Last updated: 2026-06-24 05:01 UTC
All documents
Number of pages: 167
| Author(s) | Title | Year | Publication | Keywords | ||
|---|---|---|---|---|---|---|
| Mansoor Davoodi, Setareh Maghsudi | Efficient Resource Allocation under Adversary Attacks: A Decomposition-Based Approach | 2026 | Early Access | Resource management Optimization Modeling Algorithms Timing Costing Costs Probability Fluid flow Learning (artificial intelligence) Resource allocation Adversary Decomposition Bi-objective optimization Chance-constrained optimization Network flow | We address the problem of allocating limited resources in a network under persistent yet statistically unknown adversarial attacks. Each node in the network may be degraded, but not fully disabled, depending on its available defensive resources. The objective is twofold: to minimize total system damage and to reduce cumulative resource allocation and transfer costs over time. We model this challenge as a bi-objective optimization problem and propose a decomposition-based solution that integrates chance-constrained programming with network flow optimization. The framework separates the problem into two interrelated subproblems: determining optimal node-level allocations across time slots, and computing efficient inter-node resource transfers. We theoretically prove the convergence of our method to the optimal solution that would be obtained with full statistical knowledge of the adversary. We further establish an O(√T log(nT)) regret bound, showing that the average per-round performance gap shrinks as O(1/√T). Extensive simulations demonstrate that our method efficiently learns the adversarial patterns and achieves substantial gains in minimizing both damage and operational costs, comparing three benchmark strategies under various parameter settings. | 10.1109/TNSM.2026.3703620 |
| Baofeng Ji, Xianxian Shi, Hui Zhang, Jianghui Liu, Gaoyuan Zhang, Song Chen, Chenggang Yan, Huitao Fan | Multiple Agricultural Machinery Collaboration with Improved Ant Colony Algorithms | 2026 | Early Access | In modern agricultural production, the integrated application of emerging technologies such as the Internet of Things (IoT) and Artificial Intelligence (AI) is gradually changing the way of agricultural production. In the face of large-scale farmland production and the shortage of rural labor force, IOT technology has become the key to enhancing agricultural production efficiency. To further improve agricultural production efficiency, a multiple agricultural machinery collaborative operation mode is introduced. Considering that multiple agricultural machinery collaborative operation is confronted with issues such as farmland task sequence planning and changes in the agricultural environment, this study comprehensively considers the farmland environment and the status of agricultural machinery and proposes a multi-machine task sequence planning model. By improving the ant colony algorithm and optimizing the operation path of agricultural machinery, the operation distance of agricultural machinery and the algorithm scheduling time have been significantly reduced. The simulation test results show that the cluster cost in task allocation of the improved ant colony algorithm is reduced by 36.05% ∼ 41.97% compared with the traditional algorithm, and the algorithm scheduling time is reduced by 3.60% ∼ 9.02%. The research results show that it is feasible to optimize the operation path of multi-machine tasks by using the improved ant colony algorithm. The research achievements enrich the relevant theories of collaborative operation of multiple agricultural machines and lay an effective theoretical foundation for related research. | 10.1109/TNSM.2026.3703959 | |
| Lion Steger, Liming Kuang, Johannes Zirngibl, Georg Carle, Oliver Gasser | Still on Target? An Evaluation of IPv6 Target Generation Algorithms | 2026 | Early Access | Internet measurements are a crucial foundation of IPv6-related research. Due to the infeasibility of full address space scans for IPv6 however, those measurements rely on collections of reliably responsive, unbiased addresses, as provided e.g., by the IPv6 Hitlist service. Although used for various use cases, the hitlist provides an unfiltered list of responsive addresses, the hosts behind which can come from a range of different networks and devices, such as web servers, customer-premises equipment (CPE) devices, and Internet infrastructure. In this paper, we demonstrate the importance of tailoring hitlists in accordance with the research goal in question. By using PeeringDB we classify hitlist addresses into six different network categories, uncovering that 42% of hitlist addresses are in ISP networks. Moreover, we show the different behavior of those addresses depending on their respective category, e.g., ISP addresses exhibiting a relatively low lifetime. Furthermore, we analyze different Target Generation Algorithms (TGAs), which are used to increase the coverage of IPv6 measurements by generating new responsive targets for scans. We use seed sets, e.g., based on the categorized Hitlist. We evaluate the performance of TGAs under various conditions and find generated addresses to show vastly differing responsiveness levels for different TGAs. Furthermore, we evaluate of algorithm run times and differences between multiple TGA runs. | 10.1109/TNSM.2026.3705935 | |
