Evaluating cellular systems, from 5th generation (5G) New Radio (NR) and 5G-Advanced to 6th generation (6G), is challenging because the performance emerges from the tight coupling of propagation, beam management, scheduling, and higher-layer interactions. System-level simulation is therefore indispensable, yet the vast majority of studies rely on the statistical 3rd Generation Partnership Project (3GPP) channel models. These are well suited to capture average behavior across many statistical realizations, but cannot reproduce site-specific phenomena such as comer diffraction, street-canyon blockage, or deterministic line-of-sight conditions and angle-of- departure/arrival relationships that drive directional links.This paper extends 5G-LENA, an NR module for the system-level Network Simulator 3 (ns-3), with a trace-based channel model that processes the Multipath Components (MPCs) obtained from external ray-tracers (e.g., Sionna Ray Tracer (RT)) or measurement campaigns. Our module constructs frequency-domain channel matrices, and feeds them to the existing Physical (PHY)/Medium Access Control (MAC) stack without any further modifications. The result is a geometry-based channel model that remains fully compatible with the standard 3GPP implementation in 5G-LENA, while delivering site-specific geometric fidelity. This new module provides a key building block toward Digital Twin (DT) capabilities by offering realistic site-specific channel modeling, unlocking studies that require site awareness, including beam management, blockage mitigation, and environment-aware sensing. We demonstrate its capabilities for precise beam-steering validation and end-to-end metric analysis. In both cases, the trace-driven engine exposes performance inflections that the statistical model does not exhibit, confirming its value for high- fidelity system-level cellular networks research and as a step toward DT applications.

5G networks provide low-latency, high throughput, and massive connectivity, yet the control plane remains exposed to several security threats. Among the most common and impactful threats are Denial-of-Service (DoS) attacks, with Radio Resource Control (RRC) signaling storms being particularly effective and difficult to mitigate. In this attack, a malicious User Equipment (UE) aims to exhaust Next Generation Node Base (gNB) resources, preventing legitimate UEs from establishing a connection. Existing defenses are typically limited to detection, only evaluated through numerical simulations, and cannot discern between high-load network conditions and attacks. Most of them also assume static setups and do not take mobility into account. In this paper, we first evaluate the feasibility of the signaling storm attack by using the OpenAirInterface(OAI) 5G protocol stack. Then, we propose StormShield, a signaling storm attack detection and mitigation technique implemented as an xApp on an O-RAN Near-Real-Time (near-RT) RAN Intelligent Controller (RIC). It fingerprints and blocks Malicious UEs (MUEs) before gNB resources are exhausted. We prototyped our solution on an Over-The-Air (OTA) testbed with OAI, NVIDIA Aerial, and two different gNB setups. The first one leverages an USRP X410 Software-defined Radio (SDR) with 8.1 functional split; the second a commercial Foxconn Radio Unit (RU) with 7.2 functional split. Our experimental evaluation demonstrates that StormShield effectively prevents gNB resource exhaustion, identifying and blocking MUEs with an average detection accuracy of 97.6% within 106.5 ms from the beginning of the attack.

5G and beyond cellular systems embrace the disaggregation of Radio Access Network (RAN) components, exemplified by the evolution of the fronthaul (FH) connection between cellular baseband and radio unit equipment. Crucially, synchronization over the FH is pivotal for reliable 5G services. In recent years, there has been a push to move these links to an Ethernet-based packet network topology, leveraging existing standards and ongoing research for Time-Sensitive Networking (TSN). However, TSN standards, such as Precision Time Protocol (PTP), focus on performance with little to no concern for security. This increases the exposure of the open FH to security risks. Attacks targeting synchronization mechanisms pose significant threats, potentially disrupting 5G networks and impairing connectivity. In this article, we demonstrate the impact of successful spoofing and replay attacks against PTP synchronization. We show how a spoofing attack is able to cause a production-ready O-RAN and 5G-compliant private cellular base station to catastrophically fail within 2 seconds of the attack, necessitating manual intervention to restore full network operations. To counter this, we design a Machine Learning (ML)-based monitoring solution capable of detecting various malicious attacks with over 97.5% accuracy.

Modern cellular networks adopt a software-based and disaggregated approach to support diverse requirements and mission-critical reliability needs. While softwarization introduces flexibility, it also increases the complexity of the network architectures, which calls for robust automation frameworks that can deliver efficient and fully-autonomous configuration, scalability, and multi-vendor integration. This paper presents AutoRAN, an automated, intent-driven framework for zero-touch provisioning of open, programmable cellular networks. Leveraging cloud-native principles, AutoRAN employs virtualization, declarative infrastructure-as-code templates, and disaggregated micro-services to abstract physical resources and protocol stacks. Its orchestration engine integrates Large Language Models (LLMs) to translate high-level intents into machine-readable configurations, enabling closed-loop control via telemetry-driven observability. Implemented on a multi-architecture OpenShift cluster with heterogeneous compute (x86/ARM CPUs, NVIDIA GPUs) and multi-vendor Radio Access Network (RAN) hardware (Foxconn, NI), AutoRAN automates deployment of O-RANcompliant stacks-including OpenAirInterface, NVIDIA ARC RAN, Open5GS core, and O-RAN Software Community (OSC) RIC components-using Continuous Integration and Continuous Delivery/Deployment (CI/CD) pipelines. Experimental results demonstrate that AutoRAN is capable of deploying an end-toend Private 5G network in less than 60 seconds with 1.6 Gbps throughput, validating its ability to streamline configuration, accelerate testing, and reduce manual intervention with similar performance than non cloud-based implementations. With its novel LLM-assisted intent translation mechanism, and performanceoptimized automation workflow for multi-vendor environments, AutoRAN has the potential of advancing the robustness of nextgeneration cellular supply chains through reproducible, intentbased provisioning across public and private deployments.

The growing performance demands and higher deployment densities of next-generation wireless systems emphasize the importance of adopting strategies to manage the energy efficiency of mobile networks. In this demo, we showcase a framework that enables research on Deep Reinforcement Learning (DRL) techniques for improving the energy efficiency of intelligent and programmable Open Radio Access Network (RAN) systems. Using the open-source simulator ns-O-RAN and the reinforcement learning environment Gymnasium, the framework enables to train and evaluate DRL agents that dynamically control the activation and deactivation of cells in a 5G network. We show how to collect data for training and evaluate the impact of DRL on energy efficiency in a realistic 5G network scenario, including users' mobility and handovers, a full protocol stack, and 3rd Generation Partnership Project (3GPP)-compliant channel models. The tool will be open-sourced upon acceptance of this paper and a tutorial for energy efficiency testing in ns-O-RAN.

Next-generation wireless systems, already widely deployed, are expected to become even more prevalent in the future, representing challenges in both environmental and economic terms. This paper focuses on improving the energy efficiency of intelligent and programmable Open Radio Access Network (RAN) systems through the near-real-time dynamic activation and deactivation of Base Station (BS) Radio Frequency (RF) frontends using Deep Reinforcement Learning (DRL) algorithms, i.e., Proximal Policy Optimization (PPO) and Deep Q-Network (DQN). These algorithms run on the RAN Intelligent Controllers (RICs), part of the Open RAN architecture, and are designed to make optimal network-level decisions based on historical data without compromising stability and performance. We leverage a rich set of Key Performance Measurements (KPMs), serving as state for the DRL, to create a comprehensive representation of the RAN, alongside a set of actions that correspond to some control exercised on the RF frontend. We extend ns-O-RAN, an open-source, realistic simulator for 5G and Open RAN built on ns-3, to conduct an extensive data collection campaign. This enables us to train the agents offline with over 300,000 data points and subsequently evaluate the performance of the trained models. Results show that DRL agents improve energy efficiency by adapting to network conditions while minimally impacting the user experience. Additionally, we explore the trade-off between throughput and energy consumption offered by different DRL agent designs.

