Searcharxiv⌕ Search

arXiv subjects

Raouf Boutaba

Publications and source records attributed to Raouf Boutaba.

At least 19 recordsLinked to original sources
arXiv2026

Measurement-Device Placement in MDI-QKD Networks with Minimal Trusted Relays

Measurement-Device-Independent Quantum Key Distribution (MDI-QKD) removes detector side-channel vulnerabilities by delegating measurements to an untrusted relay that, when shared by several user pairs, acts as a Bell-state measurement (BSM) hub. Channel loss still limits the reach of MDI-QKD links, so long-range services rely on trusted relays for key forwarding. As MDI-QKD moves toward metropolitan deployment, a key network-planning question arises: how should BSM hubs be placed on existing fiber infrastructure to minimize the use of trusted relays? In this work, we formalize this challenge as the MDI-QKD Hub Deployment (MHD) problem. We first prove that the MHD problem is NP-hard, and then formulate it as a Mixed-Integer Linear Programming (MILP). To the best of our knowledge, this is the first formulation for MDI-QKD network planning that captures the structural features specific to MDI-QKD, namely a shared BSM hub, two-link user-to-hub routing, and loss-balancing constraints, while jointly determining hub placement, user-to-hub assignment, and trusted-relay demand allocation. Our solution accounts for realistic budget and capacity constraints, including practical insights from real-world deployments of commercial MDI-QKD solutions. Numerical evaluations on three metropolitan topologies (12 to 50 nodes) at realistic geographic distances show that topology structure governs trusted-relay demand: hub placement alone eliminates all trusted relays in compact urban meshes, while in sparse topologies, relaxing the loss-balancing constraint removes the dominant source of trusted-relay usage at no additional infrastructure cost. The key-rate threshold at which trusted relays first appear shifts monotonically with the network diameter, i.e., the largest shortest-path distance between any node pair in fiber kilometers, delineating the feasibility boundary of pure MDI-QKD deployment.

cs.NI↗
arXiv2026

Data-Driven Online Slice Admission Control and Resource Allocation in NextG Mobile Networks

Virtualization in 5G and beyond networks enables the creation of virtual networks (i.e., network slices) tailored to the needs of different applications. To maximize revenue under limited infrastructure resources, InPs must decide in real time whether to admit incoming slice requests (SRs) based on their resource demands and offered values, while accounting for the opportunity cost of consuming scarce resources. To address this challenge, we introduce Online Pricing-based Slice Admission Control and Resource Allocation (OPA) framework. This framework dynamically assigns pseudo-prices to resources that capture long-term scarcity and anticipated inter-temporal opportunity costs. The short-term admission and resource allocation decisions for each SR are then guided by these prices. Additionally, we design an exponential pricing strategy that guarantees bounded worst-case performance. To improve practical performance, we further develop a data-driven exponential pricing approach that learns from historical data. Evaluations on a real-world network topology show that it improves mean revenue by 32.2% and 26.7% over state-of-the-art DRL and optimization-based approaches, respectively, while reducing computational cost by an order of magnitude relative to the latter.

cs.NI↗
arXiv2026

Analyzing Symbolic Properties for DRL Agents in Systems and Networking

Deep reinforcement learning (DRL) has shown remarkable performance on complex control problems in systems and networking, including adaptive video streaming, wireless resource management, and congestion control. For safe deployment, however, it is critical to reason about how agents behave across the range of system states they encounter in practice. Existing verification-based methods in this domain primarily focus on point properties, defined around fixed input states, which offer limited coverage and require substantial manual effort to identify relevant input-output pairs for analysis. In this paper, we study symbolic properties, that specify expected behavior over ranges of input states, for DRL agents in systems and networking. We present a generic formulation for symbolic properties, with monotonicity and robustness as concrete examples, and show how they can be analyzed using existing DNN verification engines. Our approach encodes symbolic properties as comparisons between related executions of the same policy and decomposes them into practically tractable sub-properties. These techniques serve as practical enablers for applying existing verification tools to symbolic analysis. Using our framework, diffRL, we conduct an extensive empirical study across three DRL-based control systems, adaptive video streaming, wireless resource management, and congestion control. Through these case studies, we analyze symbolic properties over broad input ranges, examine how property satisfaction evolves during training, study the impact of model size on verifiability, and compare multiple verification backends. Our results show that symbolic properties provide substantially broader coverage than point properties and can uncover non-obvious, operationally meaningful counterexamples, while also revealing practical solver trade-offs and limitations.

