• Developed Monitoring tool collectors for fine-grained edge workload monitoring • Lightweight pipeline for intent-based assurance on resource-constrained devices • Real-time detection of application transitions using an autoencoder model • Fast and accurate Application Type Identification via Random Forest classifier • Public AIMED-2025 dataset with 9 workloads on RPi to support the research community Intent-Based Networking (IBN) enables agile and policy-driven network management by translating high-level intents into concrete configurations and continuously validating their compliance. A critical limitation in current Intent-Based Network Assurance (IBNA) systems is the lack of real-time application-level awareness, particularly in dynamic edge environments where AI workloads frequently change. In this work, we address this limitation by introducing a lightweight, monitoring-driven pipeline that enables the detection of application transitions and identification of newly active application types on edge devices. In collaboration with Netdata engineers, we develop multimetric data collectors using Netdata, an open-source platform for real-time system and application monitoring. These collectors capture application-agnostic system metrics with minimal overhead, forming the foundation for real-time alerting and dynamic network adaptation. Our proposed pipeline transforms raw monitoring data into fixed-length vectorized multivariate time series. An undercomplete autoencoder is then used to detect changes in system behavior indicative of application transitions, followed by a Random Forest classifier that labels the newly active application based on its resource usage profile. To support reproducibility, we construct and publicly release the AIMED-2025 dataset, which includes monitoring data from seven MediaPipe-based edge AI applications and two idle states, all executed on a Raspberry Pi. Experimental evaluation demonstrates that our method achieves 100% accuracy in both Application Transition Detection and Application Type Identification using only a three-second observation window. Furthermore, the system exhibits sub-second training times and millisecond-scale inference latency, making it suitable for real-time deployment on resource-constrained edge devices. Once an application change is detected and identified, the IBNA system can automatically alert network administrators and trigger dynamic reconfiguration of network resources to meet the specific performance, security, and connectivity requirements of the active application. By integrating application-level awareness into IBNA, this work advances the state of the art in intent-driven network management and enables more adaptive, efficient, and reliable operation of edge AI systems.

The rapid expansion of Artificial Intelligence (AI) applications at the Edge has created an increasing demand for energy-efficient deployment. Furthermore, Edge devices are inherently constrained in computation, bandwidth, and storage, making the exploration of compressed AI models and data a worthwhile approach to enhancing efficiency. While compression improves resource and energy efficiency, it often leads to significant performance degradation, especially with complex data. To address this challenge, we propose leveraging transformations on compressed data to enhance the effectiveness of compressed AI models. We evaluate 13 different transformations across three benchmark datasets (MNIST, FashionMNIST, CIFAR-10) and find that applying shadow transformations to lossy compressed images significantly mitigates performance loss. Based on experiments in a real edge device our approach achieves a 10.7% reduction in energy consumption, 99.48% compression in AI model architecture, and up to 72% data size reduction, with performance degradation ranging only from 0.14% to 0.89%. These results show that data transformations can enable efficient Edge AI inference with minimal performance loss, reducing energy, bandwidth, and computation.

Modern networks are dynamic and heterogeneous, leading to significant challenges for Intrusion Detection Systems (IDS) due to data drift and concept drift phenomenons. Traditional Machine Learning (ML) models trained on a source domain often suffer performance degradation when deployed in a target domain, while online learning models require substantial data to adapt effectively. To address these limitations, we propose a hybrid methodology that integrates online learning with domain adaptation for intrusion detection (OLIDA-IDS). OLIDA-IDS begins with a static random forest model trained on the source domain, employs a Stacked Marginalized Denoising Autoencoder (sMDA) for unsupervised domain adaptation to align feature distributions, and transitions to an Adaptive Random Forest (ARF) for online learning as target data becomes available incrementally. Experimental results demonstrate that OLIDA-IDS achieves 99.59% accuracy in the target network environment, outperforming static, semi-supervised, and incremental learning approaches. Key contributions include the novel integration of sMDA for domain adaptation, a weighted-accuracy technique for seamless transition between static and online models, and the use of ARF for superior resilience in evolving network threats. This work bridges the gap between domain adaptation and online learning, offering a feasible solution for real-world IDS deployment in dynamic environments.

