Searcharxiv⌕ Search

arXiv subjects

Mohammad Shojafar

Publications and source records attributed to Mohammad Shojafar.

At least 19 recordsLinked to original sources
arXiv2026

From Reactive to Agentic Resilience: Multi-Timescale AI-RAN Orchestration Under Signaling Storms

Next-generation open radio access network (Open RAN) and AI-RAN deployments turn the RAN into a disaggregated, compute-aware platform whose service continuity depends on many control loops acting at different timescales. Resilience in this setting is best seen as a lifecycle spanning anticipation, absorption, adaptation, recovery, and evolution. Yet, existing mechanisms remain stage-specific and are rarely coordinated across the control hierarchy. This paper argues that agentic AI offers an orchestration layer that coordinates this lifecycle, turning operator intent into coordinated action while keeping slow language-model reasoning off the fast control path. Using mass-attachment signaling storms as a running study, we build a discrete-event Open RAN attach simulator that captures retry amplification, shared-compute contention, and non-instantaneous provisioning, and we propose a three-tier framework in which an orchestrator at the service management and orchestration layer sets a standing policy, a per-site non-real-time agent judges storms and anticipates scheduled crowds, and a deterministic near-real-time loop enforces every decision. Across experiments, the agentic controller approaches the resilience of a fully provisioned pool of servers at a quarter of its capacity by reading a scheduled event from a calendar and provisioning ahead of it. No reactive weight setting recovers this once the surge arrives. Free-text operator intents ground into control directives at 94% exact match on previously unseen intents, and a single instruction reshapes live behavior end to end. We also quantify the latency, cost, and contention limits that bound it. The supplementary material provides analytical proof of the derived Theorem on anticipation horizon, as well as the subsequent Corollary results on reactive provisioning limits.

cs.NI↗
arXiv2026

Authority-Bound Governance of Heterogeneous AI Security Decisions in Telecom and IoT Networks

Artificial intelligence (AI)-enabled security decision systems in telecom and IoT networks can draw on heterogeneous models whose outputs may trigger operational actions. Recording such decisions on a blockchain does not establish that they are authorised, applicable, policy-consistent, or still valid at execution time. This paper presents governance-2, an authority-bound and fail-closed architecture that separates upstream scientific decision formation from downstream operational enforcement. Each governed case is bound to registered dataset, model, policy, deployment, and optional refiner authorities. Smart-contract checks enforce role separation, authority compatibility, score-to-state and state-to-action consistency, lifecycle validity, replay protection, pause control, authority revocation, and exact-action execution. Evaluation uses two independent branches: a controlled spectrum-access replay with four frozen heterogeneous decision configurations and a measured radio-frequency branch based on WiFiSpectralJam. Across eight frozen measured-data decision streams, governance-2 processes 153,744 stream-case instances derived from 19,218 measured captures while preserving interference-specific semantics and unresolved review states. The full contract rejects all tested invalid operations; stateful invariant testing completes 2,000 generated transaction sequences with zero invariant violations; and single-capability ablation shows that removing an enforcement family exposes its assigned invalid operations while unrelated protections remain active. The results indicate that heterogeneous AI security decisions can share a common governance plane across telecom and IoT settings without redefining their scientific semantics.

cs.CR↗
arXiv2026

When Does AI Supervision Help? A Role-Aware Study of Network Fraud Decision Management with Blockchain Auditability

When does a second artificial intelligence (AI) component improve a primary network-fraud decision rather than add operational burden? We study this question through a role-aware Decider-Supervisor (DS) framework with blockchain auditability, evaluating four directional configurations that combine centralised machine learning, a Federated Averaging (FedAvg)-trained federated meta-model, and Base or Quantized Low-Rank Adaptation (QLoRA) large language model variants. The analysis compares primary-only and supervised decisions using non-hard fraud performance, intervention burden, conditional calibration, traffic-mix and Review-capacity sensitivity, dependability tests, and blockchain lifecycle controls. The deterministic hard gate resolves 89.994% of fraudulent requests, leaving the non-hard population as the main AI decision setting. Conditional validation calibration does not produce a consistently transferable supervisory advantage on deployment replay. DS-3 QLoRA is the least disruptive supervised configuration, but it still underperforms its primary FedAvg stage in F1 and total errors. Across 36 reweighted traffic mixtures, supervision reduces total errors only for DS-4 Base in two extreme high-fraud scenarios. Blockchain tests support digest verification, tamper detection, authorisation, single-use review resolution, and post-finalisation integrity, while exposing a pre-finalisation single-write limitation. The results show that the value of AI supervision depends on role assignment, calibration, escalation policy, traffic composition, and lifecycle controls rather than on the presence of a second model alone.

