Global mobile connectivity depends on international roaming, which enables subscribers to use their service abroad through agreements ensuring traffic exchange between home and visited networks. Poor interconnect performance over the IPX network can degrade user experience and cause revenue loss, yet roaming remains underexplored due to proprietary systems and limited transparency. We present a large-scale study based on nine months of active probing from gateways across seven global regions, yielding nearly four billion latency measurements spanning 173 countries and 399 operators. This dataset enables the analysis of temporal trends, regional disparities, anomalies, and routing inefficiencies in IPX-based roaming. Our findings show how interconnection choices, carrier selection, and routing detours impact performance, advancing our understanding of global roaming trade-offs and allowing future optimization.

The transition from LTE to 5G, and therefore from a monolithic network architecture to a service based architecture, introduces a myriad of new challenges. Most significantly, the decomposition of core components into individual services introduces an extensive signalling traffic overhead within the 5G core network. Additionally, there is a general lack of observability for the 5G core, hindering advancements in modelling and optimization for the system as a whole as well as the individual network functions. To address this, we present a measurement methodology to increase observability within the 5G core system and extract crucial information for the signalling traffic for specific user equipments within the individual network functions. Furthermore, we use our proposed methodology to conduct a case study on the performance of the attachment procedure in Open5GS, a commonly used open source implementation, under different loads. Lastly, we investigate the stability of the Access and Mobility Management Function under heavy load.

Internet of Things (IoT) application providers rely on Mobile Network Operators (MNOs) and roaming infrastructures to deliver their services globally. In this complex ecosystem, where the end-to-end communication path traverses multiple entities, it became increasingly challenging to guarantee communication availability and reliability. Further, most platform operators use areactiveapproach to communication issues, responding to user complaints only after incidents have become severe, compromising service quality. This paper presents our experience in the design and deployment of ANCHOR – anunsupervisedanomaly detection solution for the IoT connectivity service of a large global roaming platform. ANCHOR assists engineers by filtering vast amounts of data to identify potential problematic clients (i.e., those with connectivity issues affecting several of their IoT devices), enabling proactive issue resolution before the service is critically impacted. We first describe the IoT service, infrastructure, and network visibility of the IoT connectivity provider we operate. Second, we describe the main challenges and operational requirements for designing an unsupervised anomaly detection solution on this platform. Following these guidelines, we propose different statistical rules, and machine- and deep-learning models for IoT verticals anomaly detection based on passive signaling traffic.We describe the steps we followed working with the operational teams on the design and evaluation of our solution on the operational platform, and report an evaluation on operational IoT customers.

Explainable Artificial Intelligence (XAI) is essential for the acceptance of machine learning (ML) models, especially in critical domains like network security. Administrators need interpretable explanations to validate decisions, yet existing XAI methods often suffer from low consensus, where different techniques yield conflicting explanations. A key factor contributing to this issue is the presence of correlated features, which allows multiple equivalent but divergent explanations. While decorrelation techniques, such as Principal Component Analysis (PCA), can mitigate this, they often reduce interpretability by abstracting original features into complex combinations. This work investigates whether feature decorrelation via decomposition techniques can improve consensus among post-hoc XAI methods in the context of ML-based network intrusion detection (ML-NIDS). Using both NIDS and synthetic data, we analyze the effect of decorrelation across different models and preprocessing. We find that decorrelation can significantly improve consensus, but its effectiveness is highly dependent on the underlying model, preprocessing, and dataset characteristics. We also explore sparsityinducing variants of PCA to partially recover interpretability, though results vary depending on the level of sparsity enforced.

Modern network monitoring applications often rely on traditional machine learning models conceived for specific analysis tasks, which require extensive feature engineering, retraining for different use cases, and struggle with generalization. This lack of adaptability makes the deployment of AI/ML solutions in network monitoring a daunting task, as each new scenario requires significant reconfiguration, manual tuning, and retraining efforts, undermining the broader adoption of AI/ML for network traffic analysis. Time Series Foundation Models (TSFMs), pre-trained on vast and diverse time-series datasets, offer a promising alternative in the network monitoring realm by enabling zero-shot and few-shot adaptability across different monitoring scenarios. In this work, we explore the potential of TSFMs for network monitoring by evaluating their performance in a challenging analysis task: estimating video streaming Quality of Experience (QoE) from encrypted network traffic. Our study assesses the zero-shot and few-shot capabilities of state-of-the-art TSFMs, the impact of time-series granularity, and the role of common traffic features in performance. Using real-world video streaming QoE datasets, we show that TSFMs achieve competitive results in a zero-shot setting – plug-and-play approach, and that their performance can be easily and cost-effectively improved through few-shot learning techniques, even when applied on NetFlow-like features with coarse granularity. Beyond the specific video streaming QoE monitoring application, our findings demonstrate the viability and broader applicability of TSFMs to network monitoring tasks, opening the door to more scalable and generalizable network management solutions.

