Abstract: In one aspect, a method includes associating an MLO device with 2 transmission radios to yield a first communication link between the device and a first MLO access point and a second communication link between the device and a second MLO access point, wherein the device is configured to label the first communication link as a primary link and the second communication link as a secondary link; generating a sequence number to be assigned to a frame to be transmitted on the primary link and to a duplicate copy of the frame to be transmitted on the secondary link; associating a flag with the duplicate copy of the frame on the secondary link; and sending, from the device to the first and the second MLO access points, the frame and the duplicate copy on the primary link and the secondary link, respectively.

Abstract: Disclosed are systems, apparatuses, methods, and computer-readable media for setting a network policy at a client device.

Abstract: In one embodiment, a method includes classifying a first encrypted data flow in accordance with a classification. Classifying the first encrypted data flow is based on characteristic information associated with the first encrypted data flow. The method further includes generating an indicator that indicates a confidence in the classification of the first encrypted data flow. The method further includes generating a determination of whether the first encrypted data flow comprises malware. The method further includes classifying one or more subsequent encrypted data flows in accordance with the classification. Classifying the one or more subsequent encrypted data flows is based on the determination of whether the first encrypted data flow comprises malware.

Abstract: Presented herein are techniques to optimize wireless local area network access point beam settings. A method includes, during a survey period, causing a first access point and a second access point in a wireless local area network, to simultaneously transmit survey transmissions according to a predetermined sequence of transmission states, receiving, from a survey station that received the survey transmissions during the survey period, telemetry associated with the survey transmissions, the telemetry including a location of the survey station when the survey station received the survey transmissions, and after the survey period, controlling, based on the telemetry associated with the survey transmissions, the first access point to operate according to a first transmission state from among the transmission states and the second access point to operate according to a second transmission state from among the transmission states.

Abstract: Aspects of the present disclosure are directed to enabling, in an environment in which multiple Access Points (APs) with varying privacy and Randomized and Changing MAC (RCM) configurations operate, AP-to-AP RCM in conjunction with Multi-Access Point Coordination (MAPC) between the APs without one adversely affecting the other. In one aspect, a first access point (AP) may determine a Media Access Control (MAC) rotation strategy for a first plurality of access points (APs) of a first wireless network. The MAC rotation strategy may specify use of Basic Service Set Identifiers (BSSIDs) by the first plurality of APs for implementing RCM in presence of a second plurality of APs of a second wireless network. The first AP may perform the RCM based on the MAC rotation strategy. The first AP may perform multi-AP coordination with the second plurality of APs using the BSSIDs.

Abstract: A network function orchestrator (NFO) of a local area network (LAN) controller can configure multiple different tunnel endpoints in the LAN based on network traffic observed within the LAN. The NFO can monitor network traffic communicated from client devices and through access points in the LAN. The network traffic can be associated with multiple different destinations. The NFO can determine, based on the network traffic and using network topology data, network devices to serve as tunnel endpoints within the LAN. Different tunnel endpoints can be configured for use in connection with different traffic destinations. The NFO can communicate with the network devices and the access points to configure the LAN to use the different tunnel endpoints.

Abstract: The present technology automates the process of collecting and using data from IoT devices to improve IoT security and management while limiting the manual entry requirements of conventional IoT platforms. The technology receives data from IoT devices and determines behavioral characterizations of the IoT devices based on the data. The technology then uses a generative model to create a file representative of the behavioral characterizations of the IoT device, and uses that file to represent new IoT devices with similar attributes to those represented by the file. In doing so, the technology can improve security by, for example, creating a MUD file representative of a new IoT device with no associated MUD file. The technology can also create a file representative of the IoT device to improve onboarding of an IoT device in, for example, an IoT operations dashboard.

Abstract: A method to counter vulnerabilities associated with user equipment in operating via a 5G core architecture. The method includes monitoring a session between a user equipment and an endpoint, obtaining a vulnerability score for a vulnerability affecting the user equipment, selecting, based on the vulnerability score, a selected user plane function and a security service, accessible via the selected user plane function, to counter the vulnerability affecting the user equipment, and causing a packet flow of the session to be steered to the security service via the selected user plane function.

Abstract: This disclosure describes techniques for complying with a data sovereignty policy of data routed through a satellite network. An example method includes identifying data comprising a data sovereignty label indicating a first geographical region; determining that a coverage region of a satellite includes a first ground station in the first geographical region; determining that coverage region excludes a second ground station in a second geographical region; and based on determining that the coverage area includes the first ground station and excludes the second ground station, transmitting the data to the satellite.

Abstract: In one embodiment, a device associates available 5G functions with contextual information, wherein the contextual information maps each of the available 5G functions to a segment identifier of a security model topology for a segmented network within which that available 5G function is deployed. The device receives a request from a user equipment endpoint to communicate via the segmented network. The device selects a particular user plane function from among the available 5G functions for use by the user equipment endpoint based in part on the segment identifier of the security model topology mapped to the particular user plane function. The device causes the user equipment endpoint to communicate via the segmented network using the particular user plane function.