cs.AI↗
arXiv2026

rApp/xApp Attestation: A New Security Use Case for O-RAN

The disaggregation and softwarization introduced by the Open Radio Access Network (O-RAN) architecture enable multi-vendor innovation but also expose the RAN Intelligent Controller (RIC) ecosystem to new runtime security risks. Existing O-RAN specifications define strong safeguards for onboarding, authentication, identity management, and secure communication; however, they do not provide a concrete mechanism for verifying whether deployed rApps and xApps remain in their intended, untampered state during operation. This paper introduces rApp/xApp attestation as a RIC-native O-RAN security use case for runtime integrity verification. Rather than proposing a new cryptographic protocol, the work defines how existing integrity verification techniques can be integrated into O-RAN through attestation modules, attestation agents, RIC application interfaces, and SMO-driven policy coordination. We map the use case to relevant O-RAN Alliance working groups, identify required standardization extensions, and demonstrate feasibility through a lightweight hash-based prototype implemented on the Near-RT RIC platform. Experimental results show attestation latencies below 40 ms across multiple cryptographic hash functions, indicating that runtime attestation can be performed without disrupting time-sensitive RIC operations when appropriately scheduled. Finally, we discuss remaining technical and standardization challenges, including trusted verification, known-good runtime states, scalability, mitigation policies, and future hybrid attestation mechanisms.

cs.CR↗
arXiv2026

Free-Text Evaluation of LLMs for 5G Domain Knowledge and Fault Analysis using LLM-as-Judge

Real-world fault analysis in 5G and emerging 6G networks demands domain expertise to analyze free-text diagnostics, including root-cause explanations and recommended actions. LLMs have emerged as a promising approach to automating this, yet whether lightweight, edge-deployable models are capable of performing in-depth free-text diagnostics remains an open question. While existing benchmarks rely on restrictive MCQs with fixed answer keys, this paper evaluates 5G domain understanding and fault analysis in a free-text generation format. Transitioning to this paradigm requires evaluating lightweight, edge-deployable AI models on open-ended diagnostic reasoning, alongside a dependable framework to validate these text outputs at scale. To address this we evaluate three lightweight LLMs, Claude-Haiku-4.5, GPT-5.4-Mini, and Gemini-3.1-Flash-Lite, on free-text 5G domain knowledge and fault-analysis tasks across three benchmarks, TeleQNA ORAN FT, 5G-Faults FT, and TeleInter FT. Three independent frontier judges score outputs, and pairwise inter-judge agreement is measured as an empirical test of the LLM-as-Judge methodology. All three models reach at least 90% accuracy on fault diagnosis, while zero-shot recall of 3GPP and O-RAN specifications remains the critical gap, with all models scoring below 60%. Mean inter-judge agreement is at least 0.90 across all runs, indicating that multi-judge LLM scoring produces consistent, reproducible grades for open-ended telecom responses. Operationally, Gemini-3.1-Flash-Lite offers the best efficiency trade-off, combining competitive accuracy with the lowest inference cost and latency, making it the most suitable candidate for production telecom deployments.

cs.CL↗
arXiv2026

On the Use of AI-Driven Immersive Digital Technologies for Designing and Operating UAVs

