arXiv subjects

Andreas Johnsson

Publications and source records attributed to Andreas Johnsson.

14 recordsLinked to original sources

arXiv2026

Rethinking IoT Intrusion Detection: Augmenting Routing Metrics with Radio Features

Machine learning-based intrusion detection systems (IDS) for RPL-based IoT networks often rely solely on routing layer features, which provide only a partial view of network behaviour. In this work, we investigate whether incorporating Transmit (TX) and Receive (RX) radio features alongside the standard RPL feature set can improve detection performance in an LSTM-based IDS. We evaluate the proposed approach across three different attack types, namely DIS-Flooding, Local Repair, and Worst Parent under varying network sizes. The results show that incorporating TX and RX improves the IDS's overall detection performance by up to ~4% in F1-score compared with using routing-layer features alone, with the most notable gain observed for the Worst Parent attack.

cs.CR↗

arXiv2026

Towards Intrusion Detection Systems for RPL-based IoT Networks using Foundation Models

AI-based intrusion detection systems (IDS) have shown promise in detecting attacks on IoT systems. In this work, we explore the use of foundation models to detect and identify attacks, with a specific focus on RPL-based IoT networks. We study multiple attack types, attack variations, and network configurations, and provide insights into the performance of foundation models for attack identification. Specifically, we fine-tune the MOMENT foundation model for multi-class attack identification. Our evaluation is based on a dataset containing RPL-related statistics collected under normal operation and under Blackhole, DIS flooding, Worst Parent, and Local Repair attacks, generated in a Cooja simulation environment. The initial results are promising. The approach achieves attack-detection performance comparable to state-of-the-art methods, while also demonstrating strong performance in distinguishing between different attack types.

cs.CR↗

arXiv2026

AI-Based KPI Prediction Methods in Future 6G Networks: A Survey

The evolution from 5G to 5G-Advanced and the vision of 6G demand unprecedented levels of network performance, in which meeting stringent network Key Performance Indicators (KPIs), including capacity, latency, coverage, and reliability, is critical to supporting emerging applications such as autonomous driving, industrial automation, and immersive communications. Traditional reactive network management is insufficient in this context, driving the need for predictive, data-driven approaches. Machine Learning (ML) has emerged as a key enabler, enabling the forecasting of KPI trends from diverse data sources and thereby enabling proactive, AI-native automation in mobile networks. This survey provides the first comprehensive and systematic review of data-driven KPI prediction methods for future 6G networks. We introduce a multi-dimensional taxonomy that classifies prediction approaches by KPI type, data source, the network protocol stack at which the KPI is predicted, prediction horizon, model family, and prediction objective. Using this taxonomy, we analyze the state of the art across various KPIs, highlighting representative methods ranging from classical statistical models to deep learning and reinforcement learning. We further discuss enabling system aspects, including data collection and learning architectures, and examine deployment challenges, including data availability, scalability, privacy, and sustainability. Finally, we outline open research directions spanning new KPI definitions, probabilistic and explainable predictions. This survey aims to provide researchers and practitioners with a structured understanding of the KPI prediction landscape and a roadmap toward predictive network automation in future 6G systems.

eess.SY↗

arXiv2026

Quantifying Catastrophic Forgetting in IoT Intrusion Detection Systems

Distribution shifts in attack patterns within RPL-based IoT networks pose a critical threat to the reliability and security of large-scale connected systems. Intrusion Detection Systems (IDS) trained on static datasets often fail to generalize to unseen threats and suffer from catastrophic forgetting when updated with new attacks. Ensuring continual adaptability of IDS is therefore essential for maintaining robust IoT network defence. In this focused study, we formulate intrusion detection as a domain continual learning problem and propose a method-agnostic IDS framework that can integrate diverse continual learning strategies. We systematically benchmark five representative approaches across multiple domain-ordering sequences using a comprehensive multi-attack dataset comprising 48 domains. Results show that continual learning mitigates catastrophic forgetting while maintaining a balance between plasticity, stability, and efficiency, a crucial aspect for resource-constrained IoT environments. Among the methods, Replay-based approaches achieve the best overall performance, while Synaptic Intelligence (SI) delivers near-zero forgetting with high training efficiency, demonstrating strong potential for stable and sustainable IDS deployment in dynamic IoT networks.

