arXiv subjects

Jose Moura

Publications and source records attributed to Jose Moura.

16 recordsLinked to original sources

arXiv2026

Orchestrated Vulnerability Management for Heterogeneous Networks: Adaptive Two-Stage Vulnerability Assessment, Context-Aware Risk Prioritization, and Automated Mitigation

Heterogeneous networks pose significant security challenges due to device diversity, fragile operating conditions, and heterogeneous firmware and service configurations. Traditional vulnerability management often relies on static scanning and severity-based prioritization, overlooking exploitation likelihood and asset context. This can delay mitigation and increase operational overhead. This paper proposes a SOAR-orchestrated vulnerability management framework integrating passive asset discovery, adaptive two-stage vulnerability assessment, context-aware risk assessment, and automated SDN-based mitigation. The detection engine progressively characterizes device attack surfaces using assessment strategies tailored to device capabilities, minimizing disruption to resource-constrained IoT assets. Risk assessment combines CVSS severity, EPSS exploitation probability, and contextual attributes to prioritize vulnerabilities by operational risk. Based on risk bands, mitigation is automatically enforced through coordinated OpenFlow and IDS policies, ranging from monitoring and selective service isolation to complete host quarantine. Experimental results demonstrate the framework's effectiveness. Adaptive two-stage assessment reduces scan time by up to 91% while identifying 71% of baseline vulnerabilities during the initial stage before selectively triggering further analysis. The context-aware risk model reduces vulnerabilities requiring immediate mitigation by approximately 75% without missing any vulnerability with verified exploitation. Compared with conventional assessment, the framework reduces assessment time for 32 physical hosts by up to 45% and enforces mitigation within milliseconds, enabling efficient and scalable vulnerability management through adaptive assessment, context-aware prioritization, and automated mitigation.

cs.NI↗

arXiv2023

Regularizing Self-training for Unsupervised Domain Adaptation via Structural Constraints

Self-training based on pseudo-labels has emerged as a dominant approach for addressing conditional distribution shifts in unsupervised domain adaptation (UDA) for semantic segmentation problems. A notable drawback, however, is that this family of approaches is susceptible to erroneous pseudo labels that arise from confirmation biases in the source domain and that manifest as nuisance factors in the target domain. A possible source for this mismatch is the reliance on only photometric cues provided by RGB image inputs, which may ultimately lead to sub-optimal adaptation. To mitigate the effect of mismatched pseudo-labels, we propose to incorporate structural cues from auxiliary modalities, such as depth, to regularise conventional self-training objectives. Specifically, we introduce a contrastive pixel-level objectness constraint that pulls the pixel representations within a region of an object instance closer, while pushing those from different object categories apart. To obtain object regions consistent with the true underlying object, we extract information from both depth maps and RGB-images in the form of multimodal clustering. Crucially, the objectness constraint is agnostic to the ground-truth semantic labels and, hence, appropriate for unsupervised domain adaptation. In this work, we show that our regularizer significantly improves top performing self-training methods (by up to $2$ points) in various UDA benchmarks for semantic segmentation. We include all code in the supplementary.

cs.CV↗

arXiv2023

Software-Defined Elastic Provisioning of IoT Edge Computing Virtual Resources

The fast growth of Internet-connected embedded devices demands for new capabilities at the network edge. These new capabilities are local processing, efficient communications, and resource virtualization. The current work aims to address these capabilities by designing and deploying a new management proposal, which offers on-demand activation of offline Internet of Things (IoT) fog computing assets via a Software Defined Networking (SDN) based solution combined with containerization and sensor virtualization. We propose a testbed as a proof of concept for the main functionalities of this novel solution. The obtained results evidence that the current SDN-based solution can deploy with success activation policies on computational edge containers, which are located within the same network domain of the SDN controller. In addition, different application-level scenarios are also investigated.

cs.NI↗

arXiv2022

Resilience Enhancement at Edge Cloud Systems

It is becoming common practice to push interactive and location-based services from remote datacenters to resource-constrained edge domains. This trend creates new management challenges at the network edge, not least to ensure resilience. These challenges now need to be investigated and overcome. In this paper, we explore the use of open-source programmable asset orchestration at edge cloud systems to guarantee operational resilience and a satisfactory performance level despite system incidents such as faults, congestion, or cyber-attacks. We discuss the design and deployment of a new cross-level configurable solution, Resilient Edge Cloud Systems (RECS). Results from appropriate tests made on RECS highlight the positive effects of deploying novel service and resource management algorithms at both data and control planes of the programmable edge system to mitigate against disruptive events such as control channel issues, service overload, or link congestion. RECS offers the following benefits: i) the switch automatically selects the standalone operation mode after its disconnection from the upper-level controllers; ii) deployment of edge virtualized services is made, according to client requests; iii) the client requests are served by edge services and the related traffic is balanced among the alternative on-demand routing paths to the edge location where each service is available for its clients; iv) the TCP traffic quality is protected from unfair competitiveness of UDP flows; and v) a set of redundant controllers is orchestrated by a top-level multi-thread cluster manager, using a novel management protocol with low overhead.

