Abstract: Techniques are disclosed for bootstrapping a secure data center using a cross domain system and a cluster of edge devices. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the cluster of edge devices. The cross domain system can include a cluster configuration node that can request bootstrapping data from the host data center on demand, receive the requested bootstrapping data, and use the bootstrapping data to generate a virtual bootstrapping environment on the cluster of edge devices.

Abstract: A type restriction contextually modifies an existing type descriptor. The type restriction is imposed on a data structure to restrict the values that are assumable by the data structure. The type restriction does not cancel or otherwise override the effect of the existing type descriptor on the data structure. Rather the type restriction may declare that a value of the data structure's type is forbidden for the data structure. Additionally or alternatively, the type restriction may declare that an element count allowable for a data structure's type is forbidden for the data structure. Type restriction allows optionality (where only a singleton value for a data structure is allowed), empty sets (where no value for a data structure is allowed), and multiplicity (where only a limited element count for a data structure) to be injected into a code set independent of data type. Type restriction allows certain optimizations to be performed.

Abstract: A degree of fragmentation is determined based on a number of holes present in a storage system layout or a portion of a layout. Edges between the holes and used portions of the storage system are tabulated by scanning a storage space. The occurrences of a pattern of used/available allocation units and/or the occurrences of another pattern available/used allocation units are recognized. A fragmentation value is calculated based on occurrences of the patterns in view of the total storage space. The present fragmentation measurement system utilizes the number of occurrences of the holes in assessing fragmentation.

Abstract: Method includes generating a base model by training a pretrained model using a base training dataset including first training datapoints identifying tables in historical document images that include the tables and text, where the generated base model is configured to extract the tables as objects; and generating a table extraction model by training the base model using an enhanced training dataset including second training datapoints that are different from the first training datapoints and identify a plurality of cells disposed in each of the tables in a row direction and a column direction. The table extraction model is trained to output content of the tables and table information in an XML format, the table information including cell level information of the plurality of cells that is searchable via a query configured to provide target content that corresponds to one or more cells.

Abstract: Techniques are disclosed for generating a database schema using trained machine learning models that, in some embodiments, may include graph neural networks (GNN). A GNN may identify source to target database schema mappings using, among other features of the graph, context data associated with each node in a graph. Context data describes relationships between a particular node and some (or all) of the other nodes in the graph. The system may use this context data (and other graph data) in combination with a trained GNN model to identify a mapping between one or more source database entities to corresponding target database entities.

Abstract: Techniques are described for classifying seasonal patterns in a time series. In an embodiment, a set of time series data is decomposed to generate a noise signal and a dense signal, where the noise signal includes a plurality of sparse features from the set of time series data and the dense signal includes a plurality of dense features from the set of time series data. A set of one or more sparse features from the noise signal is selected for retention. After selecting the sparse features, a modified set of time series data is generated by combining the set of one or more sparse features with a set of one or more dense features from the plurality of dense features. At least one seasonal pattern is identified from the modified set of time series data. A summary for the seasonal pattern may then be generated and stored.

Abstract: A method of marshalling existing software applications to automatically execute a task in a cloud environment includes generating actions that together execute the task; passing the actions to code generation services, where each of the code generation services is associated with a corresponding software application. Each of the code generation services is configured to select a subset of the actions that can be executed by the corresponding software application, and to generate second actions to be executed by the corresponding software application that implement the subset of the actions. The method also includes providing a job definition for the task including each of the second actions for each of the software applications.

Abstract: Systems and methods for supporting target groups for congestion control in a private fabric in a high performance computing environment. An exemplary method can provide, at one or more microprocessors, a first subnet, the first subnet comprising a plurality of switches, a plurality of host channel adapters, and a plurality of end nodes, including a plurality of virtual machines. The method can define a target group on one of an inter-switch link or at a port of a switch of the plurality of switches, wherein the target group defines a bandwidth limit on the at least one of an inter-switch link between two switches of the plurality of switches or at a port of a switch of the plurality of switches. The method can provide a target group repository stored in a memory of the host channel adapter where the defined target group in the target group repository is recorded.