| Liang Chen, Xiaoding Wang, Limei Lin, Yanze Huang, Siwei Zheng | Defense in Depth: Architectural Homology for Adversarially Robust Semantic Communication | 2026 | Early Access | Semantic communication framework based on deep encoder–decoder architectures are increasingly vulnerable to adversarial attacks, wherein imperceptible input perturbations can induce significant misclassifications, posing critical risks to next-generation communication networks. To address this challenge, we introduce TopAliSC-KG, a holistic robust learning framework designed to fortify semantic communication against adversarial threats through a multi-layered defense strategy. Our approach integrates two complementary mechanisms: a homology graph-aligned adversarial training module that embeds topological constraints into the model optimization process to promote structural invariance, and a knowledge-guided semantic consistency module that utilizes auxiliary models to inject stable, high-level semantic information into the training loop. Together, these components establish a defense-in-depth architecture that enhances resilience across data, feature, and model levels. Extensive evaluations across diverse channel conditions, signal-to-noise ratios, and adversarial attack scenarios show that TopAliSC-KG consistently improves adversarial accuracy by 0.32%–3.39%, with the knowledge guidance mechanism contributing a further 0.11%–0.21% gain. This work provides a validated, multi-framework defense strategy suitable for securing semantic communication in mission-critical applications, advancing both the security and reliability of intelligent communication systems. | 10.1109/TNSM.2026.3705940 | |
| Josè Santos, Asser Tantawi, Pavlos Maniotis, Chen Wang, Olivier Tardieu, Tim Wauters, Filip De Turck | Sakkara: Intelligent Topology-Aware Scheduling for Kubernetes in the Age of AI | 2026 | Early Access | Topology Scheduling Schedules Artificial intelligence Volcanoes Timing Training Synchronization Information rates Throughput Artificial Intelligence Topology-aware Scheduling Orchestration Kubernetes | The rapid growth of Artificial Intelligence (AI) workloads has introduced unprecedented challenges to modern cloud-native systems, particularly in Kubernetes (K8s)-based environments. These workloads often demand low-latency communication, high resource locality, and efficient utilization of heterogeneous hardware devices such as Graphics Processing Units (GPUs) and specialized accelerators. However, the existing scheduling mechanisms in K8s are typically unaware of the underlying physical topology, leading to performance degradation and inefficient resource usage. This paper presents Sakkara, a novel topology-aware scheduling framework designed to optimize the placement of AI workloads in K8s clusters. Sakkara incorporates a hierarchical model of the Data Center (DC), including nodes and racks, enabling flexible scheduling strategies that account for resource availability and risk-aware metrics that mitigate performance interference and constraint violations caused by topology-unaware placement. Sakkara extends existing scheduling logic in K8s with placement strategies that guide pod allocation using configurable topology constraints, aiming to minimize communication costs and maximize workload performance. We evaluated Sakkara on a representative AI workload, a distributed training application under different cluster configurations. Experimental results show that Sakkara improves job completion time, throughput, and memory utilization compared to available K8s schedulers, achieving improvements of up to 10%. Sakkara, available as open-source, offers a promising pathway toward topology-conscious orchestration of AI workloads in next-generation cloud environments. | 10.1109/TNSM.2026.3703831 |
