TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Messaoud Ait-Yahia, Wael Jaafar, Rami Langar	Joint Design of Blockchain-Enabled Service Placement and Task Assignment in Vehicular Fog Computing Networks	2026	Early Access	Delays Timing Optimization	Driven by the evolution of blockchain and fog computing, vehicular networks are increasingly capable of supporting latency-sensitive applications with enhanced security and trust guarantees. However, the joint resource allocation for task offloading and blockchain services has been insufficiently investigated in existing works. To address this gap, this paper proposes a framework for jointly allocating resources of blockchain, users’ virtualized services, and Mobile Edge Computing (MEC) task assignment in Vehicular Fog Computing (VFC) networks. Specifically, we formulate the optimization problem as an integer nonlinear programming model aiming to maximize the satisfaction rate of users’ service requests while minimizing the corresponding blockchain operation time under mobility, queuing, instantiation, and resource constraints. To solve it in a timely manner, we design two-stage hierarchical low-complexity solutions, namely a Particle Swarm Optimization-based Joint Blockchain-enabled Service placement and Task Assignment algorithm (PSO-JBSTA), and a Genetic Algorithm-based approach (GA-JBSTA). Through extensive simulations, we demonstrate the effectiveness of PSO-JBSTA (resp. GA-JBSTA) and their adaptability to network conditions, achieving an average 35% (resp. 24%) improvement in users’ service satisfaction rate and 9.5% (resp. 10.2%) reduction in average blockchain validation delay compared with the baselines.	10.1109/TNSM.2026.3737068
Mohammad Saberi, Ali Ahmadi Esfidi, Mahdi Dolati, Naeimeh Omidvar	FlexINA: In-Network Aggregation for Accelerating Distributed Machine Learning with Flexible Routing	2026	Early Access	Modeling Switches Timing	The growing scale and complexity of modern machine learning (ML) models have rendered distributed training indispensable. However, as model dimensions expand, communication overhead increasingly dominates the overall training time, creating a critical performance bottleneck. While techniques such as gradient compression offer partial relief, they often incur substantial computational overhead or require specialized hardware. In-network aggregation (INA) has emerged as a compelling alternative, offloading partial computations—such as gradient reduction—directly onto programmable network switches. Yet, current INA frameworks predominantly rely on rigid, static routing schemes or uncoordinated, opportunistic aggregation, fundamentally limiting their capacity to exploit the full potential of programmable data planes. To address this limitation, we formulate the Joint Scheduling-Routing for In-Network Aggregation (JINA) problem. JINA introduces a time-slotted execution model to enable fine-grained temporal scheduling synchronously with spatial routing. By leveraging source routing, it dictates perpacket forwarding paths while explicitly coordinating multi-hop partial aggregation across the network. Furthermore, we propose FlexINA, a scalable optimization framework that solves the JINA problem through a three-phase dimensionality reduction strategy: host-level pre-aggregation, topological switch filtration, and temporal window partitioning. Extensive evaluations across fifteen diverse network topologies demonstrate that FlexINA reduces the total network load by up to 8.3% compared to INA baselines, while maintaining high computational efficiency.	10.1109/TNSM.2026.3740503
Ahlem Menaceur, Hamza Drid, Mohamed Rahouti, Yasmine Medjadba, Abdellah Chehri	Priority-Aware Dual-Queue Buffering for Reactive SDN Fault Management with Reduced Loss	2026	Early Access	Software defined networking Joining processes Loading	Software-Defined Networking (SDN) provides controller-driven flexibility for network and service management, yet reactive failure recovery often suffers from a recovery gap between fault detection and the installation of updated forwarding rules. Packets arriving during this interval are vulnerable to loss, while rerouted flows may overload specific links, undermining service continuity. To address these challenges, this paper proposes a dual-priority, queue-assisted reactive recovery mechanism that integrates traffic classification and buffering at the data plane. The design assigns flows to a high-priority queue (HPQ) or a low-priority queue (LPQ), ensuring that critical traffic is preserved while the controller completes rerouting. Evaluation on a 9-switch custom topology and the 16-node NSFNET backbone demonstrates that the proposed approach reduces packet loss (from 10.3% to 5.4% in the 9-switch topology and to below 1.9% in NSFNET) and improves post-failure load distribution, decreasing congested and surcharged links by 37.6% and 20.6%, respectively, compared to conventional reactive recovery. These results highlight that priority-aware buffering during the recovery gap enhances resilience, scalability, and operational efficiency for SDN fault and service management.	10.1109/TNSM.2026.3744288