Abstract: Log data that includes a plurality of log records is asynchronously processed to validate a configuration of each log record and data included in each log record. It is determined that one or more attributes of a particular subset of log records of the plurality of log records corresponds to one or more errors. Using the particular subset, one or more enriched log records are generated by augmenting each log record of the particular subset of log records with error information that indicates one or more categories corresponding to the one or more errors. A user interface is generated to facilitate correction of the one or more errors, the user interface comprising a plurality of interactive elements corresponding to a plurality of error metrics of different categories of errors, wherein the one or more categories of the one or more errors are included in the different categories of errors.

Abstract: Techniques are disclosed for using a multi-tenant framework for microservices in a microservices-based application to handle tenant-specific circuit breaking. The microservices-based application can include at least one microservice that incorporates the multi-tenant framework. The multi-tenant framework includes software components configured to provide multi-tenant functionality for the microservice. A first microservice may receive an indication associated with a tenant that a second microservice is overloaded. The first microservice can then receive a request containing tenant context data at an interface. A first software component of the multi-tenant framework can extract the tenant context data from the request. The first microservice may determine whether the tenant context data corresponds to the tenant. The first microservice can then trigger a circuit breaker for the second microservice.

Abstract: A time series forecasting system is disclosed that obtains a time series forecast request requesting a forecast for a particular time point. The forecast request identifies a primary time series dataset for generating the requested forecast and a set of features related to the primary time series dataset. The system provides the primary time series dataset and the set of features to a model to be used for generating the forecast. The model computes a feature importance score for one or more features and selects a subset of features based on their feature importance scores. The model determines attention scores for a set of data points in the primary time series dataset based on the selected subset of features. The system predicts an actual forecast for the particular time point based on the attention scores and outputs the actual forecast and explanation information associated with the actual forecast.

Abstract: A system and technique for a Request Forwarder as for a computer network architecture is disclosed to provide selective access to one or more cloud services. In some implementations, a computer system may receive a request for access to a cloud service, the request including a container credential. The computer system may determine an identification of the container using the container credential. The computer system may verify that the container requesting access to the cloud service is authorized based at least in part on stored policies. Based at least in part on the determination that the container requesting access to the cloud service is authorized: receiving instance credential from a metadata service. The computer system may include the instance credential with the request. The computer system may send the request to the cloud service. In various examples, the Request Forwarder can be provided as a service.

Abstract: Example embodiments facilitate prioritizing the recycling of computing resources, e.g., server-side computing systems and accompanying resources (e.g., non-volatile memory, accompanying firmware, data, etc.) leased by customers in a cloud-based computing environment, whereby computing resources (e.g., non-volatile memory) to be forensically analyzed/inspected, sanitized, and/or updated are prioritized for recycling based on estimates of when the computing resources are most likely to require recycling, e.g., via background sanitizing and updating. Computing resources that are likely to be recycled first are given priority over computing resources that are more likely to be recycled later. By prioritizing the recycling of computing resources according to embodiments discussed herein, other cloud-based computing resources that are used to implement computing resource recycling can be efficiently allocated and preserved.

Abstract: The present disclosure relates to systems and methods that enhance log data processing by asynchronously processing log data for detecting log messages that include errors and enriching the log messages with annotations that identify the errors. More particularly, log data that includes log records can be received. The log data can be asynchronously processed to validate a configuration of each log record and to validate data included in each log record. An attribute of a particular log record can be determined to correspond to an error. A category of the error can be determined. An enriched log record can be generated by augmenting the particular log record with error information indicating the category. The enriched log record can be transmitted via a user interface to facilitate correction of the error.

Abstract: A computer program product, system, and computer implemented method for scalable specification and self-governance for autonomous databases, cluster databases, and multi-tenant databases in cloud and on-prem environments. The approach disclosed herein enables management of a consolidated databases using a template-based process that allows for the consolidated databases (CDBs) and pluggable databases (PBDs) to be reconfigured automatically. In some embodiments, the approach instantiates one or more monitoring modules and one or more CDB/PDB configuration managers. These elements can detect relevant changes in the conditions in which CDB instances and open PDBs operate and adjust the configurations thereof in response.

Abstract: Techniques discussed herein manage backups of a service cell (SC). Each SC may include a data plane that is isolated from other SCs and comprises a distributed computing cluster (a cluster). A manifest that specifies one or more backup policies may be used to generate a full backup or a partial backup of a data set stored by the cluster. In accordance with the manifest, a signal may be sent to nodes of the cluster. In response, the nodes may transmit locally-stored data (e.g., data segments) to specified locations at a remote storage. The system may maintain a mapping of which segments correspond to data that was stored in the cluster at a time corresponding to a full or partial backup.

