Abstract: Techniques and mechanisms for a network-profiling system to create an embedding model that converts entity behaviors into multi-dimensional vector representations. The network-profiling system obtains telemetry data that represents network behaviors of the entities and identity data representing identities of the entities. Using the telemetry data and identity data, the network-profiling system trains an embedding model to transform and store entity behavior into a vector representation. Once the training of the embedding model is complete, a multi-dimensional vector embedding or representation of each entity has been created. Using these vector embeddings, the network-profiling system can determine semantic relationships between the entities in the vector space.

Abstract: This disclosure describes techniques for validating a network device based on an operational context of the network device. The techniques may include receiving, via an intercepting node, a DNS query from a querying device. The techniques may include extracting the metadata from the DNS query. Based at least in part on verifying a signature of the metadata, the techniques may include extracting a location code from the metadata. Based at least in part on comparing the location code to an expected location of the intercepting node, the techniques may include sending a response to the querying device indicating a contextual validation of the querying device.

Abstract: A network function orchestrator (NFO) of a local area network (LAN) controller can configure multiple different tunnel endpoints in the LAN based on network traffic observed within the LAN. The NFO can monitor network traffic communicated from client devices and through access points in the LAN. The network traffic can be associated with multiple different destinations. The NFO can determine, based on the network traffic and using network topology data, network devices to serve as tunnel endpoints within the LAN. Different tunnel endpoints can be configured for use in connection with different traffic destinations. The NFO can communicate with the network devices and the access points to configure the LAN to use the different tunnel endpoints.

Abstract: Techniques for leveraging a distributed Domain Name System (DNS) infrastructure for preserving Personally Identifiable Information (PII) data by creating a hash to policy pair (HPP) database on premises at an enterprise organization. A policy engine hosted on premises at an enterprise organization applies a cryptographic hash function to metadata including PII associated with a client of the enterprise organization to generate a client hash value. The HPP is created by mapping the client hash value to a set of DNS policy instructions associated with the client and stored in the HPP database. The HPP database in published to a DNS security service, such that the DNS security service can resolve a DNS query for the client of the enterprise organization absent knowledge of the PII associated with the client by mapping the client hash value included in the DNS query to the client HPP in the HPP database.

Abstract: Disclosed are systems, apparatuses, methods, computer readable medium, and circuits for transmitting, from an access point (AP), a multi-link device (MLD) grouping to a station device (STA); transmitting, from the AP, a policy to accept energy efficiency instructions that includes multi-link operation (MLO) in an energy conservation mode; transmitting, from the AP, instructions to reduce battery consumption by the station by limiting MLO operations and activating a single radio of a plurality of radios on the STA, wherein a remainder of the plurality of radios are inactive and powered off; determining, at the AP, that activity from the STA is increasing; and transmitting a wake-up message to one or more of the inactive radios on the STA.

Abstract: A system and method are provided for timing measurement in a wireless network to determine a location of a station (STA). A channel stability is determined for a channel between an initiating station (ISTA) and a first responding station (RSTA). A request for a first timing-measurement exchange is sent from the ISTA and the first RSTA. Parameters are negotiated for the first timing-measurement exchange based on the determined channel stability, and then the timing-measurement exchange is performed to generate a first set of times. This process is then repeated for another timing-measurement exchange between the ISTA and a second RSTA to generate a second set of times. A location of the ISTA is determined based on the first and the second sets of times.

Abstract: Disclosed are systems, apparatuses, methods, computer readable medium, and circuits for transmitting, from an access point (AP), a multi-link device (MLD) grouping to a station device (STA); transmitting, from the AP, a policy to accept energy efficiency instructions that includes multi-link operation (MLO) in an energy conservation mode; transmitting, from the AP, instructions to reduce battery consumption by the station by limiting MLO operations and activating a single radio of a plurality of radios on the STA, wherein a remainder of the plurality of radios are inactive and powered off; determining, at the AP, that activity from the STA is increasing; and transmitting a wake-up message to one or more of the inactive radios on the STA.

Abstract: Techniques for a low Earth orbit (LEO) satellite to route data through optimal satellite paths based on latency thresholds (and/or other QoS thresholds) for the application generating the data. The LEO satellite may identify the latency threshold from a data packet, where the latency threshold indicates an amount of time for the data packet to be relayed back down to a destination ground device. The LEO satellite determines available satellite paths through which data packets may be routed to destination ground stations. Further, the LEO satellite may determine latencies for transmitting traffic over the available satellite paths. The LEO satellite may compare the latency threshold for the data packet with the latencies of the available satellite paths, and select a satellite path that is optimal for transmitting the data packet. In this way, LEO satellites intelligently route data through satellite paths based on the type of traffic being transmitted.

Abstract: In one aspect, a method includes associating an MLO device with 2 transmission radios to yield a first communication link between the device and a first MLO access point and a second communication link between the device and a second MLO access point, wherein the device is configured to label the first communication link as a primary link and the second communication link as a secondary link; generating a sequence number to be assigned to a frame to be transmitted on the primary link and to a duplicate copy of the frame to be transmitted on the secondary link; associating a flag with the duplicate copy of the frame on the secondary link; and sending, from the device to the first and the second MLO access points, the frame and the duplicate copy on the primary link and the secondary link, respectively.

Abstract: Disclosed are systems, apparatuses, methods, and computer-readable media for setting a network policy at a client device.

