Recent advances in Large Language Models (LLM) and Retrieval-Augmented Generation (RAG) techniques have improved data processing in network management. However, existing RAG methods like VectorRAG and GraphRAG struggle with the complexity and implicit nature of semi-structured technical data, leading to inefficiencies in time, cost, and retrieval. This paper introduces FastRAG, a novel RAG approach for semi-structured data. FastRAG proposes chunk sampling, schema learning, and script learning to extract and structure data without submitting entire data sources to the LLM. It integrates text search with knowledge graph (KG) querying to improve accuracy. The evaluation results demonstrate that FastRAG provides accurate question answering while improving up to $90 \%$ in time and $85 \%$ in cost compared to GraphRAG.

Intent-Based Networking (IBN) aims to simplify network management by enabling users to specify high-level goals that drive automated network design and configuration. However, translating informal natural-language intents into formally correct optical network topologies remains challenging due to inherent ambiguity and lack of rigor in Large Language Models (LLMs). To address this, we propose a novel hybrid pipeline that integrates LLM-based intent parsing, formal methods, and Optical Retrieval-Augmented Generation (RAG). By enriching design decisions with domain-specific optical standards and systematically incorporating symbolic reasoning and verification techniques, our pipeline generates explainable, verifiable, and trustworthy optical network designs. This approach significantly advances IBN by ensuring reliability and correctness, essential for mission-critical networking tasks.

The rapid growth of global data traffic has exposed limitations in traditional content delivery architectures. Information-Centric Networking (ICN) addresses these challenges by leveraging in-network caching to enhance scalability, reduce latency, and improve overall performance. However, existing caching strategies either optimize single-node cache management without considering network-wide costs, or address distribution without hardware-aware cost modeling. We propose a unified, cost-aware distributed caching strategy that integrates multi-tier caching at each node with network-wide replication, guided by a comprehensive cost model including resource depreciation, bandwidth, energy, and Service Level Agreement compliance. Our approach minimizes redundant replication on the network while maximizing cache hit rates and reducing latency. Experiments show on average 19.15 %, and up to 45.19 %, cost reduction, 8.11 %, and up to 32.15 %, cache hit ratio increase, and 9.01 %, and up to 27.21 %, latency improvement over other methods, offering a cost-effective solution for next-generation ICN systems.

In the context of modern networks where cyber-attacks are increasingly complex and frequent, traditional Intrusion Detection Systems (IDS) often struggle to manage the vast volume of data and fail to detect novel attacks. Leveraging Artificial Intelligence, specifically Natural Language Processing with transformer architectures, offers a promising solution. This study applies the Bidirectional Encoder Representations from Transformers (BERT) model, enhanced by a Byte-level Byte-pair tokenizer (BBPE), to effectively identify network-based attacks within IoT systems. Experiments on three datasets-UNSW-NB15, TON-IoT, and Edge-IIoT-show that our approach substantially outperforms traditional methods in multi-class classification tasks. Notably, we achieved near-perfect classification accuracy on the Edge-IIoT dataset, with significant improvements in F1 scores and reduction in validation losses across all datasets, demonstrating the efficacy of pre-trained Large Language Models (LLMs) in network security.

As modern networks grow in complexity, ensuring their reliability and security becomes increasingly vital. Data plane analysis is a key process for verifying network behavior, but traditional data plane analysis tools face challenges in extensibility, customization, and interoperability. This paper explores the potential of implementing a data plane analysis system on a general-purpose native graph database, to create a more uniform and insightful approach to network verification and analysis. Using the graph database query language and built-in graph algorithms, we simplify the network forwarding analysis while enhancing its features. Our study offers practical insights into managing complex networks, promising more efficient and intuitive tools on the horizon.

This paper presents a network management AI assistant built with Large Language Models. It adapts at runtime to the network state and specific platform, leveraging techniques like prompt engineering, document retrieval, and Knowledge Graph integration. The AI assistant aims to simplify management tasks and is easily reproducible with available source code.