cs.NI↗
arXiv2026

Graph-Neural Multi-Agent Coordination for Distributed Access-Point Selection in Cell-Free Massive MIMO

Cell-free massive MIMO (CFmMIMO) systems require scalable and reliable distributed coordination mechanisms to operate under stringent communication and latency constraints. A central challenge is the Access Point Selection (APS) problem, which seeks to determine the subset of serving Access Points (APs) for each User Equipment (UE) that can satisfy UEs' Spectral Efficiency (SE) requirements while minimizing network power consumption. We introduce APS-GNN, a scalable distributed multi-agent learning framework that decomposes APS into agents operating at the granularity of individual AP-UE connections. Agents coordinate via local observation exchange over a novel Graph Neural Network (GNN) architecture and share parameters to reuse their knowledge and experience. APS-GNN adopts a constrained reinforcement learning approach to provide agents with explicit observability of APS' conflicting objectives, treating SE satisfaction as a cost and power reduction as a reward. Both signals are defined locally, facilitating effective credit assignment and scalable coordination in large networks. To further improve training stability and exploration efficiency, the policy is initialized via supervised imitation learning from a heuristic APS baseline. We develop a realistic CFmMIMO simulator and demonstrate that APS-GNN delivers the target SE while activating 50-70% fewer APs than heuristic and centralized Multi-agent Reinforcement Learning (MARL) baselines in different evaluation scenarios. Moreover, APS-GNN achieves one to two orders of magnitude lower inference latency than centralized MARL approaches due to its fully parallel and distributed execution. These results establish APS-GNN as a practical and scalable solution for APS in large-scale CFmMIMO networks.

cs.NI↗
arXiv2026

HyRA: A Hybrid Resource Allocation Framework for RAN Slicing

The advent of 5G and the emergence of 6G networks demand unprecedented flexibility and efficiency in Radio Access Network (RAN) resource management to satisfy diverse service-level agreements (SLAs). Existing RAN slicing frameworks predominantly rely on per-slice resource reservation, which ensures performance isolation but leads to inefficient utilization, particularly under bursty traffic. We introduce HyRA, a hybrid resource allocation framework for RAN slicing that combines dedicated per-slice allocations with shared resource pooling across slices. HyRA preserves performance isolation while improving resource efficiency by leveraging multiplexing gains in bursty traffic conditions. We formulate this design as a bi-level stochastic optimization problem, where the outer loop determines the dedicated and shared resource budgets and the inner loop performs per-UE scheduling under a novel water-filling approach. By using the sample-average approximation, the Karush-Kuhn-Tucker (KKT) conditions of the inner loop, and Big-M encoding, we transform the problem into a tractable mixed-integer program that standard optimization solvers can solve. Extensive simulations under diverse demand patterns, SLA configurations, and traffic burstiness show that HyRA achieves up to 50-75% spectrum savings compared to dedicated-only and shared-only baselines. These results highlight HyRA as a viable approach for resource-efficient, SLA-compliant RAN slicing in future mobile networks.

cs.NI↗
arXiv2025

Dynamic SLA-aware Network Slice Monitoring

Next-generation networks increasingly rely on network slices - logical networks tailored to specific application requirements, each with distinct Service-Level Agreements (SLAs). Ensuring compliance with these SLAs requires continuous, real-time monitoring of end-to-end performance metrics for each slice, within a limited telemetry budget. However, we find that existing solutions face two fundamental limitations: they either lack end-to-end visibility (e.g., sketches, probabilistic sampling) or provide visibility but lack the control mechanisms to dynamically allocate monitoring resources according to slice SLAs. We address this through a formal framework that reframes slice monitoring as a closed-loop control problem, and defines the minimal data plane requirements for SLA-aware slice monitoring via a telemetry primitive contract. We then present SliceScope, a realization of this framework that combines: (1) a control strategy that dynamically allocates the monitoring resources across diverse slices according to their SLA criticality, and (2) a data-plane based on change-triggered INT that provides per-packet end-to-end visibility with tunable accuracy-overhead trade-offs, satisfying the telemetry contract. Our evaluation results on programmable switches and in large-scale simulations with a mixture of different slice types, demonstrate that SliceScope tracks critical slices up to 4x more accurately compared to static baselines, while showing that change-triggered INT outperforms alternative primitives for realizing the telemetry primitive contract.

