive, parameter-free rule decides whether each packet is admitted to the sketch. Across multiple real-world traces, Charon achieves more than 2× higher detection accuracy for high-priority flows than the best baseline and up to four orders of magnitude lower average error than state-of-the-art priority-aware sketches, with the gap widening as memory tightens, at high processing throughput. The implementation on the industry-grade Tofino switch further demonstrates low resource utilization.

Despite driving record performance, the increasing reliance of deep learning on ever-larger datasets has led to prohibitively high storage and management costs that threaten continued progress. While coreset selection offers a promising solution to this challenge, existing methods often rely on expensive iterative optimization procedures or fail to select samples that allow strong generalization across tasks. In this work, we introduce ECHO, a coreset construction and augmentation strategy that leverages the relational properties inherent to a dataset to find its most representative samples. Unlike prior methods, our approach constructs a structured graph that encodes intrinsic dataset patterns, based on which influential samples are identified and augmented to maximize generalization performance. Extensive experiments across five benchmark datasets and against eighteen different coreset selection baselines show that ECHO achieves up to 60% accuracy gains under extreme compression, while being orders of magnitude faster than state-of-the-art alternatives. These results establish a new benchmark for data-efficient learning, particularly under tight coreset budgets, and showcase the benefits of structured coreset selection for effective generalization.

In high-speed data center networks, persistent flows are repeatedly observed over extended periods, potentially signaling threats such as stealthy DDoS or botnet attacks. Monitoring every flow in production-grade hardware switches that feature limited memory, however, is challenging under typical high flow rates and data volumes. To tackle this, approximate data structures, like sketches, are often employed. Yet many existing methods rely on per-time-window flag resets, which require frequent control-plane interventions that make them unsuitable for high-speed traffic. This paper introduces Pallas, a fully data-plane-implementable sketch for detecting persistent flows in high-speed networks with high accuracy, obviating the need for time-window-based resets. We further propose Opt-Pallas, an enhanced variant of Pallas that improves detection accuracy by incorporating flow arrival patterns. We present a rigorous error bound analysis for both Pallas and Opt-Pallas, along with extensive performance evaluations using a P4-based prototype on an Intel Tofino switch. Pallas scales persistent flow detection to line-rate capacity, while state-of-the-art solutions fail to operate beyond a few Mbps. Our results show that Pallas and Opt-Pallas can accurately detect persistent flows in traffic volumes over 60× higher than those handled by the best existing approach. Additionally, even under low-speed traffic, Pallas and Opt-Pallas achieve 4.21% and 7.85% higher lookup accuracy while consuming only 8.5% and 9.7% of switch resources, respectively. Extensive trace-driven results on a CPU platform further validate the high detection accuracy of Opt-Pallas compared to existing methods.

In today's web-scale, data-driven environments, real-time detection of persistent items that consistently recur over time is essential for maintaining system integrity, reliability, and security. Persistent items often signal critical anomalies, such as stealthy DDoS and botnet attacks in web infrastructures. Although various methods exist for identifying such items as well as for determining their frequency, they require recording every item for processing, which is impractical at very high data rates achieved by modern data streams. In this paper, we introduce Pontus, a novel approach that uses an approximate data structure (sketch) specifically designed for the efficient and accurate detection of persistent items. Our method not only achieves fast and precise lookup but is also flexible, allowing for minor modifications to accommodate other types of persistence-based item detection tasks, such as detecting persistent items with low frequency. We rigorously validate our approach through formal methods, offering detailed proofs of time/space complexity and error bounds to demonstrate its theoretical soundness. Our extensive trace-driven evaluations across various persistence-based tasks further demonstrate Pontus's effectiveness in significantly improving detection accuracy and enhancing processing speed compared to existing approaches. We implement Pontus in an experimental platform with industry-grade Intel Tofino switches and demonstrate the practical feasibility of our approach in a real-world memory-constrained environment.