Uncrewed Aerial Vehicles (UAVs) offer agile, cost-effective, and efficient solutions for communication relay networks. However, their modeling and control are challenging, and the mismatch between simulations and actual conditions limits real-world deployment, while maintaining adequate situational awareness remains essential for safe operation. Several studies have proposed integrating UAV operations with immersive digital technologies, such as Digital Twin (DT) and Extended Reality (XR), to overcome these challenges. This paper provides a comprehensive overview of the latest research and developments involving immersive digital technologies for UAVs. We explore the use of Machine Learning (ML) techniques, particularly Deep Reinforcement Learning (DRL), to improve the capabilities of DT for UAV systems, and present a case study of a DT-driven DRL pipeline that couples bidirectional physical-digital synchronization with online recursive least-squares channel calibration for UAV resource allocation. We further present a second case study in which a diffusion-augmented digital twin, kept statistically faithful to the physical swarm by the same online calibration loop, drives multi-UAV velocity coordination. We identify and discuss key research gaps, and propose countermeasures based on Generative AI (GAI), emphasizing the significant role of AI in advancing DT technology for UAVs. Furthermore, we review and discuss how the XR technology can transform UAV operations with the support of GAI, and examine its practical challenges. Finally, we propose future research directions to further develop the application of immersive digital technologies for UAV operation.

cs.RO↗
arXiv2026

LLM-Centric Agentic AI for UAV Swarms: Architecture, Enabling Technologies, and Open Problems

Uncrewed Aerial Vehicle (UAV) swarms have significant potential for applications such as Search and Rescue (SAR) and environmental monitoring, but their real-world deployment is limited by a lack of situational awareness, intermittent connectivity, and significant cybersecurity risks. Agentic Artificial Intelligence (AI) represents a shift from standalone Large Language Model (LLM) toward closed-loop cognitive architectures that integrate perception, memory, reasoning/planning, and action to enable adaptive, goal-directed swarm behavior. Within this framework, Agentic AI provides a unifying structure for autonomous and adaptive swarm operations while expanding the system attack surface compared to conventional AI systems. This paper proposes LLM-Centric Agentic AI for UAV Swarms (LAUS) and reviews key enabling technologies such as onboard and edge computing, 5G/6G connectivity, multimodal intelligence, and cybersecurity mechanisms, and analyzes threats such as Priority Manipulation Attacks (PMA) that can distort decision-making and degrade network performance. Finally, it identifies open research challenges, including hallucination-resistant reasoning, onboard LLM deployment under SWaP constraints, and standardized security benchmarks for perception-reasoning attacks in agentic UAV systems.

cs.RO↗
arXiv2026

Agentic AI-RAN: Enabling Intent-Driven, Explainable and Self-Evolving Open RAN Intelligence

Open RAN (O-RAN) exposes rich control and telemetry interfaces across the Non-RT RIC, Near-RT RIC, and distributed units, but also makes it harder to operate multi-tenant, multi-objective RANs in a safe and auditable manner. In parallel, agentic AI systems with explicit planning, tool use, memory, and self-management offer a natural way to structure long-lived control loops. This article surveys how such agentic controllers can be brought into O-RAN: we review the O-RAN architecture, contrast agentic controllers with conventional ML/RL xApps, and organise the task landscape around three clusters: network slice life-cycle, radio resource management (RRM) closed loops, and cross-cutting security, privacy, and compliance. We then introduce a small set of agentic primitives (Plan-Act-Observe-Reflect, skills as tool use, memory and evidence, and self-management gates) and show, in a multi-cell O-RAN simulation, how they improve slice life-cycle and RRM performance compared to conventional baselines and ablations that remove individual primitives. Security, privacy, and compliance are discussed as architectural constraints and open challenges for standards-aligned deployments. This framework achieves an average 8.83\% reduction in resource usage across three classic network slices.