Autoscaling is a core capability in cloud computing with significant impact on service quality and cost. Modern applications, like microservices and serverless functions, consist of many containers that enable fine-grained, component-wise scaling. Effective autoscaling across large, heterogeneous service landscapes remains challenging. As cloud adoption increases, workloads have become more diverse, exhibiting highly variable request patterns, payload characteristics, and response time requirements. This limits the effectiveness of conventional autoscalers, whose fixed intervals and cooldown periods restrict responsiveness. At the same time, the growing number of services and frequent updates strain approaches based on predefined models, motivating more adaptive solutions.

The increasing complexity and frequency of cyber attacks require Network Intrusion Detection Systems (NIDS) that can adapt to evolving threats. Artificial intelligence (AI), particularly machine learning (ML), has gained increasing popularity in detecting sophisticated attacks. However, their potential lack of interpretability remains a significant barrier to their widespread adoption in practice, especially in security-sensitive areas. In response, various explainable AI (XAI) methods have been proposed to provide insights into the decision-making process. This paper investigates whether these XAI methods, including SHAP, LIME, Tree Interpreter, Saliency, Integrated Gradients, and DeepLIFT, produce similar explanations when applied to ML-NIDS. By analyzing consensus among these methods across different datasets and ML models, we explore whether an agreement exists that could simplify the practical adoption of XAI in cybersecurity, as similar explanations would eliminate the need for rigorous selection processes. Our findings reveal varying degrees of consensus among the methods, suggesting that while some align closely, others diverge significantly, highlighting the need for careful selection and combination of XAI tools to enhance trustworthiness in real-world applications.

Artificial Intelligence (AI), particularly Machine Learning (ML), has become prominent in network monitoring, yet its practical adoption, such as for anomaly and intrusion detection, remains limited. Standard AI/ML methods often exclude experts, reducing trust and hindering practical implementations. Active Learning (AL) allows to integrate admins and their expert knowledge into the ML loop by leveraging expert-labeled data. Together with self-training and automated decisions, AL can enhance model performance, trust, and the ability to adapt to system changes. In this work, we evaluate uncertainty-based AL in network monitoring, offering a comprehensive parameter study for best practices in real-world AI/ML adoption. To this end, we evaluate stream-based and pool-based AL across four datasets for various monitoring use cases and conduct a parameter study on ten uncertainty measures, thereby identifying scenarios benefiting from self-training. By analyzing the impact of admin competence on model performance, we offer actionable guidelines towards the practical implementation of AL.

5G New Radio (NR) is designed to support diverse services, shifting from a fixed smartphone-centric infrastructure to flexible deployment options tailored for verticals like Ultra-Reliable Low-Latency Communications (URLLC) and Machine-Type Communications (MTC). To optimize the QoS of 5G NR to the service needs, understanding the impact of the introduced configuration parameters is critical. This paper investigates the configuration space of 5G NR using open-source 5G standalone deployments based on OpenAirInterface (OAI) and srsRAN (SRS). We conduct a detailed study on the impact of Next Generation NodeB (gNB) configurations on uplink and downlink throughput and latency, we compare the 5G NR implementations of OAI and SRS, and we investigate reproducibility across different testbeds at the University of Wuerzburg and NTNU. Our datasets are made publicly available.

Time-Sensitive Networking can provide a wide array of QoS guarantees that can be leveraged in a variety of use cases, ranging from industrial applications to autonomous driving. While the control plane can be configured following either a distributed or a centralized paradigm, it is difficult to make general assertions about the affinity of different topologies and use cases towards these configuration methods. In this work, we propose a hybrid simulation of the Resource Allocation Protocol to evaluate the reservation performance across a wide range of network configurations. Results show distinct behaviors between the configuration paradigms, making a case for decentralized control when scalability is critical. In addition, we make our implementation of the developed hybrid model publicly available.