Martha Cash, Charlotte Fowler, Alexander M. Wyglinski	On the Role of Time Series Clustering in Traffic Matrix Prediction	2026	Early Access	Fluid flow Timing Modeling	This paper analyzes the role of time-series clustering in traffic matrix (TM) prediction. Traffic flows within a TM often exhibit heterogeneous behavior, which can reduce the effectiveness of global forecasting models that predict all flows jointly. To address this, we propose a clustering-based prediction framework that groups flows into smaller subsets and trains separate predictors for each group. We evaluate four traffic-flow representations for clustering, namely histogram, autocorrelation function (ACF), power spectral density (PSD), and naïve partitioning, and analyze how both the representation choice and the number of clusters affect prediction performance. Experiments using the publicly available Abilene and GÉANT datasets show that clustering consistently improves over global forecasting baselines, while remaining substantially less costly than local prediction. The results further show that most of the performance gain is achieved at moderate values of K, with diminishing returns as the number of clusters increases. Although different clustering representations produce different partitions of the traffic flows, they often achieve similar root mean squared error (RMSE). This suggests that the main benefit of clustering lies in decomposing the TM prediction task into smaller subproblems, while the exact cluster structure plays a more limited role in determining overall prediction accuracy.	10.1109/TNSM.2026.3747898
Yule Han, Kezhi Wang, Yizhe Zhao, Kun Yang	Smart-TCP: An Agentic AI-based Autonomous and Adaptive TCP Protocol	2026	Early Access	Modeling Protocols TCP	The Transmission Control Protocol (TCP) relies on deterministic state machines and sequence-number arithmetic to ensure reliable communication. However, hard-coded protocol logic is difficult to adapt to increasingly complex and dynamic network conditions. This paper proposes Smart-TCP, an agentic AI-based transport protocol framework that organizes TCP control logic as a fast/slow model-assisted decision process. Specifically, a feature-aware classifier routes routine segments to a lightweight Small Language Model (SLM) fast path and anomalous or boundary cases to a Large Language Model (LLM) slow path, while an Arithmetic Logic Unit (ALU) handles deterministic computation of sequence and acknowledgment numbers. A state module maintains connection state, packet history, and key control variables, enabling protocol decisions over the full session context. A scoped Protocol Guard checks candidate decisions against RFC-derived rules before execution. We evaluate Smart-TCP through path classification, atomic packet processing, slow-path anomaly response, and end-to-end session interaction. Experimental results show that Smart-TCP achieves 99.14% action accuracy on 700 slow-path anomaly and fallback samples, and a 100% full-lifecycle success rate over 300 ideal fast-path end-to-end session windows. The ordinary 32-KiB transfer tests achieve a 96.5% completion rate at 20% segment loss. These results suggest that separating model-based protocol decisions from deterministic arithmetic improves the reliability of TCP control for network service operation.	10.1109/TNSM.2026.3747846
Mengyao Li, Sebastian Troia, Jean Pierre Asdikian, Giacomo Sguotti, Yingqian Zhang, Guido Maier	Hierarchical Auction-Based 5G Network Slicing with Region-based Multi-MNO Deployment	2026	Early Access	Resource management Modeling Radio access networks	Network slicing enables multiple virtual networks to share 5G network infrastructure while meeting heterogeneous service requirements. In parallel, region-based control in multi- Mobile Network Operators (MNOs) deployments has emerged, where each MNO manages a subregion of the network topology. This paper presents a two-level hierarchical combinatorial auction for end-to-end 5G Radio Access Network (RAN) slicing among MNOs, Mobile Virtual Network Operators (MVNOs), and users. At the upper level, MNOs provide slice resources to MVNOs. At the lower level, MVNOs allocate the slices to users. The framework considers dynamic demand, as requests may arrive at different times and remain active for different timeslots. A pair-bid mechanism is used to perform buyer–seller matching at both levels. The auction first selects the requests that can be accepted. The selection tries to keep the accepted bid value high without ignoring the electricity cost. After the winners are known, their payments are calculated using a VCG-like criticalvalue rule. The model also reflects the fact that different MNOs serve different regions and may have different infrastructure costs. In the simulations, the heuristic obtains higher welfare than both baselines. Simulations show that the heuristic improves welfare compared with two baseline methods, achieving up to 13.6% and 20.7% gains while maintaining scalability across different topologies.	10.1109/TNSM.2026.3747595