Intrusion Detection systems (IDS) are alerting cybersecurity tools that analyze network traffic in order to identify suspicious activity and known threats. State of the art IDS rely on supervised machine learning models which are trained to categorize the network flow with a historical labeled dataset. Nonetheless, next-generation networks are characterized as heterogeneous and dynamic. The heterogeneity can make every network environment to be significantly different and the dynamicity means that new threats are constantly emerging. These two factors raise the research question if a supervised machine learning based IDS can work efficiently in a network environment different from the one that generated its labeled training data. In this paper, we first give an answer to this research question and next try to propose a semi-supervised learning approach that can be generalized sufficiently in a different network environment using unlabeled data, taking into consideration that unlabeled data are much easier and cheap to be collected compared to labeled ones. In order to have a proof of concept we made experiments with two labeled datasets CIC-IDS2017, CIC-IDS2018 which are publicly available and one unlabeled dataset PS-Azure2023 which we constructed for this work and make it also publicly available. The results confirm our assumption and the applicability of the semi-supervised learning paradigm for the design of IDS.

Internet of Things (IoT) applications generate tremendous amounts of data streams which are characterized by varying Quality of Service (QoS) indicators. These indicators need to be accurately estimated in order to appropriately schedule the computational and communication resources of the access and Edge networks. Nonetheless, such types of IoT data may be produced at irregular time instances, while suffering from varying network conditions and from the mobility patterns of the edge devices. At the same time, the multipurpose nature of IoT networks may facilitate the co-existence of diverse applications, which however may need to be analyzed separately for confidentiality reasons. Hence, in this paper, we aim to forecast time series data of key QoS metrics, such as throughput, delay, packet delivery and loss ratio, under different network configuration settings. Additionally, to secure data ownership while performing the QoS forecasting, we propose the FeDerated Temporal Sparse Transformer (FeD-TST) framework, which allows local clients to train their local models with their own QoS dataset for each network configuration; subsequently, an associated global model can be updated through the aggregation of the local models. In particular, three IoT applications are deployed in a real testbed under eight different network configurations with varying parameters including the mobility of the gateways, the transmission power and the channel frequency. The results obtained indicate that our proposed approach is more accurate than the identified state-of-the-art solutions.

Next generation networks will be largely based on monitoring and telemetry tools that are essential for maintaining optimal performance, ensuring security, managing costs, and performing fault detection and resolution. An integral part of the overall monitoring strategy is alerting, which provides administrators with the necessary information to proactively or reactively manage and optimize network services. However, when monitoring systems generate an excessive number of alerts, many of which may not be actionable or may not represent critical issues, the phenomenon of alert fatigue occurs. Alert fatigue refers to a situation where the volume and the speed of the continuous influx of alerts becomes so overwhelming that the network administrators become desensitized and do not respond to them. To this end, and inspired by recent trends in network automation, where human intervention tends to be minimized, we introduce an alert fatigue mitigation mechanism in monitoring focusing on cloud computing infrastructures. In particular, a composite machine learning methodology is proposed in order to select which alerts will be hidden and which ones will be presented to the administrators. Additionally, to personalize the results, the proposed approach considers the level of users’ experience along with the alert features to further optimize the accuracy of the alert filtering mechanism. The research has been conducted in a realistic environment of a leading monitoring enterprise, Netdata, which provided two datasets for testing our approach. Furthermore, the attained results of the filtering mechanism were evaluated by expert engineers of the company that verified the output of the proposed framework. Specifically, the outcomes confirm that our proposed methodology mitigates the alert fatigue problem with an accuracy that surpass 90% in most cases.

In this paper we examine different approaches for the prediction of Service Level Agreements (SLAs) violations that occur during the service provisioning between cloud customers and providers. Despite the fact that there are many network metrics that involve the server - client interaction, it is an open research question how these available metrics can be used by a SLA prediction mechanism. We study three different data representation models for the network characteristics, a time series, a content and a context representation. We see that a context approach using graph representations captures efficiently the associativity of clients and improves the performance of traditional SLA violation prediction models when it is combined with them. The prediction of the SLA violations takes place using neural networks, making us propose a composite SLA prediction model that leverages Graph Neural Networks (GNNs). In our research, we put special emphasis and try different variations on how we construct the graphs. We perform an extensive performance evaluation of 23 different SLA prediction models that can be grouped into the three representations categories, namely the vector models that are based on network features, sequential models that leverage the temporal evolution of QoS metrics and Graph models that take into consideration the associativity of the clients. The experimental results show that our proposed GNN-based model can significantly improve the accuracy of SLA violation prediction, making it a useful tool for Cloud and Service providers.