Abstract: The techniques described herein identify the use of L4S within a network and enable a network controller to dynamically and proactively manage L4S capable devices and non-L4S capable devices. A traffic analyzer may identify client-endpoint pairs and/or the use of a congestion marker and notify the network controller. The network controller may identify pathways between pairs, capabilities of the network devices in the pathway. The network controller may monitor queues of the L4S capable devices, identify congestion points, and proactively adjust the structure of the queues of one or more of the network devices and/or perform traffic engineering to prevent and/or reduce congestion in the network.

Abstract: Examples described herein are directed to tracking location by a positioning service. For instance, a method includes: receiving distance measurements from a first anchor device; determining a trust value associated with a path between the first anchor device and a second anchor device based on the distance measurements, wherein the trust value corresponds to whether the path is obstructed; determining a first measurement interval to measure a distance from the first anchor device to the second anchor device based on a single-sided measurement and a second measurement interval to measure the distance from the first anchor device to the second anchor device based on a double-sided measurement; and sending an anchor configuration to the first anchor device including the first measurement interval for the single-sided measurement and the second measurement interval for the double-sided measurement of the second anchor device.

Abstract: Techniques are described herein for managing access to remotely accessed software applications. In embodiments, such techniques may be performed by a service provider platform for software applications capable of being accessed by computing devices. The techniques may involve determining (e.g., based on a software bill of materials) components associated with the software applications, identifying a number of current security threats, and determining, based on the components and current security threats, a risk score associated with each of the software applications. The service provider platform may receive an indication of a level of risk for each of the computing devices in the organization, generate, based on the risk score associated with the software applications and the level of risk for each of the computing devices, policy data for each of the computing devices, and provide the policy data to at least one second computing device.

Abstract: The present technology provides a group encryption key for a ring as a whole within a ring-based topology. The key can, for example, be managed by a central Key Server (KS) that then transmits the key and a group encryption tag to nodes on the ring. For example, the ring edge node can encode a tag into a header of a frame so that the tag functions as a group-based tag. Future nodes on the ring network can then avoid the burdensome decryption and encryption steps of the prior art peer-to-peer encryption and decryption process.

Abstract: Techniques for mitigating network failures (e.g., SLA violations, service degradations, network outages, etc.) based on output(s) from a predictive network system. The techniques may include determining that a failure is predicted to occur in a network and determining a correlation between the failure and a previous failure that occurred in the network. In examples, the correlation may be determined using a machine-learned model. The techniques may also include determining, based at least in part on the correlation, a condition contributing to the failure. In this way, prior to occurrence of the failure, a parameter associated with the network may be altered based at least in part on the condition to mitigate or otherwise prevent the failure.

Abstract: This disclosure describes techniques for predicting and accommodating for outages in a satellite network using crowdsourced data. An example method includes receiving outage data indicating first outages experienced by first endpoints in a first geographical region. The first outages, for instance, include interruptions in communication between first satellites and the first endpoints. The example method further includes predicting, based on the outage data, a second outage comprising an interruption in communication between at least one second satellite and a second endpoint in a second geographical region. Further, the example method includes causing the second endpoint to transmit user data over a secondary network in advance of the second outage.

Abstract: In one illustrative example, a controller may operate to send a request message towards a user equipment (UE) which operates to communicate traffic in a session in a mobile network. In response, the controller may receive, from a user plane function which anchors the session of the UE, a response message which includes an identifier of the user plane function. The controller may verify whether a zone or security level value that is assigned to the user plane function matches a zone or security level value that is assigned to the UE. If the controller identifies a discrepancy between the zone or security level values, the controller may provide a notification indication to indicate the discrepancy. The UE may be an industrial Internet of Things (IIoT) device and the zone or security level values may be based on International Electrotechnical Commission (IEC) 62443.

Abstract: The present technology monitors the behavior and security profile of an IoT device and determines the changes that need to be made to the MUD file of the IoT device based on the data gathered during the monitoring. The technology then creates a new MUD file using a generative model (such as a large language model (LLM)) and compares the new MUD file with the original MUD file. Thereafter, the technology can communicate with the IoT device manufacturer to provide the new MUD file and explain the reasons why it is advantageous over the original MUD file. The new MUD file can then be deployed by the manufacturer to resolve security and efficiency issues with ease.

Abstract: This disclosure describes techniques for tracking aircraft using a satellite network. An example method includes receiving ADS-B messages from multiple aircraft; determining that at least one of the ADS-B messages satisfies at least one condition; and in response to determining that at least one of the ADS-B messages satisfies the at least one condition, transmitting an alert. In some cases, a system transmits an instruction to perform the example method to at least one satellite and receives the alert.

Abstract: Disclosed are systems, apparatuses, methods, and computer-readable media for preventing supervision frame injection attacks in replication networks. A method includes: identifying, by a network device, a trusted network device in a replication network; providing credentials to the trusted network device to validate an identity of the network device; based on authentication of the credential at the trusted network device, receiving security information from the trusted network device that is encrypted with a public key of the network device; and transmitting an onboarding supervision frame encrypted with or signed by the security information, wherein a management device of the replication network updates a trusted peer information based on the onboarding supervision frame.