Accurate and fast data stream mining is critical to many tasks, including real-time series analysis for mobile sensor data, big data management and machine learning. Various heavy-oriented item detection tasks, such as identifying heavy hitters, heavy changers, persistent items, and significant items, have garnered considerable attention from both industry and academia. Unfortunately, as data stream speeds continue to increase and the available memory, particularly in L1 cache, remains limited for real-time processing, existing schemes face challenges in simultaneously achieving high detection accuracy, memory efficiency, and fast update throughput, as we reveal. To tackle this conundrum, we propose a versatile and elegant sketch framework named Tight-Sketch, which supports a spectrum of heavy-based detection tasks. Recognizing that, in practice, most items are cold (non-heavy/persistent/significant), we implement distinct eviction strategies for different item types. This approach allows us to swiftly discard potentially cold items while offering enhanced protection to hot ones (heavy/persistent/significant). Additionally, we introduce an eviction method based on stochastic decay, ensuring that Tight-Sketch incurs only small one-sided errors without overestimation. To further enhance detection accuracy under extremely constrained memory allocations, we introduce Tight-Opt, a variant incorporating two optimization strategies. We conduct extensive experiments across various detection tasks to demonstrate that Tight-Sketch significantly outperforms existing methods in terms of both accuracy and update speed. Furthermore, by utilizing Single Instruction Multiple Data (SIMD) instructions, we enhance Tight-Sketch's update throughput by up to 36%. We also implement Tight-Sketch on FPGA to validate its practicality and low resource overhead in hardware deployments.

The adoption of neural networks (NNs) across critical sectors including transportation, medicine, communications infrastructure, etc. is inexorable. However, NNs remain highly susceptible to adversarial perturbations, whereby seemingly minimal or imperceptible changes to their inputs cause gross misclassifications, which questions their practical use. Although a growing body of work focuses on defending against such attacks, adversarial robustness remains an open challenge, especially as the effectiveness of existing solutions against increasingly sophisticated input manipulations comes at the cost of degrading ability to recognize benign samples, as we reveal. In this work we introduce Sabre, an adversarial defense framework that closes the gap between benign and robust accuracy in NN classification tasks, without sacrificing benign sample recognition performance. In particular, through spectral decomposition of the input and selective energy-based filtering, Sabre extracts robust features that serve in input reconstruction prior to feeding existing NN architectures. We demonstrate the performance of our approach across multiple domains, by evaluating it on image classification, network intrusion detection, and speech command recognition tasks, showing that Sabre not only outperforms existing defense mechanisms, but also behaves consistently with different neural architectures, data types, (un)known attacks, and adversarial perturbation strengths. Through these extensive experiments, we make the case for Sabre’s adoption in deploying robust and reliable neural classifiers.

Data stream processing plays a pivotal role in various web-related applications, including click fraud detection, anomaly identification, and recommendation systems. Accurate and fast detection of items relevant to such tasks within data streams, e.g., heavy hitters, heavy changers, and persistent items, is however non-trivial. This is due to growing streaming speeds, limited fast memory (L1 cache) available in current systems, and highly skewed item distributions encountered in practice. In effect, items of interest that are tracked only based on their features (e.g., item frequency or persistence value) are susceptible to replacement by non-relevant ones, leading to modest detection accuracy, as we reveal. In this work, we introduce the notion of bucket stability, which quantifies the degree of recorded item variation, and show that this is a powerful metric for identifying distinct item types. We propose Stable-Sketch, an elegant and versatile sketch that exploits multidimensional information, including item statistics and bucket stability, and adopts a stochastic approach to drive replacement decisions. We present a theoretical analysis of the error bounds of Stable-Sketch, and conduct extensive experiments to demonstrate that our solution achieves substantially higher accuracy and faster processing speeds than state-of-the-art sketches in a range of item detection tasks, even with tight memories. We further enhance Stable-Sketch's update throughput with Single Instruction Multiple Data (SIMD) instructions and implement our solution with P4, demonstrating real world deployment viability.

Clustering, a key aspect of exploratory data analysis, plays a crucial role in various fields such as information retrieval. Yet, the sheer volume and variety of available clustering algorithms hinder their application to specific tasks, especially given their propensity to enforce partitions, even when no clear clusters exist, often leading to fruitless efforts and erroneous conclusions. This issue highlights the importance of accurately assessing clustering tendencies prior to clustering. However, existing methods either rely on subjective visual assessment, which hinders automation of downstream tasks, or on correlations between subsets of target datasets and random distributions, limiting their practical use. Therefore, we introduce theProximal Homogeneity Index (PHI), a novel and deterministic statistic that reliably assesses the clustering tendencies of datasets by analyzing their internal structures via knowledge graphs. Leveraging PHI and the boundaries between clusters, we establish thePartitioning Sensitivity Index (PSI), a new statistic designed for cluster quality assessment and optimal clustering identification. Comparative studies using twelve synthetic and real-world datasets demonstrate PHI and PSI's superiority over existing metrics for clustering tendency assessment and cluster validation. Furthermore, we demonstrate the scalability of PHI to large and high-dimensional datasets, and PSI's broad effectiveness across diverse cluster analysis tasks.