cs.NI↗
arXiv2025

Risk-Sensitive Online Selection with Bounded Adaptivity

Designing randomized online algorithms that perform reliably not only in expectation but also under unfavorable realizations of randomness is a fundamental challenge in online decision-making. In this paper, we study this challenge in online adversarial selection, where a decision maker allocates $k$ units of a resource to sequentially arriving buyers through posted prices. We focus on two intertwined considerations that are often overlooked simultaneously: tail-risk sensitivity and bounded adaptivity, where tail risk is measured using conditional value-at-risk (CVaR) and bounded adaptivity limits the number of allowable policy updates over time. Our main contribution is a correlated posted-price mechanism that uses a single random seed to coordinate pricing decisions across time. This correlation induces a monotonic ordering of pricing profiles across sample paths, improving lower-tail performance while respecting the adaptivity constraint. More broadly, our results highlight correlation as a mechanism for controlling tail risk in randomized online algorithms. Using this framework, we derive competitive guarantees for several regimes of the problem under both static and dynamic pricing. Our analysis develops a risk-sensitive randomized online primal-dual framework tailored to CVaR objectives and reveals a systematic trade-off between allowable adaptivity, risk sensitivity, and competitive performance. Experiments on real airline pricing data further illustrate the empirical impact of correlated pricing on welfare concentration and tail behavior.

cs.GT↗
arXiv2025

RAID: In-Network RA Signaling Storm Detection for 5G Open RAN

The disaggregation and virtualization of 5G Open RAN (O-RAN) introduces new vulnerabilities in the control plane that can greatly impact the quality of service (QoS) of latency-sensitive 5G applications and services. One critical issue is Random Access (RA) signaling storms where, a burst of illegitimate or misbehaving user equipments (UEs) send Radio Resource Control (RRC) connection requests that rapidly saturate a Central Unit's (CU) processing pipeline. Such storms trigger widespread connection failures within the short contention resolution window defined by 3GPP. Existing detection and mitigation approaches based on near-real-time RAN Intelligent Controller (n-RT RIC) applications cannot guarantee a timely reaction to such attacks as RIC control loops incur tens to hundreds of milliseconds of latency due to the non-deterministic nature of their general purpose processor (GPP) based architectures. This paper presents RAID, an in-network RA signaling storm detection and mitigation system that leverages P4-programmable switch ASICs to enable real-time protection from malicious attacks. RAID embeds a lightweight Random Forest (RF) classifier into a programmable Tofino switch, enabling line-rate flow classification with deterministic microsecond-scale inference delay. By performing ML-based detection directly in the data plane, RAID catches and filters malicious RA requests before they reach and overwhelm the RRC. RAID achieves above 94% detection accuracy with a fixed per-flow inference delay on the order of 3.4 microseconds, effectively meeting strict O-RAN control-plane deadlines. These improvements are sustained across multiple traffic loads, making RAID a fast and scalable solution for the detection and mitigation of signaling storms in 5G O-RAN.

cs.NI↗
arXiv2025

Rethinking Telemetry Design for Fine-Grained Anomaly Detection in 5G User Planes

Detecting QoS anomalies in 5G user planes requires fine-grained per-flow visibility, but existing telemetry approaches face a fundamental trade-off. Coarse per-class counters are lightweight but mask transient and per-flow anomalies, while per-packet telemetry postcards provide full visibility at prohibitive cost that grows linearly with line rate. Selective postcard schemes reduce overhead but miss anomalies that fall below configured thresholds or occur during brief intervals. We present Kestrel, a sketch-based telemetry system for 5G user planes that provides fine-grained visibility into key metric distributions such as latency tails and inter-arrival times at a fraction of the cost of per-packet postcards. Kestrel extends Count-Min Sketch with histogram-augmented buckets and per-queue partitioning, which compress per-packet measurements into compact summaries while preserving anomaly-relevant signals. We develop formal detectability guarantees that account for sketch collisions, yielding principled sizing rules and binning strategies that maximize anomaly separability. Our evaluations on a 5G testbed with Intel Tofino switches show that Kestrel achieves 10% better detection accuracy than existing selective postcard schemes while reducing export bandwidth by 10x.

