Searcharxiv⌕ Search

arXiv subjects

Alfonso Sánchez-Macián

Publications and source records attributed to Alfonso Sánchez-Macián.

At least 19 recordsLinked to original sources
arXiv2026

Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models

While Large Language Models (LLMs) have become essential productivity tools, their integration into workflows without adequate safeguards creates significant risks. This paper proposes an open-source, privacy-focused, user-facing firewall designed to secure both web-based and programmatic LLM interactions. The architecture combines a browser extension and a proxy for total traffic interception across both HTTP(S) and WebSocket communications. At its core, a flexible multi-agent pipeline delivers data leakage prevention through a hybrid approach combining deterministic detectors with LLM-driven semantic analysis, proprietary code leakage prevention, and extensible components designed for future security enhancements such as prompt injection evasion. The framework's layered architecture enables deployment across heterogeneous environments, allowing organizations to balance computational cost, detection depth and latency. Evaluation results demonstrate it achieves F1 scores of up to 94.93% on optimal configurations.

cs.CR↗
arXiv2026

SixGman: An Open-Source Planner for Fixed 6G Hierarchical Optical Access-Core Networks

This paper introduces SixGman, an open-source optical network planning tool for evaluating access-metro-core aggregation network architectures. The framework integrates traffic generation, dual-homed routing, Quality of Transmission (QoT) estimation, spectrum and fiber assignment, techno-economic analysis, energy consumption evaluation, and visualization capabilities. Its modular design, based on standardized interfaces and clearly defined functions, enables flexible, transparent, and reproducible network simulations. SixGman is applied to the Telefónica MAN157 metro-urban topology, composed of 157 optical nodes, 220 links, and four hierarchical layers (HL1-HL4), to compare a conventional full hierarchical architecture with an HL3-bypassed architecture where electrical aggregation at HL3 nodes is removed. The analysis includes traffic distribution, IP router utilization, link congestion, latency, Total Cost of Ownership (TCO), and energy consumption. Results show that HL3 bypassing improves traffic distribution, reduces optical and electrical resource usage, lowers end-to-end latency, and decreases both capital and operational expenditures. Compared to the full hierarchical architecture, the HL3-bypassed scenario achieves reductions of up to 17.5% in TCO and 29.1% in cumulative energy consumption. These results demonstrate the potential of SixGman as a flexible planning platform for cost- and energy-efficient optical network design.

cs.NI↗
arXiv2026

Optimizing power by selective IP card shutdown using transport slicing

The increasing energy demands of upcoming sixth-generation (6G) mobile networks and networks supporting AI applications pose significant challenges for network operators in terms of operational costs and environmental impact. To address these challenges, this paper proposes a novel IP-based network slicing strategy that optimizes energy efficiency through a dual-slice approach. The proposed solution consists of a Day Slice, designed to meet high-performance requirements during peak traffic hours, and a Night Slice, optimized for energy savings by deactivating excess line-cards in card-based routers during periods of low traffic demand. The traffic is switched between the Day and Night Slices at predefined times, assuming appropriate traffic engineering mechanisms are in place to minimize disruption and support session continuity. We apply Pareto-based evolutionary algorithms (NSGA-II, CTAEA, and AGE-MOEA) to jointly optimize energy consumption and latency. Experiments conducted on the SNDlib india35 topology demonstrate that multi-objective optimization can deactivate over 40% of line cards during low-traffic periods, providing significant energy savings while maintaining acceptable performance. Additionally, a multi-service extension using AGE-MOEA introduces differentiated QoS constraints, maintaining latency below 7 ms for premium traffic while preserving substantial energy savings.

cs.NI↗
arXiv2026

GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systems

The rapid integration of Large Language Models (LLMs) into Multi-Agent Systems (MAS) has significantly enhanced their collaborative problem-solving capabilities, but it has also expanded their attack surfaces, exposing them to vulnerabilities such as prompt infection and compromised inter-agent communication. While emerging graph-based anomaly detection methods show promise in protecting these networks, the field currently lacks a standardized, reproducible environment to train these models and evaluate their efficacy. To address this gap, we introduce Gammaf (Graph-based Anomaly Monitoring for LLM Multi-Agent systems Framework), an open-source benchmarking platform. Gammaf is not a novel defense mechanism itself, but rather a comprehensive evaluation architecture designed to generate synthetic multi-agent interaction datasets and benchmark the performance of existing and future defense models. The proposed framework operates through two interdependent pipelines: a Training Data Generation stage, which simulates debates across varied network topologies to capture interactions as robust attributed graphs, and a Defense System Benchmarking stage, which actively evaluates defense models by dynamically isolating flagged adversarial nodes during live inference rounds. Through rigorous evaluation using established defense baselines (XG-Guard and BlindGuard) across multiple knowledge tasks (such as MMLU-Pro and GSM8K), we demonstrate Gammaf's high utility, topological scalability, and execution efficiency. Furthermore, our experimental results reveal that equipping an LLM-MAS with effective attack remediation not only recovers system integrity but also substantially reduces overall operational costs by facilitating early consensus and cutting off the extensive token generation typical of adversarial agents.