Abstract: Techniques for displaying a stage-specific pipeline view with a prediction engine are disclosed. A system displays a plurality of regions representing various stages of completion for a plurality of transactions. The system determines a stage of completion for each of the plurality of transactions at a first point-in-time, and generates and displays visualizations representing each of the plurality of transactions in one of the plurality of regions based on the respective current stage of completion. Generating a visualization representing a first transaction includes determining a likelihood of the first transaction completing a stage associated with the first transaction. The likelihood may be determined by selecting attributes associated with the first transaction and identifying prior transactions with similar attributes.

Abstract: Systems, methods, and other embodiments associated with secure firmware update in a bare metal cloud environment are described. In one embodiment, a trusted device for causing a component of a computing device to accept a firmware update is presented. The device includes a management interface configured to receive a command that authorizes a firmware update to the component. The device further includes a recovery device logic that is configured to generate a signal configured to cause the component to enter a recovery mode. The recovery mode configures the component to accept the firmware update. The device also includes an interface of the device that is configured to pass the signal to the component to cause the component to enter the recovery mode and accept the firmware update.

Abstract: A configuration helper system (CHS) is described that simplifies the task of generating configuration information for a customer premises equipment (CPE) in a customer's on-premise network to enable the CPE to communicate with the customer's cloud network over a particular communication channel. The CHS is configured to generate configuration information that is customized for the particular CPE and communication channel. Given information about the CPE and the communication channel, the CHS automatically identifies a particular set of configuration parameters to be included in the customized configuration information and determines values for the set of parameters, where some of the values may be provided by the customer. A particular CPE-specific format is determined for the configuration information.

Abstract: A method for mitigating spoofing attacks on an SEPP inter-PLMN forwarding interface includes obtaining, by a responding SEPP, a first SEPP identifier and/or a first PLMN identifier from at least one message received over an inter-PLMN control interface. The method further includes storing the first SEPP identifier and/or the first PLMN identifier in an identity cross-validation database. The method further includes obtaining, from at least one message received over an inter-PLMN forwarding interface a second SEPP identifier and/or a second PLMN identifier and performing a lookup in the identity cross-validation database using a lookup key comprising at least one of the second SEPP identifier and the second PLMN identifier, determining that a record corresponding to the lookup key is not present in the identity cross-validation database, and, in response, preventing the at least one message received over the inter-PLMN forwarding interface from entering a PLMN protected by the responding SEPP.

Abstract: A database is stored as a plurality of database shards in a distributed database grid comprising a plurality of grid elements, each including a mid-tier database system. A first grid element receives, from an application executing in the same memory as a mid-tier database system of the first grid element, a first database transaction including at least one database operation on specific data stored in a first database shard that belongs to the first grid element. The first grid element performs and commits the first database transaction without participation of another grid element of the plurality of grid elements. The first grid element receives a second database transaction that requires access to another database shard that does not belong to the first grid element. Multiple grid elements of the plurality of grid elements perform the second database transaction and commit the second database transaction using a two-phase commit protocol.

Abstract: Systems, methods, and other embodiments associated with assessing and adaptively managing query loads are described. In one embodiment, a method includes determining that a query invoked by a client terminal against an application object has a duration that exceeds a completion threshold. In response to receiving a subsequent invocation of the query, statistics for the query are obtained. The obtained statistics are analyzed to determine whether the query causes the unacceptable negative impact on the application object. A data structure is modified to include a classification of the query into one of a plurality of different query classes based on a result of the analysis, and execution of the query in response to a future invocation is controlled based on the classification of the query in the modified data structure.

Abstract: Various embodiments provide for obtaining snapshots of a displayable form. User specified information is received from a process modeler user interface. The process that includes the displayable form is created based on the user specified information. Snapshot instructions is associated, based on the user specified information, with a point in the process that can occur anytime while displaying the form during the execution of the process. The form is displayed as part of the execution of the process. When the point is encountered during execution of the process, the snapshot of the displayed form is obtained based on execution of the snapshot instructions.

Abstract: Systems and methods for a virtual layer-2 network are described herein. The method can include providing a virtual Layer 3 network in a virtualized cloud environment. The virtual Layer 3 network can be hosted by an underlying physical network. The method can include providing a virtual Layer 2 network in the virtualized cloud environment. The virtual Layer 2 network can be hosted by the underlying physical network.