cs.NI↗
arXiv2025

Towards Sub-millisecond Latency and Guaranteed Bit Rates in 5G User Plane

Next-generation services demand stringent Quality of Service (QoS) guarantees, such as per-flow bandwidth assurance, ultra-low latency, and traffic prioritization, posing significant challenges to 5G and beyond networks. As 5G network functions increasingly migrate to edge and central clouds, the transport layer becomes a critical enabler of end-to-end QoS compliance. However, traditional fixed-function infrastructure lacks the flexibility to support the diverse and dynamic QoS profiles standardized by 3GPP. This paper presents a QoS-aware data plane model for programmable transport networks, designed to provide predictable behavior and fine-grained service differentiation. The model supports all 3GPP QoS resource types and integrates per-flow metering, classification, strict priority scheduling, and delay-aware queuing. Implemented on off-the-shelf programmable hardware using P4 and evaluated on an Intel Tofino switch, our approach ensures per-flow bandwidth guarantees, sub-millisecond delay for delay-critical traffic, and resilience under congestion. Experimental results demonstrate that the model achieves microsecond-level latencies and near-zero packet loss for mission-critical flows, validating its suitability for future QoS-sensitive applications in 5G and beyond.

cs.NI↗
arXiv2025

Over-Threshold Multiparty Private Set Intersection for Collaborative Network Intrusion Detection

An important function of collaborative network intrusion detection is to analyze the network logs of the collaborators for joint IP addresses. However, sharing IP addresses in plain is sensitive and may be even subject to privacy legislation as it is personally identifiable information. In this paper, we present the privacy-preserving collection of IP addresses. We propose a single collector, over-threshold private set intersection protocol. In this protocol $N$ participants identify the IP addresses that appear in at least $t$ participant's sets without revealing any information about other IP addresses. Using a novel hashing scheme, we reduce the computational complexity of the previous state-of-the-art solution from $O(M(N \log{M}/t)^{2t})$ to $O(t^2M\binom{N}{t})$, where $M$ denotes the dataset size. This reduction makes it practically feasible to apply our protocol to real network logs. We test our protocol using joint networks logs of multiple institutions. Additionally, we present two deployment options: a collusion-safe deployment, which provides stronger security guarantees at the cost of increased communication overhead, and a non-interactive deployment, which assumes a non-colluding collector but offers significantly lower communication costs and applicable to many use cases of collaborative network intrusion detection similar to ours.

cs.CR↗
arXiv2025

Routing and Wavelength Assignment with Minimal Attack Radius for QKD Networks

Quantum Key Distribution (QKD) can distribute keys with guaranteed security but remains susceptible to key exchange interruption due to physical-layer threats, such as high-power jamming attacks. To address this challenge, we first introduce a novel metric, namely Maximum Number of Affected Requests (maxNAR), to quantify the worst-case impact of a single physical-layer attack, and then we investigate a new problem of Routing and Wavelength Assignment with Minimal Attack Radius (RWA-MAR). We formulate the problem using an Integer Linear Programming (ILP) model and propose a scalable heuristic to efficiently minimize maxNAR. Our approach incorporates key caching through Quantum Key Pools (QKPs) to enhance resilience and optimize resource utilization. Moreover, we model the impact of different QKD network architectures, employing Optical Bypass (OB) for optical switching of quantum channels and Trusted Relay (TR) for secure key forwarding. Moreover, a tunable parameter is designed in the heuristic to guide the preference for OB or TR, offering enhanced adaptability and dynamic control in diverse network scenarios. Simulation results confirm that our method significantly outperforms the baseline in terms of security and scalability.

quant-ph↗
arXiv2025

Online Rounding Schemes for $ k $-Rental Problems

We study two online resource allocation problems with reusability in an adversarial setting, namely kRental-Fixed and kRental-Variable. In both problems, a decision-maker manages $k$ identical reusable units and faces a sequence of rental requests over time. We develop theoretically grounded relax-and-round algorithms with provable competitive ratio guarantees for both settings. For kRental-Fixed, we present an optimal randomized algorithm that achieves the best possible competitive ratio. The algorithm first computes an optimal fractional allocation using a price-based approach, and then applies a novel lossless online rounding scheme to obtain an integral solution. For kRental-Variable, we first establish the impossibility of achieving lossless online rounding. We then introduce a limited-correlation rounding technique that treats each unit independently while introducing controlled dependencies across allocation decisions involving the same unit. Combined with a carefully-crafted price-based method for computing the fractional allocation, this approach yields an order-optimal competitive ratio for the variable-duration setting.

cs.DS↗
arXiv2025

One task to rule them all: A closer look at traffic classification generalizability