| Dhiraj Bhattacharjee, Pablo G. Madoery, Abhishek Naik, Halim Yanikomerglu, Güneş Karabulut Kurt, Stéphane Martel | SQ-ROQ: A Scalable Framework for QoS-Aware Joint Routing and Queue Management in Satellite Mega-Constellations | 2026 | Early Access | The modern Internet accommodates a wide range of applications with heterogeneous quality of service (QoS) requirements across multiple network performance metrics. Low Earth orbit (LEO) satellite constellations have emerged as a promising solution to support these diverse services, not only in rural and remote areas but also in urban environments as a complement to terrestrial networks. Ensuring QoS compliance in such networks necessitates the joint optimization of routing and queue management, as effective traffic handling is critical to maintaining performance guarantees across multiple flows. In this paper, we formulate a joint routing and queue management problem in which QoS requirements are treated as soft constraints, with the objective of maximizing end-user experience while maintaining fairness among competing traffic flows. Given the combinatorial and NP-hard nature of the problem, we propose SQ-ROQ, a computationally efficient framework that decomposes the network into multiple domains and employs a Monte Carlo tree search (MCTS)-based optimization strategy to jointly determine routing and queue management decisions. Using the Starlink Phase 1 Version 2 constellation as a case study, we conduct a comparative analysis of end-user experience and fairness. The proposed algorithm shows higher and stable end-user experience and fairness served to multiple traffic flows as compared to the benchmarks. Building on this, we further investigate the inherent trade-off between optimizing user experience and ensuring fairness, as well as the impact of varying traffic loads on the proposed algorithm and the benchmark schemes. Finally, we demonstrate the scalability of SQ-ROQ through a comparative evaluation of both theoretical time complexity and measured average computation time. | 10.1109/TNSM.2026.3705946 | |
| Kai Chen, Guangjie Liu, Jiangtao Zhai, Weiwei Liu, Yuewei Dai | SSH-CAM: Fine-Grained SSH Behavior Identification in Encrypted Tunnel Traffic using Curriculum-Adaptive Mixup | 2026 | Early Access | Encrypted tunneling mechanisms are widely deployed for privacy protection and secure communication, while also obscuring application-layer semantics, making fine-grained traffic analysis more challenging. When Secure Shell (SSH) traffic is encapsulated within encrypted tunnels, multiple internal behaviors can coexist within a tunneled flow, such that traffic captured at a tunnel observation point rarely corresponds to a single behavior. Existing tunnel analysis methods focus on protocol- or application-level identification and are not designed for fine-grained SSH behavior identification under complex tunnel scenarios. We present SSH-CAM, a curriculum-guided framework for inferring the dominant SSH behavior at encrypted tunnel observation points, robust to the presence of coexisting interfering behaviors within the captured traffic. SSH-CAM constructs packet-level representations that capture both structural attributes and temporal information, followed by sequence-level feature extraction. A Curriculum-Adaptive Mixup mechanism is introduced to gradually increase training difficulty through controlled structural interpolation. The framework also imposes a learnable Gaussian prototype constraint on the latent representations, fostering intra-class compactness and greater inter-class separation under significant interference. Experiments conducted on a dataset constructed from six widely used tunneling protocols demonstrate that SSH-CAM consistently outperforms existing baselines across varying interference levels, showing robustness in highly mixed tunnel traffic scenarios. | 10.1109/TNSM.2026.3705758 | |
| Mohamed Seliem, Utz Roedig, Cormac Sreenan, Dirk Pesch | M-FRER: A Multi-Connectivity Framework for Reliable and Deterministic 5G–TSN Integration | 2026 | Early Access | Achieving ultra-reliable communication under strict end-to-end latency constraints in integrated 5G–TSN systems requires fault-tolerant mechanisms that extend beyond single-leg wireless transmission. Existing approaches that extend IEEE 802.1CB Frame Replication and Elimination for Reliability (FRER) to 5G through redundant PDU sessions or dual connectivity remain restricted to two-leg redundancy, lack correlation awareness, and operate under static replication policies. This paper proposes M-FRER, a multi-connectivity extension of FRER that enables replication and elimination across M heterogeneous connectivity legs, including multi-RAT, multi-PDU session, and non-3GPP access. M-FRER introduces (i) a correlation-aware reliability model that captures shared-risk dependencies between legs, and (ii) an adaptive replication controller that selects the active replication set while minimizing bandwidth, energy, and control overhead. Evaluations combining trace-based latency modeling with analytical reliability bounds under correlation show that M-FRER achieves five-nines on-time reliability (≥99.999%) with only a modest bandwidth increase relative to dual-connectivity replication, while maintaining bounded jitter through controlled elimination windows. These results indicate that deadline-compliant communication over stochastic wireless media is achievable when redundancy and control are jointly optimized, positioning M-FRER as a scalable foundation for TSN-integrated industrial 5G deployments. | 10.1109/TNSM.2026.3705859 | |
