arXiv subjects

Fernando Kuipers

Publications and source records attributed to Fernando Kuipers.

12 recordsLinked to original sources

arXiv2026

Media-over-Multipath-QUIC for Realtime Video Applications

Multipath transports place a client's WiFi, cellular, and satellite networks under one connection, yet real-time video gains little from them. The scheduler that assigns packets to paths sees only bytes, so it cannot tell a keyframe that anchors a second of video from an enhancement frame whose loss costs one image. We show that the limiting factor is not a shortage of path diversity but the absence of a channel through which the application can name what the transport cannot see. Media over QUIC Transport (MoQT), already deployed on production CDNs, carries media as named Objects, and relays forward each Object's metadata without interpreting it. The knowledge the scheduler lacks therefore already flows through the subscriber's relay. We present MoMQ, a MoQT extension that turns this metadata into path decisions. Applications and relay operators install declarative rules at the edge relay that match Object metadata and express delivery preferences against labeled paths. The relay evaluates the rules mechanically, so it acts on video semantics while containing no video logic. On a live testbed spanning Starlink and WiFi, four rules cut P99.9 frame completion time from 384.7 ms under the best transport-only scheduler to 114.1 ms and reduce the required playback buffer by 61.5%. MoMQ is the only configuration that meets the 150 ms interactive latency target. Across relays in two countries and subscribers on two continents, the same rules apply unchanged and retain their advantage wherever the paths remain disjoint.

cs.NI↗

arXiv2026

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?

As network threats evolve, manual NIDS rule engineering has become a critical operational bottleneck. While Large Language Models (LLMs) show promise for automating this process, their ability to produce production-ready rules remains unvalidated. This paper presents a human-centered investigation into LLM-based NIDS rule engineering, formalizing a grounded generation framework and evaluating it through a user study with 10 domain experts. Our evaluation reveals a syntax-semantics paradox: although LLMs generate syntactically correct rules, experts find them only partially deployable due to low specificity and logic hallucinations in 12% of cases. While the system received a favorable SUS score of 67, practitioners remain skeptical of its autonomous capabilities, viewing LLMs as support tools for drafting and verification rather than independent generators. Finally, our statistical analysis indicates that while large-scale models ($\geq 70B$) consistently produce syntactically valid rules, small models ($\leq 4B$) are largely ineffective for IDS rule generation.

cs.CR↗

arXiv2026

Securing the Web with HSTS-Enforced

TLS stripping attacks expose sensitive web traffic by forcing secure HTTPS connections to fall back to unencrypted HTTP. At present, protection against these attacks relies on website operators explicitly opting into security by deploying mechanisms such as HTTP Strict Transport Security (HSTS) headers. These mechanisms have significant limitations: some are weak or difficult to configure, which raises the risk of misconfiguration and reduces practical adoption; others violate HTTP backward compatibility; at least one can even be abused to enable unintended user tracking. We introduce HSTS-Enforced, a mechanism that eliminates the remaining attack surface for TLS stripping while still allowing operators to securely specify that their websites need to be accessed over HTTP when necessary, thereby maintaining accessibility. To achieve this, we flip the current opt-in security model to an opt-out model: all connections default to HTTPS, and operators can explicitly opt out if their websites require HTTP using so-called HTTP-Required indicators. We propose two such HTTP-Required indicators: a new DNS record and an HTTP-Required Preload list. We evaluate HSTS-Enforced under multiple deployment scenarios, demonstrating that it blocks all practical TLS stripping attempts while maintaining compatibility for sites that require HTTP - without introducing overhead in the typical case. Finally, we outline a practical transition path to accelerate global adoption.

cs.CR↗

arXiv2026

Scrutinizing Real-life Configurations of Random Access Procedures in Cellular Networks

In cellular networks, base stations broadcast configurations that devices use for the random access procedure, which is a vital part of the connection setup. Ideally, the network should choose configurations based on the deployment scenario to optimize radio resource management. Doing so can, for example, decrease collisions of random access messages. We captured 112,806 data points of cellular broadcast information from nine network operators across three countries and analyzed how the operators configure the random access procedure. We found that configurations often do not fit the deployment scenario, and neighboring cells often use the same configuration, causing an unnecessarily high risk of collisions and, hence, delay in the connection setup. Furthermore, we simulated the random access procedure in NS-3 and found that by varying the configurations in a large area with many cells, the number of collisions can be reduced by 43% on average and up to 61%, and the connection delay can be lowered by 11% on average and up to 42%. Our findings indicate that simple adaptations in the random access configurations can greatly improve the performance of cellular networks.