The traditional black-box and monolithic approach to Radio Access Networks (RANs) has heavily limited flexibility and innovation. The Open RAN paradigm, and the architecture proposed by the O-RAN ALLIANCE, aim to address these limitations via openness, virtualization and network intelligence. In this work, first we propose a novel, programmable scheduler design for Open RAN Distributed Units (DUs) that can guarantee minimum throughput levels to User Equipments (UEs) via configurable weights. Then, we propose an O-RAN xApp that reconfigures the scheduler’s weights dynamically based on the joint Complementary Cumulative Distribution Function (CCDF) of reported throughput values. We demonstrate the effectiveness of our approach by considering the problem of asset tracking in 5G-powered Industrial Internet of Things (IIoT) where uplink video transmissions from a set of cameras are used to detect and track assets via computer vision algorithms. We implement our programmable scheduler on the OpenAirInterface (OAI) 5G protocol stack, and test the effectiveness of our xApp control by deploying it on the O-RAN Software Community (OSC) near-RT RAN Intelligent Controller (RIC) and controlling a 5G RAN instantiated on the Colosseum Open RAN digital twin. Our experimental results demonstrate that our approach enhances the success percentage of meeting throughput requirements by 33% compared to a reference scheduler. Moreover, in the asset tracking use case, we show that the xApp improves the detection accuracy, i.e., the F1 score, by up to 37.04%.

Ultra-dense fifth generation (5G) and beyond networks leverage spectrum sharing and frequency reuse to enhance throughput, but face unpredictable in-band uplink (UL) interference challenges that significantly degrade Signal to Interference plus Noise Ratio (SINR) at affected Next Generation Node Bases (gNBs). This is particularly problematic at cell edges, where overlapping regions force User Equipments (UEs) to increase transmit power, and in directional millimeter wave systems, where beamforming sidelobes can create unexpected interference. The resulting signal degradation disrupts protocol operations, including scheduling and resource allocation, by distorting quality indicators like Reference Signal Received Power (RSRP) and Received Signal Strength Indicator (RSSI), and can compromise critical functions such as channel state reporting and Hybrid Automatic Repeat Request (HARQ) acknowledgments.

The development of 6G wireless technologies is rapidly advancing, with the 3rd Generation Partnership Project (3GPP) entering the pre-standardization phase and aiming to deliver the first specifications by 2028. This paper explores the OpenAirInterface (OAI) project, an open-source initiative that plays a crucial role in the evolution of 5G and future 6G networks. OAI provides a comprehensive implementation of 3GPP and O-RAN compliant networks, including Radio Access Network (RAN), Core Network (CN), and software-defined User Equipment (UE) components. This paper details the history and evolution of OAI, its licensing model, and the various projects under its umbrella, such as RAN, the CN, and the Operations, Administration and Maintenance (OAM) projects. It also highlights the development methodology, Continuous Integration/Continuous Delivery (CI/CD) processes, and end-to-end systems powered by OAI. Furthermore, the paper discusses the potential of OAI for 6G research, focusing on spectrum, reflective intelligent surfaces, and Artificial Intelligence (AI)/Machine Learning (ML) integration. The open-source approach of OAI is emphasized as essential for tackling the challenges of 6G, fostering community collaboration, and driving innovation in next-generation wireless technologies.

Open Radio Access Networks (RANs) leverage disaggregated and programmable RAN functions and open interfaces to enable closed-loop, data-driven radio resource management. This is performed through custom intelligent applications on the RAN Intelligent Controllers (RICs), optimizing RAN policy scheduling, network slicing, user session management, and medium access control, among others. In this context, we have proposed dApps as a key extension of the O-RAN architecture into the real-time and user-plane domains. Deployed directly on RAN nodes, dApps access data otherwise unavailable to RICs due to privacy or timing constraints, enabling the execution of control actions within shorter time intervals. In this paper, we propose for the first time a reference architecture for dApps, defining their life cycle from deployment by the Service Management and Orchestration (SMO) to real-time control loop interactions with the RAN nodes where they are hosted. We introduce a new dApp interface, E3, along with an Application Protocol (AP) that supports structured message exchanges and extensible communication for various service models. By bridging E3 with the existing O-RAN E2 interface, we enable dApps, xApps, and rApps to coexist and coordinate. These applications can then collaborate on complex use cases and employ hierarchical control to resolve shared resource conflicts. Finally, we present and open-source a dApp framework based on OpenAirInterface (OAI). We benchmark its performance in two real-time control use cases, i.e., spectrum sharing and positioning in a 5th generation (5G) Next Generation Node Base (gNB) scenario. Our experimental results show that standardized real-time control loops via dApps are feasible, achieving average control latency below 450 microseconds and allowing optimal use of shared spectral resources.

The O-RAN ALLIANCE is defining architectures, interfaces, operations, and security requirements for cellular networks based on Open Radio Access Network (RAN) principles. In this context, O-RAN introduced the RAN Intelligent Controllers (RICs) to enable dynamic control of cellular networks via data-driven applications referred to as rApps and xApps. RICs enable for the first time truly intelligent and self-organizing cellular networks. However, enabling the execution of many Artificial Intelligence (AI) algorithms making autonomous control decisions to fulfill diverse (and possibly conflicting) goals poses unprecedented challenges. For instance, the execution of one xApp aiming at maximizing throughput and one aiming at minimizing energy consumption would inevitably result in diametrically opposed resource allocation strategies. Therefore, conflict management becomes a crucial component of any functional intelligent O-RAN system. This article studies the problem of conflict mitigation in O-RAN and proposes PACIFISTA, a framework to detect, characterize, and mitigate conflicts generated by O-RAN applications that control RAN parameters. PACIFISTA leverages a profiling pipeline to tests O-RAN applications in a sandbox environment, and combines hierarchical graphs with statistical models to detect the existence of conflicts and evaluate their severity. Experiments on Colosseum and OpenRAN Gym demonstrate PACIFISTA's ability to predict conflicts and provide valuable information before potentially conflicting xApps are deployed in production systems. We use PACIFISTA to demonstrate that users can experience a 16% throughput loss even in the case of xApps with similar goals, and that applications with conflicting goals might cause severe instability and result in up to 30% performance degradation. We also show that PACIFISTA can help operators to identify conflicting applications and maintain performance degradation below a tolerable threshold.

The highly heterogeneous ecosystem of Next Generation (NextG) wireless communication systems calls for novel networking paradigms where functionalities and operations can be dynamically and optimally reconfigured in real time to adapt to changing traffic conditions and satisfy stringent and diverse Quality of Service (QoS) demands. Open Radio Access Network (RAN) technologies, and specifically those being standardized by the O-RAN Alliance, make it possible to integrate network intelligence into the once monolithic RAN via intelligent applications, namely, xApps and rApps. These applications enable flexible control of the network resources and functionalities, network management, and orchestration through data-driven intelligent control loops. Recent work has showed how Deep Reinforcement Learning (DRL) is effective in dynamically controlling O-RAN systems. However, how to design these solutions in a way that manages heterogeneous optimization goals and prevents unfair resource allocation is still an open challenge, with the logic within DRL agents often considered as a opaque system. In this paper, we introduce PandORA, a framework to automatically design and train DRL agents for Open RAN applications, package them as xApps and evaluate them in the Colosseum wireless network emulator. We benchmark 23 xApps that embed DRL agents trained using different architectures, reward design, action spaces, and decision-making timescales, and with the ability to hierarchically control different network parameters. We test these agents on the Colosseum testbed under diverse traffic and channel conditions, in static and mobile setups. Our experimental results indicate how suitable fine-tuning of the RAN control timers, as well as proper selection of reward designs and DRL architectures can boost network performance according to the network conditions and demand. Notably, finer decision-making granularities can improve Massive Machine-Type Communications (mMTC)’s performance by$\sim\! 56\%$and even increase Enhanced Mobile Broadband (eMBB) Throughput by$\sim\! 99\%$.

As Fifth generation (5G) cellular systems transition to softwarized, programmable, and intelligent networks, it becomes fundamental to enable public and private 5G deployments that are (i) primarily based on software components while (ii) maintaining or exceeding the performance of traditional monolithic systems and (iii) enabling programmability through bespoke configurations and optimized deployments. This requires hardware acceleration to scale the Physical (PHY) layer performance, programmable elements in the Radio Access Network (RAN) and intelligent controllers at the edge, careful planning of the Radio Frequency (RF) environment, as well as end-to-end integration and testing. In this paper, we describe how we developed the programmable X5G testbed, addressing these challenges through the deployment of the first 8-node network based on the integration of NVIDIA Aerial RAN CoLab Over-the-Air (ARC-OTA), OpenAirInterface (OAI), and a near-real-time RAN Intelligent Controller (RIC). The Aerial Software Development Kit (SDK) provides the PHY layer, accelerated on Graphics Processing Unit (GPU), with the higher layers from the OAI open-source project interfaced with the PHY through the Small Cell Forum (SCF) Functional Application Platform Interface (FAPI). An E2 agent provides connectivity to the O-RAN Software Community (OSC) nearreal-time RIC. We discuss software integration, network infrastructure, and a digital twin framework for RF planning. We then profile the performance with up to 4 Commercial Off-the-Shelf (COTS) smartphones for each base station with iPerf and video streaming applications, as well as up to 25 emulated User Equipments (UEs), measuring a cell rate higher than 1.65 Gbps in downlink and 143 Mbps in uplink.

