Fine-tuning Large Language Models (LLMs) for specialized domains is constrained by a fundamental challenge: the need for diverse, cross-organizational data conflicts with the principles of data privacy and sovereignty. While Federated Learning (FL) provides a framework for collaboration without raw data exchange, its classic centralized form introduces a single point of failure and remains vulnerable to model inversion attacks. Decentralized FL (DFL) mitigates this risk by removing the central aggregator but typically relies on inefficient, random peer-to-peer (P2P) pairings, forming a collaboration graph that is blind to agent heterogeneity and risks negative transfer. This paper introduces KNEXA-FL, a novel framework for orchestrated decentralization that resolves this trade-off. KNEXA-FL employs a non-aggregating Central Profiler/Matchmaker (CPM) that formulates P2P collaboration as a contextual bandit problem, using a LinUCB algorithm on abstract agent profiles to learn an optimal matchmaking policy. It orchestrates direct knowledge exchange between heterogeneous, PEFT-based LLM agents via secure distillation, without ever accessing the models themselves. Our comprehensive experiments on a challenging code generation task show that KNEXA-FL yields substantial gains, improving Pass@1 by approximately 50% relative to random P2P collaboration. Critically, our orchestrated approach demonstrates stable convergence, in stark contrast to a powerful centralized distillation baseline which suffers from catastrophic performance collapse. Our work establishes adaptive, learning-based orchestration as a foundational principle for building robust and effective decentralized AI ecosystems.

IP Geolocation has many applications from service tailoring and customization to security, such as fraud detection and location-based access control. Active IP geolocation, where the location of a target is verified by probing, can enhance the trustworthiness of geolocation sufficient for security applications. For example, an NMS, can verify the geographic path a packet takes against a claimed path. Numerous active geolocation solutions have been proposed and developed; however, the vast majority were not designed to mitigate against the reality of potentially malicious probes. We propose a scheme, PARL (Probe-Adversary Resistant Localization), that leverages contradictions in measurements to maintain trust scores of probes that reflect their reliability and are used to eliminate malicious measurements. Unlike the state-of-the-art, PARL does not require the geolocation target to perform probing measurements, making it suitable for general IP geolocation. We evaluate our solution via C++ simulation and demonstrate that given enough iterations, it is able to distinguish between malicious and benign probes in probe networks of up to 44% malicious probes, whereas the state of the art can be tricked into accepting false locations when more than 30% of the probes are malicious. We also demonstrate PARL using the RIPE ATLAS probe network.

Advances in networking and computing are moving society towards a cyber space, in which more aspects of our daily lives are being conducted over the Internet. This movement generates concerns regarding trust between the parties involved in these aspects. Nevertheless, trust is a broad topic and thus it is challenging to define a unified mechanism for evaluating trust in communication networks. This article focuses on presenting a general model of trust in communication networks that is flexible enough to be implemented by a wide range of use cases. The model is based on the concept of trust functions, a type of relationship used to evaluate trust. Trust functions are evaluated between two subjects, based on the action that is about to take place and the objects being affected by that action. We use this model to describe a use case of Trust Enhanced Networking and present a discussion regarding trust in communication networks and future challenges.

DDoS defence evaluation provides a way to capture the usefulness of defensive solutions to one of the most notorious Internet attacks of our computing generation. An alternative approach to evaluation offers a valuable mechanism by which different DDoS defences can be commensurably and objectively compared. Such a development would not only enable individual organizations to make better informed decisions on which defences to implement but could also aid collaborations to realize global solutions; and reveal insights into aspects requiring further investigation. We present CED3 (pronounced “Seed”), a DDoS defence evaluation framework designed to facilitate the commensurable comparison between DDoS defences in a way that captures their strengths and weaknesses. Firstly, CED3 introduces the notion of true effectiveness, which addresses the problem, identified in the literature, of previously validated defences subsequently being shown to be ineffective when evaluated under different attack conditions. CED3 leverages a structured theoretical analysis process to drive empirical data acquisition in order to enhance consistency, transparency and, ultimately, longevity of evaluation conclusions. Lastly, CED3 introduces the concept of defence maps, which applies the idea of true effectiveness to “scopes” in order to communicate the strengths and weaknesses of defences in a way that allows them to be visually compared. We demonstrate the CED3 framework by applying it to comparatively evaluate three DDoS defences. Using results obtained from extensive simulations in NS-3, we show how the strengths and weaknesses of different defences can be visually compared. We conclude by discussing the merits and limitations of CED3.

The predominant strategy for DDoS mitigation involves resource enlargement so that victim services can handle larger demands, however, with growing attack strengths, this approach alone is unsustainable. This paper proposes DiDoS (Distributed Defence of Service), a collaborative DDoS defence architecture that leverages victim feedback to build network-level sender reputations that are applied to identify and thwart attack traffic - thus alleviating the need for resource enlargement. Since attack traffic is dropped at points of contention in the Internet, (rather than rote blocking at source) DiDoS reduces the impact of false positives and enables the traversal of legitimate traffic from said devices across the Internet. Through anti-spoofing protection and preferential treatment of DiDoS-compliant devices, DiDoS offers adoption incentives that help offset the Tragedy of the Commons effect of DDoS mitigation, which commonly sees non-victim intermediary entities benefit little from DDoS defence expenditure. In this paper, the tenets and fundamentals of the architecture are described, before being analysed against the presented threat model. Simulation results, demonstrating the effectiveness of the reputation convergence of the scheme, in the use-case of a local access network, are also presented and discussed.