cs.NI↗

arXiv2026

SoK: Harmonizing Attack Graphs and Intrusion Detection Systems

Detecting and responding to cyber attacks is increasingly difficult as high-volume, complex network traffic allows threats to remain concealed. While Intrusion Detection Systems (IDSs) identify anomalous behavior, Attack Graphs (AGs) serve as the primary threat model for analyzing attacker strategies and informing any response. Despite the conceptual connection being recognized in early research, the field of AG and IDS integration lacks a common structure. This paper presents the first systematic analysis of AG-IDS integration, reviewing a 73 comprehensive works in literature. We introduce a novel taxonomy revealing that current research is dominated by specialized, single-purpose integrations, such as using AGs to filter IDS false positives or using IDS alerts to prune AGs. Our analysis highlights a critical gap: the absence of a unifying framework that treats IDSs and AGs as a cohesive, integrated system. To address this gap, we propose a formal AG-IDS lifecycle. This framework establishes a continuous feedback loop where IDSs refine the accuracy of AG models, and those updated models, in turn, enhance IDS detection capabilities. We provide a proof-of-concept implementation demonstrating the practical advantages of this lifecycle for threat detection and incident response. Finally, we conclude by elaborating on significant opportunities for future development within the AG-IDS domain.

cs.CR↗

arXiv2022

Future Computer Systems and Networking Research in the Netherlands: A Manifesto

Our modern society and competitive economy depend on a strong digital foundation and, in turn, on sustained research and innovation in computer systems and networks (CompSys). With this manifesto, we draw attention to CompSys as a vital part of ICT. Among ICT technologies, CompSys covers all the hardware and all the operational software layers that enable applications; only application-specific details, and often only application-specific algorithms, are not part of CompSys. Each of the Top Sectors of the Dutch Economy, each route in the National Research Agenda, and each of the UN Sustainable Development Goals pose challenges that cannot be addressed without groundbreaking CompSys advances. Looking at the 2030-2035 horizon, important new applications will emerge only when enabled by CompSys developments. Triggered by the COVID-19 pandemic, millions moved abruptly online, raising infrastructure scalability and data sovereignty issues; but governments processing social data and responsible social networks still require a paradigm shift in data sovereignty and sharing. AI already requires massive computer systems which can cost millions per training task, but the current technology leaves an unsustainable energy footprint including large carbon emissions. Computational sciences such as bioinformatics, and "Humanities for all" and "citizen data science", cannot become affordable and efficient until computer systems take a generational leap. Similarly, the emerging quantum internet depends on (traditional) CompSys to bootstrap operation for the foreseeable future. Large commercial sectors, including finance and manufacturing, require specialized computing and networking or risk becoming uncompetitive. And, at the core of Dutch innovation, promising technology hubs, deltas, ports, and smart cities, could see their promise stagger due to critical dependency on non-European technology.

cs.CY↗

arXiv2021

Heads in the Clouds: Measuring the Implications of Universities Migrating to Public Clouds

With the emergence of remote education and work in universities due to COVID-19, the `zoomification' of higher education, i.e., the migration of universities to the clouds, reached the public discourse. Ongoing discussions reason about how this shift will take control over students' data away from universities, and may ultimately harm the privacy of researchers and students alike. However, there has been no comprehensive measurement of universities' use of public clouds and reliance on Software-as-a-Service offerings to assess how far this migration has already progressed. We perform a longitudinal study of the migration to public clouds among universities in the U.S. and Europe, as well as institutions listed in the Times Higher Education (THE) Top100 between January 2015 and October. We find that cloud adoption differs between countries, with one cluster (Germany, France, Austria, Switzerland) showing a limited move to clouds, while the other (U.S., U.K, the Netherlands, THE Top100) frequently outsources universities' core functions and services -- starting long before the COVID-19 pandemic. We attribute this clustering to several socio-economic factors in the respective countries, including the general culture of higher education and the administrative paradigm taken towards running universities. We then analyze and interpret our results, finding that the implications reach beyond individuals' privacy towards questions of academic independence and integrity.

