Next-generation mobile networks, evolving from 5 G Stand-alone (5 G SA) toward 6 G, require real-time adaptability to monitor large-scale, dynamic deployments. However, traditional monitoring methods struggle with the growing volume and interdependence of Key Performance Indicators (KPIs), limiting the effectiveness of threshold-based detection. This paper introduces AnomalyTrack, a scalable, self-adaptive anomaly-detection framework that (i) details the exact implementation parameters of LOF, COF, IF-LOF, ARIMA, and SARIMA for full reproducibility; (ii) specifies its physical placement and resource footprint inside the 5 G core; and (iii) quantifies which KPIs contribute most to detection accuracy. Tested on one year of real-world data from a commercial Mobile Network Operator, AnomalyTrack processes 524019 KPI time series every 30 min, achieving 97% detection accuracy with inference latencies below $\mathbf{5 s}-\mathbf{9 6. 5 \%}$ faster than conventional monitoring. These results demonstrate a practical path toward zero-touch automation in large-scale $\mathbf{5 G}$ and forthcoming 6 G networks.

Recent advancements in Network Intrusion Detection Systems (NIDS) primarily focus on detecting intrusions at the network layer. However, most solutions identify malicious activities when the attacker is already inside the network. This study introduces an innovative approach to NIDS, utilizing the Wi-Fi Channel State Information (CSI) combined with machine learning to proactively detect threats at the physical and link layers. Unlike traditional methods, our system leverages physical layer data, significantly enhancing early detection capabilities. We evaluated the performance of classical machine learning models, including SVM, Random Forest, Decision Tree, KNN, and Naive Bayes, on 800, 000 instances across three different environments: laptops, iPhones, and Android devices. The Decision Tree algorithm emerged as the most effective, achieving an accuracy and F1-score of 99.95%. This research demonstrates that the amplitude variations of Wi-Fi signals across subcarriers during brute-force attacks are markedly distinct from benign activities, providing a robust indicator for early threat detection. To the best of our knowledge, our approach advances the state-of-the-art in NIDS by integrating data from layers 1 and 2, enabling the identification of malicious users before they associate with the target Wi-Fi network.

The use of host intrusion detection systems shows promising results in detecting APT campaigns due to the use of systems logs as source data to get more information about system environment. However, dealing with the increase of logs in time while tracking the execution context is a challenge for security analysts. Therefore, this work presents backbone extraction as a crucial preprocessing step, filtering out irrelevant logs. As the logs are modeled as provenance graphs, we discard spurious edges to detect residuals with distinctive node and edge distributions that indicate security threats. By applying our methodology to state-of-the-art benchmark datasets, we observed an increase in the performance of one-class classifiers by up to 62% on F1-score and 48% on recall in the Streamspot dataset and by up to 40% on F1-score and 33% on recall in the DARPA3 THEIA dataset. Moreover, our results indicate mitigation of the dependency explosion problem and underscore the ability of our methodology to improve the detection landscape by shrinking graph sizes without losing essential aspects to characterize attacks.

Nowadays, the growth of privacy concerns imposes new requirements on security mechanisms deployed on autonomous vehicles. Assessing users’ misbehavior in Cooperative Intelligent Transport Systems (C-ITS) is crucial to keep them safe. Notwithstanding, data is a valuable asset, and exchanging them (e.g., Basic Safety Message—BSM) over the external network exposes sensitive data and compromises the privacy of CITS participants. This paper presents a federated learning-based architecture that shares model parameters for position spoofing detection in C-ITS. Our solution consists of buffering the host’s received messages and using them as predictors for misbehavior. To this end, we derived five novel features and group messages into analysis windows varying from 2 to 23 BSMs to predict dynamic attacker behavior better. Our results demonstrate the feasibility of training the models on the onboard unit (OBU) and sharing the models’ parameters in a federated learning-based architecture. Therefore, we bring users’ privacy to the table by preserving a local dataset, balancing the tradeoff between a rapid training process and reliable misbehavior detection. Moreover, our multilayer perceptron model outperforms the detecting position spoofing attacks in state-of-the-art works.

Basic Safety Messages (BSMs) are crucial for Cooperative Intelligent Transport Systems (C-ITS) to enable signalization of events and therefore allow vehicle synchronization to avoid accidents and improve traffic flows. However, in this context, entities can maliciously alter the content of BSMs and consequently incur disastrous events to disturb the CITS, causing user prejudice. This paper presents DISMISS-BSM, a novel misbehavior detection for detecting BSM forgery, consisting of buffering the host's received messages and using them as predictors. We compared our solution with state-of-the-art approaches, and the results indicate that our features promote better performance in identifying message forgery. We derive predictors considering the received signal strength and a movement pattern disruption indicator through our feature engineering process. Moreover, we use different sliding window lengths (2, 3, 8, 13, 18, and 23) to predict the dynamic attacker behavior better. Our results outperform the state-of-the-art and indicate that decision trees were the better conformant among K-NN, DT, MLP, and LSTM, performing the training phase in about 47 seconds on average for the signal strength and displacement compliance predictors.

With the growth in connected devices and network traffic, these systems require automated and fast approaches to achieve secure operations. Hence, machine learning-based network intrusion detection has become the state-of-the-art approach to tackle uncertainties and new attacks. However, the generalization of the models when exposed to different domains and workloads remains an open issue. In this paper, we propose using federated learning (FL) with sampling methods and feature selection to improve the generalization of the trained global model when evaluated in different network contexts. We evaluate this approach to classify network flows representing benign traffic and distributed denial-of-service attacks. Our proposed approach results in an 85% improvement compared with the naive evaluation of training in one context and evaluating others. Moreover, it presented a similar performance to a statistical algorithm with the reported generalization capability on flow-based network traffic classification. Additionally, this FL-based approach brings data privacy and distributed learning capability to the table.

It is a challenging task to ensure quality in service-oriented systems deployed in cloud computing owing to the dynamicity of its environment. Many approaches have been adopted to identify and evaluate bottlenecks and problems in performance. The most common scenario consists of distributed systems that use a workload capable of enabling clients to exploit the target system in different operational conditions. However, one requirement that tends to be overlooked is to determine how the workload is executed, as software and hardware faults can lead to its mischaracterization. In this paper, a number of problems in the workload generation have been identified and summarized. A new architecture, called PEESOS-Cloud, is proposed which allows these services to be evaluated as well as to improve the ability of the workload so that it conforms with its described characteristics. Experiments in a cloud environment were conducted to show how PEESOS-Cloud works and validate its capabilities. Our experiment also showed that the mischaracterization of the workload leads to poor results, whereas an workload-aware implementation leads to a better performance evaluation.

This paper introduces an approach to the design of discrete event simulation experiments aimed at transient performance analysis. Specially in complex, multi-tier applications, the net effects of small delays introduced by buffers, IO operations, communication latency and averaged measurements, may result in significant inertia along the input-output path. In order to bring out these dynamic properties, the simulation experiment should excite the system with non-stationary workload under controlled conditions. The work discusses the dynamic properties of large-scale distributed computer systems and how these may impact delivered performance. These rationales are explored to motivate a concern-based architecture which captures the elicited requirements. The design approach is systematic formulated and illustrated by a case study on extending a well-known cloud computing simulation framework to meet the aimed features. Experimental results of ongoing work are also addressed.