| Ashiqur Rahaman Ridoy, Arnab Kumar Biswas | Adaptive Intrusion Detection Systems: Leveraging Meta-Learning for Improved Cybersecurity | 2026 | Early Access | In the evolving landscape of cybersecurity, the integration of machine learning (ML) into Intrusion Detection Systems (IDS) has become critical for detecting both known and unknown attacks. This paper proposes a novel multi-stage hybrid IDS framework combining unsupervised anomaly detection, supervised classification, and low-shot adaptation for enhanced resilience to concept drift. The architecture comprises three interconnected stages: Stage 1 (unsupervised anomaly gating) and Stage 2 (supervised taxonomy learning) operate in parallel on a shared harmonized feature space; Stage 3 (Hybrid Low-Shot Adapter (H-LSA)) performs low-shot adaptation when the Stage 1 trigger fires, using transferred Stage 2 weights and a prototype-based cosine-kNN jury. Within the meta-learning family, we instantiate a metric-based low-shot adaptation approach eschewing second-order Model-Agnostic Meta-Learning (MAML) in favor of a partial-freeze, first-order protocol with a prototype-based cosine-kNN jury to enable rapid, low-resource adaptation. Extensive experiments were conducted on the CICIDS2017 (Source), CSECIC-IDS2018 (Target), and the modern BCCC-cPacket-Cloud-DDoS-2024 (Target) datasets (hereafter referred to as BCCC-2024). The results demonstrate that while static Stage 2 models suffer catastrophic failure under concept drift (dropping to 45.36% and 38.32% accuracy on CICIDS2018 and harmonized BCCC-2024, respectively), the proposed framework successfully adapts to new environments, achieving 90.64% accuracy on CICIDS2018 (Macro-F1: 0.8981) and 89.70% on BCCC-2024 (Macro-F1: 0.8801) with a low-resource support set of only 500 labeled samples per class. Furthermore, the system exhibits high computational efficiency, achieving a Stage 3 adapted inference latency between 0.0786 ms and 0.1667 ms per flow across diverse traffic profiles, proving its suitability for real-time, scalable deployment in modern cloud and edge network infrastructures. | 10.1109/TNSM.2026.3706597 | |
| Gergely Dobreff, Nóra Szlovencsák, Alija Pašić | A Framework for Disaster-Tolerant Slice Placement in Future Networks | 2026 | Early Access | Autonomous vehicles and telesurgery are placing increasing pressure on network operators to ensure that 5G and beyond networks can support a wide range of services with diverse and stringent requirements. Technologies such as Software-Defined Networking (SDN), Network Function Virtualization (NFV), and network slicing are key enablers for building an ecosystem capable of meeting these demanding conditions. Ensuring not only classical Quality of Service (QoS) metrics but also network resiliency is crucial, as failures in shared infrastructures can severely impact critical services. This paper addresses the problem of resilient network slice placement under arbitrary disasters or attacks, modeled as Shared Risk Link Group (SRLG) failure patterns. We propose an approach that guarantees strict end-to-end delay, bandwidth, and computing requirements while minimizing overall resource usage by accounting for potential failure scenarios. To this end, we introduce a Disaster-Tolerant Slice Placement Framework that enables network operators to define their own resilience scenarios and optimize the network accordingly. Several - routing and network coding–based - strategies are proposed and analyzed. We formulate the problem as an Integer Linear Program (ILP), analyze its computational complexity, and develop efficient heuristic algorithms to obtain near-optimal solutions. Extensive simulations demonstrate the effectiveness of the proposed methods in achieving resource-efficient and resilient network slice placement. The results show that high levels of resiliency can be achieved without excessive over-provisioning, positioning the proposed framework as an effective offline planning and benchmarking tool for 5G and beyond network design. | 10.1109/TNSM.2026.3706661 | |