Time-sensitive applications are increasingly prevalent in various network domains, such as industrial, medical, and vehicular communications, imposing substantial demands on network infrastructure. Consequently, ensuring low latency has become a crucial requirement for future networks, particularly through the implementation of deterministic latency network controllers. However, it is essential to recognize that the network controller represents just one facet of network performance management. The configuration of the network’s topology also significantly influences its overall performance. This study, therefore, investigates the impact of different topologies on network performance, specifically focusing on deterministic latency guarantees. Our analysis shows the correlation between graph metrics characterizing the topology and its performance. This correlation facilitates a straightforward ranking of topology performance during critical phases like network planning or expansion. We introduce a readily obtainable graph metric that enables relative performance ranking without the need for exhaustive simulations or emulations. The metric exhibits a Spearman Ranking correlation coefficient exceeding 0.93.

The growing popularity of LoRa-based solutions, such as weather, environmental, and climate monitoring, has resulted in larger LoRaWAN deployments and increased network load. However, the random channel access method used in LoRaWAN leads to higher message collision probabilities and potential data loss, diminishing the networks energy efficiency. This paper addresses this issue by proposing a hardware-independent model that assesses energy consumption and efficiency in different LoRaWAN channel access approaches. Through simulation and analysis of real energy values, we provide insights and recommendations for optimizing the network performance and energy usage. This study fills a research gap and contributes to the development of more robust and energy-efficient LoRaWAN systems for various application areas.

IoT plays an important role in cellular networks, and its need for global connectivity is driving the rise of Global IoT Providers. These provide service by aggregating multiple mobile providers through roaming, complicating the understanding of the overall mobile ecosystem. This calls for lightweight monitoring solutions, which are crucial to meet the quality demanded by IoT services, and of automatic means to analyze the data, with the final goal to carry out economic and management activities. This paper provides insights from the study of two commercial, widespread IoT providers. We show how monitoring signaling traffic between mobile networks offers a unique opportunity to understand both the IoT customers’ characteristics and the network functioning. Leveraging clustering, we offer the first data-driven methodology to examine large IoT signaling datasets. By analyzing over 1.3 billion signaling dialogues across two providers, we identify common signaling profiles that depend on the specific IoT vertical, likely misconfigured devices, and sudden changes that indicate potential problems. This provides actionable insights for network management decisions and service improvements, and lays the groundwork for future research on IoT traffic modeling.

Network operators require real-time traffic monitoring insights to provide high performance and security to their customers. It has been shown that artificial intelligence and machine learning (ML) can improve the visibility of telemetry systems, especially with encrypted traffic. However, current solutions cannot cope with high traffic rates and volumes in large-scale networks. To realize the ML-driven network intelligence paradigm at terabit scale, we design Marina, a system that spreads monitoring over a highly efficient data plane, which can extract traffic statistics at line rate, and a powerful ML server, which can run monitoring inference using complex ML models. We apply temporal microaggregation into sub-second time slots and extract moment-based statistics. These allow to flexibly obtain accurate ML-based monitoring decisions during the next time slot. To demonstrate the scalability of our design, we implement and evaluate a Marina data plane prototype on a Barefoot Wedge 100BF-65X P4 switch, which can monitor more than 520,000 concurrent flows at full switching capacity of 6.4 Tbps. We validate the analytics capabilities enabled by our Marina implementation for four ML-driven real-time monitoring tasks with a broad set of standard ML models, achieving comparable or better than state-of-the-art results.

The steady growth of IoT networks and the rise of LoRa and LoRaWAN as a wireless communication protocol in smart city deployments invoke the need for energy efficient and performance focused channel access mechanisms. Since LoRa makes use of the random access protocol ALOHA, the expected collision probability is directly related to the density of deployed IoT devices. In order to alleviate this scalability issue of LoRa deployments, and the energy losses caused by rising packet collisions, this work proposes a novel channel access mechanism that aims to mitigate high collision probabilities as a result of dense, bursty periods of transmissions, without the need for centralized control instances or dedicated control messages. Based on simulation results, we show that the proposed mechanism is able to mitigate between 30% and 100% of collisions compared to pure ALOHA, depending on factors such as system load and device density.