Network management relies on extensive monitoring of network state to analyse network behavior, design optimizations, plan upgrades, and conduct troubleshooting. Network monitoring collects various data from network devices through different protocols and interfaces such as NETCONF and Syslog, and from monitoring tools such as Zeek and Osquery. To unify and automate the monitoring workflow across the network, this paper identifies and discusses the data collection requirements for network management, reviews different monitoring approaches, and proposes an efficient data collection platform that addresses the requirements through an extensible and lightweight protocol. The platform design is demonstrated through an adaptive collection of data for network management based on digital twin technology.

This paper introduces a microservice-based architecture designed to enable automation of network programmability and management. Amid the complexity of today’s networks and the diversity of equipment, achieving efficient and reliable network programmability poses a significant challenge. Our architecture leverages the OpenConfig YANG models and the NETCONF protocol to simplify network configuration, automate tasks, and avoid errors. We demonstrate how our solution streamlines the collection and configuration workflows, enabling network operators to efficiently manage complex networks. The paper further presents a performance evaluation of the proposed design, which confirms its efficacy in handling complex configurations and its fault tolerance capabilities.

This paper builds upon our previous work on Network Security Traffic Analysis Platforms (NSTAP) [1], presenting an advanced framework for the real-time monitoring of network traffic and endpoint security in large-scale enterprises. We employ a fully integrated technology stack that includes Elastic Stack, ZEEK, Osquery, Kafka, and GeoLocation data to create a comprehensive security analytics solution. A significant contribution of this research is the integration of supervised machine learning models into our platform, trained specifically on the UNSW-NB15 dataset. We explored three supervised machine learning algorithms - Random Forest (RF), Decision Trees (DT), and Support Vector Machines (SVM). For SVM, we also tested a dimensionality reduction algorithm to maximize model accuracy and optimized both computation time and performance. The evaluation is based on Accuracy, False Positive Rate (FPR) and revealed that the Random Forest Classifier, in conjunction with Pearson correlation-based feature selection methods, achieved the highest accuracy of 99.32% and an error rate of 0.67%.These findings not only substantiate the robustness of our unified platform but also set the stage for future research in developing scalable, efficient, and automated security solutions tailored for large enterprises.

Memory caching is a common practice to reduce application latencies by buffering relevant data in high speed memory. When the volume of data to cache is too large or a DRAM - based solution too expensive, several technologies such as NVM or high speed SSDs could complement DRAM to form a multi-tier cache. Additionally, most existing policies focus on categorizing the data based on factors like recency and frequency, setting aside the fact that applications/customers have varying Quality-of-Service requirements. This concept is well established in Cloud environment with Service Level Agreement (SLA). In this paper, by extending the Adaptive Replacement Cache (ARC), that uses recency and frequency lists, we propose a QoS-aware Multi-tier Adaptive Replacement Cache (QM-ARC) policy with the ability to take into account data applications/customers priorities through the concept of penalty borrowed from the Cloud. QM-ARC is generic, as it can be applied whatever the number of tiers and can accommodate different penalty functions. Using synthetic and real traces, our solution improved QoS as compared to state-of-the-art work.

Real-time traffic management and control have become necessary in today's networks due to their complexity and cybersecurity risks. With the increase in Internet use, threats are more prevalent and require real-time detection and analysis to prevent network intrusions. As the number of data flow increases, the number and the types of attacks increase, which makes detecting intrusions challenging. Therefore, over the last years, many researchers have focused on different ways to detect and more importantly prevent these intrusions. In this work, we describe the design and evaluation of a network security traffic analysis platform (NSTAP) that collects, searches, and analyzes traffic data in real time in order to filter out malicious flows. Through charts, tables, histograms, and other visualization methods, we demonstrate that the platform can produce powerful and useful insights with simple time-domain analytics of large data volumes. This work is intended to be the foundation for more automation tools based on machine learning.