| Shi-Xin Huang, Te-Chuan Chiu, Jing-Chih Lin, Cheng-Hsuan Kuo | EdgeCookie: A Mitigation Solution Against Threatening TCP DDoS Attack in Edge Cloud | 2026 | Early Access | With the explosive growth of GenAI service requirements, the demand for digital infrastructure and cloud resources continues to increase. At the same time, distributed denial-of-service (DDoS) attacks – particularly TCP-based vectors such as SYN flood and emerging TCP distributed reflective denial-of-service (DRDoS) – have surged, posing a significant threat to service availability. Current mitigation strategies often fall short in effectively countering both attack types. Although the proliferation of edge computing offers opportunities to deploy mitigation closer to attack sources, it also introduces synchronization challenges across distributed edge servers. In this paper, we propose EdgeCookie, an edge-centric TCP flood attack mitigation architecture. EdgeCookie can mitigate TCP SYN floods, ACK floods, and emerging TCP reflection amplification attacks. Unlike existing switch-based defenses, EdgeCookie requires no specific hardware, making it suitable for running in resource-limited edge clouds. In the core mechanism, we introduce a novel HybridCookie that effectively solves synchronization challenges across distributed edge servers. Experimental results demonstrate that EdgeCookie can mitigate both TCP SYN flood and emerging TCP reflection amplification attacks without facing false positive issues, while maintaining high throughput and adding negligible latency to legitimate traffic. | 10.1109/TNSM.2026.3706627 | |
| Siya Xu, Ye Yu, Shaoyong Guo | F-CShard: A Fast Cross-Shard Consensus Protocol for the Large-Scale Sharing of Cultural Resources | 2026 | Early Access | Sharding Protocols Consensus protocol Information rates Throughput Timing Modeling Loading Correlation Frequency Cultural resources blockchain scalability spatio-temporal correlation heartbeat signal virtual account | Blockchain’s decentralization and immutability inherently ensure the privacy and transactional reliability of cultural resources. However, traditional global consensus mechanisms scale poorly with increasing data volume and transaction frequency. While sharding enhances blockchain scalability, current sharding-based implementations exhibit high latency and communication overhead during cross-shard transactions. In this paper, we propose F-CShard, a fast cross-shard consensus protocol that optimizes blockchain sharding and consensus for large-scale cultural resource sharing. F-CShard addresses two key challenges in existing systems: low transaction throughput and high cross-shard communication costs. Our solution incorporates four technical innovations. First, we construct a spatio-temporal correlation model based on historical transaction patterns and account geographical distribution to minimize cross-shard transactions. Second, we add a random-bit to optimize the Cuckoo Rule, thereby reducing the migratory frequency of nodes while improving system throughput and robustness. Third, we design a heartbeat-enhanced consensus protocol to decrease latency and communication overhead. Finally, we propose a cross-shard consensus protocol based on virtual accounts to simplify the processing of cross-shard transactions and ultimately improve the scalability and security of the system. Experimental results show that F-CShard outperforms X-Shard and LBF in terms of throughput and latency, and has near-linear scalability in high concurrency environments. | 10.1109/TNSM.2026.3703588 |
| Masoumeh Safkhani, Mohammad Reza Servati, Fatemeh Rezaei | HEIoT: A Novel Three-Factor Authentication Protocol for Enhanced Security in IoT and Next-Generation Networks | 2026 | Early Access | Authentication Internet of Things Protocols Security Smart devices Elliptic curve cryptography Modeling Error correction codes Biometrics Costing of Yuan et al.’s Protocol Authentication Multi-factor authentication Desynchronization attack Insider adversary Traceability attack User impersonation attack Elliptic Curve Cryptography (ECC) | The Internet has a significant impact on contemporary society, enabling a wide range of applications, including advanced cellular networks such as 4G, 5G, and 6G. Since these communications occur over shared or open channels, ensuring secure data exchange is of critical importance, as any weakness in the communication infrastructure may compromise system reliability. Device authentication in the Internet of Things (IoT) and user authentication in smart environments, such as smart homes, remain fundamental security challenges. As the first line of defense, authentication mechanisms must be robust, since vulnerabilities at this stage can expose the entire system to serious threats. To address these challenges, numerous authentication schemes based on cryptographic primitives, including Elliptic Curve Cryptography (ECC), have been proposed. In this paper, we present a comprehensive security analysis of an ECC-based three-factor authentication protocol proposed by Yuan et al. Our analysis shows that the protocol is vulnerable to desynchronization, user impersonation, traceability, and insider attacks, all of which succeed with probability 1 by exploiting at most two protocol phases. To mitigate these weaknesses, we propose an improved authentication scheme, called HEIoT. The proposed scheme is formally analyzed under the Real-or-Random (RoR) model to establish session-key security and is further verified using the Scyther tool. Moreover, a Python-based implementation is provided to demonstrate the practicality of the proposed protocol. Comparative results indicate that HEIoT achieves stronger security while maintaining acceptable communication, computational, and storage overhead. | 10.1109/TNSM.2026.3702041 |
