As the project progresses, available peer-reviewed papers published by project partners will be made available here.
Return to this page for updates and new research publications!
Machine Learning-Enriched Cybersecurity in Smart Grids
Authors: G. Amritha, Manjula G. Nair, Fabrizio Granelli
MARE Partner: Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT)
Journal: IEEE Access, June 2025. Journal website.
Abstract: A smart grid is one of the critical infrastructures that, when targeted by a cyber-attack, could have disastrous effects on the economy and disrupt the lives of the population. Firewalls and Intrusion detection systems, the conventional protective schemes and cyber threat mitigation systems in smart grids, are usually deployed to analyse incoming and outgoing traffic. Although these approaches are capable of detecting external attacks, they are ill-suited to detect threats originating from a compromised device [internal to the grid] infected with malware or malicious software. To mitigate such threats, Industrial Control System (ICS) traffic monitoring and the implementation of anomaly detection systems based on the traffic data are crucial. We propose an anomaly detection system for monitoring the ICS traffic data based on IP traffic flows extended with application layer data obtained from the ICS packet headers. Unlike conventional methods that utilise statistical properties of the communication profiles of the dataflows to identify unknown threats, this study proposes an Autoencoder-based threat detection model. The dataset considered for the scope of this research was generated for the project at Brno University of Technology: Security monitoring of Industrial Control System (ICS) communication in the smart grid (Bonnet), 2019–2022, funded by the Ministry of Interior of the Czech Republic. The proposed solution was validated on diverse cyber-attack datasets, in conformance with IEC (International Electrotechnical Commission) 104 and IEC 61850 standards. The proposed model is efficient with an average anomaly detection rate of 99% in IEC 104 dataset and 97% in IEC 61850 dataset.
A Cross-Layer Analysis of Network Antifragility with RIS-assisted Links under Jamming Attacks
Authors: M. Bensalem, T. Röthig, and A. Jukan.
MARE Partner: Technische Universität Braunschweig (TUBS)
Journal: IEEE Networking Letters, November 2025. Journal website.
Abstract: Antifragility is an economics term defined as measure of (monetary) benefits gained from the adverse events and variability of the markets. This paper integrates for the first time the antifragility into the network based on communication links with Reconfigurable Intelligent Surface (RIS) affected by a jamming attack. We analyze whether antifragility can be achieved for several jamming models. Beyond the link-level gains, the results reveal how antifragile RIS-assisted links can be integrated into multi-hop systems to improve end-to-end network resilience, connectivity, and throughput under adversarial effects.
Authors: Andrea Bellmunt, Beatriz Otero, Eva Rodríguez, Xavier Masip-Bruin
MARE Partner: Universitat Politècnica de Catalunya (UPC)
Journal: Expert Systems with Applications, 5 April 2026, Article: 130868, Volume: Volume 305. Journal website.
Abstract: The development of Intrusion Detection Systems (IDS) for the Internet of Things (IoT) and 5G networks is rapidly advancing. This study investigates the application of federated architectures to train detection models while preserving data privacy by eliminating the need for data sharing among devices. We propose a Federated Transfer Learning (FTL) model tailored for scenarios with unbalanced nodes, enhancing the detection capabilities for unknown attacks compared to conventional Federated Learning (FL) approaches. Utilizing the Bot-IoT dataset as the source domain and the UNSW-NB15 dataset as the target domain, our experiments reveal significant improvements in detection performance.
Specifically, nodes characterized by lower proportions of malicious traffic demonstrate up to a 62.614 % enhancement in detecting unknown attacks, increasing detection rates from 19.090 % to 81.704 %. Moreover, our findings indicate that FTL not only improves the identification of unknown threats but also maintains robust performance in detecting both attacks and benign traffic. Notably, the minimum accuracy achieved by the most imbalanced node reaches 0.912, in contrast to 0.741 with standard FL models.
These results highlight the potential of FTL to train robust models across distributed nodes while ensuring privacy, thereby contributing to improved security measures in IoT and 5G networks.
Design and Evaluation of a Network Digital Twin Framework for 5G/6G Architectures
Authors: I. Vasalos, M. Christopoulou, A. Vasalos, M. A. Kourtis, N. Dimitriou and G. Xylouris.