cs.NI↗

arXiv2021

SDN-Based Intrusion Detection System for Early Detection and Mitigation of DDoS Attacks

The current paper addresses relevant network security vulnerabilities introduced by network devices within the emerging paradigm of Internet of Things (IoT) as well as the urgent need to mitigate the negative effects of some types of Distributed Denial of Service (DDoS) attacks that try to explore those security weaknesses. We design and implement a Software-Defined Intrusion Detection System (IDS) that reactively impairs the attacks at its origin, ensuring the normal operation of the network infrastructure. Our proposal includes an IDS that automatically detects several DDoS attacks, and then as an attack is detected, it notifies a Software Defined Networking (SDN) controller. The current proposal also downloads some convenient traffic forwarding decisions from the SDN controller to network devices. The evaluation results suggest that our proposal timely detects several types of cyber-attacks based on DDoS, mitigates their negative impacts on the network performance, and ensures the correct data delivery of normal traffic. Our work sheds light on the programming relevance over an abstracted view of the network infrastructure to timely detect a Botnet exploitation, mitigate malicious traffic at its source, and protect benign traffic.

cs.CR↗

arXiv2021

PMIPv6 Integrated with MIH for Flow Mobility Management: a Real Testbed with Simultaneous Multi-Access in Heterogeneous Mobile Networks

The exponential growth of the number of multihomed mobile devices is changing the way how we can connect to the Internet. Our mobile devices are demanding for more network resources, in terms of traffic volume and QoS requirements. Unfortunately, it is very hard to a multihomed device to be simultaneously connected to the network through multiple links. The current work enhances the network access of multihomed devices agnostically to the deployed access technologies. This enhancement is achieved by using simultaneously all of the mobile devices interfaces, and by routing each individual data flow through the most convenient access technology. The proposed solution is only deployed at the network side and it extends Proxy Mobile IPv6 with flow mobility in a completely transparent way to mobile nodes. In fact, it gives particular attention to the handover mechanisms, by improving the detection and attachment of nodes in the network, with the inclusion of the IEEE 802.21 standard in the solution. This provides the necessary implementation and integration details to extend a network topology with femtocell devices. Each femtocell is equipped with various network interfaces supporting a diverse set of access technologies. There is also a decision entity that manages individually each data flow according to its QoS / QoE requisites. The proposed solution has been developed and extensively tested with a real prototype. Evaluation results evidence that the overhead for using the solution is negligible as compared to the offered advantages such as: the support of flow mobility, the fulfil of VoIP functional requisites, the session continuity in spite of flows mobility, its low overhead, its high scalability, and the complete transparency of the proposed solution to the user terminals.

cs.NI↗

arXiv2020

Fog Computing Systems: State of the Art, Research Issues and Future Trends, with a Focus on Resilience

Many future innovative computing services will use Fog Computing Systems (FCS), integrated with Internet of Things (IoT) resources. These new services, built on the convergence of several distinct technologies, need to fulfil time-sensitive functions, provide variable levels of integration with their environment, and incorporate data storage, computation, communications, sensing, and control. There are, however, significant problems to be solved before such systems can be considered fit for purpose. The high heterogeneity, complexity, and dynamics of these resource-constrained systems bring new challenges to their robust and reliable operation, which implies the need for integral resilience management strategies. This paper surveys the state of the art in the relevant fields, and discusses the research issues and future trends that are emerging. We envisage future applications that have very stringent requirements, notably high-precision latency and synchronization between a large set of flows, where FCSs are key to supporting them. Thus, we hope to provide new insights into the design and management of resilient FCSs that are formed by IoT devices, edge computer servers and wireless sensor networks; these systems can be modelled using Game Theory, and flexibly programmed with the latest software and virtualization platforms.