Next-generation wireless networks target high network availability, ubiquitous coverage, and extremely high data rates for mobile users. This requires exploring new frequency bands, e.g., mmWaves, moving toward ultra-dense deployments in urban locations, and providing ad hoc, resilient connectivity in rural scenarios. The design of the backhaul network plays a key role in advancing how the access part of the wireless system supports next-generation use cases. Wireless backhauling, such as the newly introduced Integrated Access and Backhaul (IAB) concept in 5G, provides a promising solution, also leveraging the mmWave technology and steerable beams to mitigate interference and scalability issues. At the same time, however, managing and optimizing a complex wireless backhaul introduces additional challenges for the operation of cellular systems. This paper presents a strategy for the optimal creation of the backhaul network considering various constraints related to network topology, robustness, and flow management. We evaluate its feasibility and efficiency using synthetic and realistic network scenarios based on 3D modeling of buildings and ray tracing. We implement and prototype our solution as a dynamic IAB control framework based on the Open Radio Access Network (RAN) architecture, and demonstrate its functionality in Colosseum, a large-scale wireless network emulator with hardware in the loop.

Network virtualization, software-defined infrastructure, and orchestration are pivotal elements in contemporary networks, yielding new vectors for optimization and novel capabilities. In line with these principles, O-RAN presents an avenue to bypass vendor lock-in, circumvent vertical configurations, enable network programmability, and facilitate integrated artificial intelligence (AI) support. Moreover, modern container orchestration frameworks (e.g., Kubernetes, Red Hat OpenShift) simplify the way cellular base stations, as well as the newly introduced RAN Intelligent Controllers (RICs), are deployed, managed, and orchestrated. While this enables cost reduction via infrastructure sharing, it also makes it more challenging to meet O-RAN control latency requirements, especially during peak resource utilization. For instance, the Near-real-time RIC is in charge of executing applications (xApps) that must take control decisions within one second, and we show that container platforms available today fail in guaranteeing such timing constraints. To address this problem, we propose ScalO-RAN, a control framework rooted in optimization and designed as an O-RAN rApp that allocates and scales AI-based O-RAN applications (xApps, rApps, dApps) to: (i) abide by application-specific latency requirements, and (ii) monetize the shared infrastructure while reducing energy consumption. We prototype ScalO-RAN on an OpenShift cluster with base stations, RIC, and a set of AI-based xApps deployed as micro-services. We evaluate ScalO-RAN both numerically and experimentally. Our results show that ScalO-RAN can optimally allocate and distribute O-RAN applications within available computing nodes to accommodate even stringent latency requirements. More importantly, we show that scaling O-RAN applications is primarily a time-constrained problem rather than a resource-constrained one, where scaling policies must account for stringent inference time of AI applications, and not only how many resources they consume.

Digital twins are now a staple of wireless networks design and evolution. Creating an accurate digital copy of a real system offers numerous opportunities to study and analyze its performance and issues. It also allows designing and testing new solutions in a risk-free environment, and applying them back to the real system after validation. A candidate technology that will heavily rely on digital twins for design and deployment is 6G, which promises robust and ubiquitous networks for eXtended Reality (XR) and immersive communications solutions. In this paper, we present BostonTwin, a dataset that merges a high-fidelity 3D model of the city of Boston, MA, with the existing geospatial data on cellular base stations deployments, in a ray-tracing-ready format. Thus, BostonTwin enables not only the instantaneous rendering and programmatic access to the building models, but it also allows for an accurate representation of the electromagnetic propagation environment in the real-world city of Boston. The level of detail and accuracy of this characterization is crucial to designing 6G networks that can support the strict requirements of sensitive and high-bandwidth applications, such as XR and immersive communication.

While the availability of large datasets has been instrumental to advance fields like computer vision and natural language processing, this has not been the case in mobile networking. Indeed, mobile traffic data is often unavailable due to privacy or regulatory concerns. This problem becomes especially relevant in Open Radio Access Network (RAN), where artificial intelligence can potentially drive optimization and control of the RAN, but still lags behind due to the lack of training datasets. While substantial work has focused on developing testbeds that can accurately reflect production environments, the same level of effort has not been put into twinning the traffic that traverse such networks.

Network slicing allows Telecom Operators (TOs) to support service provisioning with diverse Service Level Agreements (SLAs). The combination of network slicing and Open Radio Access Network (RAN) enables TOs to provide more customized network services and higher commercial benefits. However, in the current Open RAN community, an open-source end-to-end slicing solution for 5G is still missing. To bridge this gap, we developed ORANSlice, an open-source network slicing-enabled Open RAN system integrated with popular open-source RAN frameworks. ORANSlice features programmable, 3GPP-compliant RAN slicing and scheduling functionalities. It supports RAN slicing control and optimization via xApps on the near-real-time RAN Intelligent Controller (RIC) thanks to an extension of the E2 interface between RIC and RAN, and service models for slicing. We deploy and test ORANSlice on different O-RAN testbeds and demonstrate its capabilities on different use cases, including slice prioritization and minimum radio resource guarantee.

RAN Intelligent Controllers (RICs) are programmable platforms that enable data-driven closed-loop control in the O-RAN architecture. They collect telemetry and data from the RAN, process it in custom applications, and enforce control or new configurations on the RAN. Such custom applications in the Near-Real-Time (RT) RIC are called xApps, and enable a variety of use cases related to radio resource management. Despite numerous open-source and commercial projects focused on the Near-RT RIC, developing and testing xApps that are interoperable across multiple RAN implementations is a time-consuming and technically challenging process. This is primarily caused by the complexity of the protocol of the E2 interface, which enables communication between the RIC and the RAN while providing a high degree of flexibility, with multiple Service Models (SMs) providing plug-and-play functionalities such as data reporting and RAN control. In this paper, we propose xDevSM, an open-source flexible framework for O-RAN service models, aimed at simplifying xApp development for the O-RAN Software Community (OSC) Near-RT RIC. xDevSM reduces the complexity of the xApp development process, allowing developers to focus on the control logic of their xApps and moving the logic of the E2 service models behind simple Application Programming Interfaces (APIs). We demonstrate the effectiveness of this framework by deploying and testing xApps across various RAN software platforms, including OpenAirInterface and srsRAN. This framework significantly facilitates the development and validation of solutions and algorithms on O-RAN networks, including the testing of data-driven solutions across multiple RAN implementations.

In this paper, we investigate the security implications of virtualized and software-based Open Radio Access Network (RAN) systems, specifically focusing on the architecture proposed by the O-RAN ALLIANCE and O-Cloud deployments based on the O-RAN Software Community (OSC) stack and infrastructure. Our key findings are based on a thorough security assessment and static scanning of the OSC Near Real-Time RAN Intelligent Controller (RIC) cluster. We highlight the presence of potential vulnerabilities and misconfigurations in the Kubernetes infrastructure supporting the RIC, also due to the usage of outdated versions of software packages, and provide an estimation of their criticality using various deployment auditing frameworks (e.g., MITRE ATT&CK and the NSA CISA). In addition, we propose methodologies to minimize these issues and harden the Open RAN virtualization infrastructure. These encompass the integration of security evaluation methods into the deployment process, implementing deployment hardening measures, and employing policy-based control for RAN components. We emphasize the need to address the problems found in order to improve the overall security of virtualized Open RAN systems.

Softwarized and programmable Radio Access Networks (RANs) come with virtualized and disaggregated components, increasing the supply chain robustness and the flexibility and dynamism of the network deployments. This is a key tenet of Open RAN, with open interfaces across disaggregated components specified by the O-RAN ALLIANCE. It is mandatory, however, to validate that all components are compliant with the specifications and can successfully interoperate, without performance gaps with traditional, monolithic appliances. Open Testing & Integration Centers (OTICs) are entities that can verify such interoperability and adherence to the standard through rigorous testing. However, how to design, instrument, and deploy an OTIC which can offer testing for multiple tenants, heterogeneous devices, and is ready to support automated testing is still an open challenge. In this paper, we introduce a blueprint for a programmable OTIC testing infrastructure, based on the design and deployment of the Open6G OTIC at Northeastern University, Boston, and provide insights on technical challenges and solutions for O-RAN testing at scale.