cs.LG↗
arXiv2026

Agentic AI for 6G: A New Paradigm for Autonomous RAN Security Compliance

Agentic AI systems are emerging as powerful tools for automating complex, multi-step tasks across various industries. One such industry is telecommunications, where the growing complexity of next-generation radio access networks (RANs) opens up numerous opportunities for applying these systems. Securing the RAN is a key area, particularly through automating the security compliance process, as traditional methods often struggle to keep pace with evolving specifications and real-time changes. In this article, we propose a framework that leverages LLM-based AI agents integrated with a retrieval-augmented generation (RAG) pipeline to enable intelligent and autonomous enforcement of security compliance. An initial case study demonstrates how an agent can assess configuration files for compliance with O-RAN Alliance and 3GPP standards, generate explainable justifications, and propose automated remediation if needed. We also highlight key challenges such as model hallucinations and vendor inconsistencies, along with considerations like agent security, transparency, and system trust. Finally, we outline future directions, emphasizing the need for telecom-specific LLMs and standardized evaluation frameworks.

cs.NI↗
arXiv2026

Solving the Post-Quantum Control Plane Bottleneck: Energy-Aware Cryptographic Scheduling in Open RAN

The Open Radio Access Network (O-RAN) offers flexibility and innovation but introduces unique security vulnerabilities, particularly from cryptographically relevant quantum computers. While Post-Quantum Cryptography (PQC) is the primary scalable defence, its computationally intensive handshakes create a significant bottleneck for the RAN control plane, posing sustainability challenges. This paper proposes an energy-aware framework to solve this PQC bottleneck, ensuring quantum resilience without sacrificing operational energy efficiency. The system employs an O-RAN aligned split: a Crypto Policy rApp residing in the Non-Real-Time (Non-RT) RIC defines the strategic security envelope (including PQC suites), while a Security Operations Scheduling (SOS) xApp in the Near-RT RIC converts these into tactical timing and placement intents. Cryptographic enforcement remains at standards-compliant endpoints: the Open Fronthaul utilizes Media Access Control Security (MACsec) at the O-DU/O-RU, while the xhaul (midhaul and backhaul) utilizes IP Security (IPsec) at tunnel terminators. The SOS xApp reduces PQC overhead by batching non-urgent handshakes, prioritizing session resumption, and selecting parameters that meet slice SLAs while minimizing joules per secure connection. We evaluate the architecture via a Discrete-Event Simulation (DES) using 3GPP-aligned traffic profiles and verified hardware benchmarks from literature. Results show that intelligent scheduling can reduce per-handshake energy by approximately 60 percent without violating slice latency targets.

cs.CR↗
arXiv2026

IE-RAP: An Intelligence and Efficient Reader Anti-Collision Protocol for Dense RFID Networks

An advanced technology known as a radio frequency identification (RFID) system enables seamless wireless communication between tags and readers. This system operates in what is referred to as a dense reader environment, where readers are placed close to each other to optimize coverage. However, this setup comes with its challenges, as it increases the likelihood of collisions between readers and tags (reader-to-reader and reader-to-tag), leading to reduced network performance. To address this issue, various protocols have been proposed, with centralized solutions emerging as promising options due to their ability to deliver higher throughput. In this paper, we propose the Intelligence and Efficient Reader Anti-collision Protocol (IE-RAP) that improves network performance such as throughput, average waiting time, and energy consumption, which employs a powerful combination of Time Division Multiple Access (TDMA) and Frequency Division Multiple Access (FDMA) mechanisms. IE-RAP improves the efficiency of RFID networks through techniques such as the SIFT function and distance calculation between readers. By preventing re-read tags and ensuring the on-time release of the communication channel, we effectively eliminate unnecessary collisions. Our simulations emphasize the superiority of our proposed method, it increases 26% throughput, reduces 74% the average waiting time, and lower by 52% the energy consumption compared to existing approaches. Importantly, our solution supports the seamless integration of mobile readers within the network.

cs.NI↗
arXiv2026

Talk Like a Packet: Rethinking Network Traffic Analysis with Transformer Foundation Models

Inspired by the success of Transformer-based models in natural language processing, this paper investigates their potential as foundation models for network traffic analysis. We propose a unified pre-training and fine-tuning pipeline for traffic foundation models. Through fine-tuning, we demonstrate the generalizability of the traffic foundation models in various downstream tasks, including traffic classification, traffic characteristic prediction, and traffic generation. We also compare against non-foundation baselines, demonstrating that the foundation-model backbones achieve improved performance. Moreover, we categorize existing models based on their architecture, input modality, and pre-training strategy. Our findings show that these models can effectively learn traffic representations and perform well with limited labeled datasets, highlighting their potential in future intelligent network analysis systems.