cs.CR↗

arXiv2020

Resilient Cyber-Physical Systems: Using NFV Orchestration

Cyber-Physical Systems (CPSs) are increasingly important in critical areas of our society such as intelligent power grids, next generation mobile devices, and smart buildings. CPS operation has characteristics including considerable heterogeneity, variable dynamics, and high complexity. These systems have also scarce resources in order to satisfy their entire load demand, which can be divided into data processing and service execution. These new characteristics of CPSs need to be managed with novel strategies to ensure their resilient operation. Towards this goal, we propose an SDN-based solution enhanced by distributed Network Function Virtualization (NFV) modules located at the top-most level of our solution architecture. These NFV agents will take orchestrated management decisions among themselves to ensure a resilient CPS configuration against threats, and an optimum operation of the CPS. For this, we study and compare two distinct incentive mechanisms to enforce cooperation among NFVs. Thus, we aim to offer novel perspectives into the management of resilient CPSs, embedding IoT devices, modeled by Game Theory (GT), using the latest software and virtualization platforms.

cs.CR↗

arXiv2019

Game Theory for Multi-Access Edge Computing: Survey, Use Cases, and Future Trends

Game Theory (GT) has been used with significant success to formulate, and either design or optimize, the operation of many representative communications and networking scenarios. The games in these scenarios involve, as usual, diverse players with conflicting goals. This paper primarily surveys the literature that has applied theoretical games to wireless networks, emphasizing use cases of upcoming Multi-Access Edge Computing (MEC). MEC is relatively new and offers cloud services at the network periphery, aiming to reduce service latency backhaul load, and enhance relevant operational aspects such as Quality of Experience or security. Our presentation of GT is focused on the major challenges imposed by MEC services over the wireless resources. The survey is divided into classical and evolutionary games. Then, our discussion proceeds to more specific aspects which have a considerable impact on the game usefulness, namely: rational vs. evolving strategies, cooperation among players, available game information, the way the game is played (single turn, repeated), the game model evaluation, and how the model results can be applied for both optimizing resource-constrained resources and balancing diverse trade-offs in real edge networking scenarios. Finally, we reflect on lessons learned, highlighting future trends and research directions for applying theoretical model games in upcoming MEC services, considering both network design issues and usage scenarios.

cs.GT↗

arXiv2016

Efficient Access of Mobile Flows to Heterogeneous Networks under Flash Crowds

Future wireless networks need to offer orders of magnitude more capacity to address the predicted growth in mobile traffic demand. Operators to enhance the capacity of cellular networks are increasingly using WiFi to offload traffic from their core networks. This paper deals with the efficient and flexible management of a heterogeneous networking environment offering wireless access to multimode terminals. This wireless access is evaluated under disruptive usage scenarios, such as flash crowds, which can mean unwanted severe congestion on a specific operator network whilst the remaining available capacity from other access technologies is not being used. To address these issues, we propose a scalable network assisted distributed solution that is administered by centralized policies, and an embedded reputation system, by which initially selfish operators are encouraged to cooperate under the threat of churn. Our solution after detecting a congested technology, including within its wired backhaul, automatically offloads and balances the flows amongst the access resources from all the existing technologies, following some quality metrics. Our results show that the smart integration of access networks can yield an additional wireless quality for mobile flows up to thirty eight percent beyond that feasible from the best effort standalone operation of each wireless access technology. It is also evidenced that backhaul constraints are conveniently reflected on the way the flow access to wireless media is granted. Finally, we have analyzed the sensitivity of the handover decision algorithm running in each terminal agent to consecutive flash crowds, as well as its centralized feature that controls the connection quality offered by a heterogeneous access infrastructure owned by distinct operators.

cs.NI↗

arXiv2016

Security and Privacy Issues of Big Data

This chapter revises the most important aspects in how computing infrastructures should be configured and intelligently managed to fulfill the most notably security aspects required by Big Data applications. One of them is privacy. It is a pertinent aspect to be addressed because users share more and more personal data and content through their devices and computers to social networks and public clouds. So, a secure framework to social networks is a very hot topic research. This last topic is addressed in one of the two sections of the current chapter with case studies. In addition, the traditional mechanisms to support security such as firewalls and demilitarized zones are not suitable to be applied in computing systems to support Big Data. SDN is an emergent management solution that could become a convenient mechanism to implement security in Big Data systems, as we show through a second case study at the end of the chapter. This also discusses current relevant work and identifies open issues.

cs.CR↗

arXiv2016

Review and Analysis of Networking Challenges in Cloud Computing

Cloud Computing offers virtualized computing, storage, and networking resources, over the Internet, to organizations and individual users in a completely dynamic way. These cloud resources are cheaper, easier to manage, and more elastic than sets of local, physical, ones. This encourages customers to outsource their applications and services to the cloud. The migration of both data and applications outside the administrative domain of customers into a shared environment imposes transversal, functional problems across distinct platforms and technologies. This article provides a contemporary discussion of the most relevant functional problems associated with the current evolution of Cloud Computing, mainly from the network perspective. The paper also gives a concise description of Cloud Computing concepts and technologies. It starts with a brief history about cloud computing, tracing its roots. Then, architectural models of cloud services are described, and the most relevant products for Cloud Computing are briefly discussed along with a comprehensive literature review. The paper highlights and analyzes the most pertinent and practical network issues of relevance to the provision of high-assurance cloud services through the Internet, including security. Finally, trends and future research directions are also presented.

