Circular Image

F.A. Kuipers

info

Please Note

141 records found

Cross-Layer Observability Framework for Mobile Core Networks

Conference paper (2026) - Sehan Samarakoon, Nitinder Mohan, Fernando Kuipers
Cloud-native 5G core networks span service, orchestration, and infrastructure layers, each producing telemetry in different formats, at different rates, with different semantics. Yet monitoring tools operate per layer, leaving operators without cross-layer visibility needed to diagnose faults that cascade across architectural boundaries. We present PRISM, the first-of-its-kind cross-layer observability framework designed to plug into existing cloud-native cellular core network deployments, capturing evolving structural and temporal dependencies. PRISM collects and correlates logs, metrics, and configuration state from three layers into a unified, continuously updated representation, using an ontology-driven temporal knowledge graph (TKG) as core data structure. To support fault investigation, PRISM provides an incident-time subgraph extraction algorithm that, given incident time and rollback window, produces a compact diagnostic view of the TKG by highlighting anomalous entities and dependency paths connecting them. We evaluate PRISM on an Open5GS 5G core deployment under four fault scenarios spanning resource stress and configuration changes. Across all scenarios, PRISM produces operator-usable incident-time subgraphs that capture dominant anomalous components and their dependency structure, enabling focused troubleshooting and accelerating issue resolution time in virtualized mobile core networks. ...
Journal article (2026) - Michail Kalntis, George Iosifidis, Jose Suarez-Varela, Andra Lutu, Fernando A. Kuipers
While traditional handovers (THOs) have served as a backbone for mobile connectivity, they increasingly suffer from failures and delays, especially in dense deployments and high-frequency bands. To address these limitations, 3GPP introduced Conditional Handovers (CHOs) that enable proactive cell reservations and user-driven execution. However, both handover (HO) types present intricate trade-offs in signaling, resource usage, and reliability. This paper presents unique, countrywide mobility management datasets from a top-tier mobile network operator (MNO) that offer fresh insights into these issues and call for adaptive and robust HO control in next-generation networks. Motivated by these findings, we propose CONTRA, a framework that, for the first time, jointly optimizes THOs and CHOs within the O-RAN architecture. We study two variants of CONTRA: one where users are a priori assigned to one of the HO types, reflecting distinct service or user-specific requirements, as well as a more dynamic formulation where the controller decides on-the-fly the HO type, based on system conditions and needs. To this end, it relies on a practical meta-learning algorithm that adapts to runtime observations and guarantees performance comparable to an oracle with perfect future information (universal no-regret). CONTRA is specifically designed for near-real-time deployment as an O-RAN xApp and aligns with the 6G goals of flexible and intelligent control. Extensive evaluations leveraging crowdsourced datasets show that CONTRA improves user throughput and reduces both THO and CHO switching costs, outperforming 3GPP-compliant and Reinforcement Learning (RL) baselines in dynamic and real-world scenarios. ...
TLS stripping attacks expose sensitive web traffic by forcing secure HTTPS connections to fall back to unencrypted HTTP. At present, protection against these attacks relies on website operators explicitly opting into security by deploying mechanisms such as HTTP Strict Transport Security (HSTS) headers. These mechanisms have significant limitations: some are weak or difficult to configure, which raises the risk of misconfiguration and reduces practical adoption; others violate HTTP backward compatibility; at least one can even be abused to enable unintended user tracking.We introduce HSTS-Enforced, a mechanism that eliminates the remaining attack surface for TLS stripping while still allowing operators to securely specify that their websites need to be accessed over HTTP when necessary, thereby maintaining accessibility. To achieve this, we flip the current opt-in security model to an opt-out model: all connections default to HTTPS, and operators can explicitly opt out if their websites require HTTP using so-called HTTP-Required indicators. We propose two such HTTP-Required indicators: a new DNS record and an HTTP-Required Preload list. We evaluate HSTS-Enforced under multiple deployment scenarios, demonstrating that it blocks all practical TLS stripping attempts while maintaining compatibility for sites that require HTTP-without introducing overhead in the typical case. Finally, we outline a practical transition path to accelerate global adoption. ...

