Cyber Resilience of IP/MPLS Core Networks in Saudi Arabia: Hardening, Threat Analysis, and Operational Continuity under Vision 2030

References

[1] Mrabet, H., Belguith, S., Alhomoud, A. and Jemai, A. (2020). A survey of IoT security based on a layered architecture of sensing and data analysis. Sensors, 20, 3625. https://doi.org/10.3390/s20133625.

[2] Rose, S., Borchert, O., Mitchell, S. and Connelly, S. (2020). Zero Trust Architecture. NIST Special Publication 800-207. https://doi.org/10.6028/NIST.SP.800-207.

[3] Communications, Space and Technology Commission (2020). Cybersecurity Regulatory Framework for Service Providers in the Information and Communications Technology Sector. Decision 424/1442.

[4] Herrera, M., Proselkov, Y., Pérez-Hernández, M. and Parlikad, A.K. (2021). Mining graph-Fourier transform time series for anomaly detection of Internet traffic at core and metro networks. IEEE Access, 9. https://doi.org/10.1109/ACCESS.2021.3050014.

[5] Filsfils, C., Camarillo, P., Leddy, J., Voyer, D., Matsushima, S. and Li, Z. (2021). Segment Routing over IPv6 Network Programming. RFC 8986. https://doi.org/10.17487/RFC8986.

[6] Choi, K., Yi, J., Park, C. and Yoon, S. (2021). Deep learning for anomaly detection in time-series data: review, analysis, and guidelines. IEEE Access, 9, 120043–120065. https://doi.org/10.1109/ACCESS.2021.3107975.

[7] Internet Engineering Task Force (2022). Network Telemetry Framework. RFC 9232. https://doi.org/10.17487/RFC9232.

[8] Internet Engineering Task Force (2022). Route Leak Prevention and Detection Using Roles in UPDATE and OPEN Messages. RFC 9234. https://doi.org/10.17487/RFC9234.

[9] Internet Engineering Task Force (2022). Segment Routing Policy Architecture. RFC 9256. https://doi.org/10.17487/RFC9256.

[10] Internet Engineering Task Force (2022). Operations, Administration, and Maintenance in Segment Routing over IPv6. RFC 9259. https://doi.org/10.17487/RFC9259.

[11] Internet Engineering Task Force (2022). The Use of maxLength in the Resource Public Key Infrastructure. RFC 9319. https://doi.org/10.17487/RFC9319.

[12] Internet Engineering Task Force (2022). Policy Based on the Resource Public Key Infrastructure without Route Refresh. RFC 9324. https://doi.org/10.17487/RFC9324.

[13] Internet Engineering Task Force (2022). TCP Authentication Option Test Vectors. RFC 9235. https://doi.org/10.17487/RFC9235.

[14] Wirtgen, T. and Bonaventure, O. (2022). A first step towards checking BGP routes in the dataplane. Proceedings of the ACM SIGCOMM Workshop on Future of Internet Routing and Addressing, 50–57. https://doi.org/10.1145/3527974.3545723.

[15] Hlavacek, T., Jeitner, P., Mirdita, D., Shulman, H. and Waidner, M. (2022). Stalloris: RPKI downgrade attack. 31st USENIX Security Symposium, 4455–4471.

[16] National Cybersecurity Authority (2022). Data Cybersecurity Controls (DCC-1:2022). Riyadh, Saudi Arabia.

[17] National Cybersecurity Authority (2022). Operational Technology Cybersecurity Controls (OTCC-1:2022). Riyadh, Saudi Arabia.

[18] Digital Government Authority (2023). Guideline of Business Continuity Management in Digital Government, Version 2.0. Riyadh, Saudi Arabia.

[19] Internet Engineering Task Force (2023). IS-IS Extensions to Support Segment Routing over the IPv6 Data Plane. RFC 9352. https://doi.org/10.17487/RFC9352.

[20] Internet Engineering Task Force (2023). OSPFv3 Extensions for Segment Routing over IPv6. RFC 9513. https://doi.org/10.17487/RFC9513.

[21] Internet Engineering Task Force (2023). Export of Segment Routing over IPv6 Information in IP Flow Information Export. RFC 9487. https://doi.org/10.17487/RFC9487.

[22] Bordeau-Aubert, K., Whatley, J., Nadeau, S., Glatard, T. and Jaumard, B. (2023). Classification of anomalies in telecommunication network KPI time series. arXiv:2308.16279.

[23] National Institute of Standards and Technology (2024). The NIST Cybersecurity Framework 2.0. NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29.

[24] National Cybersecurity Authority (2024). Essential Cybersecurity Controls (ECC-2:2024). Riyadh, Saudi Arabia.

[25] Digital Government Authority (2024). Digital Government Policies, Version 2.0. Riyadh, Saudi Arabia.

[26] Koumar, J., Hynek, K., Čejka, T. and Šiška, P. (2024). CESNET-TimeSeries24: time series dataset for network traffic anomaly detection and forecasting. arXiv:2409.18874.

[27] Internet Engineering Task Force (2024). Egress Validation in Label Switched Path Ping and Traceroute Mechanisms. RFC 9655. https://doi.org/10.17487/RFC9655.

[28] Saudi Vision 2030 (2025). Vision 2030 Annual Report 2024. Riyadh, Saudi Arabia.

[29] National Institute of Standards and Technology (2025). Implementing a Zero Trust Architecture. NIST Special Publication 1800-35. https://doi.org/10.6028/NIST.SP.1800-35.

@article{1722267,
      author = {Zakiuddin Mohammed},
      title = {Cyber Resilience of IP/MPLS Core Networks in Saudi Arabia: Hardening, Threat Analysis, and Operational Continuity under Vision 2030},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {2},
      pages = {1241-1252},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1722267.pdf},
      abstract = {Saudi Arabia’s digital economy increasingly depends on IP/MPLS core networks that aggregate mobile, fixed, cloud, government and industrial traffic. Their importance creates a difficult resilience problem: the core must preserve deterministic forwarding and rapid convergence while resisting control-plane manipulation, data-plane abuse, management compromise, supply-chain weaknesses and operational error. This review synthesises research, standards and Saudi regulatory guidance published from 2020 to 2025 to develop an integrated cyber-resilience framework for national-scale carrier networks. The review examines layered attack surfaces across external routing, MPLS and segment-routing control, provider-edge services, router operating systems, automation platforms, telemetry pipelines and operational processes. It argues that resilience cannot be achieved by perimeter filtering alone. A defensible design combines authenticated administration, infrastructure access controls, route-origin validation, explicit peering roles, control-plane policing, label and interface validation, segmented management, cryptographic agility, continuous telemetry, tested rollback, diverse transport paths and recovery procedures governed by service criticality. The resulting framework links prevention, detection, containment, traffic restoration and organisational learning. It also aligns technical controls with Saudi cybersecurity obligations and Vision 2030 priorities for trusted digital infrastructure. The review concludes that the strongest operating model treats routing correctness, security assurance and continuity engineering as one measurable discipline rather than separate network, security and business-continuity functions [1–4].},
      keywords = {IP/MPLS, Cyber Resilience, Core Networks, BGP Security, Segment Routing, RPKI, Network Telemetry, Operational Continuity, Saudi Vision 2030},
      month = {August},
      doi = {https://doi.org/10.64388/IREV10I2-1722267}
  }