The uptake of digital services and IoT technology gives rise to increasingly diverse cyber attacks, with which commonly-used rule-based Network Intrusion Detection Systems (NIDSs) struggle to cope. Therefore, Artificial Intelligence (AI) supports a second line of defense, since this methodology helps in extracting non-obvious patterns from network traffic and subsequently in detecting more confidently new types of threats. Cybersecurity is however an arms race and intelligent solutions face renewed challenges as attacks evolve while network traffic volumes surge. We propose Adaptive Clustering-based Intrusion Detection (ACID), a novel approach to malicious traffic classification and a valid candidate for deployment at the network edge. ACID addresses the critical challenge of sensitivity to subtle changes in traffic features, which routinely leads to misclassification. We circumvent this problem by relying on low-dimensional embeddings learned with a lightweight neural model comprising multiple kernel networks that we introduce, which optimally separates samples of different classes. Extensive experiments with datasets spanning 20 years demonstrate ACID attains 100% accuracy and F1-score, and 0% false alarm rate, significantly outperforming state-of-the-art clustering methods and NIDSs. Furthermore, our results show that ACID offers a high degree of robustness to input perturbations, while intrinsically providing a framework for continual learning.

In large data streams consisting of sequences of data items, those appearing over a long period of time are regarded as persistent. Compared with frequent items, persistent items do not necessarily hold large amounts of data and thus may hamper the effectiveness of vanilla volume-based detectors. Identifying persistent items plays a crucial role in a range of areas such as fraud detection and network management. Fast detection of persistent items in massive streams is however challenging due to the inherently high data rates, while state-of-the-art persistent item lookup solutions routinely require large enough memory to attain high accuracy, which questions the feasibility of deploying them in practice. In this paper, we introduce P-Sketch, a novel approach to persistent item lookup that achieves high accuracy even with small memory (L1 Cache) budgets and maintains high update speed across different settings. Specifically, we introduce the concept of arrival continuity(hotness)that counts the number of consecutive windows in which an item appears, to effectively protect persistent items from being wrongly replaced by non-persistent ones. Through meticulous data analysis, we also reveal that items with higher persistence tend to possess a stronger hotness than non-persistent ones. Thus, we harness the information of persistence and hotness, and employ a probability-based replacement strategy to achieve a good balance between memory efficiency, lookup accuracy, and update speed. We also present a theoretical analysis of the performance of the proposed P-Sketch. Through trace-driven emulations, we demonstrate that our P-Sketch yields average F1 score and update throughput gains of up to 10.32$\times$and respectively 2.9$\times$, over existing schemes. Lastly, we show how to further boost the P-Sketch’s update speed with Single Instruction Multiple Data (SIMD) instructions.

Accurate and fast data stream mining is critical and fundamental to many tasks, including time series database handling, big data management and machine learning. Different heavy-based detection tasks, such as heavy hitter, heavy changer, persistent item and significant item detection, have drawn much attention from both the industry and academia. Unfortunately, due to the growing data stream speeds and limited memory (L1 cache) available for real-time processing, existing schemes face challenges in simultaneously achieving high detection accuracy, high memory efficiency, and fast update throughput, as we reveal. To tackle this conundrum, we propose a versatile and elegant sketch framework named Tight-Sketch, which supports a spectrum of heavy-based detection tasks. Considering that most items are cold (non-heavy/persistent/significant) in practice, we employ different eviction treatments for different types of items to discard these potentially cold ones as soon as possible, and offer more protection to those that are hot (heavy/persistent/significant). In addition, we propose an eviction method that follows a stochastic decay strategy, enabling Tight-Sketch to only bear small one-sided errors (no overestimation). We present a theoretical analysis of the error bounds and conduct extensive experiments on diverse detection tasks to demonstrate that Tight-Sketch significantly outperforms existing methods in terms of accuracy and update speed. Lastly, we accelerate Tight-Sketch's update throughput by up to 36% with Single Instruction Multiple Data (SIMD) instructions.