Shubhani Aggarwal, Georges Kaddoum	QSB-SHA: Quantum-secured Blockchain for Smart Home Authentication	2026	Early Access	Authentication Smart homes Internet of Things	Today, IoT enables smart home users to remotely connect with household appliances via the Internet. Sensor-equipped smart devices are widely deployed in smart homes to collect and manage information regardless of user location. However, ensuring the secure and private accessibility of these devices in a centralized manner remains a major concern. The emergence of blockchain and quantum computing, with their enhanced information processing capabilities on decentralized platforms, offers a viable solution to this issue. Consequently, there is a need for cryptographic primitives that can withstand both quantum and classical attacks. To address this concern in the present study, we propose a quantum-secured blockchain (QSB) framework for smart home authentication (SHA). The proposed framework employs quantum key distribution (QKD) and maximally entangled states on a decentralized platform to enable secure key distribution and mutual authentication between smart home users and devices. Furthermore, our approach integrates quantum passwords and quantum digital signatures to verify and validate legitimate users, thereby ensuring security and privacy. The framework is simulated using the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool for formal security analysis. We also conduct an informal security analysis and compare the performance of our proposed scheme with that of the previously proposed solutions. The results demonstrate that our framework outperforms existing approaches across various performance evaluation metrics.	10.1109/TNSM.2026.3747090
Qing Qian, Longwen Ran, Ruixue Tang, Huan Wang, Hongfa Ding, Yunhe Cui	SATEEN: A Heterogeneous Graph Neural Network for Saturation Attack Detection in SDN	2026	Early Access	Fluid flow Switches Modeling	SDN decouples the control plane from the data plane, enabling flexible network management. However, it is increasingly threatened by saturation attacks that target both switch flow tables and controller resources. Existing attack detection methods often focus on individual flows or network topology alone, neglecting the inherent interdependencies among flows and devices. This limitation can result in incomplete information aggregation and suboptimal detection performance. To address these challenges, we propose SATEEN, a GNN-based saturation attack detection method that leverages a heterogeneous Device-Flow Graph and a novel heterogeneous convolution model, HEGNN. The DevFlow-Graph explicitly models interactions among hosts, flows, and switches, incorporating multiple types of edges to capture structural and semantic relationships. HEGNN partitions the DevFlow-Graph into edge-type-specific subgraphs, computes attention-weighted aggregations within each subgraph, and integrates multi-layer information to generate expressive node embeddings for accurate attack classification. Experiments conducted on both FatTree and Agis topologies, using real-world background traffic, demonstrate that SATEEN significantly outperforms existing methods in detection accuracy and stability across different topologies and traffic patterns.	10.1109/TNSM.2026.3745553
Tian-Yu Zuo, Xiuyi Zhao, Pan Li, Junxiong Lin, Mingyi Liu, Jiuchuan Jiang, Gengyu Lyu, Kai Di, Ning Luo	PrivKV-Sched: Budgeted Cross-Tenant KV-Cache Reuse for Multi-Tenant LLM Serving	2026	Early Access	Modeling Pricing Testing	Enterprise LLM services need faster responses and less repeated computation. Shared KV caches store computation results for reuse by later requests with matching input. However, content has different sharing permissions, and maximizing hits alone can permit reuse outside the authorized scope, creating privacy risks. Businesses that explicitly allow limited cross-user reuse also need to control its total amount. We propose PrivKV, which incorporates content permissions and reuse allowances into scheduling. For each request, it checks cached content and jointly selects a worker and reuse