Open Radio Access Networks (O-RAN) are expected to revolutionize the telecommunications industry with benefits like cost reduction, vendor diversity, and improved network performance through AI optimization. Supporting the O-RAN ALLIANCE’s mission to achieve more intelligent, open, virtualized and fully interoperable mobile networks, O-RAN Open Testing and Integration Centers (OTICs) play a key role in accelerating the adoption of O-RAN specifications based on rigorous testing and validation. One theme in the recent O-RAN Global PlugFest Spring 2024 focused on demonstrating consistent and repeatable Open Fronthaul testing in multiple labs. To respond to this topic, in this paper, we present a detailed analysis of the testing methodologies and results for O-RAN Distributed Unit (O-DU) in O-RAN across two OTICs. We identify key differences in testing setups, share challenges encountered, and propose best practices for achieving repeatable and consistent testing results. Our findings highlight the impact of different deployment technologies and testing environments on performance and conformance testing outcomes, providing valuable insights for future O-RAN implementations.

The Open Radio Access Network (Open RAN) vision is based on the three principles of (i) open interfaces; (ii) cloudification; and (iii) automation through closed-loop control. It is a network architecture paradigm embodied and augmented through technical reference specifications of the 3GPP and the O-RAN Alliance. At the centre of Open RAN are open, programmable, and virtualized components, connected to each other through open interfaces that enable closed-loop, data-driven, and intelligent control. For instance, the O-RAN Alliance introduced two RAN Intelligent Controllers (or RICs) that connect through open interfaces to the disaggregated components of the RAN, and implement control loops that run at different time scales.

Innovation and standardization in 5G have brought advancements to every facet of the cellular architecture. This ranges from the introduction of new frequency bands and signaling technologies for the radio access network (RAN), to a core network underpinned by micro-services and network function virtualization (NFV). However, like any emerging technology, the pace of real-world deployments does not instantly match the pace of innovation. To address this discrepancy, one of the key aspects under continuous development is the RAN with the aim of making it more open, adaptive, functional, and easy to manage. In this paper, we highlight the transformative potential of embracingnovel cellular architecturesby transitioning from conventional systems to the progressive principles of Open RAN. This promises to make 6G networks more agile, cost-effective, energy-efficient, and resilient. It opens up a plethora of novel use cases, ranging from ubiquitous support for autonomous devices to cost-effective expansions in regions previously underserved. The principles of Open RAN encompass: (i) a disaggregated architecture with modular and standardized interfaces; (ii) cloudification, programmability and orchestration; and (iii) AI-enabled data-centric closed-loop control and automation. We first discuss the transformative role Open RAN principles have played in the 5G era. Then, we adopt a system-level approach and describe how these Open RAN principles will support 6G RAN and architecture innovation. We qualitatively discuss potential performance gains that Open RAN principles yield for specific 6G use cases. For each principle, we outline the steps that research, development and standardization communities ought to take to make Open RAN principles central to next-generation cellular network designs.

Obtaining access to exclusive spectrum, cell sites, Radio Access Network (RAN) equipment, and edge infrastructure imposes major capital expenses to mobile network operators. A neutral host infrastructure, by which a third-party company provides RAN services to mobile operators through network virtualization and slicing techniques, is seen as a promising solution to decrease these costs. Currently, however, neutral host providers lack automated and virtualized pipelines for onboarding new tenants and to provide elastic and on-demand allocation of resources matching operators' requirements. To address this gap, this paper presents NeutRAN, a zero-touch framework based on the O-RAN architecture to support applications on neutral hosts and automatic operator onboarding. NeutRAN builds upon two key components: (i) an optimization engine to guarantee coverage and to meet quality of service requirements while accounting for the limited amount of shared spectrum and RAN nodes, and (ii) a fully virtualized and automated infrastructure that converts the output of the optimization engine into deployable micro-services to be executed at RAN nodes and cell sites. NeutRAN was prototyped on an OpenShift cluster and on a programmable testbed with 4 base stations and 10 users from 3 different tenants. We evaluate its benefits, comparing it to a traditional license based RAN where each tenant has dedicated physical and spectrum resources. We show that NeutRAN can deploy a fully operational neutral host-based cellular network in around 10 seconds. Experimental results× and the per-user average throughput by 1.73× in networks with shared spectrum blocks of 30 MHz. NeutRAN provides a 1.77× cumulative throughput gain even when it can only operate on a shared spectrum block of 10 MHz (one third of the spectrum used in license-based RANs).

The next generation of cellular networks will be characterized by softwarized, open, and disaggregated architectures exposing analytics and control knobs to enable network intelligence via innovative data-driven algorithms. How to practically realize this vision, however, is largely an open problem. Specifically, for a given intent, it is still unclear how to select which data-driven models should be deployed and where, which parameters to control, and how to feed them appropriate inputs. In this paper, we take a decisive step forward by presenting OrchestRAN, a network intelligence orchestration framework for next generation systems that embraces and builds upon the Open Radio Access Network (RAN) paradigm to provide a practical solution to these challenges. OrchestRAN has been designed to execute in the non-Real-time (RT) RAN Intelligent Controller (RIC) as an rApp and allows Network Operators (NOs) to specify high-level control/inference objectives (i.e., adapt scheduling, and forecast capacity in near-RT, e.g., for a set of base stations in Downtown New York). OrchestRAN automatically computes the optimal set of data-driven algorithms and their execution location (e.g., in the cloud, or at the edge) to achieve intents specified by the NOs while meeting the desired timing requirements and avoiding conflicts between different data-driven algorithms controlling the same parameters set. We show that the intelligence orchestration problem in Open RAN is NP-hard. To support real-world applications, we also propose three complexity reduction techniques to obtain low-complexity solutions that, when combined, can compute a solution in 0.1 s for large network instances. We prototype OrchestRAN and test it at scale on Colosseum, the world's largest wireless network emulator with hardware in the loop. Our experimental results on a network with 7 base stations and 42 users demonstrate that OrchestRAN is able to instantiate data-driven services on demand with minimal control overhead and latency.

The next generation of cellular networks will be characterized by openness, intelligence, virtualization, and distributed computing. The Open Radio Access Network (Open RAN) framework represents a significant leap toward realizing these ideals, with prototype deployments taking place in both academic and industrial domains. While it holds the potential to disrupt the established vendor lock-ins, Open RAN's disaggregated nature raises critical security concerns. Safeguarding data and securing interfaces must be integral to Open RAN's design, demanding meticulous analysis of cost/benefit tradeoffs. In this paper, we embark on the first comprehensive investigation into the impact of encryption on two pivotal Open RAN interfaces: the E2 interface, connecting the base station with a near-real-time RAN Intelligent Controller, and the Open Fronthaul, connecting the Radio Unit to the Distributed Unit. Our study leverages a full-stack O-RAN ALLIANCE compliant implementation within the Colosseum network emulator and a production-ready Open RAN and 5G-compliant private cellular network. This research contributes quantitative insights into the latency introduced and throughput reduction stemming from using various encryption protocols. Furthermore, we present four fundamental principles for constructing security by design within Open RAN systems, offering a roadmap for navigating the intricate landscape of Open RAN security.

5G and beyond mobile networks will support heterogeneous use cases at an unprecedented scale, thus demanding automated control and optimization of network functionalities customized to the needs of individual users. Such fine-grained control of the Radio Access Network (RAN) is not possible with the current cellular architecture. To fill this gap, the Open RAN paradigm and its specification introduce an “open” architecture with abstractions that enable closed-loop control and provide data-driven, and intelligent optimization of the RAN at the user-level. This is obtained through custom RAN control applications (i.e., xApps) deployed on near-real-time RAN Intelligent Controller (near-RT RIC) at the edge of the network. Despite these premises, as of today the research community lacks a sandbox to build data-driven xApps, and create large-scale datasets for effective Artificial Intelligence (AI) training. In this paper, we address this by introducingns-O-RAN, a software framework that integrates a real-world, production-grade near-RT RIC with a 3GPP-based simulated environment on ns-3, enabling at the same time the development of xApps, automated large-scale data collection and testing of Deep Reinforcement Learning (DRL)-driven control policies for the optimization at the user-level. In addition, we propose the first user-specific O-RAN Traffic Steering (TS) intelligent handover framework. It uses Random Ensemble Mixture (REM), a Conservative$Q$-learning (CQL) algorithm, combined with a state-of-the-art Convolutional Neural Network (CNN) architecture, to optimally assign a serving base station to each user in the network. Our TS xApp, trained with more than 40 million data points collected by ns-O-RAN, runs on the near-RT RIC and controls the ns-O-RAN base stations. We evaluate the performance on a large-scale deployment with up to 126 users with 8 base stations, showing that the xApp-based handover improves throughput and spectral efficiency by an average of 50% over traditional handover heuristics, with less mobility overhead.