Adaptive Redundancy-aware Telemetry node Activation in 6G Edge

Future 6G edge networks must support ultra-reliable and low-latency communication for applications such as autonomous driving and industrial automation, while operating under strict bandwidth and compute constraints. Achieving this balance requires telemetry systems that are adaptive, scalable, and resource-efficient. However, existing telemetry approaches either rely on static deployment or network-wide activation, leading to excessive overhead and redundant measurements in dense edge environments. This paper presents ARTA, an Adaptive Redundancy-Aware Telemetry Node Activation framework that formulates the telemetry activation problem as a redundancy-aware benefit-cost optimization. Each node is evaluated by anomaly likelihood, traffic importance, topological centrality, and context relevance, while redundancy, caused by nearby nodes reporting overlapping telemetry data, and resource limits are explicitly modeled. The resulting submodular objective enables a greedy algorithm with provable optimality guarantees. Simulations on edge-core topologies of up to 1,000 nodes show that ARTA achieves approximately 0.8 normalized accuracy (80% of the maximum achievable accuracy) while activating only 20% of nodes within a few seconds, demonstrating scalability and zero-touch observability. ...

Accelerating Serverless Workflows by Unleashing Hybrid Resource Elasticity

Journal article (2025) - Xiaofei Yue, Song Yang, Fan Li, Liehuang Zhu, Xu Wang, Zhen Feng, Fernando A. Kuipers
Serverless computing promises fine-grained resource elasticity and billing, making it an attractive way to build complex applications as multi-stage workflows. Nonetheless, existing workflow orchestration ignores the heterogeneous demands of the computation and communication parts within a stage, potentially resulting in resource inefficiency on either side. In this paper, we advocate for computation-communication-separated orchestration to unleash hybrid resource (i.e., compute and network) elasticity. We present HyFaaS, a serverless workflow orchestrator that improves performance while ensuring cost efficiency. It seamlessly decouples computation and communication as a series of hybrid stages re-expressed within HyDAG, a novel workflow abstraction. HyFaaS uses a gray-box profiling model to identify their Pareto-optimal saturated configurations, and then deploys the saturated workflow to juggle communication and scaling overheads through two-level HyDAG partitioning. Along with event-driven runtime fine-tuning, HyFaaS further scales down the non-critical stages to reduce cost via branch-aware coordination. Experimental results show that HyFaaS surpasses existing solutions by 32.7%–50.4% on end-to-end latency, while lowering cost by up to 1.37×. ...
Programmable networks enable us to define the behaviour of a network through software. This added freedom comes with added complexity because multiple switches need to coordinate and be programmed correctly. To ease this task, we focus on intent-based networking via program synthesis. In this paper, we explain how to leverage linear temporal logic to describe the desired behaviour of a program, how to verify a P4 program against that description, and how to use the formula describing the program's behaviour to reduce the search space of the program synthesiser. ...
Conference paper (2025) - C. Ji, F. Kuipers
Programmable data plane devices have enabled various in-network applications that rely on locally stored state for delivering low-latency and high-throughput services. However, these applications are susceptible to network failures, which can disrupt state access and network functionality. Timely and reliable failure detection is therefore a critical component of a stateful data plane. In this paper, we propose a data plane framework, FASTR, that enables microsecond-scale fast failure detection between directly connected switches. FASTR can achieve sub- 10 μ s detection latency by implementing a heartbeat mechanism in the data plane. In addition, FASTR also incorporates traffic-awareness to reduce overhead and priority queuing to avoid false alarms. We validate FASTR with hardware experiments, demonstrating that it can consistently detect failures within 10 μ s using a 4 μ s interval while remaining robust to network congestion. ...
Conference paper (2025) - E. Bardhi, C. Ji, A. Imran, M. Shahbaz, R. Lazzeretti, M. Conti, F. Kuipers
The emergence of softwarized network devices, like programmable switches and smart NICs, has brought about new and advanced network functionalities. Intelligent decision-making becomes possible at line rate by offloading network functionality from the network control-plane to the programmable data-plane. In this paper, we offload fine-grained Distributed Denial of Service (DDoS) attack detection to the data-plane. The state-of-the-art in this regard, mainly aims to embed Machine Learning (ML) models into the data-plane without compromising on inference accuracy. Besides accuracy, we must consider multiple other factors, like traffic feature availability and false positive rates. To that end, we propose O’MINE: ONE MODEL IS NOT ENOUGH, a novel collaborative detection mechanism comprising lightweight ML models. This maximises the detection accuracy while keeping the false positive rate (FPR) low. We use three state-of-the-art datasets to evaluate the O’MINE algorithm and its ML models. Our results show that O’MINE can detect DDoS attacks with high accuracy (≈98% and ≈96% with full and scarce training data, respectively) and low FPR (≈0.22% and ≈0.72% with full and scarce training data, respectively), outperforming the state-of-the-art. Lastly, O’MINE only consumes a few device resources (≈6% of LUT and ≈4% of FF) on the Xlinx Alevo U250 FPGA we have used for inference at line rate. ...