Existing website fingerprinting and traffic classification solutions do not work well when the evaluation context changes, as their performances often heavily rely on context-specific assumptions. To clarify this problem, we take three prior solutions presented for different but similar traffic classification and website fingerprinting tasks, and apply each solution's model to another solution's dataset. We pinpoint dataset-specific and model-specific properties that lead each of them to overperform in their specific evaluation context. As a realistic evaluation context that takes practical labeling constraints into account, we design an evaluation framework using two recent real-world TLS traffic datasets from large-scale networks. The framework simulates a futuristic scenario in which SNIs are hidden in some networks but not in others, and the classifier's goal is to predict destination services in one network's traffic, having been trained on a labelled dataset collected from a different network. Our framework has the distinction of including real-world distribution shift, while excluding concept drift. We show that, even when abundant labeled data is available, the best solutions' performances under distribution shift are between 30% and 40%, and a simple 1-Nearest Neighbor classifier's performance is not far behind. We depict all performances measured on different models, not just the best ones, for a fair representation of traffic models in practice.

cs.NI↗
arXiv2025

Towards NWDAF-enabled Analytics and Closed-Loop Automation in 5G Networks

The fifth generation of cellular technology (5G) delivers faster speeds, lower latency, and improved network service alongside support for a large number of users and a diverse range of verticals. This brings increased complexity to network control and management, making closed-loop automation essential. In response, the 3rd Generation Partnership Project (3GPP) introduced the Network Data Analytics Function (NWDAF) to streamline network monitoring by collecting, analyzing, and providing insights from network data. While prior research has focused mainly on isolated applications of machine learning within NWDAF, critical aspects such as standardized data collection, analytics integration in closed-loop automation, and end-to-end system evaluation have received limited attention. This work addresses existing gaps by presenting a practical implementation of NWDAF and its integration with leading open-source 5G core network solutions. We develop a 3GPP-compliant User Plane Function (UPF) event exposure service for real-time data collection and an ML model provisioning service integrated with MLflow to support end-to-end machine learning lifecycle management. Additionally, we enhance the Session Management Function (SMF) to consume NWDAF analytics and respond accordingly. Our evaluation demonstrates the solution's scalability, resource efficiency, and effectiveness in enabling closed-loop security management in 5G networks.

cs.NI↗
arXiv2025

5Guard: Isolation-aware End-to-End Slicing of 5G Networks

Network slicing logically partitions the 5G infrastructure to cater to diverse verticals with varying requirements. However, resource sharing exposes the slices to threats and performance degradation, making slice isolation essential. Fully isolating slices is resource-prohibitive, prompting the need for isolation-aware network slicing, where each slice is assigned a tailored isolation level to balance security, usability, and overhead. This paper investigates end-to-end 5G network slicing with resource isolation from the perspective of the infrastructure provider, ensuring compliance with the customers' service-level agreements. We formulate the online 5G isolation-aware network slicing (5G-INS) as a mixed-integer programming problem, modeling realistic slice isolation levels and integrating slice prioritization. To solve 5G-INS, we propose 5Guard, a novel adaptive framework that leverages an ensemble of custom optimization algorithms to achieve the best solution within resource budget and time constraints. Our results show that 5Guard increases profit by up to 10.1% in resource-constrained environments and up to 25.4% in a real-world large-scale network compared to the best-performing individual algorithm. Furthermore, we analyze the trade-offs between isolation levels, their impact on resource utilization, and the effects of slice placement, demonstrating significant advantages over baseline approaches that enforce uniform isolation policies.

cs.NI↗
arXiv2025

Posted Price Mechanisms for Online Allocation with Diseconomies of Scale

This paper addresses the online $k$-selection problem with diseconomies of scale (OSDoS), where a seller seeks to maximize social welfare by optimally pricing items for sequentially arriving buyers, accounting for increasing marginal production costs. Previous studies have investigated deterministic dynamic pricing mechanisms for such settings. However, significant challenges remain, particularly in achieving optimality with small or finite inventories and developing effective randomized posted price mechanisms. To bridge this gap, we propose a novel randomized dynamic pricing mechanism for OSDoS, providing a tighter lower bound on the competitive ratio compared to prior work. Our approach ensures optimal performance in small inventory settings (i.e., when $k$ is small) and surpasses existing online mechanisms in large inventory settings (i.e., when $k$ is large), leading to the best-known posted price mechanism for optimizing online selection and allocation with diseconomies of scale across varying inventory sizes.

cs.GT↗