cs.LG↗

arXiv2026

Automated Model Design using Gated Neuron Selection in Telecom

The telecommunications industry is experiencing rapid growth in adopting deep learning for critical tasks such as traffic prediction, signal strength prediction, and quality of service optimisation. However, designing neural network architectures for these applications remains challenging and time-consuming, particularly when targeting compact models suitable for resource-constrained network environments. Therefore, there is a need for automating the model design process to create high-performing models efficiently. This paper introduces TabGNS (Tabular Gated Neuron Selection), a novel gradient-based Neural Architecture Search (NAS) method specifically tailored for tabular data in telecommunications networks. We evaluate TabGNS across multiple telecommunications and generic tabular datasets, demonstrating improvements in prediction performance while reducing the architecture size by 51-82% and reducing the search time by up to 36x compared to state-of-the-art tabular NAS methods. Integrating TabGNS into the model lifecycle management enables automated design of neural networks throughout the lifecycle, accelerating deployment of ML solutions in telecommunications networks.

cs.LG↗

arXiv2025

Multi-Generator Continual Learning for Robust Delay Prediction in 6G

In future 6G networks, dependable networks will enable telecommunication services such as remote control of robots or vehicles with strict requirements on end-to-end network performance in terms of delay, delay variation, tail distributions, and throughput. With respect to such networks, it is paramount to be able to determine what performance level the network segment can guarantee at a given point in time. One promising approach is to use predictive models trained using machine learning (ML). Predicting performance metrics such as one-way delay (OWD), in a timely manner, provides valuable insights for the network, user equipments (UEs), and applications to address performance trends, deviations, and violations. Over the course of time, a dynamic network environment results in distributional shifts, which causes catastrophic forgetting and drop of ML model performance. In continual learning (CL), the model aims to achieve a balance between stability and plasticity, enabling new information to be learned while preserving previously learned knowledge. In this paper, we target on the challenges of catastrophic forgetting of OWD prediction model. We propose a novel approach which introducing the concept of multi-generator for the state-of-the-art CL generative replay framework, along with tabular variational autoencoders (TVAE) as generators. The domain knowledge of UE capabilities is incorporated into the learning process for determining generator setup and relevance. The proposed approach is evaluated across a diverse set of scenarios with data that is collected in a realistic 5G testbed, demonstrating its outstanding performance in comparison to baselines.

cs.NI↗

arXiv2025

On Measuring Available Capacity in High-speed Cloud Networks

Measurement of available path capacity with high accuracy over high-speed links deployed in cloud and transport networks is vital for performance assessment and traffic engineering. Methods for measuring the available path capacity rely on sending and receiving time stamped probe packets. A requirement for accurate estimates of the available path capacity is the ability to generate probe packets at a desired rate and also time stamping with high precision and accuracy. This is challenging especially for measurement systems deployed using general purpose hardware. To touch upon the challenge this paper describes and evaluates four approaches for sending and receiving probe packets in high-speed networks (10+ Gbps). The evaluation shows that the baseline approach, based on the native UDP socket, is suitable for available path capacity measurements over links with capacities up to 2.5 Gbps. For higher capacities we show that an implementation based on Data Plane Development Kit (DPDK) gives good results up to 10 Gbps.

cs.NI↗

arXiv2024

Towards Neural Architecture Search for Transfer Learning in 6G Networks

The future 6G network is envisioned to be AI-native, and as such, ML models will be pervasive in support of optimizing performance, reducing energy consumption, and in coping with increasing complexity and heterogeneity. A key challenge is automating the process of finding optimal model architectures satisfying stringent requirements stemming from varying tasks, dynamicity and available resources in the infrastructure and deployment positions. In this paper, we describe and review the state-of-the-art in Neural Architecture Search and Transfer Learning and their applicability in networking. Further, we identify open research challenges and set directions with a specific focus on three main requirements with elements unique to the future network, namely combining NAS and TL, multi-objective search, and tabular data. Finally, we outline and discuss both near-term and long-term work ahead.

cs.NI↗

arXiv2023

DietTopp: A first implementation and evaluation of a simplified bandwidth measurement method

This paper describes the active available bandwidth measurement tool DietTopp. It measures the available bandwidth and the link capacity on an end-to-end path having one bottleneck link. DietTopp is based on a simplified TOPP method. This paper describe and motivate the simplifications and assumptions made to TOPP. Further, the paper describes some of the DietTopp implementation issues. A first evaluation of DietTopp in a testbed scenario is made. Within this evaluation the performance and measurement accuracy of DietTopp is compared to the state-of-the-art tools Pathload and Pathrate. We show that DietTopp gives fast and accurate estimations of both the available bandwidth and the link capacity of the bottleneck link.