Open RAN is Open to RIC E2 Subscription Denial of Service Attacks

Conference paper (2025) - F. Klement, A. Brighente, A. K. Bhattacharjee, S. Cecconello, F. Kuipers, G. Smaragdakis, M. Conti, S. Katzenbeisser
Telecommunication services are essential in ensuring the operation of numerous critical infrastructures. While mobile network security increased with the advancement of generations, emerging concepts such as the Open Radio Access Network (O-RAN) are transforming the traditional operation of Radio Access Networks (RANs). Novel concepts and technologies are finding their way into RANs with a focus on softwareization and virtualization. This increases the overall attack surface and introduces new attack vectors not necessarily found in traditional RANs. This paper shows that Denial of Service (DoS) attacks leveraging subscription mechanisms can compromise O-RAN implementations. We present a novel DoS attack targeting the Near Real-Time (Near-RT) RAN Intelligent Controller (RIC). By deploying a malicious xApp, we demonstrate how an adversary can flood the Near-RT RIC with excessive subscription requests, leading to service disruption. This attack exploits the lack of rate-limiting mechanisms within the Service Model (SM), a critical component of the Near-RT RIC responsible for handling E2 subscription requests. We systematically evaluate various attack scenarios and investigate the underlying vulnerabilities exposed. Furthermore, we propose and assess countermeasures to safeguard publicly accessible O-RAN systems from such threats. ...
Conference paper (2025) - M. Kalntis, F. A. Kuipers, G. Iosifidis
Handovers (HOs) are the cornerstone of modern cellular networks for enabling seamless connectivity to a vast and diverse number of mobile users. However, as mobile networks become more complex with more diverse users and smaller cells, traditional HOs face significant challenges, such as prolonged delays and increased failures. To mitigate these issues, 3GPP introduced conditional handovers (CHOs), a new type of HO that enables the preparation (i.e., resource allocation) of multiple cells for a single user to increase the chance of HO success and decrease the delays in the procedure. Despite its advantages, CHO introduces new challenges that must be addressed, including efficient resource allocation and managing signaling/communication overhead from frequent cell preparations and releases. This paper presents a novel framework aligned with the O-RAN paradigm that leverages meta-learning for CHO optimization, providing robust dynamic regret guarantees and demonstrating at least 180% superior performance than other 3GPP benchmarks in volatile signal conditions. ...
Open RAN systems, with their virtualized base stations (vBSs), offer increased flexibility and reduced costs, vendor diversity, and interoperability. However, optimizing the allocation of radio resources in such systems raises new challenges due to the volatile vBSs operation, and the dynamic network conditions and user demands they are called to support. Leveraging the novel O-RAN multi-tier control architecture, we propose a new set of resource allocation threshold policies with the aim of balancing the vBSs' performance and energy consumption in a robust and provably optimal fashion. To that end, we introduce an online learning algorithm that operates under minimal assumptions and without requiring knowledge of the environment, hence being suitable even for "challenging"environments with non-stationary or adversarial demands and conditions. We also develop a meta-learning scheme that utilizes other available algorithmic schemes, e.g., tailored for more "easy"environments, by choosing dynamically the best-performing algorithm; thus enhancing the system's effectiveness. We prove that the proposed solutions achieve sub-linear regret (zero optimality gap), and characterize their dependence on the main system parameters. The performance of the algorithms is evaluated with real-world data from a testbed, in stationary and adversarial conditions, indicating energy savings of up to 64.5% compared with several state-of-the-art benchmarks. ...