China is currently the country with the largest number of Android smartphone users. We use a combination of static and dynamic code analysis techniques to study the data transmitted by the preinstalled system apps on Android smartphones from three of the most popular vendors in China. We find that an alarming number of preinstalled system, vendor and third-party apps are granted dangerous privileges. Through traffic analysis, we find these packages transmit to many third-party domains privacy sensitive information related to the user's device (persistent identifiers), geolocation (GPS coordinates, network-related identifiers), user profile (phone number, app usage) and social relationships (e.g., call history), without consent or even notification. This poses serious deanonymization and tracking risks that extend outside China when the user leaves the country, and calls for a more rigorous enforcement of the recently adopted data privacy legislation.

Machine Learning (ML) techniques are increasingly adopted to tackle ever-evolving high-profile network attacks, including Distributed Denial of Service (DDoS), botnet, and ransomware, due to their unique ability to extract complex patterns hidden in data streams. These approaches are however routinely validated with data collected in the same environment, and their performance degrades when deployed in different network topologies and/or applied on previously unseen traffic, as we uncover. This suggests malicious/benign behaviors are largely learned superficially and ML-based Network Intrusion Detection Systems (NIDS) need revisiting, to be effective in practice. In this paper we dive into the mechanics of large-scale network attacks, with a view to understanding how to use ML for Network Intrusion Detection (NID) in a principled way. We reveal that, although cyberattacks vary significantly in terms of payloads, vectors and targets, their early stages, which are critical to successful attack outcomes, share many similarities and exhibit important temporal correlations. Therefore, we treat NID as a time-sensitive task and propose NetSentry, perhaps the first of its kind NIDS that builds on Bidirectional Asymmetric LSTM (Bi-ALSTM), an original ensemble of sequential neural models, to detect network threats before they spread. We cross-evaluate NetSentry using two practical datasets, training on one and testing on the other, and demonstrate F1 score gains above 33% over the state-of-the-art, as well as up to 3× higher rates of detecting attacks such as Cross-Site Scripting (XSS) and web bruteforce. Further, we put forward a novel data augmentation technique that boosts the generalization abilities of a broad range of supervised deep learning algorithms, leading to average F1 score gains above 35%. Lastly, we shed light on the feasibility of deploying NetSentry in operational networks, demonstrating affordable computational overhead and robustness to evasion attacks.

Neural networks (NNs) are increasingly popular in developing NIDS, yet can prove vulnerable to adversarial examples. Through these, attackers that may be oblivious to the precise mechanics of the targeted NIDS add subtle perturbations to malicious traffic features, with the aim of evading detection and disrupting critical systems. Defending against such adversarial attacks is of high importance, but requires to address daunting challenges. Here, we introduce TIKI- TAKA, a general framework for(i)assessing the robustness of state-of-the-art deep learning-based NIDS against adversarial manipulations, and which(ii)incorporates defense mechanisms that we propose to increase resistance to attacks employing such evasion techniques. Specifically, we select five cutting-edge adversarial attack types to subvert three popular malicious traffic detectors that employ NNs. We experiment with publicly available datasets and consider both one-to-all and one-to-one classification scenarios, i.e., discriminating illicit vs benign traffic and respectively identifying specific types of anomalous traffic among many observed. The results obtained reveal that attackers can evade NIDS with up to 35.7% success rates, by only altering time-based features of the traffic generated. To counteract these weaknesses, we propose three defense mechanisms: model voting ensembling, ensembling adversarial training, and query detection. We demonstrate that these methods can restore intrusion detection rates to nearly 100% against most types of malicious traffic, and attacks with potentially catastrophic consequences (e.g., botnet) can be thwarted. This confirms the effectiveness of our solutions and makes the case for their adoption when designing robust and reliable deep anomaly detectors.