length based on saved computation, allowance consumption, and worker load. When spending is high, a dynamic price favors lower-cost reuse. An optional pre-execution check reserves the required allowance, preventing concurrent requests from spending the same balance twice. We compare methods with equal allowances on public request data and disable each control to examine its role. Tests cover different scales and inputs, small optimal solutions, and real GPU execution measuring service performance and scheduling overhead. Budget adjustment reduces unauthorized reuse, while pre-execution checks prevent overspending. With a common replacement rule, PrivKV retains about 96% of unconstrained cache hits. Real-model tests also verify the feasibility of pre-execution checks. For businesses allowing limited cross-user reuse, PrivKV applies content permissions and usage allowances to shared caches, limiting total unauthorized reuse while retaining computational savings.	10.1109/TNSM.2026.3745203
Jiuxiang Cao, Guang Cheng, Guangjie Liu	A Queueing-Stability Criterion for Causal IPD-QIM Network Flow Watermarking	2026	Early Access	Fluid flow Watermarking Timing	On multi-hop encrypted links such as Tor and cascaded VPNs, inter-packet delay (IPD) is the main carrier for active flow attribution. Causality lets the embedder only delay packets, so every quantization-index-modulation (QIM) alignment adds nonnegative dwell to a buffer; whether it stays stable on bursty traffic has been left to empirical tuning. We model the embedder as a dwell queue reflected at zero, with state-dependent injection, and use two structural facts: at large dwell the mean injection per packet is a quarter of the quantization step, and the dwell stays within one step of a classical Lindley waiting time. A drift argument compares this quarter step with the mean background IPD through their ratio, the intensity. For i.i.d. backgrounds the buffer is positive recurrent exactly when the intensity is below one; under finite-state Markov modulation the time-average intensity decides stability, so instantaneous overload is tolerated; for stationary-ergodic backgrounds a time-average intensity below one yields a finite stationary envelope. At the boundary the i.i.d. chain is null recurrent, with mean dwell growing as the square root of time, and below it a computable Cram´er–Lundberg bound controls the overflow probability of a finite buffer and the truncation frequency of the clipped embedder, giving a sufficient dimensioning rule and a plug-in safety margin. Together with a distribution-free sufficient decoding floor, this yields a certified step-size window. Simulations agree with the transition, growth laws, and tail bound; on four real IPD traces the criterion gives the correct direction, while pooled cross-flow means overestimate the margin.	10.1109/TNSM.2026.3745060
Taylor Henderson, Eric Osterweil, Pavan Dinesh, Robert Simon	Scalable and Robust User Deobfuscation using Pattern of Life	2026	Early Access	Modeling Timing Privacy	Online message boards have become increasing popular with cyber criminals and those wishing to conduct illegal acts. They are used in coordinating drug/human trafficking, terrorist activity, and distributing information from data breaches to name a few. We provide a novel method for deobfuscating message board users: Deobfuscating Using Patterns of Life (DUPOL). DUPOL uses a novel technique to take advantage of system artifacts arising from the proliferation of Public DNS. DUPOL is validated on a test bed which accurately maps the Internet to different information scopes. This provides an understanding of how DUPOL would perform if it was performed by different entities on the Internet. DUPOL is shown to be able to correctly identify message board users even when users employ privacy preserving technologies using only observable network traffic and without the need to decrypt any information. Additionally, DUPOL is shown to be robust to missing data and scalable using a novel decomposition of the NCC which removes the need for pairwise comparison.	10.1109/TNSM.2026.3744089