Wireless network emulators are being increasingly used for developing and evaluating new solutions for Next Generation (NextG) wireless networks. However, the reliability of the solutions tested on emulation platforms heavily depends on the precision of the emulation process, model design, and parameter settings. To address, obviate, or minimize the impact of errors of emulation models, in this work, we apply the concept of Digital Twin (DT) to large-scale wireless systems. Specifically, we demonstrate the use of Colosseum, the world?s largest wireless network emulator with hardware-in-the-loop, as a DT for NextG experimental wireless research at scale. As proof of concept, we leverage the Channel emulation scenario generator and Sounder Toolchain (CaST) to create the DT of a publicly available over-the-air indoor testbed for sub-6 GHz research, namely, Arena. Then, we validate the Colosseum DT through experimental campaigns on emulated wireless environments, including scenarios concerning cellular networks and jamming of Wi-Fi nodes, on both the real and digital systems. Our experiments show that the DT is able to provide a faithful representation of the real-world setup, obtaining an average similarity of up to 0.987 in throughput and 0.982 in Signal to Interference plus Noise Ratio (SINR).

Future wireless networks and sensing systems will benefit from access to large chunks of spectrum above 100 GHz, to achieve terabit-per-second data rates in 6th Generation (6G) cellular systems and improve accuracy and reach of Earth exploration and sensing and radio astronomy applications. These are extremely sensitive to interference from artificial signals, thus the spectrum above 100 GHz features several bands which are protected from active transmissions under current spectrum regulations. To provide more agile access to the spectrum for both services, active and passive users will have to coexist without harming passive sensing operations. In this paper, we provide the first, fundamental analysis of Radio Frequency Interference (RFI) that large-scale terrestrial deployments introduce in different satellite sensing systems now orbiting the Earth. We develop a geometry-based analysis and extend it into a data-driven model which accounts for realistic propagation, building obstruction, ground reflection, for network topology with up to 105nodes in more than 85 km2. We show that the presence of harmful RFI depends on several factors, including network load, density and topology, satellite orientation, and building density. The results and methodology provide the foundation for the development of coexistence solutions and spectrum policy towards 6G.

Energy consumption represents a major part of the operating expenses of mobile network operators. With the densification foreseen with 5G and beyond, energy optimization has become a problem of crucial importance. While energy optimization is widely studied in the literature, there are limited insights and algorithms for energy-saving techniques for Integrated Access and Backhaul (IAB), a self-backhauling architecture that ease deployment of dense cellular networks reducing the number of fiber drops. This paper proposes a novel optimization model for dynamic joint routing and energy optimization in IAB networks. We leverage the closed-loop control framework introduced by the Open Radio Access Network (O-RAN) architecture to minimize the number of active IAB nodes while maintaining a minimum capacity per User Equipment (UE). The proposed approach formulates the problem as a binary nonlinear program, which is transformed into an equivalent binary linear program and solved using the Gurobi solver. The approach is evaluated on a scenario built upon open data of two months of traffic collected by network operators in the city of Milan, Italy. Results show that the proposed optimization model reduces the RAN energy consumption by 47%, while guaranteeing a minimum capacity for each UE.

The highly heterogeneous ecosystem of Next Generation (NextG) wireless communication systems calls for novel networking paradigms where functionalities and operations can be dynamically and optimally reconfigured in real time to adapt to changing traffic conditions and satisfy stringent and diverse Quality of Service (QoS) demands. Open Radio Access Network (RAN) technologies, and specifically those being standardized by the O-RAN Alliance, make it possible to integrate network intelligence into the once monolithic RAN via intelligent applications, namely, xApps and rApps. These applications enable flexible control of the network resources and functionalities, network management, and orchestration through data-driven control loops. Despite recent work demonstrating the effectiveness of Deep Reinforcement Learning (DRL) in controlling O-RAN systems, how to design these solutions in a way that does not create conflicts and unfair resource allocation policies is still an open challenge. In this paper, we perform a comparative analysis where we dissect the impact of different DRL-based xApp designs on network performance. Specifically, we benchmark 12 different xApps that embed DRL agents trained using different reward functions, with different action spaces and with the ability to hierarchically control different network parameters. We prototype and evaluate these xApps on Colosseum, the world's largest O-RAN-compliant wireless network emulator with hardware-in-the-loop. We share the lessons learned and discuss our experimental results, which demonstrate how certain design choices deliver the highest performance while others might result in a competitive behavior between different classes of traffic with similar objectives.

Jamming attacks have plagued wireless communication systems and will continue to do so going forward with technological advances. These attacks fall under the category of Electronic Warfare (EW), a continuously growing area in both attack and defense of the electromagnetic spectrum, with one subcategory being electronic attacks (EA). Jamming attacks fall under this specific subcategory of EW as they comprise adversarial signals that attempt to disrupt, deny, degrade, destroy, or deceive legitimate signals in the electromagnetic spectrum. While jamming is not going away, recent research advances have started to get the upper hand against these attacks by leveraging new methods and techniques, such as machine learning. However, testing such jamming solutions on a wide and realistic scale is a daunting task due to strict regulations on spectrum emissions. In this paper, we introduce eSWORD (emulation (of) Signal Warfare On Radio-frequency Devices), the first large-scale framework that allows users to safely conduct real-time and controlled jamming experiments with hardware-in-the-loop. This is done by integrating METEOR, an electronic warfare (EW) threat-emulating software developed by the MITRE Corporation, into the Colosseum wireless network emulator that enables large-scale experiments with up to 49 software-defined radio nodes. We compare the performance of eSWORD with that of real-world jamming systems by using an over-the-air wireless testbed (considering safe measures when conducting experiments). Our experimental results demonstrate that eSWORD achieves up to 98% accuracy in following throughput, signal-to-interference-plus-noise ratio, and link status patterns when compared to real-world jamming experiments, testifying to the high accuracy of the emulated eSWORD setup.

millimeter wave (mmWave) and sub-terahertz (THz) communications have the potential of increasing mobile network throughput drastically. However, the challenging propagation conditions experienced at mmWave and beyond frequencies can potentially limit the range of the wireless link down to a few meters, compared to up to kilometers for sub-6GHz links. Thus, increasing the density of base station deployments is required to achieve sufficient coverage in the Radio Access Network (RAN). To such end, 3rd Generation Partnership Project (3GPP) introduced wireless backhauled base stations with Integrated Access and Backhaul (IAB), a key technology to achieve dense networks while preventing the need for costly fiber deployments. In this paper, we introduce SeBaSi, a system-level simulator for IAB networks, and demonstrate its functionality by simulating IAB deployments in Manhattan, New York City and Padova. Finally, we show how SeBaSi can represent a useful tool for the performance evaluation of self-backhauled cellular networks, thanks to its high level of network abstraction, coupled with its open and customizable design, which allows users to extend it to support novel technologies such as Reconfigurable Intelligent Surfaces (RISs).

The electromagnetic spectrum plays a fundamental role in the development of the digital society. It enables wireless communications (either between humans or machines) and sensing (for example, for Earth exploration, radio astronomy, imaging, and radars). While each of these uses benefits from a larger bandwidth, the spectrum is a finite resource. This introduces competing interests among the different stakeholders of the spectrum, which have led—so far—to rigid policies and spectrum allocations. Recently, the spectrum crunch in the sub-6-GHz bands has prompted communication technologies to move to higher carrier frequencies, where future sixth-generation (6G) wireless networks can exploit theoretically very large bandwidths. However, the spectrum above 100 GHz features several narrow, yet numerous subbands that are exclusively allocated for passive sensing applications, e.g., for climate and weather monitoring. This prevents the allocation of large contiguous bands to active users of the spectrum, either being communications (which need tens of gigahertz of bandwidth to target terabit-per-second links) or radars. This article explores how spectrum policy and spectrum technologies can evolve to enablesharingamong different stakeholders in the above 100-GHz spectrum, without introducing harmful interference or disrupting either security applications or fundamental science exploration. This portion of the spectrum presents new challenges and opportunities for the design of spectrum sharing schemes, including higher spreading and absorption losses, extremely directional antenna technologies, and ultrahigh data-rate communications, among others. This article provides a tutorial on current regulations above 100 GHz and highlights how sharing is central to allowing each stakeholder to make the most out of this spectrum. It then defines—through detailed simulations based on standard International Telecommunications Union (ITU) channel and antenna models—scenarios in which active users may introduce harmful interference to passive sensing. Based on this evaluation, it reviews a number of promising techniques that can enable active/passive sharing above 100 GHz. The critical review and tutorial on policy and technologies of this article have the potential to kickstart future research and regulations that promote safe coexistence between active and passive users above 100 GHz, further benefiting the development of digital technologies and scientific exploration.