This paper introduces CloudLSTM, a new branch of recurrent neural models tailored to forecasting over data streams generated by geospatial point-cloud sources. We design a Dynamic Point-cloud Convolution (DConv) operator as the core component of CloudLSTMs, which performs convolution directly over point-clouds and extracts local spatial features from sets of neighboring points that surround different elements of the input. This operator maintains the permutation invariance of sequence-to-sequence learning frameworks, while representing neighboring correlations at each time step -- an important aspect in spatiotemporal predictive learning. The DConv operator resolves the grid-structural data requirements of existing spatiotemporal forecasting models and can be easily plugged into traditional LSTM architectures with sequence-to-sequence learning and attention mechanisms. We apply our proposed architecture to two representative, practical use cases that involve point-cloud streams, i.e. mobile service traffic forecasting and air quality indicator forecasting. Our results, obtained with real-world datasets collected in diverse scenarios for each use case, show that CloudLSTM delivers accurate long-term predictions, outperforming a variety of competitor neural network models.

Data-driven mobile network management hinges on accurate traffic measurements, which routinely require expensive specialized equipment and substantial local storage capabilities, and bear high data transfer overheads. To overcome these challenges, in this paper we propose Spider, a deep-learning-driven mobile traffic measurement collection and reconstruction framework, which reduces the cost of data collection while retaining state-of-the-art accuracy in inferring mobile traffic consumption with fine geographic granularity. Spider harnesses Reinforcement Learning and tackles large action spaces to train a policy network that selectively samples a minimal number of cells where data should be collected. We further introduce a fast and accurate neural model that extracts spatiotemporal correlations from historical data to reconstruct network-wide traffic consumption based on sparse measurements. Experiments we conduct with a real-world mobile traffic dataset demonstrate that Spider samples 48% fewer cells as compared to several benchmarks considered, and yields up to 67% lower reconstruction errors than state-of-the-art interpolation methods. Moreover, our framework can adapt to previously unseen traffic patterns.

The rapid uptake of digital services and Internet of Things (IoT) technology gives rise to unprecedented numbers and diversification of cyber attacks, with which commonly-used rule-based Network Intrusion Detection Systems (NIDSs) are struggling to cope. Therefore, Artificial Intelligence (AI) is being exploited as second line of defense, since this methodology helps in extracting non-obvious patterns from network traffic and subsequently in detecting more confidently new types of threats. Cybersecurity is however an arms race and intelligent solutions face renewed challenges as attacks evolve while network traffic volumes surge. In this paper, we propose Adaptive Clustering-based Intrusion Detection (Acid), a novel approach to malicious traffic classification and a valid candidate for deployment at the network edge. Acid addresses the critical challenge of sensitivity to subtle changes in traffic features, which routinely leads to misclassification. We circumvent this problem by relying on low-dimensional embeddings learned with a lightweight neural model comprising multiple kernel networks that we introduce, which optimally separates samples of different classes. We empirically evaluate our approach with both synthetic and three intrusion detection datasets spanning 20 years, and demonstrate Acid consistently attains 100% accuracy and F1-score, and 0% false alarm rate, thereby significantly outperforming state-of-the-art clustering methods and NIDSs.

The fifth generation wireless systems are starting to exploit the large bandwidths available in the millimeter-wave (mmWave) spectrum to provide high data rates. The exploitation of mmWave requires the use of compact antenna arrays with hundreds of antenna elements, which leads to very directional beam patterns. The beams at both the transmitter and the receiver are trained periodically to maintain accurate beam alignments. The trade-off between the training overhead and the achievable data rate must be considered. In this paper, we propose an adaptive beam training algorithm using deep reinforcement learning for tracking dynamic mmWave channels. Based on the patterns learnt from historical data, the proposed algorithm can sense the changes in the environment and switch between different beam training methods so that a high data rate can be achieved with a minimum amount of beam training.

The growing diversification of mobile services imposes requirements on network performance that are ever more stringent and heterogeneous. Network slicing aligns mobile network operation to this context, by enabling operators to isolate and customize network resources on a per-service basis. A key input for provisioning resources to slices is real-time information about the traffic demands generated by individual services. Acquiring such knowledge is however challenging, as legacy approaches based on in-depth inspection of traffic streams have high computational costs, which inflate with the widening adoption of encryption over data and control traffic. In this paper, we present a new approach to service-level demand estimation for slicing, which hinges on decomposition, i.e., the inference of per-service demands from traffic aggregates. By operating on total traffic volumes only, our approach overcomes the complexity and limitations of legacy traffic classification techniques, and provides a suitable input to recent 'Network Slice as a Service' (NSaaS) models. We implement decomposition through Microscope, a novel framework that uses deep learning to infer individual service demands from complex spatiotemporal features hidden in traffic aggregates. Microscope (i) transforms traffic data collected in irregular radio access deployments in a format suitable for convolutional learning, and (ii) can accommodate a variety of neural network architectures, including original 3D Deformable Convolutional Neural Networks (3D-DefCNNs) that we explicitly design for decomposition. Experiments with measurement data collected in an operational network demonstrate that Microscope accurately estimates per-service traffic demands with relative errors below 1.2%. Further, tests in practical NSaaS management use cases show that resource allocations informed by decomposition yield affordable costs for the mobile network operator.