cs.NI↗

arXiv2022

Measurement-based Admission Control in Sliced Networks: A Best Arm Identification Approach

In sliced networks, the shared tenancy of slices requires adaptive admission control of data flows, based on measurements of network resources. In this paper, we investigate the design of measurement-based admission control schemes, deciding whether a new data flow can be admitted and in this case, on which slice. The objective is to devise a joint measurement and decision strategy that returns a correct decision (e.g., the least loaded slice) with a certain level of confidence while minimizing the measurement cost (the number of measurements made before committing to the decision). We study the design of such strategies for several natural admission criteria specifying what a correct decision is. For each of these criteria, using tools from best arm identification in bandits, we first derive an explicit information-theoretical lower bound on the cost of any algorithm returning the correct decision with fixed confidence. We then devise a joint measurement and decision strategy achieving this theoretical limit. We compare empirically the measurement costs of these strategies, and compare them both to the lower bounds as well as a naive measurement scheme. We find that our algorithm significantly outperforms the naive scheme (by a factor $2-8$).

cs.NI↗

arXiv2022

Evolving 5G: ANIARA, an Edge-Cloud perspective

Emerging use-cases like smart manufacturing and smart cities pose challenges in terms of latency, which cannot be satisfied by traditional centralized networks. Edge networks, which bring computational capacity closer to the users/clients, are a promising solution for supporting these critical low latency services. Different from traditional centralized networks, the edge is distributed by nature and is usually equipped with limited connectivity and compute capacity. This creates a complex network to handle, subject to failures of different natures, that requires novel solutions to work in practice. To reduce complexity, more lightweight solutions are needed for containerization as well as smart monitoring strategies with reduced overhead. Orchestration strategies should provide reliable resource slicing with limited resources, and intelligent scaling while preserving data privacy in a distributed fashion. Power management is also critical, as providing and managing a large amount of power at the edge is unprecedented.

cs.NI↗

arXiv2020

Predictive Bandits

We introduce and study a new class of stochastic bandit problems, referred to as predictive bandits. In each round, the decision maker first decides whether to gather information about the rewards of particular arms (so that their rewards in this round can be predicted). These measurements are costly, and may be corrupted by noise. The decision maker then selects an arm to be actually played in the round. Predictive bandits find applications in many areas; e.g. they can be applied to channel selection problems in radio communication systems. In this paper, we provide the first theoretical results about predictive bandits, and focus on scenarios where the decision maker is allowed to measure at most one arm per round. We derive asymptotic instance-specific regret lower bounds for these problems, and develop algorithms whose regret match these fundamental limits. We illustrate the performance of our algorithms through numerical experiments. In particular, we highlight the gains that can be achieved by using reward predictions, and investigate the impact of the noise in the corresponding measurements.

cs.LG↗

arXiv2015

Predicting SLA Violations in Real Time using Online Machine Learning

Detecting faults and SLA violations in a timely manner is critical for telecom providers, in order to avoid loss in business, revenue and reputation. At the same time predicting SLA violations for user services in telecom environments is difficult, due to time-varying user demands and infrastructure load conditions. In this paper, we propose a service-agnostic online learning approach, whereby the behavior of the system is learned on the fly, in order to predict client-side SLA violations. The approach uses device-level metrics, which are collected in a streaming fashion on the server side. Our results show that the approach can produce highly accurate predictions (>90% classification accuracy and < 10% false alarm rate) in scenarios where SLA violations are predicted for a video-on-demand service under changing load patterns. The paper also highlight the limitations of traditional offline learning methods, which perform significantly worse in many of the considered scenarios.

cs.NI↗

arXiv2015

Scalability and Dimensioning of Network-Capacity Measurement System using Reflecting Servers

In a class of methods for measurement of available path capacity and other capacity-related metrics in a network, trains of probe packets are transmitted from a sender to a receiver across a network path, and the sequences of time stamps at sending and reception are analyzed. In large-scale implementations there may potentially be interference between the probe-packet trains corresponding to several concurrent measurement sessions, due to congestion in the network and common measurement end points. This paper outlines principles for large-scale deployments of network capacity measurement methods using standardized network functionality. Further, the paper provides an in-depth study of dimensioning and scalability challenges related to the measurement end-points of such systems. The main result is a framework for dimensioning of large-scale network capacity measurement systems based on TWAMP. The framework is based on a method for explicit calculation of queuelength and waiting-time distributions, where results from M/G/1 queuing theory are combined with Monte Carlo integration.

cs.NI↗