Cellular networks are undergoing a radical transformation toward disaggregated, fully virtualized, and programmable architectures with increasingly heterogeneous devices and applications. In this context, the open architecture standardized by the O-RAN Alliance enables algorithmic and hardware-independent Radio Access Network (RAN) adaptation through closed-loop control. O-RAN introduces Machine Learning (ML)-based network control and automation algorithms as so-calledxAppsrunning on RAN Intelligent Controllers . However, in spite of the new opportunities brought about by the Open RAN, advances in ML-based network automation have been slow, mainly because of the unavailability of large-scale datasets and experimental testing infrastructure. This slows down the development and widespread adoption of Deep Reinforcement Learning (DRL) agents on real networks, delaying progress in intelligent and autonomous RAN control. In this paper, we address these challenges by discussing insights and practical solutions for the design, training, testing, and experimental evaluation of DRL-based closed-loop control in the Open RAN. To this end, we introduce ColO-RAN, the first publicly-available large-scale O-RAN testing framework with software-defined radios-in-the-loop. Building on the scale and computational capabilities of the Colosseum wireless network emulator, ColO-RAN enables ML research at scale using O-RAN components, programmable base stations, and a “wireless data factory.” Specifically, we design and develop three exemplary xApps for DRL-based control of RAN slicing, scheduling and online model training, and evaluate their performance on a cellular network with 7 softwarized base stations and 42 users. Finally, we showcase the portability of ColO-RAN to different platforms by deploying it on Arena, an indoor programmable testbed. The lessons learned from the ColO-RAN implementation and the extensive results from our first-of-its-kind large-scale evaluation highlight the importance of experimental frameworks for the development of end-to-end intelligent RAN control pipelines, from data analysis to the design and testing of DRL agents. They also provide insights on the challenges and benefits of DRL-based adaptive control, and on the trade-offs associated to training on a live RAN. ColO-RAN and the collected large-scale dataset are publicly available to the research community.

The next generation of cellular networks will be characterized by softwarized, open, and disaggregated architectures exposing analytics and control knobs to enable network intelligence via innovative data-driven algorithms. How to practically realize this vision, however, is largely an open problem. For a given network optimization/automation objective, it is currently unknown how to select which data-driven models should be deployed and where, which parameters to control, and how to feed them appropriate inputs. In this paper, we take a decisive step forward by presenting and prototyping OrchestRAN, a novel orchestration framework for next generation systems that embraces and builds upon the Open Radio Access Network (RAN) paradigm to provide a practical solution to these challenges. OrchestRAN has been designed to execute in the non-Real-time (RT) RAN Intelligent Controller (RIC) and allows Network Operators (NOs) to specify high-level control/inference objectives (i.e., adapt scheduling, and forecast capacity in near-RT, e.g., for a set of base stations in Downtown New York). OrchestRAN automatically computes the optimal set of data-driven algorithms and their execution location (e.g., in the cloud, or at the edge) to achieve intents specified by the NOs while meeting the desired timing requirements and avoiding conflicts between different data-driven algorithms controlling the same parameters set. We show that the intelligence orchestration problem in Open RAN is NP-hard, and design low-complexity solutions to support real-world applications. We prototype OrchestRAN and test it at scale on Colosseum, the world’s largest wireless network emulator with hardware in the loop. Our experimental results on a network with 7 base stations and 42 users demonstrate that OrchestRAN is able to instantiate data-driven services on demand with minimal control overhead and latency.

Millimeter wave (mmWave) communications have the potential to dramatically increase the throughput of 5G-and-beyond wireless networks. However, the challenging propagation conditions typical of higher frequencies require expensive base station densification to guarantee reliable Radio Access Networks (RANs). Integrated Access and Backhaul (IAB), a solution where wireless access and backhaul use the same waveform, spectrum, and protocol stack, has been proposed and standardized as a highly effective means of decreasing these costs. While IAB is considered a key enabler for high-frequency RANs, experimental research in this context is hampered by the lack of accessible testing platforms. In this demonstration, we showcase IABEST, a large-scale end-to-end IAB testbed based on open-source software and compatible with off-the-shelf hardware. We show how to deploy IABEST capabilities at scale on Colosseum, a publicly available massive channel emulator. Finally, we show how IABEST can support researchers in data collection and algorithm testing from the highest levels of network abstraction down to scheduling decisions.

Open Radio Access Network (RAN) architectures will enable interoperability, openness, and programmatic data-driven control in next generation cellular networks. However, developing scalable and efficient data-driven algorithms that can generalize across diverse deployments and optimize RAN performance is a complex feat, largely unaddressed as of today. Specifically, the ability to design efficient data-driven algorithms for network control and inference requires at a minimum (i) access to large, rich, and heterogeneous datasets; (ii) testing at scale in controlled but realistic environments, and (iii) software pipelines to automate data collection and experimentation. To facilitate these tasks, in this paper we propose OpenRAN Gym, a practical, open, experimental toolbox that provides end-to-end design, data collection, and testing workflows for intelligent control in next generation Open RAN systems. OpenRAN Gym builds on software frameworks for the collection of large datasets and RAN control, and on a lightweight O-RAN environment for experimental wireless platforms. We first provide an overview of OpenRAN Gym and then describe how it can be used to collect data, to design and train artificial intelligence and machine learning-based O-RAN applications (xApps), and to test xApps on a softwarized RAN. Then, we provide an example of two xApps designed with OpenRAN Gym and used to control a large-scale network with 7 base stations and 42 users deployed on the Colosseum testbed. OpenRAN Gym and its software components are open source and publicly-available to the research community.

This paper studies the cross-layer challenges and performance of Hybrid Beamforming (HBF) and Multi-User Multiple-Input Multiple-Output (MU-MIMO) in 5G millimeter wave (mmWave) cellular networks with full-stack TCP/IP traffic and MAC scheduling. While previous research on HBF and MU-MIMO has focused on link-level analysis of full-buffer transmissions, this work reveals the interplay between HBF techniques and the higher layers of the protocol stack. To this aim, prior work on the full-stack evaluation of mmWave cellular networks has been extended by including the modeling of MU-MIMO and HBF. Our results reveal novel relations between the networking layers and the HBF MU-MIMO performance at the physical layer. Particularly, throughput can be increased in 5G networks by means of Space Division Multiple Access (SDMA). However, in order to achieve such benefits it is necessary to take into account certain trade-offs and the implementation complexity of a full-stack HBF solution.

The next generations of mobile networks will be deployed as ultra-dense networks, to match the demand for increased capacity and the challenges that communications in the higher portion of the spectrum (i.e., the mmWave band) introduce. Ultra-dense networks, however, require pervasive, high-capacity backhaul solutions, and deploying fiber optic to all base stations is generally considered to be too expensive for network operators. The 3gpp has thus introduced iab, a wireless backhaul solution in which the access and backhaul links share the same hardware, protocol stack, and also spectrum. The multiplexing of different links in the same frequency bands, however, introduces interference and capacity sharing issues, thus calling for the introduction of advanced scheduling and coordination schemes. This paper proposes a semi-centralized resource allocation scheme for iab networks, designed to be flexible, with low complexity, and compliant with the 3gpp iab specifications. We develop a version of the mwm problem that can be applied on a spanning tree that represents the iab network and whose complexity is linear in the number of iab-nodes. The proposed solution is compared with state-of-the-art distributed approaches through end-to-end, full-stack system-level simulations with a 3gpp-compliant channel model, protocol stack, and a diverse set of user applications. The results show that our scheme can increase the throughput of cell-edge users up to 3 times, while decreasing the overall network congestion with an end-to-end delay reduction of up to 25 times.