Bluetooth Classic (BT) remains the de facto connectivity technology in car stereo systems, wireless headsets, laptops, and a plethora of wearables, especially for applications that require high data rates, such as audio streaming, voice calling, tethering, etc. Unlike in Bluetooth Low Energy (BLE), where address randomization is a feature available to manufactures, BT addresses are not randomized because they are largely believed to be immune to tracking attacks. We analyze the design of BT and devise a robust de-anonymization technique that hinges on the apparently benign information leaking from frame encoding, to infer a piconet's clock, hopping sequence, and ultimately the Upper Address Part (UAP) of the master device's physical address, which are never exchanged in clear. Used together with the Lower Address Part (LAP), which is present in all frames transmitted, this enables tracking of the piconet master, thereby debunking the privacy guarantees of BT. We validate this attack by developing the first Software-defined Radio (SDR) based sniffer that allows full BT spectrum analysis (79 MHz) and implements the proposed de-anonymization technique. We study the feasibility of privacy attacks with multiple testbeds, considering different numbers of devices, traffic regimes, and communication ranges. We demonstrate that it is possible to track BT devices up to 85 meters from the sniffer, and achieve more than 80% device identification accuracy within less than 1 second of sniffing and 100% detection within less than 4 seconds. Lastly, we study the identified privacy attack in the wild, capturing BT traffic at a road junction over 5 days, demonstrating that our system can re-identify hundreds of users and infer their commuting patterns.

5G mobile networks are expected to provide pervasive high speed wireless connectivity and support increasingly resource intensive user applications. Network hyper-densification therefore becomes necessary, though connecting to the Internet tens of thousands of base stations is non-trivial, especially in urban scenarios where optical fibre is difficult and costly to deploy. The millimetre wave (mm-wave) spectrum is a promising candidate for inexpensive multi-Gbps wireless backhauling, but exploiting this band for effective multi-hop data communications is challenging. In particular, resource allocation and scheduling of very narrow transmission/ reception beams require to overcome terminal deafness and link blockage problems, while managing fairness issues that arise when flows encounter dissimilar competition and traverse different numbers of links with heterogeneous quality. In this paper, we propose WiHaul, an airtime allocation and scheduling mechanism that overcomes these challenges specific to multi-hop mm-wave networks, guarantees max-min fairness among traffic flows, and ensures the overall available backhaul resources are fully utilised. We evaluate the proposed WiHaul scheme over a broad range of practical network conditions, and demonstrate up to 5× individual throughput gains and a five-fold improvement in terms of measurable fairness, over recent mm-wave scheduling solutions.

Forecasting with high accuracy the volume of data traffic that mobile users will consume is becoming increasingly important for precision traffic engineering, demand-aware network resource allocation, as well as public transportation. Measurements collection in dense urban deployments is however complex and expensive, and the post-processing required to make predictions is highly non-trivial, given the intricate spatio-temporal variability of mobile traffic due to user mobility. To overcome these challenges, in this paper we harness the exceptional feature extraction abilities of deep learning and propose a Spatio-Temporal neural Network (STN) architecture purposely designed for precise network-wide mobile traffic forecasting. We present a mechanism that fine tunes the STN and enables its operation with only limited ground truth observations. We then introduce a Double STN technique (D-STN), which uniquely combines the STN predictions with historical statistics, thereby making faithful long-term mobile traffic projections. Experiments we conduct with real-world mobile traffic data sets, collected over 60 days in both urban and rural areas, demonstrate that the proposed (D-)STN schemes perform up to 10-hour long predictions with remarkable accuracy, irrespective of the time of day when they are triggered. Specifically, our solutions achieve up to 61% smaller prediction errors as compared to widely used forecasting approaches, while operating with up to 600 times shorter measurement intervals.