cs.NI↗

arXiv2016

Future Trends and Challenges for Mobile and Convergent Networks

Some traffic characteristics like real-time, location-based, and community-inspired, as well as the exponential increase on the data traffic in mobile networks, are challenging the academia and standardization communities to manage these networks in completely novel and intelligent ways, otherwise, current network infrastructures can not offer a connection service with an acceptable quality for both emergent traffic demand and application requisites. In this way, a very relevant research problem that needs to be addressed is how a heterogeneous wireless access infrastructure should be controlled to offer a network access with a proper level of quality for diverse flows ending at multi-mode devices in mobile scenarios. The current chapter reviews recent research and standardization work developed under the most used wireless access technologies and mobile access proposals. It comprehensively outlines the impact on the deployment of those technologies in future networking environments, not only on the network performance but also in how the most important requirements of several relevant players, such as, content providers, network operators, and users/terminals can be addressed. Finally, the chapter concludes referring the most notable aspects in how the environment of future networks are expected to evolve like technology convergence, service convergence, terminal convergence, market convergence, environmental awareness, energy-efficiency, self-organized and intelligent infrastructure, as well as the most important functional requisites to be addressed through that infrastructure such as flow mobility, data offloading, load balancing and vertical multihoming.

cs.NI↗

arXiv2016

Intelligent Management and Efficient Operation of Big Data

This chapter details how Big Data can be used and implemented in networking and computing infrastructures. Specifically, it addresses three main aspects: the timely extraction of relevant knowledge from heterogeneous, and very often unstructured large data sources, the enhancement on the performance of processing and networking (cloud) infrastructures that are the most important foundational pillars of Big Data applications or services, and novel ways to efficiently manage network infrastructures with high-level composed policies for supporting the transmission of large amounts of data with distinct requisites (video vs. non-video). A case study involving an intelligent management solution to route data traffic with diverse requirements in a wide area Internet Exchange Point is presented, discussed in the context of Big Data, and evaluated.

cs.NI↗

arXiv2014

Asymptotically Efficient Distributed Estimation With Exponential Family Statistics

The paper studies the problem of distributed parameter estimation in multi-agent networks with exponential family observation statistics. A certainty-equivalence type distributed estimator of the consensus + innovations form is proposed in which, at each each observation sampling epoch agents update their local parameter estimates by appropriately combining the data received from their neighbors and the locally sensed new information (innovation). Under global observability of the networked sensing model, i.e., the ability to distinguish between different instances of the parameter value based on the joint observation statistics, and mean connectivity of the inter-agent communication network, the proposed estimator is shown to yield consistent parameter estimates at each network agent. Further, it is shown that the distributed estimator is asymptotically efficient, in that, the asymptotic covariances of the agent estimates coincide with that of the optimal centralized estimator, i.e., the inverse of the centralized Fisher information rate. From a technical viewpoint, the proposed distributed estimator leads to non-Markovian mixed timescale stochastic recursions and the analytical methods developed in the paper contribute to the general theory of distributed stochastic approximation.

math.PR↗

arXiv2010

Moderate Deviations of the Random Riccati Equation

We characterize the invariant filtering measures resulting from Kalman filtering with intermittent observations (\cite{Bruno}), where the observation arrival is modeled as a Bernoulli process. In \cite{Riccati-weakconv}, it was shown that there exists a $\overlineγ^{\{\scriptsize{sb}}}>0$ such that for every observation packet arrival probability $\overlineγ$, $\overlineγ>\overlineγ^{\{\scriptsize{sb}}}>0$, the sequence of random conditional error covariance matrices converges in distribution to a unique invariant distribution $\mathbbμ^{\overlineγ}$ (independent of the filter initialization.) In this paper, we prove that, for controllable and observable systems, $\overlineγ^{\{\scriptsize{sb}}}=0$ and that, as $\overlineγ\uparrow 1$, the family $\{\mathbbμ^{\overlineγ}\}_{\overlineγ>0}$ of invariant distributions satisfies a moderate deviations principle (MDP) with a good rate function $I$. The rate function $I$ is explicitly identified. In particular, our results show:

math.PR↗