Providing differentiated services to meet the unique requirements of different use cases is a major goal of the fifth generation (5G) telecommunication networks and will be even more critical for future 6G systems. Fulfilling this goal requires the ability to assure quality of service (QoS) end to end (E2E), which remains a challenge. A key factor that makes E2E QoS assurance difficult in a telecommunication system is that access networks (ANs) and core networks (CNs) manage their resources autonomously. So far, few results have been available that can ensure E2E QoS over autonomously managed ANs and CNs. Existing techniques rely predominately on each subsystem to meet static local QoS budgets with no recourse in case any subsystem fails to meet its local budgets and, hence will have difficulty delivering E2E assurance. Moreover, most existing distributed optimization techniques that can be applied to assure E2E QoS over autonomous subsystems require the subsystems to exchange sensitive information such as their local decision variables. This paper presents a novel framework and a distributed algorithm that can enable ANs and CNs to autonomously "cooperate" with each other to dynamically negotiate their local QoS budgets and to collectively meet E2E QoS goals by sharing only their estimates of the global constraint functions, without disclosing their local decision variables. We prove that this new distributed algorithm converges to an optimal solution almost surely, and also present numerical results to demonstrate that the convergence occurs quickly even with measurement noise.

We study the problem of minimizing the (time) average security costs in large systems comprising many interdependent subsystems, where the state evolution is captured by a susceptible-infected-susceptible (SIS) model. The security costs reflect security investments, economic losses and recovery costs from infections and failures following successful attacks. However, unlike in existing studies, we assume that the underlying dependence graph is only weakly connected, but not necessarily strongly connected. When the dependence graph is not strongly connected, existing approaches to computing optimal security investments cannot be applied. Instead, we show that it is still possible to find a good solution by perturbing the problem and establishing necessary continuity results that then allow us to leverage the existing algorithms.

Determining an appropriate distributional model for a univariate measurement process is a common problem in science and engineering. Although a poorly chosen distributional model may suffice for measuring and assessing the uncertainty of averages, this will not be the case for tails of the distribution. In many applications (e.g., reliability), accurate assessment of the tail behavior is more critical than the average. However, distribution fitting can be an exhaustive process that takes time and requires previous knowledge of statistics as well as familiarity with several probability distributions and is, therefore, a difficult task for some analysts. As such, this paper presents an alternative methodology which is based on a combination of neural networks and statistical tests to conduct distribution fitting. First, neural networks are used to map data to a probability distribution. Then, traditional statistics are used to estimate the parameters of the distribution and conduct further assessment on the fitted model. We show that our neural networks can produce robust results and perform comparably to the traditional statistical tests based on synthetic and real-world data.

Probabilistic security metrics estimate the vulnerability of a network in terms of the likelihood of an attacker reaching the goal states (of a network) by exploiting the attack graph paths. The probability computation depends upon several assumptions regarding the possible attack scenarios. In this paper, we extend the existing security metric to model networks with intrusion detection systems and their associated uncertainties and time latencies. We consider learning capabilities of attackers as well as detection systems. Estimation of risk is obtained by using the attack paths that are undetectable owing to the latency of the detection system. Thus, we define the overall vulnerability (of a network) as a function of the time window available to an attacker for repeated exploring (via learning) and exploitation of a network, before the attack is mitigated by the detection system. Finally, we consider the realistic scenario where an attacker explores and abandons various partial paths in the attack graph before the actual exploitation. A dynamic programming formulation of the vulnerability computation methodology is proposed for this scenario. The nature of these metrics are explained using a case study showing the vulnerability spectrum from the case of zero detection latency to a no detection scenario.

We study the problem of minimizing the (time) average security costs in large networks/systems comprising many interdependent subsystems, where the state evolution is captured by a susceptible-infected-susceptible (SIS) model. The security costs reflect security investments, economic losses and recovery costs from infections and failures following successful attacks. We show that the resulting optimization problem is nonconvex and propose a suite of algorithms – two based on convex relaxations, and the other two for finding a local minimizer, based on a reduced gradient method and sequential convex programming. Also, we provide a sufficient condition under which the convex relaxations are exact and, hence, an optimal solution of the original problem can be recovered. Numerical results are provided to validate our analytical results and to demonstrate the effectiveness of the proposed algorithms.

We study the problem of minimizing the (time) average security costs in large systems comprising many interdependent subsystems, where the state evolution is captured by a susceptible-infected-susceptible (SIS) model. The security costs reflect security investments, economic losses and recovery costs from infections and failures following successful attacks. We show that the resulting optimization problem is non-convex and propose two algorithms - one for solving a convex relaxation, and the other for finding a local minimizer, based on a reduced gradient method. Also, we provide a sufficient condition under which the convex relaxation is exact and its solution coincides with that of the original problem. Numerical results are provided to validate our analytical results and to demonstrate the effectiveness of the proposed algorithms.