Franck Messaoudi, Luhan Wang, Abdelkader Mekrache, Adlen Ksentini, Bingxuan Li, Jialei Su, Sofiane Messaoudi, Salim El Ghalbzouri	The Brewing Storm in 5G’s Data Plane: Design and Evaluation of a High-Performance eBPF/XDP-Based User Plane Function	2026	Early Access	Quality of service Fluid flow Kernel	This paper presents the design and implementation of a novel 5G UPF leveraging eBPF technology to meet the stringent performance and programmability requirements of emerging 6G systems. Traditional UPF implementations often struggle to balance performance, flexibility, and resource efficiency-challenges particularly critical in CPU- and I/O-constrained edge environments. The proposed eBPF-based UPF architecture mitigates these limitations by embedding core functionalities, such as packet classification, forwarding, and QoS enforcement, directly within the Linux kernel via eBPF programs attached through XDP and tc hook points. Performance evaluation using TRex demonstrates that the proposed solution achieves competitive throughput, low packet loss, and efficient CPU utilization across traffic profiles. Moreover, it maintains full compliance with 5G Core Network standards. Comparative analysis with well-established open-source UPF implementations further underscores its advantages. This work highlights the potential of eBPF as a foundational technology for building next-generation, programmable UPFs optimized for edge cloud deployments in the 6G era.	10.1109/TNSM.2026.3720812
Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh	Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices	2026	Early Access	Schedules Scheduling Cloning	Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline.	10.1109/TNSM.2026.3694238
Yifan Zeng, Zihui Gu, Peijia Zheng, Huiyu Zhou	A Federated Semi-Supervised Framework for Data Efficiency and Privacy-Preserving Intrusion Detection in Internet of Things	2026	Early Access	Internet of Things Modeling Labeling	The Internet of Things (IoT) forms the foundation of modern smart environments, enabling intelligent industries, homes, cities, healthcare, and autonomous systems. However, as IoT devices increasingly connect to cloud platforms and the Internet, they become highly vulnerable to network intrusions that can lead to critical data breaches and service disruptions. This paper proposes a Contrastive Federated Semi-Supervised Learning Network Intrusion Detection framework (CFedSSL-NID), specifically tailored to enhance the security of IoT communications. It addresses practical scenarios where clients lack labeled data and computational resources, and where data privacy is paramount. The CFedSSL-NID framework enhances detection performance and robustness. It uniquely achieves this by synergistically leveraging abundant, unlabeled data from distributed IoT gateways through self-supervised contrastive learning, while optimally integrating supervised signals from a central server. This dual approach enables highly accurate intrusion detection while substantially mitigating the reliance on scarce and costly labeled data. Experiments on the TON-IoT, UNSW-NB15, and NSL-KDD datasets show that CFedSSL-NID outperforms federated and centralized baselines; additional evaluations under Non-IID data, asynchronous participation, and malicious-client updates confirm robustness, while communication and edge-inference analyses indicate its deployment feasibility.	10.1109/TNSM.2026.3742261
Shyam Kumar Shrestha, Shiva Raj Pokhrel, Jonathan Kua	Adapting Large Language Models for TCP Fairness over Wi-Fi	2026	Early Access	Large language models TCP Modeling	Designing Transmission Control Protocol (TCP) Congestion Control Algorithms (CCAs) for heterogeneous Wi-Fi networks remains a challenge due to rapidly varying delay, loss, and contention dynamics. These effects often lead to CCA incompatibility, flow unfairness, and starvation among competing TCP flows. Although Deep Reinforcement Learning (DRL) has shown promise in mitigating these challenges, its slow convergence, high training costs, and limited generalization hinder practical deployments. In this paper, we propose TCP-LLM, a learning-augmented transport framework that leverages Large Language Models (LLMs) for compatibility-aware CCA selection. TCP-LLM encodes multivariate TCP time-series into token embeddings and performs single-step discrete CCA decisions through a lightweight LLM decision head. Parameter-efficient low-rank adaptation (LoRA) reduces the number of trainable parameters by approximately two orders of magnitude. Evaluation using traces collected from a physicalWi-Fi testbed with competing TCP Cubic, Bottleneck Bandwidth and Round-trip propagation time (BBR), and Performance-oriented Congestion Control (PCC) flows shows that TCP-LLM achieves the highest mean, geometric-mean, and minimum per-flow throughput among the evaluated schemes. TCP-LLM also exhibits faster and more stable training convergence and supports low-latency bounded inference. These results demonstrate the feasibility of LLM-based sequence adaptation for compatibility-aware transport-layer supervision under heterogeneous wireless conditions.	10.1109/TNSM.2026.3739364