Practical experimentation and prototyping are core steps in the development of any wireless technology. Often times, however, this crucial step is confined to small laboratory setups that do not capture the scale of commercial deployments and do not ensure result reproducibility and replicability, or it is skipped altogether for lack of suitable hardware and testing facilities. Recent years have seen the development of publicly-available testing platforms for wireless experimentation at scale. Examples include the testbeds of the PAWR program and Colosseum, the world's largest wireless network emulator. With its 256 software-defined radios, 24 racks of powerful compute servers and first-of-its-kind channel emulator, Colosseum allows users to prototype wireless solutions at scale, and guarantees reproducibility and replicability of results. This tutorial provides an overview of the Colosseum platform. We describe the architecture and components of the testbed as a whole, and we then showcase how to run practical experiments in diverse scenarios with heterogeneous wireless technologies (e.g., Wi-Fi and cellular). We also emphasize how Colosseum experiments can be ported to different testing platforms, facilitating full-cycle experimental wireless research: design, experiments and tests at scale in a fully controlled and observable environment and testing in the field. The tutorial concludes with considerations on the flexible future of Colosseum, focusing on its planned extension to emulate larger scenarios and channels at higher frequency bands (mmWave).

Highly directional millimeter wave (mmWave) radios need to perform beam management to establish and maintain reliable links. To achieve this objective, existing solutions mostly rely on explicit coordination between the transmitter (TX) and the receiver (RX), which significantly reduces the airtime available for communication and further complicates the network protocol design. This paper advances the state of the art by presenting DeepBeam, a framework for beam management that does not require pilot sequences from the TX, nor any beam sweeping or synchronization from the RX. This is achieved by inferring (i) the Angle of Arrival (AoA) of the beam and (ii) the actual beam being used by the transmitter through waveform-level deep learning on ongoing transmissions between the TX to other receivers. In this way, the RX can associate Signal-to-Noise-Ratio (SNR) levels to beams without explicit coordination with the TX. This is possible because different beam patterns introduce different "impairments" to the waveform, which can be subsequently learned by a convolutional neural network (CNN). To demonstrate the generality of DeepBeam, we conduct an extensive experimental data collection campaign where we collect more than 4 TB of mmWave waveforms with (i) 4 phased array antennas at 60.48 GHz, (ii) 2 codebooks containing 24 one-dimensional beams and 12 two-dimensional beams; (iii) 3 receiver gains; (iv) 3 different AoAs; (v) multiple TX and RX locations. Moreover, we collect waveform data with two custom-designed mmWave software-defined radios with fully-digital beamforming architectures at 58 GHz. We also implement our learning models in FPGA to evaluate latency performance. Results show that DeepBeam (i) achieves accuracy of up to 96%, 84% and 77% with a 5-beam, 12-beam and 24-beam codebook, respectively; (ii) reduces latency by up to 7x with respect to the 5G NR initial beam sweep in a default configuration and with a 12-beam codebook. The waveform dataset and the full DeepBeam code repository are publicly available.

The fifth generation of cellular networks (5G) will rely on edge cloud deployments to satisfy the ultra-low latency demand of future applications. In this paper, we argue that such deployments can also be used to enable advanced data-driven and Machine Learning (ML) applications in mobile networks. We propose an edge-controller-based architecture for cellular networks and evaluate its performance with real data from hundreds of base stations of a major U.S. operator. In this regard, we will provide insights on how to dynamically cluster and associate base stations and controllers, according to the global mobility patterns of the users. Then, we will describe how the controllers can be used to run ML algorithms to predict the number of users in each base station, and a use case in which these predictions are exploited by a higher-layer application to route vehicular traffic according to network Key Performance Indicators (KPIs). We show that the prediction accuracy improves when based on machine learning algorithms that rely on the controllers’ view and, consequently, on the spatial correlation introduced by the user mobility, with respect to when the prediction is based only on the local data of each single base station.

The millimeter wave (mmWave) band will provide multi-gigabits-per-second connectivity in the radio access of future wireless systems. The high propagation loss in this portion of the spectrum calls for the deployment of large antenna arrays to compensate for the loss through high directional gain, thus introducing the need for a spatial dimension in the channel model to accurately represent the performance of a mmWave network. In this perspective, ray tracing can characterize the channel in terms of Multi Path Components (MPCs) to provide a highly accurate model, at the price of extreme computational complexity (e.g., for processing detailed environment information about the propagation), which may limit the scalability of the simulations. In this paper, we present possible simplifications to improve the trade-off between accuracy and complexity in ray-tracing simulations at mmWaves by reducing the total number of MPCs. The effect of such simplifications is evaluated from a full-stack perspective through end-to-end simulations, testing different configuration parameters, propagation scenarios, and higher-layer protocol implementations. We then provide guidelines on the optimal degree of simplification, for which it is possible to reduce the complexity of simulations with a minimal reduction in accuracy for different deployment scenarios.

5G and beyond networks will use, for the first time ever, the millimeter wave (mmWave) spectrum for mobile communications. Accurate performance evaluation is fundamental for the design of reliable mmWave networks, with accuracy rooted in the fidelity of the channel models. At mmWaves, the model must account for the spatial characteristics of propagation since networks will employ highly directional antennas to counter the much greater pathloss. In this regard, Quasi-Deterministic (QD) models are highly accurate channel models, which characterize the propagation in terms of clusters of multipath components, given by a reflected ray and multiple diffuse components of any given Computer Aided Design (CAD) scenario. This paper introduces a detailed mathematical formulation for QD models at mmWaves, that can be used as a reference for their implementation and development. Moreover, it compares channel instances obtained with an open source National Institute of Standards and Technology (NIST) QD model implementation against real measurements at 60 GHz, substantiating the accuracy of the model. Results show that, when comparing the proposed model and deterministic rays alone with a measurement campaign, the Kolmogorov-Smirnov (KS) test of the QD model improves by up to 0.537.

3GPP NR V2X represents the new 3GPP standard for next-generation vehicular systems which, among other innovations, supports vehicle-to-vehicle (V2V) operations in the millimeter wave (mmWave) spectrum to address the communication requirements of future intelligent automotive networks. While mmWaves will enable massive data rates and low latency, the propagation characteristics at very high frequencies become very challenging, thereby calling for accurate performance evaluations as a means to properly assess the performance of such systems. Along these lines, in this paper we use MilliCar, the new ns-3 module based on the latest NR V2X specifications, to provide an end-to-end performance evaluation of mmWave V2V networks. We investigate the impact of different propagation scenarios and system parameters, including the inter-vehicle distance, the adopted frame numerology, and the modulation and coding scheme, and provide guidelines towards the most promising V2V deployment configurations.

Recent developments in robotics and communication technologies are paving the way towards the use of Unmanned Aerial Vehicles (UAVs) to provide ubiquitous connectivity in public safety scenarios or in remote areas. The millimeter wave (mmWave) spectrum, in particular, has gained momentum since the huge amount of free spectrum available at such frequencies can yield very high data rates. In the UAV context, however, mmWave operations may incur severe signal attenuation and sensitivity to blockage, especially considering the very long transmission distances involved. In this paper, we present a tractable stochastic analysis to characterize the coverage probability of UAV stations operating at mmWaves. We exemplify some of the trade-offs to be considered when designing solutions for mmWave scenarios, such as the beamforming configuration, and the UAV altitude and deployment.

Network slicing of multi-access edge computing (MEC) resources is expected to be a pivotal technology to the success of 5G networks and beyond. The key challenge that sets MEC slicing apart from traditional resource allocation problems is that edge nodes depend on tightly-intertwined and strictly-constrained networking, computation and storage resources. Therefore, instantiating MEC slices without incurring in resource over-provisioning is hardly addressable with existing slicing algorithms. The main innovation of this paper is Sl-EDGE, a unified MEC slicing framework that allows network operators to instantiate heterogeneous slice services (e.g., video streaming, caching, 5G network access) on edge devices. We first describe the architecture and operations of Sl-EDGE, and then show that the problem of optimally instantiating joint network-MEC slices is NP-hard. Thus, we propose near-optimal algorithms that leverage key similarities among edge nodes and resource virtualization to instantiate heterogeneous slices 7.5x faster and within 25% of the optimum. We first assess the performance of our algorithms through extensive numerical analysis, and show that Sl-EDGE instantiates slices 6x more efficiently then state-of-the-art MEC slicing algorithms. Furthermore, experimental results on a 24-radio testbed with 9 smartphones demonstrate that Sl-EDGE provides simultaneously highly-efficient slicing of joint LTE connectivity, video streaming over WiFi, and ffmpeg video transcoding.