MARE Partner: National Centre For Scientific Research Demokritos (NCSRD)
Publication: 2025 21st International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT), Lucca, Italy, June 2025, pp. 915-920. Conference website.
Abstract: Network Digital Twin (NDT) systems serve as a real-time, virtualized replica of physical networks, enabling closed-loop automation and AI/ML driven network intelligence. In this paper, we present a comprehensive approach to implementing an NDT framework tailored for B5G/6G networks. Through the proposed methodology, we demonstrate the generation of the NDT model, the accurate modeling of network topology, and the seamless synchronization with real world network operations. Our research delves into the deployment_and validation of an NDT prototype platform, seamlessly integrated with a 5G physical network testbed. We also present the end-to-end deployment of the framework and showcase its integration with a physical 5G testbed, effectively demonstrating its capability to support AI-native functionalities in next-generation mobile networks.
B5G/6G Cyber Security Testbed
Authors: Alessandro Carrega, Franco Davoli, and Ramin Rabbani.
MARE Partner: Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT)
Publication: Way to 6G Workshop (WT6G) on 33rd International Symposium on the Modeling, Analysis, and Simulation of Computer and Telecommunication System (MASCOTS). Paris, France: IEEE, Oct. 2025. Workshop website.
Abstract: The evolution of mobile communication technologies to Beyond 5G (B5G) and Sixth-Generation (6G) introduces significant advancements but also new cybersecurity vulnerabilities. This paper details the National Inter-university Consortium for Telecommunications (CNIT) National Laboratory of Smart and Secure Networks (S2N) testbed in Genoa, Italy, a state-of-the-art facility for research and development in B5G/6G technologies with a focus on cybersecurity. The testbed’s modular architecture, including isolated “islands” and advanced HardWare/SoftWare (HW/SW), enables the simulation and analysis of cyber threats like Application Programming Interface (API) exposure, and Distributed Denial of Service (DDoS) attacks. It supports the testing of security measures, including Artificial Intelligence (AI) / Machine Learning (ML)-based solutions, and facilitates comprehensive vulnerability assessments and penetration testing for next-generation networks.
Authors: Zied Ennaceur, Admela Jukan
MARE Partner: Technische Universität Braunschweig (TUBS)
Publication: IEEE International Conference on Communications (ICC) , Glasgow, Scotland, UK, 24–28 May 2026. Conference website.
Abstract: We study the problem of service continuity in 6G networks and propose a solution aligned with current mobile network standards that integrates conformal prediction and risk-aware throughput estimation to anticipate short-term degradations and, in addition, to optimize application and session continuity during network topology changes. Our pipeline combines throughput prediction over short horizons with calibration based on split conformal prediction to produce sharp intervals with coverage guarantees, and a throughput degradations estimator that provides the probability that throughput falls below the SLA threshold on each link. A risk-aware optimizer then selects associations that balance expected throughput, reliability, and continuity. Experiments on emulated mobile network traces demonstrate that the performance improves by incorporating uncertainty and calibrated risk estimation. Experiments on emulated mobile network traces demonstrate that the degradation risk model is well calibrated with a Brier score of 0.095, an Expected Calibration Error of 0.068, and a PR–AUC of 0.810, and that incorporating uncertainty and calibrated risk improves control decisions. The risk-aware controller consistently attains higher expected throughput than the commonly used point-estimate baseline at matched reassociation rates, and it can identify network operating regimes with low SLA degradation, e.g., 7.9% violations at 999 Mb expected throughput for ε = 0.40.