Abstract: Embodiments validate representational state transfer (“REST”) application program interfaces (“API”). Embodiments receive a REST API specification that provides information for a plurality of REST APIs and parse the REST API specification to extract, for each REST API, a corresponding Uniform Resource Locator (“URL”), and corresponding parameter names response codes and payloads. Embodiments convert the parsed REST API specification into a converted text file, the converting including parameter constraints and parameter default values. Embodiments then generate all possible combinations of test data for each REST API from the converted text file and perform one or more test operations on each of the combinations of test data.

Abstract: Providing selective peer-to-peer monitoring using MBeans by providing a federation of peer-to-peer network servers based on the MBeans, and enabling each of the peer-to-peer networks servers to selectively monitor data associated with at least a subset of the peer-to-peer network servers using at least one of the MBeans.

Abstract: A method for generating, conveying, and using attempted producer network function (NF) instance communication information includes, at a first service communication proxy (SCP), receiving, from a sender, a first service based interface (SBI) request message. The method further includes attempting to obtain a service requested by the first SBI request message from at least one producer NF instance. The method further includes receiving at least one error response or failing to receive a response from the at least one producer NF instance. The method further includes generating, from the at least one error response or the failing to receive a response from the at least one producer NF instance, attempted producer NF instance communication information. The method further includes communicating, to the sender, the attempted producer NF instance communication information.

Abstract: A system for loading graph data from an external store in response to a graph query is disclosed. In some embodiment, given a graph database where all vertices are stored in memory and some but not all edges are stored in the external store, the system performs one of two methods. In the first method, the system iteratively expands a set of vertices that is initially specified in the graph query and collects all edges connected to the set of vertices, including edges stored in the external store, that satisfy a vertex constraint also specified in the query. In the second method, the system finds a set of vertices that satisfy the vertex constraint and collects all edges connected to the set of vertices, including edges stored in an external store.

Abstract: Systems, devices, and methods discussed herein provide improved autonomous agent applications that are configured to generate automated answers to a question using summarized logical forms (SLFs). A myriad of techniques may be utilized to manually or automatically generate one or more summarized logical forms for an answer, where the summarized logical form(s) identifies the main entities/informative portions of the answer. Instead of indexing the whole of the answer as in conventional methods, an answer can be indexed using the summarized logical forms. A subsequent query may be matched to the SLF and the answer may be provided in response to the question. By indexing the answer with its informative portions, the speed and accuracy of identifying the answer is improved.

Abstract: The present disclosure relates to techniques for identifying out-of-domain utterances.

Abstract: Techniques described herein relate to systems and methods of data storage, and more particularly to providing layering of file system functionality on an object interface. In certain embodiments, file system functionality may be layered on cloud object interfaces to provide cloud-based storage while allowing for functionality expected from a legacy applications. For instance, POSIX interfaces and semantics may be layered on cloud-based storage, while providing access to data in a manner consistent with file-based access with data organization in name hierarchies. Various embodiments also may provide for memory mapping of data so that memory map changes are reflected in persistent storage while ensuring consistency between memory map changes and writes. For example, by transforming a ZFS file system disk-based storage into ZFS cloud-based storage, the ZFS file system gains the elastic nature of cloud storage.

Abstract: A network virtualization device receives a storage request from a compute instance executed by a host machine separate from the network virtualization device, the storage request comprising data to be stored. Responsive to receiving the storage request, the network virtualization device divides the data to be stored into a set of one or more data stripes. For a first data stripe in the set of data stripes, the network virtualization device determines, from a plurality of extent servers, a first extent server to which the first data stripe is to be sent for storing the first data stripe, transmits the first data stripe to the first extent server, wherein the first extent server stores the first data stipe to a first physical storage device, and receives, from the first extent server, an acknowledgement confirming that the first data stripe was stored.

Abstract: Domain specific inlining for interpreters includes obtaining an interpreter source code including compiler directives. A host compilation is performed on the interpreter source code to obtain a compiled interpreter. Performing host compilation includes inlining code blocks based on the plurality of compiler directives. The compiled interpreter is outputted.