The Light and Shadow of System Call Interposition - From Pitfalls to Solutions with K23

System call interposition is a widely used technique to trace and modify application behavior. Over the years, numerous interposition mechanisms have been proposed, each with distinct strengths and trade-offs. Recently, advances in binary rewriting - specifically targeting x86-64 syscall and sysenter instructions - have led to new techniques that take important steps forward, with some claiming to support general-purpose use.We analyze state-of-the-art interposers in depth and uncover several fundamental design and implementation flaws - pitfalls that we collectively term System Call Interposition Pitfalls. For example, prior work cannot reliably interpose all system calls and may even corrupt code and data. These flaws undermine the practicality of existing solutions in real-world scenarios, rendering them unsuitable as universal interposition mechanisms.Motivated by our findings, we design and implement a new plug-and-play system call interposition approach named K23, targeting x86-64 platforms. K23 addresses the uncovered pitfalls via a hybrid design that unifies the strengths of prior methods, combining offline and online phases that leverage multiple Linux interfaces and binary rewriting. Our evaluation shows that K23 overcomes the key limitations of state-of-the-art solutions while remaining highly efficient. To our knowledge, K23 is the first general-purpose interposer suitable for a wide range of use cases and environments, from low-end devices to performance-critical, datacenter-scale workloads. ...
Journal article (2024) - Wojciech Kozlowski, Fernando Kuipers, Rob Smets, Belma Turkovic
Quantum entanglement is so fundamentally differ- ent from a network packet that several quantum network stacks have been proposed; one of which has even been experimentally demonstrated. Several simulators have also been developed to make up for limited hardware availability, and which facili- tate the design and evaluation of quantum network protocols. However, the lack of shared tooling and community-agreed node architectures has resulted in protocol implementations that are tightly coupled to their simulators. Besides limiting their reusabil- ity between different simulators, it also makes building upon prior results and simulations difficult. To address this problem, we have developed QuIP: a P4-based Quantum Internet Protocol prototyping framework for quantum network protocol design. QuIP is a framework for designing and implementing quantum network protocols in a platform-agnostic fashion. It achieves this by providing the means to flexibly, but rigorously, define device architectures against which quantum network protocols can be implemented in the network programming language P416. QuIP also comes with the necessary tooling to enable their execution in existing quantum network simulators. We demonstrate its use by showcasing V1Quantum, a completely new device architecture, implementing a link- and network-layer protocol, and simulating it in the existing simulator NetSquid. ...

