Abstract: The present technology automates the process of collecting and using data from IoT devices to improve IoT security and management while limiting the manual entry requirements of conventional IoT platforms. The technology receives data from IoT devices and determines behavioral characterizations of the IoT devices based on the data. The technology then uses a generative model to create a file representative of the behavioral characterizations of the IoT device, and uses that file to represent new IoT devices with similar attributes to those represented by the file. In doing so, the technology can improve security by, for example, creating a MUD file representative of a new IoT device with no associated MUD file. The technology can also create a file representative of the IoT device to improve onboarding of an IoT device in, for example, an IoT operations dashboard.

Abstract: A method to counter vulnerabilities associated with user equipment in operating via a 5G core architecture. The method includes monitoring a session between a user equipment and an endpoint, obtaining a vulnerability score for a vulnerability affecting the user equipment, selecting, based on the vulnerability score, a selected user plane function and a security service, accessible via the selected user plane function, to counter the vulnerability affecting the user equipment, and causing a packet flow of the session to be steered to the security service via the selected user plane function.

Abstract: This disclosure describes techniques for complying with a data sovereignty policy of data routed through a satellite network. An example method includes identifying data comprising a data sovereignty label indicating a first geographical region; determining that a coverage region of a satellite includes a first ground station in the first geographical region; determining that coverage region excludes a second ground station in a second geographical region; and based on determining that the coverage area includes the first ground station and excludes the second ground station, transmitting the data to the satellite.

Abstract: In one embodiment, a device associates available 5G functions with contextual information, wherein the contextual information maps each of the available 5G functions to a segment identifier of a security model topology for a segmented network within which that available 5G function is deployed. The device receives a request from a user equipment endpoint to communicate via the segmented network. The device selects a particular user plane function from among the available 5G functions for use by the user equipment endpoint based in part on the segment identifier of the security model topology mapped to the particular user plane function. The device causes the user equipment endpoint to communicate via the segmented network using the particular user plane function.

Abstract: The techniques described herein identify the use of L4S within a network and enable a network controller to dynamically and proactively manage L4S capable devices and non-L4S capable devices. A traffic analyzer may identify client-endpoint pairs and/or the use of a congestion marker and notify the network controller. The network controller may identify pathways between pairs, capabilities of the network devices in the pathway. The network controller may monitor queues of the L4S capable devices, identify congestion points, and proactively adjust the structure of the queues of one or more of the network devices and/or perform traffic engineering to prevent and/or reduce congestion in the network.

Abstract: Examples described herein are directed to tracking location by a positioning service. For instance, a method includes: receiving distance measurements from a first anchor device; determining a trust value associated with a path between the first anchor device and a second anchor device based on the distance measurements, wherein the trust value corresponds to whether the path is obstructed; determining a first measurement interval to measure a distance from the first anchor device to the second anchor device based on a single-sided measurement and a second measurement interval to measure the distance from the first anchor device to the second anchor device based on a double-sided measurement; and sending an anchor configuration to the first anchor device including the first measurement interval for the single-sided measurement and the second measurement interval for the double-sided measurement of the second anchor device.

Abstract: Techniques are described herein for managing access to remotely accessed software applications. In embodiments, such techniques may be performed by a service provider platform for software applications capable of being accessed by computing devices. The techniques may involve determining (e.g., based on a software bill of materials) components associated with the software applications, identifying a number of current security threats, and determining, based on the components and current security threats, a risk score associated with each of the software applications. The service provider platform may receive an indication of a level of risk for each of the computing devices in the organization, generate, based on the risk score associated with the software applications and the level of risk for each of the computing devices, policy data for each of the computing devices, and provide the policy data to at least one second computing device.

Abstract: The present technology provides a group encryption key for a ring as a whole within a ring-based topology. The key can, for example, be managed by a central Key Server (KS) that then transmits the key and a group encryption tag to nodes on the ring. For example, the ring edge node can encode a tag into a header of a frame so that the tag functions as a group-based tag. Future nodes on the ring network can then avoid the burdensome decryption and encryption steps of the prior art peer-to-peer encryption and decryption process.

Abstract: Techniques for mitigating network failures (e.g., SLA violations, service degradations, network outages, etc.) based on output(s) from a predictive network system. The techniques may include determining that a failure is predicted to occur in a network and determining a correlation between the failure and a previous failure that occurred in the network. In examples, the correlation may be determined using a machine-learned model. The techniques may also include determining, based at least in part on the correlation, a condition contributing to the failure. In this way, prior to occurrence of the failure, a parameter associated with the network may be altered based at least in part on the condition to mitigate or otherwise prevent the failure.

Abstract: This disclosure describes techniques for predicting and accommodating for outages in a satellite network using crowdsourced data. An example method includes receiving outage data indicating first outages experienced by first endpoints in a first geographical region. The first outages, for instance, include interruptions in communication between first satellites and the first endpoints. The example method further includes predicting, based on the outage data, a second outage comprising an interruption in communication between at least one second satellite and a second endpoint in a second geographical region. Further, the example method includes causing the second endpoint to transmit user data over a secondary network in advance of the second outage.