Future mobile networks will exploit unlicensed spectrum to boost capacity and meet growing user demands cost-effectively. The 3rdGeneration Partnership Project (3GPP) has recently defined a License Assisted Access (LAA) scheme to enable global Unlicensed LTE (U-LTE) deployment, aiming at 1) ensuring fair coexistence with incumbent WiFi networks, i.e., impacting on their performance no more than another WiFi device; and 2) achieving superior airtime efficiency as compared with WiFi. We show the standardized LAA fails to simultaneously fulfill these objectives, and design an alternative orthogonal (collision-free) listen-before-talk coexistence paradigm that provides a substantial improvement in performance, yet imposes no penalty on existing WiFi networks. We derive two optimal transmission policies, ORLA and OLAA, that maximize LAA throughput in both asynchronous and synchronous (i.e., with alignment to licensed anchor frame boundaries) modes of operation, respectively. We present a comprehensive evaluation through which we demonstrate that, when aggregating packets, IEEE 802.11ac WiFi can be more efficient than LAA, whereas our proposals attains 100% higher throughput, without harming WiFi. We further show that long U-LTE frames incur up to 92% throughput losses on WiFi when using 3GPP LAA, whilst ORLA/OLAA sustain >200% gains at no cost, even in the presence of non-saturated WiFi and/or in multi-rate scenarios.

Large-scale mobile traffic analytics is becoming essential to digital infrastructure provisioning, public transportation, events planning, and other domains. Monitoring city-wide mobile traffic is however a complex and costly process that relies on dedicated probes. Some of these probes have limited precision or coverage, others gather tens of gigabytes of logs daily, which independently offer limited insights. Extracting fine-grained patterns involves expensive spatial aggregation of measurements, storage, and post-processing. In this paper, we propose a mobile traffic super-resolution technique that overcomes these problems by inferring narrowly localised traffic consumption from coarse measurements. We draw inspiration from image processing and design a deep-learning architecture tailored to mobile networking, which combines Zipper Network (ZipNet) and Generative Adversarial neural Network (GAN) models. This enables to uniquely capture spatio-temporal relations between traffic volume snapshots routinely monitored over broad coverage areas ('low-resolution') and the corresponding consumption at 0.05 km2 level ('high-resolution') usually obtained after intensive computation. Experiments we conduct with a real-world data set demonstrate that the proposed ZipNet(-GAN) infers traffic consumption with remarkable accuracy and up to 100X higher granularity as compared to standard probing, while outperforming existing data interpolation techniques. To our knowledge, this is the first time super-resolution concepts are applied to large-scale mobile traffic analysis and our solution is the first to infer fine-grained urban traffic patterns from coarse aggregates.

While Western societies are becoming increasingly connected, many developing regions lack basic Internet connectivity, primarily due to the high costs associated with infrastructure deployment and maintenance. Potential exists for the TV white-space (TVWS) wireless technology to bridge this digital divide, though efficient channel access mechanisms suited to multi-hop networks that operate in sub-gigahertz bands are yet to be developed. Using a small test bed, we demonstrate a prototype implementation of a medium access protocol that learns appropriate transmission opportunities in such settings, achieving pseudo-scheduled behaviour ex tempore and providing substantial gains over the de facto IEEE 802.11af protocol.

Due to the directionality of transmissions in millimeter wave (mm-wave) networks, wireless stations are usually unable to overhear when other stations access the channel. This makes it hard to design efficient distributed beam coordination and scheduling mechanisms. At the same time, centralized schemes only perform well in relatively simple, static scenarios. In practical settings where links have different channel qualities and in the context of relaying or in-band backhauling, centrally coordinating all stations becomes difficult. In this paper, we propose a low complexity, decentralized, learning-based scheduling algorithm for mm-wave networks that handles heterogeneous link rates and packet sizes efficiently. Compared to state-of-the-art slotted channel access for mm-wave networks, the proposed mechanism achieves throughput gains of up to a factor of 8 in single-hop scenarios and end-to-end throughput improvements of up to a factor of 1.6 in multi-hop topologies.