A Countrywide Empirical Study of Cellular Handovers

Conference paper (2024) - Michail Kalntis, José Suárez-Varela, Jesús Omaña Iglesias, Anup Kiran Bhattacharjee, George Iosifidis, Fernando A. Kuipers, Andra Lutu
Cellular networks rely on handovers (HOs) as a fundamental element to enable seamless connectivity for mobile users. A comprehensive analysis of HOs can be achieved through data from Mobile Network Operators (MNOs); however, the vast majority of studies employ data from measurement campaigns within confined areas and with limited end-user devices, thereby providing only a partial view of HOs. This paper presents the first countrywide analysis of HO performance, from the perspective of a top-tier MNO in a European country. We collect traffic from approximately 40M users for 4 weeks and study the impact of the radio access technologies (RATs), device types, and manufacturers on HOs across the country. We characterize the geo-temporal dynamics of horizontal (intra-RAT) and vertical (inter-RATs) HOs, at the district level and at millisecond granularity, and leverage open datasets from the country's official census office to associate our findings with the population. We further delve into the frequency, duration, and causes of HO failures, and model them using statistical tools. Our study offers unique insights into mobility management, highlighting the heterogeneity of the network and devices, and their effect on HOs. ...
To avoid exploitation of known vulnerabilities, it is standard security practice to not disclose any model information regarding the antennas used in cellular infrastructure. However, in this work, we show that end-user devices receive enough information to infer, with high accuracy, the model-family of antennas. We demonstrate how low-cost hardware and software setups can fingerprint the cellular infrastructure of whole regions within a few minutes by only listening to cellular broadcast messages. To show the effectiveness and hence risk of such fingerprinting, we collected an extensive dataset of broadcast messages from three different countries. We then trained a machine-learning model to classify broadcast messages based on the model-family they belong to. Our results reveal a worryingly high average accuracy of 97% for model-family classification. We further discuss how inferring the model-family with such high accuracy can lead to a class of identification attacks on cellular infrastructure and we subsequently suggest countermeasures to mitigate the fingerprint effectiveness. ...
Book chapter (2023) - T. Fiebig, F.S. Gürses, C. Hernandez Ganan, E. Kotkamp, F.A. Kuipers, Martina Lindorfer, M.M.G.C. Prisse, P.T. Sari
With the emergence of remote education and work in universi- ties due to COVID-19, the ‘zoomification’ of higher education, i.e., the migration of universities to the clouds, reached the public dis- course. Ongoing discussions reason about how this shift will take control over students’ data away from universities, and may ulti- mately harm the privacy of researchers and students alike. How- ever, there has been no comprehensive measurement of universi- ties’ use of public clouds and reliance on Software-as-a-Service of- ferings to assess how far this migration has already progressed. We perform a longitudinal study of the migration to public clouds among universities in the U.S. and Europe, as well as institutions listed in the Times Higher Education (THE) Top100 between Jan- uary 2015 and October 2022. We find that cloud adoption differs between countries, with one cluster (Germany, France, Austria, Switzerland) showing a limited move to clouds, while the other (U.S., U.K., the Netherlands, THE Top100) frequently outsources universities’ core functions and services—starting long before the COVID-19 pandemic. We attribute this clustering to several socio- economic factors in the respective countries, including the general culture of higher education and the administrative paradigm taken towards running universities. We then analyze and interpret our results, finding that the implications reach beyond individuals’ pri- vacy towards questions of academic independence and integrity. ...
Preprint (2023) - P. Maćkowiak, F.A. Kuipers
The inability to check how our Internet trac is being handled and routed poses all kinds of security and privacy risks. Yet, for the typical end-user, the Internet indeed is such a black box. In this paper, we adhere to the call for an Internet that is more transparent, and as a step forward we propose a mechanism that carefully balances the desire to share transparency information with the necessity to not expose all internal details of a network. We realize this by building on the framework of multi-party computation. Our architecture and corresponding proof-of-concept is evaluated via experiments and demonstrates the feasibility of our concept to improve Internet transparency. ...
Conference paper (2023) - Biao Hou, Song Yang, Fernando A. Kuipers, Lei Jiao, Xiaoming Fu
Recent years have witnessed video streaming grad- ually evolve into one of the most popular Internet applications. With the rapidly growing personalized demand for real-time video streaming services, maximizing their Quality of Experience (QoE) is a long-standing challenge. The emergence of the server- less computing paradigm has potential to meet this challenge through its fine-grained management and highly parallel comput- ing structures. However, it is still ambiguous how to implement and configure serverless components to optimize video streaming services. In this paper, we propose EAVS, an Edge-assisted Adaptive Video streaming system with Serverless pipelines, which facilitates fine-grained management for multiple concurrent video transmission pipelines. Then, we design a chunk-level optimiza- tion scheme to address video bitrate adaptation. We propose a Deep Reinforcement Learning (DRL) algorithm based on Proximal Policy Optimization (PPO) with a trinal-clip mechanism to make bitrate decisions efficiently for better QoE. Finally, we implement the serverless video streaming system prototype and evaluate the performance of EAVS on various real-world network traces. Our results show that EAVS significantly improves QoE and reduces the video stall rate, achieving over 9.1% QoE improvement and 60.2% latency reduction compared to state- of-the-art solutions. ...
Conference paper (2023) - C. Ji, F.A. Kuipers
To cater to constantly changing network needs, enabling stateful reconfiguration of Network Functions (NFs) is crucial. Recently, there has been growing interest in offloading NFs to programmable network devices. Unfortunately, it is currently not possible to maintain the full state of NFs during a switch reconfiguration without consuming network resources from and to neighboring switches. In this paper, we present State4, a framework that maintains the state of P4 programs during the reconfiguration of a P4-programmab1e network device, by only using a small amount of local resources on the switch undergoing reconfiguration. State4 acts on both the in-switch control-plane and the data-plane. By utilizing the in-switch local controller, State4 requires no external network resources to achieve reconfiguration while preserving states. As such, State4 enables on-The-fly reconfiguration of stateful NFs, at minimal traffic disruption, where previously traffic had to be re-routed. ...
Conference paper (2023) - A. Zapletal, F.A. Kuipers
The conventional definition of fairness in congestion control is flow rate fairness. However, Internet users typically care about flow completion times (FCTs) and flow rate fairness does not lead to equitable FCTs for different users. Therefore, we reconsider what it means for congestion control to be fair and posit a novel stance on fairness: it is fair when no flow unnecessarily prolongs another flow. Based on this stance, we propose an evaluation framework for congestion control fairness that uses slowdown (normalized FCT) as the metric.
We demonstrate the usefulness of our framework through surprising experiment results: in theory, prioritizing short flows should outperform fair queueing, but we show that this is not the case due to slow start dominating short flows. The framework can also analyze traditional flow rate fairness; we do so and verify well-known "fairness" issues, but additionally, we show that flow rate unfairness does not induce slowdown and is thus not a problem per se. ...