cs.NI↗
arXiv2026

Towards a Multi-Layer Defence Framework for Securing Near-Real-Time Operations in Open RAN

Securing the near-real-time (near-RT) control operations in Open Radio Access Networks (Open RAN) is increasingly critical, yet remains insufficiently addressed, as new runtime threats target the control loop while the system is operational. In this paper, we propose a multi-layer defence framework designed to enhance the security of near-RT RAN Intelligent Controller (RIC) operations. We classify operational-time threats into three categories, message-level, data-level, and control logic-level, and design and implement a dedicated detection and mitigation component for each: a signature-based E2 message inspection module performing structural and semantic validation of signalling exchanges, a telemetry poisoning detector based on temporal anomaly scoring using an LSTM network, and a runtime xApp attestation mechanism based on execution-time hash challenge-response. The framework is evaluated on an O-RAN testbed comprising FlexRIC and a commercial RAN emulator, demonstrating effective detection rates, low latency overheads, and practical integration feasibility. Results indicate that the proposed safeguards can operate within near-RT time constraints while significantly improving protection against runtime attacks, introducing less than 80 ms overhead for a network with 500 User Equipment (UEs). Overall, this work lays the foundation for deployable, layered, and policy-driven runtime security architectures for the near-RT RIC control loop in Open RAN, and provides an extensible framework into which future mitigation policies and threat-specific modules can be integrated.

cs.CR↗
arXiv2025

Energy-Efficient Resource Management in Microservices-based Fog and Edge Computing: State-of-the-Art and Future Directions

The exponential growth of Internet of Things (IoT) devices has intensified the demand for efficient and responsive services. To address this demand, fog and edge computing have emerged as distributed paradigms that bring computational resources closer to end users, reducing latency, bandwidth limitations, and energy consumption. However, these paradigms present challenges in resource management due to resource constraints, computational heterogeneity, dynamic workloads, and diverse Quality of Service (QoS) requirements. This paper presents a comprehensive survey of state-of-the-art resource management strategies in microservices-based fog and edge computing, focusing on energy-efficient solutions. We systematically review and classify more than 136 studies (2020-2024) into five key subdomains: service placement, resource provisioning, task scheduling and offloading, resource allocation, and instance selection. Our categorization is based on optimization techniques, targeted objectives, and the strengths and limitations of each approach. In addition, we examine existing surveys and identify unresolved challenges and gaps in the literature. By highlighting the lack of synergy among fundamental resource management components, we outline promising research directions leveraging AI-driven optimization, quantum computing, and serverless computing. This survey serves as a comprehensive reference for researchers and practitioners by providing a unified and energy-aware perspective on resource management in microservices-based fog and edge computing, paving the way for more integrated, efficient, and sustainable future solutions.

cs.DC↗
arXiv2025

Interpretable Anomaly-Based DDoS Detection in AI-RAN with XAI and LLMs

Next generation Radio Access Networks (RANs) introduce programmability, intelligence, and near real-time control through intelligent controllers, enabling enhanced security within the RAN and across broader 5G/6G infrastructures. This paper presents a comprehensive survey highlighting opportunities, challenges, and research gaps for Large Language Models (LLMs)-assisted explainable (XAI) intrusion detection (IDS) for secure future RAN environments. Motivated by this, we propose an LLM interpretable anomaly-based detection system for distributed denial-of-service (DDoS) attacks using multivariate time series key performance measures (KPMs), extracted from E2 nodes, within the Near Real-Time RAN Intelligent Controller (Near-RT RIC). An LSTM-based model is trained to identify malicious User Equipment (UE) behavior based on these KPMs. To enhance transparency, we apply post-hoc local explainability methods such as LIME and SHAP to interpret individual predictions. Furthermore, LLMs are employed to convert technical explanations into natural-language insights accessible to non-expert users. Experimental results on real 5G network KPMs demonstrate that our framework achieves high detection accuracy (F1-score > 0.96) while delivering actionable and interpretable outputs.