Abstract: The disclosed systems, methods, and computer readable media relate to managing persistent memory within a smart network interface card (smartNIC) of a cloud-computing environment, or at storage device of the host instance on which the smartNIC operates and to which the smartNIC has access. The smartNIC may be configured with various modes that enable passthrough of input/output operations to or from non-volatile remote storage (e.g., a block storage data plane volume) or storage of at least some of the data corresponding to the input/output operations within the persistent memory managed by the smartNIC. The smartNIC may be configured to select a storage location for data between a pool of candidate storage including the persistent storage managed by the smartNIC or the non-volatile remote storage. These techniques improve communications between the smartNIC and the non-volatile remote storage and reduce the risk of network jitters and overall network latency.

Abstract: Techniques are provided for generating training data to facilitate fine-tuning embedding models. Training data including anchor utterances is obtained. Positive utterances and negative utterances are generated from the anchor utterances. Tuples including the anchor utterances, the positive utterances, and the negative utterances are formed. Embeddings for the tuples are generated and a pre-trained embedding model is fine-tuned based on the embeddings. The fine-tuned model can be deployed to a system.

Abstract: Techniques disclosed herein include receiving a request to perform an upgrade. The upgrade can comprise changes to firmware or software of the network interface card. Input/Output (I/O) traffic can be monitored on one or more paths between the network interface card and a storage device. The paths can have a path capacity comprising a bandwidth of Input/Output traffic. The spare Input/Output traffic capacity can be calculated based at least in part on the Input/Output traffic and the path capacity. Whether to remove a path can be determined based at least in part on the spare Input/Output traffic capacity. The upgrade can be performed with the path halted in accordance with a determination to remove the path. The upgrade can be performed with the path included in accordance with a determination to not remove the path.

Abstract: Embodiments upsell a hotel room selection by providing a first plurality of hotel room choices, each first plurality of hotel room choices comprising a first type of hotel room and a corresponding first price. Embodiments receive a first selection of one of the first plurality of hotel room choices. In response to the first selection, embodiments provide a second plurality of hotel room choices, the second plurality of hotel room choices comprising a subset of the first types of hotel room choices and a corresponding optimized price that is different from the respective corresponding first price.

Abstract: Systems, devices, and methods of the present invention detect deceptive or fake content in text. In an example, a computer system generates, from text a discourse tree that represents rhetorical relationships between fragments of the text. The computer system generates a communicative discourse tree from the discourse tree. The computer system identifies a number of non-trivial rhetorical relations associated with the nonterminal nodes in the communicated discourse tree and, for each terminal edge having a communicative action, a level of nesting of the communicative action. The computer system derives, from the number of non-trivial rhetorical relations and the levels of nesting of the identified communicative actions, a complexity score that is indicative of a level of deception in the text.

Abstract: Techniques for using honeypots to lure attackers and gather data about attackers and attack patterns on Infrastructure-as-a-Service (IaaS) instances. The gathered data may then be analyzed and used to proactively prevent such attacks.

Abstract: Techniques for determining recommended allocations of resources among different platforms that sell a common type of inventory. Determining the allocations can include obtaining parameters of a campaign from a client. Determining the allocations can include combining current campaign parameters and scoring with historical campaign performance data to create recommendations for dividing resources among different media platforms.

Abstract: Techniques for using signed nonces to secure cloud shells are provided. The techniques include receiving, by a session manager service, a request to connect a user device to a secure connection to a secure shell instance. The session manager service may authorize the user device to access the secure shell instance and may configure the secure shell instance, being described by a shell identifier of the secure shell instance. The techniques also include generating, by the session manager service, a nonce token and providing the shell identifier, and a router address of the secure shell router to the user device. The techniques also include generating, by the session manager service, a signed nonce token using the nonce token; and providing the signed nonce token and the shell identifier to a user device.

Abstract: A network validation system is described which may perform operations such as generating, analyzing, verifying, correcting, recommending, and deploying language, symbols, etc., such as domain specific language, configured to allow users to express their intent on the configuration and operation of a network, such as a cloud-based network. The network validation system may provide domain specific language that includes rules, statements, symbols, data, etc., configured to convey the intent of users on the configuration and operation of networks for purposes such as configuring and/or validating communication paths, testing or setting associated network object configurations, and may be employed to report violations in such configurations relative to user intent of the one or more users. The network validation system may also be employed to monitor such domain specific language and generate telemetry signaling, for example, that a rule has or has not been violated, actions a user may take, etc.