Modern services like video conferencing, video streaming or cloud gaming, but also technologies like the Internet of Things, are all relying on the availability of reliable, high speed network connectivity. The resulting requirements imposed on the underlying network infrastructure are highly complex, leading to the emergence of network softwarization with its instances Software-Defined Networking (SDN) and Network Function Virtualization (NFV). In this work, we develop mechanisms to assess the performance of software-based network components and architectures by means of measurements, simulation and numerical analysis. We develop tools and concepts to monitor, evaluate and optimize the performance of both single network components and complex interconnected systems.

Video streaming generates most network traffic in today’s Internet. For that reason, video on demand streaming is researched heavily in recent years, and many traffic monitoring mechanisms, flow and stream models, and models to predict the user perceived quality are well established. However, the quickly growing live streaming sector is not considered in these Quality of Experience models and not even the relation between network traffic and playback quality has been studied so far, forming a gap in literature. For that reason, we investigate Twitch.tv streaming as one of the largest live streaming platforms based on a large dataset and investigate the possibility to predict live streaming quality based on uplink request information. We apply approaches that are well studied for on demand streaming to predict quality changes, playback quality, and video interruption events as the most important metrics impairing user perceived quality. In this context, we answer whether these models are suitable for live streaming, if small changes are sufficient for satisfactory prediction results, or if fundamental changes and new models are required.

Today, video streaming is responsible for about 50 % of all Internet traffic worldwide. To cope with this massive amount of video streaming data, a major concern of network providers is the development of efficient traffic monitoring and management techniques. However, fast and efficient monitoring which leads to intelligent management decisions is becoming highly resource intense and complex, due to the steady increase of the number of streamed videos and the quality of the streamed content. Considering HTTP adaptive streaming applications, we present a simple machine learning free, uplink request based approach to estimate drops in the video playback butter. These drops are the first indicator leading to quality impairment events like downwards quality changes or stalling. With our approach, instead of analyzing thousands of encrypted packets in the network, we only need to consider one single packet every 5 s-10s on average, depending on the video chunk size and independently of the played resolution. Nevertheless, we are able to detect nearly all stalling events or consider a trade-off between stalling detection recall and false positives. Our approach can be implemented completely moving average based, thus not requiring any parameter setup or other expert knowledge. Due to its simplicity, it can be deployed on any access point to collect streaming quality information that is useful for active network management and intelligent resource provisioning but also in a data center to analyze a massive number of parallel video flows.

The rapid growth of connected devices has led to the implementation of Internet of Things (IoT)-centric platforms designed to provide connectivity for machine-to-machine-type communication. Specifically, mobile virtual network operators (MVNOs) provide global service for IoT use cases by leveraging roaming in readily deployed physical networks. This global deployment of connected devices poses a significant challenge regarding the operation of centralized core networks with respect to dimensioning, scaling, as well as system survivability in case of signaling incidents. Overload control mechanisms for IoT mobile networks offer a proactive solution for mitigating excessive signaling traffic from IoT devices in mobile core networks. However, global scaling and a heterogeneous composition of devices present network operators with additional challenges. To address these challenges, this work presents a detailed, protocol-level simulation framework of a real-world IoT MVNO core network. We present both models for the expected IoT signaling load and the processing of signaling messages based on measurements in a live, production environment as well as a dedicated testbed. Finally, we present a case study on various overload mechanisms and identify critical performance characteristics to compare their performance. The results of this study categorize overload control mechanisms and shed light on the necessity for MVNOs to deal with the upcoming IoT traffic by defining appropriate overload control mechanisms in mobile core networks to ensure network survivability under unforeseen conditions.

The recent rise of the Internet of Things (IoT) has given way to numerous challenges and research questions. One of the most critical issues in the area of low powered devices is the question of energy efficiency. Here, technologies like LoRa or Zigbee emerged, promising low power consumption while maintaining adequate performance. However, even when using these tailor made technologies, several configuration aspects need to be taken into account to provide high performance, energy efficient operation. To this end, we propose a generic model to compute the energy efficiency of wireless sensors under the assumption of perfect CSMA/CA channel access. We present numerical results for a typical LoRa device and highlight extensions towards other channel access mechanisms. Finally, we apply Kleinrock’s power metric to obtain ideal system configurations for varying load parameters.