Enabling Named Data Networking (NDN) in realworld Internet of Things (IoT) deployments becomes essential to benefit from Information Centric Networking (ICN) features in current IoT systems. To design realistic NDN-based communication solutions for IoT, revisiting mainstream technologies such as low-power wireless standards may be the key. In this paper, we explore the NDN forwarding over IEEE 802.15.4 by modeling a broadcast-based forwarding strategy. Based on the observations, we adapt the Carrier-Sense Multiple Access (CSMA) algorithm of 802.15.4 to improve NDN wireless forwarding while reducing broadcast effects in terms of packet redundancy, round-trip time and energy consumption.

This paper investigates the efficiency of wavelength selection in an optical network when it is conducted without knowledge of wavelength utilization, and compares it to the case when switches exchange wavelength availability through a routing protocol such as OSPR. We describe a series of experiments to determine the effect of wavelength advertisement on connection blocking probability in heterogeneous networks consisting of both wavelength converter and nonconverter switches. Based on these experiments, we describe some consequences of advertising wavelength availability, and quantify when it is advantageous to advertise wavelength availability within the routing protocol.

Abstract We describe the Component Architecture for Simulating Network Objects (CASiNO) useful for the implementation of communication protocol stacks and network simulators. This framework implements a rich, modular coarse‐grained dataflow architecture, with an interface to a reactor kernel that manages the application's handlers for asynchronous I/O, real timers and custom interrupts. These features enable developers to write applications that are driven by both data flow and asynchronous event delivery, while allowing them to keep these two functionalities distinct. We provide an example program and expository comments on the program to illustrate the use of the CASiNO framework. Published in 2002 by John Wiley & Sons, Ltd.

Just a few years ago, the phrase "optical Internet" meant little more than a few WDM fibers whose wavelengths were serving as a link layer to interconnect routers via add/drop multiplexors. By comparison today, multiwavelength reconfigurable optical switches are becoming readily available, enabling for the first time, the development of large-scale high speed optical networks operating at rates in excess of 10 Gbit/s. At the core of this lightpath management problem for these switched optical networks is the challenge of developing effective mechanisms to coordinate the control planes of different optical switches. In this paper, we describe how the Multi-wavelength Optical Networking (MONET) Program is meeting this challenge today. Specifically, we describe the NRL MONET control plane and, though its implementation is not yet fully completed, provide some preliminary measurements and assessment of its effectiveness as a system for lightpath management.

The toolkit for routing in optical networks (TRON) is a freely available library developed to facilitate research experiments on OSPF-based routing protocols for optical networks. Currently, TRON supports the lightwave-OSPF routing protocol, which is our adaptation of the optical extensions to OSPF proposed in the Internet drafts of Kompella et al and Wang et al. TRON is implemented in C++ using the component architecture for simulating network objects (CASiNO). TRON software can be used in either simulation or emulation mode. In this paper, we describe lightwave-OSPF and the architecture of the TRON software.

SEAN is freely distributed, object-oriented, extensible software for research and development in host ATM signaling. SEAN includes a complete source-level release of the host native ATM protocol stack, and implements the ATM user network interface, compliant to the ITU Q.2931 specification for point-to-point calls, the ITU Q.2971 extension for point-to-multipoint calls, and the ATM Forum extension UNI-4.0 for leaf initiated join calls, SEAN provides APIs to the programmers writing application programs that require ATM signaling. Developers can easily modify and extend SEAN, using the framework library released together. This paper describes essential parts of SEAN's architecture and guides the users and protocol developers.

A queueing model with two finite-size buffers, a single constant rate server using a serving strategy based on buffer thresholds is studied. Exact relationships for buffer size, overflow probabilities, and queueing delay are obtained. The queueing model is very general, and an application in ATM switching is described. The results are presented in-graphs that are useful in selecting a threshold pair that satisfies certain constraints on delay and cell loss.>