Abstract: Disclosed are techniques for processing user profiles using data structures that are specialized for processing by a GPU. More particularly, the disclosed techniques relate to systems and methods for evaluating characteristics of user profiles to determine whether to offload certain user profiles to the GPU for processing or to process the user profiles locally by one or more central processing units (CPUs). Processing user profiles may include comparing the interest tags included in the user profiles with logic trees, for example, logic trees representing marketing campaigns, to identify user profiles that match the campaigns.

Abstract: Systems, methods, and machine-readable media to migrate data from source databases to target databases are disclosed. Data may be received, relating to the source databases and the target databases. For each source database, a migration assessment may be generated based on analyzing the data, and a migration method may be selected. A migration plan that specifies a parallel migration of a set of databases to the target databases may be created, with a first migration method to migrate a first subset of the set of databases and a second migration method to migrate a second subset of the set of databases. The parallel migration may be executed according to the migration plan may be caused so that the first subset of the set of databases is migrated with the first migration method while the second subset of the set of databases is migrated with the second migration method.

Abstract: An example method facilitates modification and generation of User Interface (UI) display screens for webpages and web applications, such as process-based software applications. The example method includes receiving a first signal to access a webpage that includes a static UI display screen for a web application; serving the webpage in response to the signal; detecting the dynamic configuration functionality associated with the webpage, wherein the configuration functionality includes code and UI metadata provided in or with a dynamic layout file, the code and UI metadata including one or more rules and specifications for configuring schema used to generate rendering instructions for the dynamic part of the webpage.

Abstract: System and method for using multiple global identification subnet prefix values in a network switch environment in a high performance computing environment. A packet is received from a network fabric by a first Host Channel Adapter (HCA). The packet has a header portion including a destination subnet prefix identifying a destination subnet of the network fabric. The network HCA is allowed to receive the first packet from a port of the network HCA by selectively determining a logical state of a flag and, selectively in accordance with a predetermined logical state of the flag, ignoring the destination subnet prefix identifying the destination subnet of the network fabric.

Abstract: Techniques for modifying rules for completing requests using a conversational interface are disclosed. A conversational interface receives a user request to perform a particular function. A system extracts semantic content from the request and obtains contextual metadata associated with the request. Using the semantic content and contextual metadata, the system generates a data set of attribute values. The system determines whether the data set matches a data set of required data attributes associated with the request. If the provided data set is different than the required data set, the system determines whether to modify a set of rules associated with the request. The set of rules specifies which attribute values are required to complete the request. When the system modifies the rules associated with the request, the system also determines whether to apply the rule modification to subsequent requests by the same user and other users.

Abstract: When a request for accessing a service is received, a user object may be stored in a long-term data store, as well as in a short-term cache. The cache may be divided into a regular cache that stores full versions of the user objects, and a surrogate cache that stores compact versions of the user object. The compact version of the user object may include a field that is derived from the full user object indicating whether a subsequent request for access to a particular service should be granted. After access is granted/denied based on this value in the compact user object, the system can process an update to the full user object offline. This surrogate cache structure may be used to rapidly approve/deny requests, decoupling this procedure from the processing involved with a full user object.

Abstract: Plugins that are independently written are executed in a collaborative manner to analysis a log. A plugin executing with respect to a particular node of a hierarchical data structure determines values for a set of keys based on information of the particular node and/or any ancestor nodes, and information stored in a shared repository. The plugin stores the values for the keys as additional information of the particular hierarchical node and/or into the shared repository. The plugin does not access information of non-ancestor nodes when executing with respect to the particular hierarchical node. Each plugin writes into and retrieves from the shared repository using the shared naming convention, thereby sharing information. The sequence of execution of the plugins is not dependent on dependencies amongst the plugins. If a dependent plugin requiring an output from a requisite plugin is first executed, the dependent plugin is flagged as pending and subsequently re-executed.

Abstract: Roaming spoofing attacks can be initiated during N32-c handshake procedure used for inter-PLMN communication in 5G network. One example solution described herein uses the SEPP to mitigate the N32-c roaming spoofing attacks by cross validating the sender attribute present in N32-c handshake security capability exchange messages against the endpoint identity in the X.509v3 certificate shared during TLS handshake and the remote SEPP identity configured in the SEPP's local database.