Authors: Ioannis Vasalos, Efstathios Zaragkas, Athina Vekraki, Maria Christopoulou, Michail Alexandros Kourtis, George Xilouris, Nikos Dimitriou
MARE Partner: National Centre For Scientific Research Demokritos (NCSRD)
Publication: Second International Workshop on Whole-Lifecycle Security for Smart Systems: Methods and Tools, IEEE SMARTCOMP 2026 , Messina, Italy
Abstract: With the rapid evolution of 5G and emerging 6G networks, ensuring security against DDoS threats remains a pressing challenge, particularly due to expanded attack surfaces across the edge–cloud continuum and heterogeneous edge devices. Traditional security mechanisms struggle to provide proactive, scalable, and low-risk detection and classification solutions in such highly dynamic environments. This paper proposes a Network Digital Twin (NDT)–driven framework for DDoS detection, analysis, and classification in 5G/6G networks, leveraging a synchronized digital twin for safe attack emulation and AI/ML-based anomaly detection. We implement and validate the framework on a real 5G testbed combined with an operational NDT platform, demonstrating that the NDT accurately reproduces network behavior under both normal and attack conditions and validating its efficacy for DT-driven, adaptive security in next-generation mobile systems.
Authors: Fabrizio Granelli, Eva Rodriguez, Xavier Masip-Bruin, Ioannis Vasalos, George Xilouris
MARE Partners:
Publication: 1st International Workshop on Trust for Service Oriented 6G Network Architecture (Trust 6G-Net 2026), 12th IEEE International Conference on Network Softwarization (NetSoft 2026), Berlin Germany, June 29-30.
Abstract: In 6G, effective protection mechanisms must be inherently cross-layer and adaptive. In this context, the HORSE and MARE projects align with this vision by proposing an adaptable and extensible approach based on a 6G service provisioning platform. This approach introduces a novel security plane built upon a well-defined set of open and programmable security functions, delivered as enablers within the 6G architecture. It operates transparently across multi-domain and multistakeholder environments, while efficiently handling emerging threats. As such, it enables the dynamic orchestration of security strategies to efficiently address novel and evolving attacks.
Authors: Athina Vekraki, Maria Christopoulou, Ioannis Vasalos, Michail Alexandros Kourtis, Athanasia Alonisioti, George Xilouris
MARE Partner: National Centre For Scientific Research Demokritos (NCSRD)
Publication: 7th International Conference in Electronic Engineering and Information Technology, EEITE 2026
Abstract: As 5G and emerging 6G networks evolve into highly complex, AI-native infrastructures, the risk and cost of testing new orchestration policies or security mechanisms on live systems become prohibitive. Network Digital Twins (NDTs) have emerged as a critical paradigm for providing risk-free virtual replicas; however, current solutions often focus on coarse performance prediction rather than the high-fidelity replication of dynamic traffic patterns. In this paper, we present an AI-native NDT engine based on Graph Transformers designed to reconstruct the intricate spatio-temporal dynamics of 5G traffic. Using a comprehensive dataset from an Amarisoft-based testbed, we model network telemetry as a k-hop temporal line graph to capture the underlying statistical structure and bitrate oscillations of individual User Equipments (UEs) across both benign streaming and Distributed Denial-of-Service (DDoS) traffic regimes. Experimental results demonstrate that our Graph Transformer architecture achieves high-fidelity reconstruction with R^2 scores up to 0.9839, significantly outperforming traditional Long Short-Term Memory (LSTM) baselines. Furthermore, strong alignment in Cumulative Distribution Function (CDF) analysis confirms the model’s ability to preserve the underlying probability distributions and variance of real-world telemetry. This work provides a foundation for high-fidelity traffic synthesis and reproducible security analysis in future 6G ecosystems.
MARE appeared in the 2025 SNS Journal, as a project developing a programmable, modular, and disaggregated Security Plane for 6G ecosystems, built from open and extendable Security Functions composed from atomic building blocks called DOTs.
The journal also highlights MARE’s pre-assessment sandbox, based on network modelling and digital twinning, which is used to analyse and test security functions – which are composed of various DOTS, before deployment across realistic 6G scenarios and PoCs.
In this white paper, MARE appears as a project contributing to secure zero-trust service development and management in programmable, open end-to-end 6G systems, with emphasis on cross-platform interoperability and multi-tenant operation.
The paper also refers to MARE in relation to federated learning among security components, challenges around programmable security functions, exposure controls and a proactive security approach for edge attack scenarios in beyond-5G and 6G environments.
Co-funded by the European Union
MARE project has received funding from the Smart Networks and Services Joint Undertaking (SNS JU) under the European Union’s Horizon Europe research and innovation programme under Grant Agreement No 101191436