cs.CY↗

arXiv2020

A P4 Data Plane for the Quantum Internet

The quantum technology revolution brings with it the promise of a quantum internet. A new -- quantum -- network stack will be needed to account for the fundamentally new properties of quantum entanglement. The first realisations of quantum networks are imminent and research interest in quantum network protocols has started growing. In the non-quantum world, programmable data planes have broken the pattern of ossification of the protocol stack and enabled a new -- software-defined -- network software architecture. Similarly, a programmable quantum data plane could pave the way for a software-defined quantum network architecture. In this paper, we demonstrate how we use P4$_{16}$ to explore abstractions and device architectures for quantum networks.

cs.NI↗

arXiv2019

GP4P4: Enabling Self-Programming Networks

Recent advances in programmable switches have enabled network operators to build high-speed customized network functions. Although this is an important step towards self-* networks, operators are now faced with the burden of learning a new language and maintaining a repository of network function code. Inspired by the Intent-Based Networking paradigm, we propose a new framework, GP4P4: a genetic programming approach able to autonomously generate programs for P4-programmable switches directly from network intents. We demonstrate that GP4P4 is able to generate various small network functions in up to a few minutes; an important first step towards realizing the vision of `Self-Driving' networks.

cs.NI↗

arXiv2019

Detecting Heavy Hitters in the Data-plane

The ability to detect, in real-time, heavy hitters is beneficial to many network applications, such as DoS and anomaly detection. Through programmable languages as P4, heavy hitter detection can be implemented directly in the data-plane, allowing custom actions to be applied to packets as they are processed at a network node. This enables networks to immediately respond to changes in network traffic in the data-plane itself and allows for different QoS profiles for heavy hitter and non-heavy hitter traffic. Current interval-based methods that flush the whole counting structure are not well-suited for programmable hardware (the data-plane), because they either require more resources than available in that hardware, they do not provide good accuracy, or require too many actions from the control-plane. A sliding window approach that maintains accuracy over time would solve these issues. However, to the best of our knowledge, the concept of sliding windows in programmable hardware has not been studied yet. In this paper, we develop streaming approaches to detect heavy hitters in the data-plane. We consider the problems of (1) adopting a sliding window and (2) identifying heavy hitters separately and propose multiple memory- and processing-efficient solutions for each of them. These solutions are suitable for P4 programmable hardware and can be combined at will to solve the streaming variant of the heavy hitter detection problem.

cs.NI↗

arXiv2018

ThingPot: an interactive Internet-of-Things honeypot

The Mirai Distributed Denial-of-Service (DDoS) attack exploited security vulnerabilities of Internet-of-Things (IoT) devices and thereby clearly signalled that attackers have IoT on their radar. Securing IoT is therefore imperative, but in order to do so it is crucial to understand the strategies of such attackers. For that purpose, in this paper, a novel IoT honeypot called ThingPot is proposed and deployed. Honeypot technology mimics devices that might be exploited by attackers and logs their behavior to detect and analyze the used attack vectors. ThingPot is the first of its kind, since it focuses not only on the IoT application protocols themselves, but on the whole IoT platform. A Proof-of-Concept is implemented with XMPP and a REST API, to mimic a Philips Hue smart lighting system. ThingPot has been deployed for 1.5 months and through the captured data we have found five types of attacks and attack vectors against smart devices. The ThingPot source code is made available as open source.

cs.NI↗

arXiv2017

LoRaWAN in the Wild: Measurements from The Things Network

The Long-Range Wide-Area Network (LoRaWAN) specification was released in 2015, primarily to support the Internet-of-Things by facilitating wireless communication over long distances. Since 2015, the role-out and adoption of LoRaWAN has seen a steep growth. To the best of our knowledge, we are the first to have extensively measured, analyzed, and modeled the performance, features, and use cases of an operational LoRaWAN, namely The Things Network. Our measurement data, as presented in this paper, cover the early stages up to the production-level deployment of LoRaWAN. In particular, we analyze packet payloads, radio-signal quality, and spatio-temporal aspects, to model and estimate the performance of LoRaWAN. We also use our empirical findings in simulations to estimate the packet-loss.

cs.NI↗