With the increasing availability of flexible wireless 802.11 devices, the potential exists for users to selfishly manipulate their channel access parameters and gain a performance advantage. Such practices can have a severe negative impact on compliant stations. To enable access points to counteract these selfish behaviours and preserve fairness in wireless networks, in this paper we propose a policing mechanism that drives misbehaving users into compliant operation without requiring any cooperation from clients. This approach is demonstrably effective against a broad class of misbehaviours, soundly-based, i.e., provably hard to circumvent and amenable to practical implementation on existing commodity hardware.

Wireless networks increasingly utilize diverse spectral bands that exhibit vast differences in both transmission range and usage. In this work, we present MAWS (Mobile Access of Wide-Spectrum Networks), the first scheme designed for mobile clients to evaluate and select both APs and spectral bands in wide-spectrum networks. Because of the potentially vast number of spectrum and AP options, scanning may be prohibitive. Consequently, our key technique is for clients to infer channel quality and spectral usage for their current location and bands using limited measurements collected in other bands and at other locations. We experimentally evaluate MAWS via a widespectrum network that we deploy, a testbed providing access to four bands at 700 MHz, 900 MHz, 2.4 GHz and 5 GHz. To the best of our knowledge, the spectrum of these bands is the widest to be spanned to date by a single operational access network. A key finding of our evaluation is that under a diverse set of operating conditions, mobile clients can accurately predict their performance without a direct measurement at their current location and spectral bands.

As open-source WiFi device drivers are increasingly available, wireless equipment can be configured to disobey the 802.11 specification, with the goal of achieving performance gains, to the detriment of fair users.We demonstrate a practical implementation of a node policing scheme that combats such selfish behaviour, using commercial off-the-shelf hardware and a modified firmware. With a small testbed, we show that access points running our scheme can detect misbehaving stations, inflict punishment upon them and effectively restore fairness in the network.

In practical WLAN deployments, the capture effect has been shown to enhance the performance of stations residing close to the AP, while putting at disadvantage the distant nodes. In this paper, we introduce an analytical model to characterise the performance of 802.11 devices with heterogeneous capture probabilities and different network loads, and explore the interaction between the MAC operation and PHY capture. Unlike previous studies, we reveal that the throughput of stations experiencing low capture probabilities can also benefit from the capture effect when the stations retaining high capture probabilities are not saturated. Following these findings, we design a power-hopping scheme for 802.11 MAC that exploits the benefits of the capture effect to improve performance in dense deployments where nodes experience similar channel conditions. We investigate the potential gains of this mechanism by implementing a practical approximation using commercial off-the-shelf hardware and open-source drivers and, by conducting experiments in a real testbed, we show that our scheme can significantly outperform the standard 802.11 protocol in terms of throughput.

The EDCA mechanism of the IEEE 802.11 standard has been designed to support, among others, video traffic. This mechanism relies on a number of parameters whose configuration is left open by the standard. Although there are some recommended values for these parameters, they are fixed independent of the WLAN conditions, which results in suboptimal performance. Following this observation, a number of approaches in the literature have been devised to set the EDCA parameters based on an estimation of the WLAN conditions. However, these previous approaches are based on heuristics and hence do not guarantee optimized performance. In this article we propose a novel algorithm to adjust the EDCA parameters to carry video traffic which, in contrast to previous approaches, is sustained on mathematical foundations that guarantee optimal performance. In particular, our approach builds upon (i) an analytical model of the WLAN performance under video traffic, used to derive the optimal point of operation of EDCA, and (ii) a control theoretic designed mechanism which drives the WLAN to this point of operation. Via extensive simulations, we show that the proposed approach performs optimally and substantially outperforms the standard recommended configuration as well as previous adaptive proposals.

The optimal configuration of the contention parameters of a WLAN depends on the network conditions in terms of number of stations and the traffic they generate. Following this observation, a considerable effort in the literature has been devoted to the design of distributed algorithms that optimally configure the WLAN parameters based on current conditions. In this paper, we propose a novel algorithm that, in contrast to previous proposals which are mostly based on heuristics, is sustained by mathematical foundations from multivariable control theory. A key advantage of the algorithm over existing approaches is that it is compliant with the 802.11 standard and can be implemented with current wireless cards without introducing any changes into the hardware or firmware. We study the performance of our proposal by means of theoretical analysis, simulations, and a real implementation. Results show that the algorithm substantially outperforms previous approaches in terms of throughput and delay.