Abstract: In one embodiment, a method includes classifying a first encrypted data flow in accordance with a classification. Classifying the first encrypted data flow is based on characteristic information associated with the first encrypted data flow. The method further includes generating an indicator that indicates a confidence in the classification of the first encrypted data flow. The method further includes generating a determination of whether the first encrypted data flow comprises malware. The method further includes classifying one or more subsequent encrypted data flows in accordance with the classification. Classifying the one or more subsequent encrypted data flows is based on the determination of whether the first encrypted data flow comprises malware.

Abstract: Presented herein are techniques to optimize wireless local area network access point beam settings. A method includes, during a survey period, causing a first access point and a second access point in a wireless local area network, to simultaneously transmit survey transmissions according to a predetermined sequence of transmission states, receiving, from a survey station that received the survey transmissions during the survey period, telemetry associated with the survey transmissions, the telemetry including a location of the survey station when the survey station received the survey transmissions, and after the survey period, controlling, based on the telemetry associated with the survey transmissions, the first access point to operate according to a first transmission state from among the transmission states and the second access point to operate according to a second transmission state from among the transmission states.

Abstract: Aspects of the present disclosure are directed to enabling, in an environment in which multiple Access Points (APs) with varying privacy and Randomized and Changing MAC (RCM) configurations operate, AP-to-AP RCM in conjunction with Multi-Access Point Coordination (MAPC) between the APs without one adversely affecting the other. In one aspect, a first access point (AP) may determine a Media Access Control (MAC) rotation strategy for a first plurality of access points (APs) of a first wireless network. The MAC rotation strategy may specify use of Basic Service Set Identifiers (BSSIDs) by the first plurality of APs for implementing RCM in presence of a second plurality of APs of a second wireless network. The first AP may perform the RCM based on the MAC rotation strategy. The first AP may perform multi-AP coordination with the second plurality of APs using the BSSIDs.

Abstract: A network function orchestrator (NFO) of a local area network (LAN) controller can configure multiple different tunnel endpoints in the LAN based on network traffic observed within the LAN. The NFO can monitor network traffic communicated from client devices and through access points in the LAN. The network traffic can be associated with multiple different destinations. The NFO can determine, based on the network traffic and using network topology data, network devices to serve as tunnel endpoints within the LAN. Different tunnel endpoints can be configured for use in connection with different traffic destinations. The NFO can communicate with the network devices and the access points to configure the LAN to use the different tunnel endpoints.

Abstract: The present technology automates the process of collecting and using data from IoT devices to improve IoT security and management while limiting the manual entry requirements of conventional IoT platforms. The technology receives data from IoT devices and determines behavioral characterizations of the IoT devices based on the data. The technology then uses a generative model to create a file representative of the behavioral characterizations of the IoT device, and uses that file to represent new IoT devices with similar attributes to those represented by the file. In doing so, the technology can improve security by, for example, creating a MUD file representative of a new IoT device with no associated MUD file. The technology can also create a file representative of the IoT device to improve onboarding of an IoT device in, for example, an IoT operations dashboard.

Abstract: A method to counter vulnerabilities associated with user equipment in operating via a 5G core architecture. The method includes monitoring a session between a user equipment and an endpoint, obtaining a vulnerability score for a vulnerability affecting the user equipment, selecting, based on the vulnerability score, a selected user plane function and a security service, accessible via the selected user plane function, to counter the vulnerability affecting the user equipment, and causing a packet flow of the session to be steered to the security service via the selected user plane function.

Abstract: This disclosure describes techniques for complying with a data sovereignty policy of data routed through a satellite network. An example method includes identifying data comprising a data sovereignty label indicating a first geographical region; determining that a coverage region of a satellite includes a first ground station in the first geographical region; determining that coverage region excludes a second ground station in a second geographical region; and based on determining that the coverage area includes the first ground station and excludes the second ground station, transmitting the data to the satellite.

Abstract: In one embodiment, a device associates available 5G functions with contextual information, wherein the contextual information maps each of the available 5G functions to a segment identifier of a security model topology for a segmented network within which that available 5G function is deployed. The device receives a request from a user equipment endpoint to communicate via the segmented network. The device selects a particular user plane function from among the available 5G functions for use by the user equipment endpoint based in part on the segment identifier of the security model topology mapped to the particular user plane function. The device causes the user equipment endpoint to communicate via the segmented network using the particular user plane function.

Abstract: The techniques described herein identify the use of L4S within a network and enable a network controller to dynamically and proactively manage L4S capable devices and non-L4S capable devices. A traffic analyzer may identify client-endpoint pairs and/or the use of a congestion marker and notify the network controller. The network controller may identify pathways between pairs, capabilities of the network devices in the pathway. The network controller may monitor queues of the L4S capable devices, identify congestion points, and proactively adjust the structure of the queues of one or more of the network devices and/or perform traffic engineering to prevent and/or reduce congestion in the network.

Abstract: Examples described herein are directed to tracking location by a positioning service. For instance, a method includes: receiving distance measurements from a first anchor device; determining a trust value associated with a path between the first anchor device and a second anchor device based on the distance measurements, wherein the trust value corresponds to whether the path is obstructed; determining a first measurement interval to measure a distance from the first anchor device to the second anchor device based on a single-sided measurement and a second measurement interval to measure the distance from the first anchor device to the second anchor device based on a double-sided measurement; and sending an anchor configuration to the first anchor device including the first measurement interval for the single-sided measurement and the second measurement interval for the double-sided measurement of the second anchor device.