Abstract: In one illustrative example, a controller may operate to send a request message towards a user equipment (UE) which operates to communicate traffic in a session in a mobile network. In response, the controller may receive, from a user plane function which anchors the session of the UE, a response message which includes an identifier of the user plane function. The controller may verify whether a zone or security level value that is assigned to the user plane function matches a zone or security level value that is assigned to the UE. If the controller identifies a discrepancy between the zone or security level values, the controller may provide a notification indication to indicate the discrepancy. The UE may be an industrial Internet of Things (IIoT) device and the zone or security level values may be based on International Electrotechnical Commission (IEC) 62443.

Abstract: The present technology monitors the behavior and security profile of an IoT device and determines the changes that need to be made to the MUD file of the IoT device based on the data gathered during the monitoring. The technology then creates a new MUD file using a generative model (such as a large language model (LLM)) and compares the new MUD file with the original MUD file. Thereafter, the technology can communicate with the IoT device manufacturer to provide the new MUD file and explain the reasons why it is advantageous over the original MUD file. The new MUD file can then be deployed by the manufacturer to resolve security and efficiency issues with ease.

Abstract: This disclosure describes techniques for tracking aircraft using a satellite network. An example method includes receiving ADS-B messages from multiple aircraft; determining that at least one of the ADS-B messages satisfies at least one condition; and in response to determining that at least one of the ADS-B messages satisfies the at least one condition, transmitting an alert. In some cases, a system transmits an instruction to perform the example method to at least one satellite and receives the alert.

Abstract: Disclosed are systems, apparatuses, methods, and computer-readable media for preventing supervision frame injection attacks in replication networks. A method includes: identifying, by a network device, a trusted network device in a replication network; providing credentials to the trusted network device to validate an identity of the network device; based on authentication of the credential at the trusted network device, receiving security information from the trusted network device that is encrypted with a public key of the network device; and transmitting an onboarding supervision frame encrypted with or signed by the security information, wherein a management device of the replication network updates a trusted peer information based on the onboarding supervision frame.

Abstract: Techniques for providing a language model with dynamic configuration data for network devices in a network that is then used by the language model to generate network-contextual responses to prompts received at the language model. A network controller may collect configuration data from the network devices where the configuration data includes device configurations of the network devices. The network controller may further receive a prompt from a network operator to which the language model is to respond and identify a relevant device configuration that is contextually relevant to the prompt. Further, the network controller may provide the prompt and the relevant device configuration to the language model, generate, by the language model and using the relevant device configuration, a response to the prompt, and provide the network operator with an indication of the response to the prompt.

Abstract: Software bill of materials (SBOM) vulnerability systems do not monitor software components behavior in real time, and rather rely on the static periodic updates. This gap leaves cloud-native software applications exposed to 0-day or supply chain attacks that exploit vulnerabilities that are not known or updated into the public vulnerability data sources. The techniques described herein provide dynamic and intelligent identification of 0-day and supply chain attacks in runtime environments, mitigate the attacks in real-time, and share intelligence to prevent a malicious workload from being deployed through the CI/CD pipeline.

Abstract: Techniques for, among other things, embedding metadata in network traffic without having to implement an overlay network. By way of example, and not limitation, the techniques described herein may include receiving an Ethernet packet at a network node and determining that a preamble of the Ethernet packet includes metadata. The metadata may, in some examples, be associated with the Ethernet packet itself, a flow that the Ethernet packet belongs to, etc. Based at least in part on the metadata, a policy decision may be made for handling the Ethernet packet, and the Ethernet packet may be handled in accordance with the policy decision.

Abstract: Techniques are described herein for determining and mitigating a risk to an organization associated with a security threat. In embodiments, such techniques may be performed by an access control device and may comprise receiving information about a security threat, identifying one or more components susceptible to the security threat, determining a number of software applications associated with the one or more components, and determining, based on usage metrics stored in relation to the number of software applications, a severity associated with each of the number of software applications. The techniques may further comprise determining at least one mitigation technique associated with a software application having the highest severity in relation to the security threat and causing the at least one mitigation technique to be implemented.

Abstract: Disclosed are systems, apparatuses, and methods to minimize service disruption in ring topology based on unavailability of the network device. A network device includes a network interface configured to receive frames from other network devices in a ring network and configured to detect that the network device will become unavailable and, in response to detecting the network device will become unavailable, transmit an unavailability frame to a first network device in the ring network and a second network device in the ring network. The unavailability frame indicates that the network device will become unavailable and causes at least one of the first network device or the second network device to change a transmission direction in the ring network. The unavailability frame is configured and stored in a hardware to reduce the power required to transmit the unavailability frame.

Abstract: Disclosed are systems, apparatuses, methods, computer readable medium, and circuits for reducing energy consumption of one or more station devices, the method including: monitoring, at a controller, energy usage by one or more station devices, on a wireless local area network (WLAN); determining, at the controller, reduction in energy consumption on the WLAN is required to meet a predetermined target; and transmitting, from the controller, a beacon that instructs the one or more station devices to enter an energy efficiency mode.