cs.CR↗
arXiv2025

Design and Development of an Intelligent LLM-based LDAP Honeypot

Cybersecurity threats continue to increase, with a growing number of previously unknown attacks each year targeting both large corporations and smaller entities. This scenario demands the implementation of advanced security measures, not only to mitigate damage but also to anticipate emerging attack trends. In this context, deception tools have become a key strategy, enabling the detection, deterrence, and deception of potential attackers while facilitating the collection of information about their tactics and methods. Among these tools, honeypots have proven their value, although they have traditionally been limited by rigidity and configuration complexity, hindering their adaptability to dynamic scenarios. The rise of artificial intelligence, and particularly general-purpose Large Language Models (LLMs), is driving the development of new deception solutions capable of offering greater adaptability and ease of use. This work proposes the design and implementation of an LLM-based honeypot to simulate an LDAP server, a critical protocol present in most organizations due to its central role in identity and access management. The proposed solution aims to provide a flexible and realistic tool capable of convincingly interacting with attackers, thereby contributing to early detection and threat analysis while enhancing the defensive capabilities of infrastructures against intrusions targeting this service.

cs.CR↗
arXiv2025

Evaluating Language Models For Threat Detection in IoT Security Logs

Log analysis is a relevant research field in cybersecurity as they can provide a source of information for the detection of threats to networks and systems. This paper presents a pipeline to use fine-tuned Large Language Models (LLMs) for anomaly detection and mitigation recommendation using IoT security logs. Utilizing classical machine learning classifiers as a baseline, three open-source LLMs are compared for binary and multiclass anomaly detection, with three strategies: zero-shot, few-shot prompting and fine-tuning using an IoT dataset. LLMs give better results on multi-class attack classification than the corresponding baseline models. By mapping detected threats to MITRE CAPEC, defining a set of IoT-specific mitigation actions, and fine-tuning the models with those actions, the models are able to provide a combined detection and recommendation guidance.

cs.CR↗
arXiv2025

Introducing Large Language Models as the Next Challenging Internet Traffic Source

This article explores the growing impact of large language models (LLMs) and Generative AI (GenAI) tools on Internet traffic, focusing on their role as a new and significant source of network load. As these AI tools continue to gain importance in applications ranging from virtual assistants to content generation, the volume of traffic they generate is expected to increase massively. These models use the Internet as the global infrastructure for delivering multimedia messages (text, voice, images, video, etc.) to users, by interconnecting users and devices with AI agents typically deployed in the cloud. We believe this represents a new paradigm that will lead to a considerable increase in network traffic, and network operators must be prepared to address the resulting demands. To support this claim, we provide a proof-of-concept and source code for measuring traffic in remote user-agent interactions, estimating the traffic generated per prompt for some of the most popular open-source LLMs in 2025. The average size of each prompt query and response is 7,593 bytes, with a standard deviation of 369 bytes. These numbers are comparable with email and web browsing traffic. However, we envision AI as the next "killer application" that will saturate networks with traffic, such as Peer-to-Peer traffic and Video-on-demand dominated in previous decades.

cs.NI↗
arXiv2024

Designing Reliable Experiments with Generative Agent-Based Modeling: A Comprehensive Guide Using Concordia by Google DeepMind

In social sciences, researchers often face challenges when conducting large-scale experiments, particularly due to the simulations' complexity and the lack of technical expertise required to develop such frameworks. Agent-Based Modeling (ABM) is a computational approach that simulates agents' actions and interactions to evaluate how their behaviors influence the outcomes. However, the traditional implementation of ABM can be demanding and complex. Generative Agent-Based Modeling (GABM) offers a solution by enabling scholars to create simulations where AI-driven agents can generate complex behaviors based on underlying rules and interactions. This paper introduces a framework for designing reliable experiments using GABM, making sophisticated simulation techniques more accessible to researchers across various fields. We provide a step-by-step guide for selecting appropriate tools, designing the model, establishing experimentation protocols, and validating results.

cs.AI↗
arXiv2024

Adding web pentesting functionality to PTHelper

Web application pentesting is a crucial component in the offensive cybersecurity area, whose aim is to safeguard web applications and web services as the majority of the web applications are mounted in publicly accessible web environments. This method requires that the cybersecurity experts pretend and act as real attackers to identify all the errors and vulnerabilities in web applications with the objective of preventing and reducing damages. As this process may be quite complex and the amount of information pentesters need may be big, being able to automate it will help them to easily discover the vulnerabilities given. This project is the direct continuation of the previous initiative called PThelper: An open source tool to support the Penetration Testing process. This continuation is focused on expanding PThelper with the functionality to detect and later report web vulnerabilities in order to address emerging threats and strengthen the ability of the organizations to protect their web applications against potential cyber-attacks.