Future Internet of Things deployments generate a multitude of new challenges and opportunities. While 5G networks promise massive throughput rates with ultra low delays, many verticals in the areas of Industry 4.0, Smart City, or Smart Agriculture only transmit tiny amounts of data and instead demand high energy efficiency. This is addressed by access technologies like Low Power Wide Area Networks being complementary to high performance 5G networks. Especially Long Range Wide Area Network (LoRaWAN) promises transmissions across long distances with low energy requirements with the drawback of unreliable transmission due to potential message collisions through random channel access. For that reason, a broad parameter study simulation for LoRaWAN channel access with slotted Aloha is presented for real world scenarios and influences like clock drifts or cross traffic. The key impact factors of this channel access approach are studied with focus on the collision probability in various scenarios and simulation results are compared to the current state of the art. The contribution of this work are guidelines for parameter settings in a LoRaWAN with slotted Aloha channel access and performance comparisons for different settings. This information is crucial to scale and operate future LoRaWANs.

Internet of Things (IoT) and Machine-to-Machine (M2M) devices have seen a significant growth in usage and deployment over the last years. Gaining insight into device and data usage behavior exhibited by the participants of mobile networks is elementary for Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) to scale their networks and provide a reliable service. This work aims to make use of its first of a kind dataset, spanning multiple countries and MNOs, to provide a detailed characterization of GPRS Tunneling Protocol (GTP) tunnels and devices. To this end, general statistics are used to describe the observed data traffic focusing on the distribution of the tunnel duration and volume as well as periodic device behavior. An approximate metric is introduced to analyze the periodicity and synchronicity of IoT devices. Lastly, we publish the data investigated in this work and provide a large scale dataset on the data usage behavior of IoT devices to interested researchers.

The development and adoption speed of new Internet of Things (IoT) devices and applications is constantly increasing. In particular in mobile networks, however, constant connectivity for all newly developed, globally spread, and occasionally geographically mobile devices is challenging. While the main business of current network operators is in particular, not to roam these new device generation between different networks, whereas new so called Mobile Virtual Network Operators (MVNOs) arise with exactly this business case. They use already available Radio Access Networks and deploy SIM cards that are able to establish data connection everywhere on the basis of international roaming agreements. However, because of the complex interconnection of different systems, additional challenges arise. Outages in one network component might impact the whole system.In this work, we study these signaling anomalies called incidents based on a dataset received from a global MVNO. The goal of this work is to determine traffic characteristics during these incidents towards a better understanding of signaling traffic in IoT networks. Thus, this work can be seen as a fundamental basis to help operators in a characterization, and in particular prediction and avoidance of signaling incidents.

LoRaWAN is one of the most promising Internet of Things technologies with regard to low energy consumption. However, the currently used random channel access has much potential for improvement. Thus, current literature studies alter-native channel access approaches, but the energy consumption is often not taken into consideration. For that reason, we present a generic model to quantify energy consumption in LoRaWAN for different channel access mechanisms based on a state machine. With our model, we can describe the energy consumption for specific access mechanisms or for the complete network. Our model shows that random access only performs best if no additional receive windows are opened. A simple improvement is Listen before Talk. For networks with high load, improvements are achieved by a more complex scheduled MAC. Our model serves as a basis for future energy consumption studies, conducted through measurements or simulations.

Software Defined Networking aims to separate network control and data plane by moving the control logic from network elements into a logically-centralized controller. Using a well-defined, unified control-channel protocol, such as OpenFlow, the controller is able to configure the forwarding behavior of data plane devices. Here, the OpenFlow protocol is translated to vendor- and device-specific instructions that, for instance, manipulate the flow table entries of a switch. In practice, SDN-enabled switches often feature different hardware capabilities and configurations with respect to the number of flow tables, their implementation, and which kind of data plane features they support. This leads to device heterogeneity within the SDN landscape, thereby obstructing the increased scalability and flexibility promised by the SDN paradigm. To overcome this challenge we propose TableVisor, a transparent proxy-layer for the SDN control channel that enables the flexible abstraction of heterogeneous data plane devices into a single emulated data plane switch. In this paper, we extend our previous work by introducing features to integrate modern P4 devices into an existing SDN environment and perform a detailed performance evaluation to quantify the overhead induced by our approach.