Hongyuan Cheng, Lihua Yin, Tianqing Zhu, Hongyu Yang, Dexin Zhu, Weixiang Jiang, Nan Wei	Pattern2Bot: A malicious server IP detection model based on self-trained heterogeneous graph neural network	2026	Early Access	Labeling Modeling Signal detection	Botnets play a key role in network attacks such as Distributed Denial-of-Service (DDoS) attacks, spamming and click fraud. Command & Control server is an important node for botmaster to control bots and distribute attack commands. Bot disguise as normal domain requests through DNS traffic, but leave malicious records in DNS logs containing client IP, query domain, server IP and other complex interactions. This information provides important clues for detecting those botnets. In the current study, researchers detect botnets through multiple perspectives, including abstracting DNS communication records into graphs and using graph neural network models for detection. Conventional approaches often necessitate massive labeled datasets for model training, which substantially incurs training costs. Moreover, despite enriching node embeddings via topological relations, graph models often suffer performance degradation when confronted with structural semantic obfuscation from evasion techniques like double-flux. In order to understand the abstract and complex relationship patterns in DNS records while reducing label usage to lower training costs, we propose a botnet Command & Control server detection model based on DNS traffic. This is a self-training heterogeneous graph neural network model that does not require a large number of labels. By integrating the high-order relational semantics derived from multiple meta-paths with the local topologies of target nodes, the model achieves finer-grained structural awareness and semantic abstraction, thereby enhancing detection performance. We validate the effectiveness of the model in a real dataset, and the results show that the model has a better understanding of the special structure possessed by the IPs of Command & Control servers.	10.1109/TNSM.2026.3741111
Ke He, Muhammad Rizwan Asghar, Jeong Do Yoo, Young Hun Lee, Hyunjae Kang, Huy Kang Kim, Dan Dongseong Kim	Liuer Mihou: A Practical Grey-box Adversarial Attack against Anomaly-based Network Intrusion Detection Systems	2026	Early Access	Modeling Signal detection Timing	Deep learning has gained popularity as a detection algorithm for Network-based Intrusion Detection Systems (NIDS) due to its expressiveness and speed. However, Deep learning algorithms are susceptible to adversarial attacks that introduce imperceptible changes to deceive the Deep learning algorithm into misclassifying the input. Existing adversarial attacks often overlook the practicality and replayability of the attack. In this paper, we present Liuer Mihou (LM), an adversarial attack designed to generate practical and replayable adversarial network packets, specifically targeting unsupervised anomaly-based NIDS deployed in Internet of Things (IoT) networks. The core concept behind LM is to leverage adversarial transferability and generate adversarial packets on a surrogate NIDS while considering predefined, semantic-preserving mutation operations to ensure practicality. To assess the effectiveness of LM, we objectively analyze its evasiveness against five general-purpose machine learning-based outlier detection algorithms (SOM, RRCF, LOF, OCSVM, and FROCC), as well as the state-of-the-art NIDS, Kitsune. Rather than claiming broad practicality, we characterize when and how packet-space attacks remain feasible: we quantify the trade-off between evasion and attack effectiveness, the distortion introduced by physical replay, and the conditions under which the attack transfers across detector families. We further show that LM’s mutation set is extensible beyond timing and size, adding TCP-window and payload-byte operators to evade a header-field-aware detector. Furthermore, we demonstrate that adversarial detectors such as Feature Squeezing and MagNet, as well as defenses designed for unsupervised anomaly detection, are largely ineffective in defending against LM. Moving beyond a theoretical setting, we conduct a replay of LM in two real IoT testbeds to analyze its practicality.	10.1109/TNSM.2026.3742885
Michael Georgiades, Iacovos Ioannou, Hasan Islam, Ferheen Ayaz, Yun Hou, Kin-Hon Ho	Enhanced Vehicular Edge Offloading through SLA-Based Deep Reinforcement Learning and Risk-Aware Bandits	2026	Early Access	Service level agreements Modeling Timing	This paper investigates service-level agreement (SLA)-aware computation offloading in vehicular edge computing using two complementary online learners. SRM-FA-UCB combines staleness-aware transport exploration, contextual service-time prediction, empirical SLA screening, and selected-arm feedback. SLA-MA-PPO couples a state-dependent SLA action mask with a two-hidden-layer actor–critic, generalized advantage estimation, and cooperative KPI shaping. We evaluate both methods in an extended EdgeCloudSim environment with deterministic SUMO