The recently proposed QUIC protocol has been widely adopted at the transport layer of the Internet over the past few years. Its design goals are to overcome some of TCP's performance issues, while maintaining the same properties and basic application interface. Two of the main drivers of its success were the integration with the innovative Bottleneck Bandwidth and Round-trip propagation time (BBR) congestion control mechanism, and the possibility of multiplexing different application streams over the same connection. Given the strong interest in QUIC shown by the ns-3 community, we present an extension to the native QUIC module that allows researchers to fully explore the potential of these two features. In this work, we present the integration of BBR into the QUIC module and the implementation of the necessary pacing and rate sampling mechanisms, along with a novel scheduling interface, with three different scheduling flavors. The new features are tested to verify that they perform as expected, using a web traffic model from the literature.

In the last decades, technological developments in wireless communications have been coupled with an increasing demand of mobile services. From real-time applications with focus on entertainment (e.g., high quality video streaming, virtual and augmented reality), to industrial automation and security scenarios (e.g., video surveillance), the requirements are constantly pushing the limits of communication hardware and software. Communications at millimeter wave frequencies could provide very high throughput and low latency, thanks to the large chunks of available bandwidth, but operating at such high frequencies introduces new challenges in terms of channel reliability, which eventually impact the overall end-to-end performance. In this paper, we introduce a proxy that coordinates the physical and transport layers to seamlessly adapt to the variable channel conditions and avoid performance degradation (i.e., latency spikes or low throughput). We study the performance of the proposed solution using a simulated IEEE 802.11ad-compliant network, with the integration of input traces generated from measurements from real devices, and show that the proposed proxy-based mechanism reduces the latency by up to 50% with respect to TCP CUBIC on a 60 GHz link.

Communication and video capture from unmanned aerial vehicles (UAVs) offer significant potential for assisting first responders in remote public safety settings. In such uses, millimeter wave (mmWave) wireless links can provide high throughput and low latency connectivity between the UAV and a remote command center. However, maintaining reliable aerial communication in the mmWave bands is challenging due to the need to support high speed beam tracking and overcome blockage. This paper provides a simulation study aimed at assessing the feasibility of public safety UAV connectivity through a 5G link at 28 GHz. Real flight motion traces are captured during maneuvers similar to those expected in public safety settings. The motions traces are then incorporated into a detailed mmWave network simulator that models the channel, blockage, beamforming and full 3GPP protocol stack. We show that 5G mmWave communications can deliver throughput up to 1 Gbps with consistent sub ms latency when the base station is located near the mission area, enabling remote offloading of the UAV control and perception algorithms.

The Internet of Things (IoT) is rapidly spreading, reaching a multitude of different domains, including personal health care, environmental monitoring, home automation, smart mobility, and Industry 4.0. As a consequence, more and more IoT devices are being deployed in a variety of public and private environments, progressively becoming common objects of everyday life. It is hence apparent that, in such a scenario, cybersecurity becomes critical to avoid threats like leakage of sensible information, denial of service (DoS) attacks, unauthorized network access, and so on. Unfortunately, many low-end IoT commercial products do not usually support strong security mechanisms, and can hence be target of-or even means for-a number of security attacks. The aim of this article is to provide a broad overview of the security risks in the IoT sector and to discuss some possible counteractions. To this end, after a general introduction to security in the IoT domain, we discuss the specific security mechanisms adopted by the most popular IoT communication protocols. Then, we report and analyze some of the attacks against real IoT devices reported in the literature, in order to point out the current security weaknesses of commercial IoT solutions and remark the importance of considering security as an integral part in the design of IoT systems. We conclude this article with a reasoned comparison of the considered IoT technologies with respect to a set of qualifying security attributes, namely integrity, anonymity, confidentiality, privacy, access control, authentication, authorization, resilience, self organization.

Communication at mmWave frequencies is a promising enabler for ultra high data rates in the next generation of mobile cellular networks (5G). The harsh propagation environment at such high frequencies, however, demands a dense base station deployment, which may be infeasible because of the unavailability of fiber drops to provide wired backhauling. To address this issue, 3GPP has recently proposed a Study Item on Integrated Access and Backhaul (IAB), i.e., on the possibility of providing wireless backhaul together with radio access to the mobile terminals. The design of IAB base stations and networks introduces new research challenges, especially when considering the demanding conditions at mmWave frequencies. In this paper we study different path selection techniques, using a distributed approach, and investigate their performance in terms of hop count and bottleneck Signal-to-Noise-Ratio (SNR) using a channel model based on real measurements. We show that there exist solutions that decrease the number of hops without affecting the bottleneck SNR, and provide guidelines on the design of IAB path selection policies.

The next generation of cellular networks (5G) will exploit the mmWave spectrum to increase the available capacity. Communication at such high frequencies, however, suffers from high path loss and blockage, therefore directional transmissions using antenna arrays and dense deployments are needed. Thus, when evaluating the performance of mmWave mobile networks, it is necessary to accurately model the complex channel, the directionality of the transmission, but also the interplay that these elements can have with the whole protocol stack, both in the radio access and in the higher layers. In this paper, we improve the channel model abstraction of the mmWave module for ns-3, by introducing the support of a more realistic antenna array model, compliant with 3GPP NR requirements, and of multiple antenna arrays at the base stations and mobile handsets. We then study the end-to-end performance of a mmWave cellular network by varying the channel and antenna array configurations, and show that increasing the number of antenna arrays and, consequently, the number of sectors is beneficial for both throughput and latency.

So far, research on Smart Cities and self-organizing networking techniques for fifth-generation (5G) cellular systems has been one-sided: a Smart City relies on 5G to support massive machine-to-machine (M2M) communications, but the actual network is unaware of the information flowing through it. However, a greater synergy between the two would make the relationship mutual, since the insights provided by the massive amount of data gathered by sensors can be exploited to improve the communication performance. In this paper, we concentrate on self-organization techniques to improve handover efficiency using vehicular traffic data gathered in London. Our algorithms exploit mobility patterns between cell coverage areas and road traffic congestion levels to optimize the handover bias in heterogeneous networks and dynamically manage mobility management entity (MME) loads to reduce handover completion times.

The role of mobile devices, like smartphones or tablets, is becoming more and more important in everyday life, at the point that their unavailability due to early or unexpected battery discharge is perceived as a serious issue. Therefore, there is an urge for smart and efficient battery management algorithms that can prolong the duration of the battery charge. To this end, a reliable prediction of the battery discharging process would represent a precious tool to enable energy-efficiency optimization mechanisms. In this paper, we address this challenge by considering different machine learning techniques to provide an accurate and user-dependent prediction of the discharging time of a mobile device and, eventually, we propose a Deep Neural Network model that provides the best performance. Unlike previous solutions proposed in the literature, our method exploits space-time data from the device operating system (Android) to learn the specific battery usage pattern of the user, thus offering a customized prediction of the discharge process. We show that such model outperforms the other machine-learning methods considered in this study, and achieves much better performance than the deterministic linear fitting methods widely used in commercial devices.

The millimeter wave (mmWave) bands offer the possibility of orders of magnitude greater throughput for fifth-generation (5G) cellular systems. However, since mmWave signals are highly susceptible to blockage, channel quality on any one mmWave link can be extremely intermittent. This paper implements a novel dual connectivity protocol that enables mobile user equipment devices to maintain physical layer connections to 4G and 5G cells simultaneously. A novel uplink control signaling system combined with a local coordinator enables rapid path switching in the event of failures on any one link. This paper provides the first comprehensive end-to-end evaluation of handover mechanisms in mmWave cellular systems. The simulation framework includes detailed measurement-based channel models to realistically capture spatial dynamics of blocking events, as well as the full details of Medium Access Control, Radio Link Control, and transport protocols. Compared with conventional handover mechanisms, this paper reveals significant benefits of the proposed method under several metrics.

Several studies assert that the random access procedure of the Long Term Evolution (LTE) cellular standard may not be effective whenever a massive number of simultaneous connection attempts are performed by terminals, as may happen in a typical Internet of Things or Smart City scenario. Nevertheless, simulation studies in real deployment scenarios are missing because many system-level simulators do not implement the LTE random access procedure in detail. In this paper, we propose a patch for the LTE module of ns-3, one of the most prominent open-source network simulators, to improve the accuracy of the routine that simulates the LTE Random Access Channel (RACH). The patched version of the random access procedure is compared with the default one and the issues arising from massive simultaneous access from mobile terminals in LTE are assessed via a simulation campaign.