cs.CR↗
arXiv2025

Quantum Enhanced Entropy Pool for Cryptographic Applications and Proofs

This paper investigates the integration of quantum randomness into Verifiable Random Functions (VRFs) using the Ed25519 elliptic curve to strengthen cryptographic security. By replacing traditional pseudorandom number generators with quantum entropy sources, we assess the impact on key security and performance metrics, including execution time, and resource usage. Our approach simulates a modified VRF setup where initialization keys are derived from a quantum random number generator source (QRNG). The results show that while QRNGs could enhance the unpredictability and verifiability of VRFs, their incorporation introduces challenges related to temporal and computational overhead. This study provides valuable insights into the trade-offs of leveraging quantum randomness in API-driven cryptographic systems and offers a potential path toward more secure and efficient protocol design. The QRNG-based system shows increased (key generation times from 50 to 400+ microseconds, verification times from 500 to 3500 microseconds) and higher CPU usage (17% to 30%) compared to the more consistent performance of a Go-based VRF (key generation times below 200 microseconds, verification times under 2000 microseconds, CPU usage below 10%), highlighting trade-offs in computational efficiency and resource demands.

cs.CR↗
arXiv2025

KPI Poisoning: An Attack in Open RAN Near Real-Time Control Loop

Open Radio Access Network (Open RAN) is a new paradigm to provide fundamental features for supporting next-generation mobile networks. Disaggregation, virtualisation, closed-loop data-driven control, and open interfaces bring flexibility and interoperability to the network deployment. However, these features also create a new surface for security threats. In this paper, we introduce Key Performance Indicators (KPIs) poisoning attack in Near Real-Time control loops as a new form of threat that can have significant effects on the Open RAN functionality. This threat can arise from traffic spoofing on the E2 interface or compromised E2 nodes. The role of KPIs is explored in the use cases of Near Real-Time control loops. Then, the potential impacts of the attack are analysed. An ML-based approach is proposed to detect poisoned KPI values before using them in control loops. Emulations are conducted to generate KPI reports and inject anomalies into the values. A Long Short-Term Memory (LSTM) neural network model is used to detect anomalies. The results show that more amplified injected values are more accessible to detect, and using more report sequences leads to better performance in anomaly detection, with detection rates improving from 62% to 99%.

cs.NI↗
arXiv2025

Surviving the Storm: The Impacts of Open RAN Disaggregation on Latency and Resilience

The development of Open Radio Access Networks (Open RAN), with their disaggregated architectures and virtualization of network functions, has brought considerable flexibility and cost savings to mobile networks. However, these architectural advancements introduce additional latency during the initial attachment procedure of User Equipment (UE), increasing the risk of signaling storms. This paper investigates the latency impact due to disaggregation of the Base-band Unit (BBU) into the Central Unit (CU) and Distributed Unit (DU). Specifically, we model the delays induced due to disaggregation on UE attachment, analyzing the performance under varying load conditions, and sensitivity to processing times. We demonstrate that while both monolithic and Open RAN architectures experience performance degradation under high-load conditions, Open RAN's added overheads can increase its susceptibility to congestion and signaling storms. However, Open RAN's inherent flexibility, enabled by disaggregation and virtualization, allows efficient deployment of resources, faster service deployment, and adaptive congestion control mechanisms to mitigate these risks and enhance overall system resilience. Thereby, we quantify resilience by introducing a new utility function and propose a novel adaptation mechanism to reinforce Open RAN's robustness against signaling storms. Our results show that the proposed adaptive mechanism significantly enhances resilience, achieving improvements of up to 286% over fixed configurations, with resilience scores approaching 0.96 under optimal conditions. While simulation results show that Open RAN disaggregation increases attachment latency and susceptibility to signaling congestion, they also highlight that its architectural flexibility can mitigate these effects, improving resilience under high-load conditions.

cs.NI↗