urban-grid mobility, V2X radio, congestion and handover effects, 200–1000 vehicles, and 10 paired replications per load. Among the six primary schemes, SRM-FA-UCB attains the lowest mean SLA violation, service time, and modeled energy with near-unity fairness. Additional controlled attribution with two simple screened heuristics and a screened FA-UCB control shows that the large improvement over conventional FA-UCB is primarily associated with the shared SLA-aware prediction and admissibility-screening stage; no independent endpoint advantage of the more complex post-screen SRM selector is established after Holm correction. SLA-MA-PPO significantly reduces SLA violations, mean service time, and modeled energy relative to PPO-GAE, while ablations identify action masking as its critical component. A controlled change-point experiment does not establish a transient benefit from the restless term. Code, configurations, seeds, and analysis scripts are provided through a public EdgeCloudSim research fork.	10.1109/TNSM.2026.3742669
Chengsheng Pan, Yingzhi Wang, Huaifeng Shi, Lishang Qin, Xiaosong Cui	DBSDD-AQM: Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management for Edge IoT Networks	2026	Early Access	Delays Satellite broadcasting Internet of Things	Bursty heterogeneous traffic can build persistent queues at edge IoT gateways when the offered load converges on a lower-rate bottleneck. Conventional active queue management (AQM) regulates packet dropping under a fixed buffer capacity, whereas adaptive buffer sizing alone does not coordinate capacity adjustment with queue-removal control. We propose Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management (DBSDD-AQM), which combines a bounded buffersizing loop with a faster continuous queue-removal controller. DBS adjusts the admissible capacity according to sustained queue evolution, while the DDPG Actor selects packet-granular removal actions for the resident backlog. A class-aware extension maps three concurrent service classes to logical FIFO queues sharing the same dynamic physical buffer. DBSDD-AQM is implemented using an NS3-PyTorch framework. Aggregate experiments compare it with RED, ARED, PIE, CoDel, and DQN-AQM, while the class-aware evaluation additionally includes FQ-CoDel and FQ-PIE. Matched-DBS comparisons show similar throughput but different delay–loss operating points among the aggregate controllers, and component ablation distinguishes the effects of capacity adaptation and learned queue removal. Relative to a fixed 50 KB buffer, DBS reduces average queueing delay by 16.23% for UDP and 17.70% for TCP Westwood in controlled transport experiments. In the evaluated three-class overload scenarios, all classes retain nonzero throughput. Class-aware DBSDD-AQM provides stronger D- and T-class differentiation, whereas FQ-CoDel and FQ-PIE produce more uniform class-level outcomes and stronger R-class performance. The measured 95th-percentile batch-one Actor inference latency is 0.109 ms on the reported x86-64 platform.	10.1109/TNSM.2026.3741334
Ashesh Gaur, Sridhar Radhakrishnan, Mohammed Atiquzzaman	Inverse Packet Classification: Reconstructing Behaviorally Equivalent Rule Sets from Observed Traffic	2026	Early Access	Merging Labeling Modeling	Network devices classify packets with ordered rule tables, but those tables are often inaccessible. Passive reconstruction can support behavior audits, misconfiguration analysis, and policy compliance without privileged device access. We define inverse packet classification as inferring a compact rule set from observed packet headers and device actions. The goal is observational equivalence on observed traffic, not recovery of the original configuration or priority order. The problem is difficult because traffic covers only part of the header space. Packet classifiers also use first-match semantics and structured prefix or interval predicates. We propose InversePC, which combines entropy-guided k-d-tree partitioning with greedy region merging. For a dominant default action, InversePC-HiB uses a hybrid split loss, exception-only merging, and a wildcard default rule. On synthetic classifiers, accuracy reaches 100% once coverage is sufficient. On native-resolution ClassBench filters, InversePC reaches 94.1% action agreement versus 88.3% for cross-validated CART on 1,000-rule sets. At 8-bit quantization, the two methods are statistically tied (98.1% versus 98.0%). In a well-covered 250-rule setting, InversePC uses 1.20× the original rule count versus 1.32× for CART. HiB is most useful for sparse, irregular default-permit ACLs, where it uses up to 2.5× fewer rules than InversePC at 99.8% accuracy. Optimized implementation makes native-resolution reconstruction practical in seconds.	10.1109/TNSM.2026.3744323