Network Functions Virtualization (NFV) is among the latest network revolutions, bringing flexibility and avoiding network ossification. At the same time, all-software NFV implementations on commodity hardware raise performance issues with respect to ASIC solutions. To address these issues, numerous software acceleration frameworks for packet processing have appeared in the last few years. Common among these frameworks is the use of batching techniques. In this context, packets are processed in groups as opposed to individually, which is required at high-speed to minimize the framework overhead, reduce interrupt pressure, and leverage instruction-level cache hits. Whereas several system implementations have been proposed and experimentally benchmarked, the scientific community has so far only to a limited extent attempted to model the system dynamics of modern NFV routers exploiting batching acceleration. In this paper, we fill this gap by proposing a simple generic model for such batching-based mechanisms, which allows a very detailed prediction of highly relevant performance indicators. These include the distribution of the processed batch size as well as queue size, which can be used to identify loss-less operational regimes or quantify the packet loss probability in high-load scenarios. We contrast the model prediction with experimental results gathered in a high-speed testbed including an NFV router, showing that the model not only correctly captures system performance under simple conditions, but also in more realistic scenarios in which traffic is processed by a mixture of functions.

HTTP Adaptive Streaming (HAS) is the de-facto standard for video delivery over the Internet. It enables the dynamic adaptation of video quality by splitting the video clip into small segments and providing multiple quality levels per segment. Current HAS streaming services typically utilize segments of equal durations. However, this leads to video encoding overhead as segments have to start with I -frames, independently of the encoded video content. In this paper we evaluate the prospects of variable segment durations, where video segments are aligned to the video characteristics. We evaluate the reduction of the encoding overhead and investigate its impact on the stalling probability using a theoretical model. It turns out that the variable approach outperforms the fixed approach in 86% of the evaluated cases with respect to video stalls.

This paper details a measurement study on the impact of different HTTP-based application layer protocols, namely HTTP/1, HTTP/2 and QUIC, on video streaming performance. In this context we evaluate the influence on the initial delay until video playout is started using the live version of the YouTube platform. Furthermore, we evaluate how different network parameters, i.e. bandwidth, RTTs and packet loss influence the different protocols. This work presents an overview over the characteristics of the compared protocols and presents a detailed measurement methodology on how the data has been obtained. Finally, the observed data is evaluated in the context of YouTube video streaming.

A key requirement for Active and Assisted Living (AAL) environments is the exchange of data between different communication endpoints to support wide range of services and applications. Used communication protocols need to support the bidirectional flow of information and have to be optimized with regard to security or latency constraints. To address these issues, RESTful approaches have recently gained much attention from the community. In this context, different application layer transport protocols can be used to realize the required data exchange. Besides HTTP/1.1, developed and standardized in the 1990s, new protocols like HTTP/2 and the QUIC transfer protocol my be suitable candidates. The impact of the different protocols on the overall performance for web and AAL services is still an open research question. This paper narrows this gap by conducting a measurement-based comparison of the three described protocols with regard to their performance in terms of web page loading times for Google web services.

Modern Software Defined Networking (SDN) applications rely on sophisticated packet processing. However, there is a mismatch between control plane requirements and data plane capabilities caused by increasing hardware heterogeneity. To overcome this challenge, we propose TableVisor, a proxy-layer for the OpenFlow control channel that enables the flexible and scalable abstraction of multiple physical devices into one emulated data plane switch that meets the requirements of the control plane application. TableVisor registers with the SDN controller as a single switch with use-case specific capabilities. It translates the instructions and rules from the control application towards the appropriate physical device where they are executed. In this paper, we present the updated architecture and functionality of TableVisor as well as first evaluation results based on testbed experiments.

We describe a number of experiments that demonstrate the usefulness of prosodic information for a processing module which parses spoken utterances with a feature-based grammar employing empty categories.We show that by requiring certain prosodic properties from those positions in the input, where the presence of an empty category has to be hypothesized, a derivation can be accomplished more eciently.The approach has been implemented in the machine translation project Verbmobil and results in a signicant reduction of the work-load for the parser.