Recent advances in cloud computing and data centers have increased the demands for monitoring the network infrastructure and the applications that it hosts. The monitoring processes let network administrators to be aware of the status of the physical and logical units that compose their system. Since the goal of next generation networks is to minimise the administrators’ intervention, the alerting systems should minimize the frequency of notifications, emphasizing on critical scenarios such as when a monitoring metric surpasses a threshold or an anomalous behaviour is detected. However, current monitoring tools flood network administrators with hundreds of notifications every day. In this paper, we propose a binary classification approach, in order to decide if the administrators should be notified through monitoring alerts or not. To do so, our framework is build upon real monitoring logs and alerts, that show how the administrators reacted when receiving an alert. Extensive simulation results assess the performance of various classification approaches and reveal that random forests are great candidates for the binary classification alerting system that we propose, in terms of classification efficiency and computational overhead.

Highly automated driving continues to attract massive research efforts at a global scale, leading to developments that pave the way towards the future of mobility. Despite the innumerable innovations that have already penetrated our lives, there are still several challenges to overcome in this area. Indicatively, highly automated driving decisions are often associated with undertaking partially unknown risks, which are critical for fail-safe and fail-operational components and systems of modern vehicles, operating at alternative Levels of Autonomy (LoA). As such, novel functionality is required to a-priori assess those risks and propose decisions that affect vehicular behavior, in a cognitive (knowledge-based) manner. This paper proposes an in-vehicle cognitive management functionality that dynamically suggests the most appropriate LoA, by (a) incorporating in the decision-making process the "a priori risk assessment" associated with every possible decision, by applying the Failure Mode and Effect Analysis (FMEA) to model the identified risks of each candidate LoA, (b) predicting at a 1st level the most suitable LoA by means of Bayesian networks, (c) further enhancing predictions at a 2nd level, by using neural networks, namely a Binary Classification model and a MultiClass Classification model and (d) storing and exploiting in the future all associated decisions through experience creation (3rd cognition level). A simulation scenario is used to validate the effectiveness of the proposed functionality. Results showcase that the method can a priori, quickly, and effectively lead to optimum LoA decisions with minimum risk, contributing further to safer roads.

Internet of Things (IoT) devices generate a tremendous amount of time series data that is extremely dynamic, heterogeneous and time dependent. Such types of data introduce significant challenges for the real-time prediction of QoS metrics of IoT applications with different traffic characteristics. To this end, in this paper, we propose a temporal transformer model and a unified system to predict several QoS metrics of heterogeneous IoT applications when they communicate with the Edge of the network. The transformer model also leverages an attention module to provide a solution for both short-term and long-term sequence prediction of QoS metrics that allows to better extract any time dependencies. In particular, in our framework, we firstly generate a set of datasets containing real-time traffic information of five different IoT applications such as Heating, Ventilation, and Air Conditioning (HVAC), lighting, Voice over Internet Protocol (VoIP), surveillance and emergency response using the 802.15.4 access technology and the RPL routing protocol. Following, we perform the data cleaning, downsampling and pre-processing of the datasets and we construct the QoS datasets, which include four QoS metrics, namely throughput, packet delivery ratio, packet loss ratio and latency. Finally, we evaluate the transformer model through extensive experimentation using both short-term and long-term dependencies and we show that our model can guarantee a robust performance and accurate QoS prediction.

The proliferation of Internet of Things (IoT) and edge devices constitute important an efficient orchestration of the edge computing infrastructures, calling the providers to rethink their decision making methods. The resource usage prediction can be a prominent source of information for adaptive resource allocation and task offloading. In this research, we propose a Gated Recurrent Neural Network multi-output regression model that leverage time series resource usage metrics. The edge computing infrastructures are characterized as dynamical and heterogeneous environments. This motivated us to propose the innovative Hybrid Bayesian Evolutionary Strategy (HBES) algorithm for automated adaptation of the resource usage models in order to to enhance the generality of our approach. The proposed resource usage prediction mechanism has been experimentally evaluated and compared with other state of the art methods with significant improvements in terms of RMSE and MAE.

Deciding and reserving appropriate resources in the Cloud, is a basic initial step for adopters when employing an Infrastructure as a Service to host their application. However, the size and number of Virtual Machines used, along with the expected application workload, will highly influence its operation, in terms of the observed Quality of Service. This paper proposes a machine learning approach, based on Artificial Neural Networks, for mapping Quality of Service required levels and (expected) application workload to concrete resource demands. The presented solution is evaluated through a comercial Customer Relationship Management application, generating a training set of realistic workload and Quality of Service measurements in order to illustrate the effectiveness of the proposed technique in a real-world scenario.