cs.CR↗
arXiv2024

MoleNetwork: A tool for the generation of synthetic optical network topologies

Model networks and their underlying topologies have been used as a reference for techno-economic studies for several decades. Existing reference topologies for optical networks may cover different network segments such as backbone, metro core, metro aggregation, access and/or data center. While telco operators work on the optimization of their own existing deployed optical networks, the availability of different topologies is useful for researchers and technology developers to test their solutions in a variety of scenarios and validate the performance in terms of energy efficiency or cost reduction. This paper presents an open-source tool, MoleNetwork, to generate graphs inspired by real network topologies of telecommunication operators that can be used as benchmarks for techno-economic studies.

cs.NI↗
arXiv2024

A Comprehensive Guide to Combining R and Python code for Data Science, Machine Learning and Reinforcement Learning

Python has gained widespread popularity in the fields of machine learning, artificial intelligence, and data engineering due to its effectiveness and extensive libraries. R, on its side, remains a dominant language for statistical analysis and visualization. However, certain libraries have become outdated, limiting their functionality and performance. Users can use Python's advanced machine learning and AI capabilities alongside R's robust statistical packages by combining these two programming languages. This paper explores using R's reticulate package to call Python from R, providing practical examples and highlighting scenarios where this integration enhances productivity and analytical capabilities. With a few hello-world code snippets, we demonstrate how to run Python's scikit-learn, pytorch and OpenAI gym libraries for building Machine Learning, Deep Learning, and Reinforcement Learning projects easily.

cs.LG↗
arXiv2024

A Queuing Envelope Model for Estimating Latency Guarantees in Deterministic Networking Scenarios

Accurate estimation of queuing delays is crucial for designing and optimizing communication networks, particularly in the context of Deterministic Networking (DetNet) scenarios. This study investigates the approximation of Internet queuing delays using an M/M/1 envelope model, which provides a simple methodology to find tight upper bounds of real delay percentiles. Real traffic statistics collected at large Internet Exchange Points (like Amsterdam and San Francisco) have been used to fit polynomial regression models for transforming packet queuing delays into the M/M/1 envelope models. We finally propose a methodology for providing delay percentiles in DetNet scenarios where tight latency guarantees need to be assured.

cs.NI↗
arXiv2024

On optimizing Inband Telemetry systems for accurate latency-based service deployments

The power of Machine Learning and Artificial Intelligence algorithms based on collected datasets, along with the programmability and flexibility provided by Software Defined Networking can provide the building blocks for constructing the so-called Zero-Touch Network and Service Management systems. However, the fuel towards this goal relies on the availability of sufficient and good-quality data collected from measurements and telemetry. This article provides a telemetry methodology to collect accurate latency measurements, as a first step toward building intelligent control planes that make correct decisions based on precise information.

cs.NI↗
arXiv2024

Reinforcement-Learning based routing for packet-optical networks with hybrid telemetry

This article provides a methodology and open-source implementation of Reinforcement Learning algorithms for finding optimal routes in a packet-optical network scenario. The algorithm uses measurements provided by the physical layer (pre-FEC bit error rate and propagation delay) and the link layer (link load) to configure a set of latency-based rewards and penalties based on such measurements. Then, the algorithm executes Q-learning based on this set of rewards for finding the optimal routing strategies. It is further shown that the algorithm dynamically adapts to changing network conditions by re-calculating optimal policies upon either link load changes or link degradation as measured by pre-FEC BER.

cs.NI↗
arXiv2024

PTHelper: An open source tool to support the Penetration Testing process

Offensive security is one of the state of the art measures to protect enterprises and organizations. Penetration testing, broadly called pentesting, is a branch of offensive security designed to find, rate and exploit these vulnerabilities, in order to assess the security posture of an organization. This process is often time-consuming and the quantity of information that pentesters need to manage might also be difficult to handle. This project takes a practical approach to solve the automation of pentesting and proposes a usable tool, called PTHelper. This open-source tool has been designed in a modular way to be easily upgradable by the pentesting community, and uses state of the art tools and artificial intelligence to achieve its objective.

cs.CR↗
arXiv2024

Deepfake Detection and the Impact of Limited Computing Capabilities

The rapid development of technologies and artificial intelligence makes deepfakes an increasingly sophisticated and challenging-to-identify technique. To ensure the accuracy of information and control misinformation and mass manipulation, it is of paramount importance to discover and develop artificial intelligence models that enable the generic detection of forged videos. This work aims to address the detection of deepfakes across various existing datasets in a scenario with limited computing resources. The goal is to analyze the applicability of different deep learning techniques under these restrictions and explore possible approaches to enhance their efficiency.

cs.CV↗