Abstract: The present technology provides a group encryption key for a ring as a whole within a ring-based topology. The key can, for example, be managed by a central Key Server (KS) that then transmits the key and a group encryption tag to nodes on the ring. For example, the ring edge node can encode a tag into a header of a frame so that the tag functions as a group-based tag. Future nodes on the ring network can then avoid the burdensome decryption and encryption steps of the prior art peer-to-peer encryption and decryption process.

Abstract: Techniques for mitigating network failures (e.g., SLA violations, service degradations, network outages, etc.) based on output(s) from a predictive network system. The techniques may include determining that a failure is predicted to occur in a network and determining a correlation between the failure and a previous failure that occurred in the network. In examples, the correlation may be determined using a machine-learned model. The techniques may also include determining, based at least in part on the correlation, a condition contributing to the failure. In this way, prior to occurrence of the failure, a parameter associated with the network may be altered based at least in part on the condition to mitigate or otherwise prevent the failure.

Abstract: This disclosure describes techniques for predicting and accommodating for outages in a satellite network using crowdsourced data. An example method includes receiving outage data indicating first outages experienced by first endpoints in a first geographical region. The first outages, for instance, include interruptions in communication between first satellites and the first endpoints. The example method further includes predicting, based on the outage data, a second outage comprising an interruption in communication between at least one second satellite and a second endpoint in a second geographical region. Further, the example method includes causing the second endpoint to transmit user data over a secondary network in advance of the second outage.

Abstract: In one illustrative example, a controller may operate to send a request message towards a user equipment (UE) which operates to communicate traffic in a session in a mobile network. In response, the controller may receive, from a user plane function which anchors the session of the UE, a response message which includes an identifier of the user plane function. The controller may verify whether a zone or security level value that is assigned to the user plane function matches a zone or security level value that is assigned to the UE. If the controller identifies a discrepancy between the zone or security level values, the controller may provide a notification indication to indicate the discrepancy. The UE may be an industrial Internet of Things (IIoT) device and the zone or security level values may be based on International Electrotechnical Commission (IEC) 62443.

Abstract: The present technology monitors the behavior and security profile of an IoT device and determines the changes that need to be made to the MUD file of the IoT device based on the data gathered during the monitoring. The technology then creates a new MUD file using a generative model (such as a large language model (LLM)) and compares the new MUD file with the original MUD file. Thereafter, the technology can communicate with the IoT device manufacturer to provide the new MUD file and explain the reasons why it is advantageous over the original MUD file. The new MUD file can then be deployed by the manufacturer to resolve security and efficiency issues with ease.

Abstract: This disclosure describes techniques for tracking aircraft using a satellite network. An example method includes receiving ADS-B messages from multiple aircraft; determining that at least one of the ADS-B messages satisfies at least one condition; and in response to determining that at least one of the ADS-B messages satisfies the at least one condition, transmitting an alert. In some cases, a system transmits an instruction to perform the example method to at least one satellite and receives the alert.

Abstract: Disclosed are systems, apparatuses, methods, and computer-readable media for preventing supervision frame injection attacks in replication networks. A method includes: identifying, by a network device, a trusted network device in a replication network; providing credentials to the trusted network device to validate an identity of the network device; based on authentication of the credential at the trusted network device, receiving security information from the trusted network device that is encrypted with a public key of the network device; and transmitting an onboarding supervision frame encrypted with or signed by the security information, wherein a management device of the replication network updates a trusted peer information based on the onboarding supervision frame.

Abstract: Techniques for providing a language model with dynamic configuration data for network devices in a network that is then used by the language model to generate network-contextual responses to prompts received at the language model. A network controller may collect configuration data from the network devices where the configuration data includes device configurations of the network devices. The network controller may further receive a prompt from a network operator to which the language model is to respond and identify a relevant device configuration that is contextually relevant to the prompt. Further, the network controller may provide the prompt and the relevant device configuration to the language model, generate, by the language model and using the relevant device configuration, a response to the prompt, and provide the network operator with an indication of the response to the prompt.

Abstract: Techniques for, among other things, embedding metadata in network traffic without having to implement an overlay network. By way of example, and not limitation, the techniques described herein may include receiving an Ethernet packet at a network node and determining that a preamble of the Ethernet packet includes metadata. The metadata may, in some examples, be associated with the Ethernet packet itself, a flow that the Ethernet packet belongs to, etc. Based at least in part on the metadata, a policy decision may be made for handling the Ethernet packet, and the Ethernet packet may be handled in accordance with the policy decision.

Abstract: Software bill of materials (SBOM) vulnerability systems do not monitor software components behavior in real time, and rather rely on the static periodic updates. This gap leaves cloud-native software applications exposed to 0-day or supply chain attacks that exploit vulnerabilities that are not known or updated into the public vulnerability data sources. The techniques described herein provide dynamic and intelligent identification of 0-day and supply chain attacks in runtime environments, mitigate the attacks in real-time, and share intelligence to prevent a malicious workload from being deployed through the CI/CD pipeline.

Abstract: Techniques are described herein for determining and mitigating a risk to an organization associated with a security threat. In embodiments, such techniques may be performed by an access control device and may comprise receiving information about a security threat, identifying one or more components susceptible to the security threat, determining a number of software applications associated with the one or more components, and determining, based on usage metrics stored in relation to the number of software applications, a severity associated with each of the number of software applications. The techniques may further comprise determining at least one mitigation technique associated with a software application having the highest severity in relation to the security threat and causing the at least one mitigation technique to be implemented.

Abstract: Disclosed are systems, apparatuses, and methods to minimize service disruption in ring topology based on unavailability of the network device. A network device includes a network interface configured to receive frames from other network devices in a ring network and configured to detect that the network device will become unavailable and, in response to detecting the network device will become unavailable, transmit an unavailability frame to a first network device in the ring network and a second network device in the ring network. The unavailability frame indicates that the network device will become unavailable and causes at least one of the first network device or the second network device to change a transmission direction in the ring network. The unavailability frame is configured and stored in a hardware to reduce the power required to transmit the unavailability frame.

Abstract: Disclosed are systems, apparatuses, methods, computer readable medium, and circuits for reducing energy consumption of one or more station devices, the method including: monitoring, at a controller, energy usage by one or more station devices, on a wireless local area network (WLAN); determining, at the controller, reduction in energy consumption on the WLAN is required to meet a predetermined target; and transmitting, from the controller, a beacon that instructs the one or more station devices to enter an energy efficiency mode.

Abstract: In one aspect, a method includes associating an MLO device with 2 transmission radios to yield a first communication link between the device and a first MLO access point and a second communication link between the device and a second MLO access point, wherein the device is configured to label the first communication link as a primary link and the second communication link as a secondary link; generating a sequence number to be assigned to a frame to be transmitted on the primary link and to a duplicate copy of the frame to be transmitted on the secondary link; associating a flag with the duplicate copy of the frame on the secondary link; and sending, from the device to the first and the second MLO access points, the frame and the duplicate copy on the primary link and the secondary link, respectively.

Abstract: Examples described herein are directed to tracking location by a positioning service. For instance, a method includes: receiving distance measurements from a first anchor device; determining a trust value associated with a path between the first anchor device and a second anchor device based on the distance measurements, wherein the trust value corresponds to whether the path is obstructed; determining a first measurement interval to measure a distance from the first anchor device to the second anchor device based on a single-sided measurement and a second measurement interval to measure the distance from the first anchor device to the second anchor device based on a double-sided measurement; and sending an anchor configuration to the first anchor device including the first measurement interval for the single-sided measurement and the second measurement interval for the double-sided measurement of the second anchor device.

Abstract: Access point devices can be equipped with Machine Learning (ML) models to improve access point device operations. An access point device operating mode can be sent to a controller. The access point device operating mode can indicate multiple network protocols employed at the access point device. The controller can provide a coarse ML model to the access point device, wherein the coarse ML model is based on the operating mode. The access point device can then use local network traffic data, processed by the access point device, to train and refine the coarse ML model, and the access point device can use the resulting trained ML model in connection with network traffic processing determinations.

Abstract: A method for adaptive presence-based radio configuration of access points in a venue includes defining a number of regions in the venue in which access points are deployed, each region having a center point, and assigning a first access point to a first region, positioned at the center of the first region. The method also includes affecting a first energy level in the first region, which corresponds to a power of a transmit signal emitted by the first access point, and assigning to the first region a configurable capacity value that determines an acceptable overlap constraint between the first energy level of the first region and an energy level of a neighboring region. The method further includes generating data describing a tessellation graph in which a possible map of the access points is formed using an iterative descent process based on the first energy level and the overlap constraint.

Abstract: In one illustrative example, a controller for use in a private mobile network may determine network service requirements for an industrial device. The controller may select, from a set of network slices, a subset of network slices having network service requirement configurations that most closely support the network service requirements. Each network slice of the set may be associated with an affinity ranking value that is indicative of a service performance of the network slice for industrial device operation in a cell or a zone associated with a zone or security level value assigned to the industrial device. The controller may identify, from the subset of network slices, a selected network slice associated with a best affinity ranking value for the zone or security level value assigned to the industrial device. The controller may assign the selected network slice and associated service parameters for the communications of the industrial device.

Abstract: This disclosure describes techniques for complying with a data sovereignty policy of data routed through a satellite network. An example method includes identifying data comprising a data sovereignty label indicating a first geographical region; determining that a coverage region of a satellite includes a first ground station in the first geographical region; determining that coverage region excludes a second ground station in a second geographical region; and based on determining that the coverage area includes the first ground station and excludes the second ground station, transmitting the data to the satellite.

Abstract: Presented herein are techniques to allocate use of controlled wireless spectrum. A method includes receiving, from a wireless local area network service provider, a request for wireless local area network spectrum for a future time window, wherein the wireless local area network spectrum is subject to automated frequency coordination, in response to the request, sending, to an incumbent that uses the wireless local area network spectrum, a query consistent with the request for the wireless local area network spectrum for the future time window, receiving, from the incumbent, in response to the query, a grant to use the wireless local area network spectrum for the future time window, and in response to receiving the grant, sending permission to the wireless local area network service provider to use the wireless local area network spectrum for the future time window.