| Wenying Wang, Mohammad S. Obaidat, Xuxun Liu, Kuei-Fang Hsiao | Node-Differentiated Resource Allocation for Media Access Control in Wireless Body Area Networks | 2026 | Early Access | Timing Resource management Media Access Control Protocols Body area networks Fuzzy sets Distance measurement Equations Information rates Throughput Wireless body area network (WBAN) medium access control (MAC) resource allocation continuous priority fuzzy inference system | Medium access control (MAC) is crucial for resource allocation in wireless body area networks (WBANs). However, existing MAC protocols often suffer from transmission conflicts and inefficient channel utilization. To address these issues, this paper proposes a Node-Differentiated Resource Scheduling (NDRS) MAC protocol, which dynamically allocates access resources based on node-specific requirements. This protocol employs a superframe structure consisting of a contention-based phase and a contention-free phase for data transmission. A Mamdani fuzzy inference system is utilized to calculate continuous node priorities. These priorities achieve fine-grained differentiation of node importance and thus serve as the foundation for transmission conflict minimization. During the contention-based phase, continuous and differentiated backoff times are assigned to nodes based on their priorities. These backoff times effectively reduce transmission collisions and enhance channel utilization. In the contention-free phase, time slots are preferentially allocated to nodes with higher priority, better channel utilization, and greater transmission reliability. This allocation thereby enhances channel usage efficiency and reduce transmission delays. This protocol is characterized by three key features: precise node prioritization, low transmission collisions, and high channel utilization. Extensive experimental results demonstrate that NDRS outperforms existing protocols in terms of average delay, throughput, packet loss ratio, and average energy consumption. | 10.1109/TNSM.2026.3700262 |
| Arash Heidari, Jamal N. Al-Karaki | NOVA: A Self-Supervised Graph Framework for Real-Time Anomaly Detection in Internet of Vehicles | 2026 | Early Access | Context Internet of Vehicles Modeling Timing Vehicles Labeling Anomaly detection Matrices Vectors Joining processes Internet of Vehicles V2X Security Anomaly Detection Self-Supervised Learning Graph Neural Networks | The Internet of Vehicles (IoV) enables cooperative driving and real-time Vehicle-to-Everything (V2X) communication but remains vulnerable to behavioral and structural anomalies due to its dynamic, decentralized nature. Existing deep learning methods either overlook topological inconsistencies or ignore communication feature fidelity, while random-walk sampling introduces contextual noise. In this paper, we propose Network Observation for Vehicular Anomalies (NOVA), a self-supervised graph-based framework that detects both behavioral and structural anomalies in IoV networks without labeled data. NOVA models vehicular communications as attributed graphs and employs intimacy-guided subgraph sampling to extract meaningful neighborhoods. A Graph Convolutional Network (GCN)–based generative module reconstructs node attributes to reveal behavioral deviations, while a contrastive module validates structural coherence through embedding comparisons of real and perturbed contexts. Their hybrid anomaly score enables accurate, scalable, and real-time detection of compromised nodes. Performance results show that NOVA achieves state-of-the-art performance (98.7% accuracy, 98.1% F1), real-time throughput (~4.7k events/s at 5k msg/s), and strong robustness (AUROC 0.99, AUPRC 0.98, FAR 0.05) with near-linear scalability (≤40 ms latency for 50k vehicles). By integrating generative and contrastive self-supervised learning with context-aware sampling, NOVA significantly enhances IoV security, reliability, and adaptability. | 10.1109/TNSM.2026.3696324 |
| Huijuan Zhu, Chenhao Zheng, Zhongyuan Liu, Yuan Zhang | Reliable Interpretations of Deep Learning-based Malware Detectors via Deep Q-Networks | 2026 | Early Access | Malware Signal detection Modeling Application programming interfaces Operating systems Androids Training Detectors Probability Conferences Android Malware detection Interpretation Deep Q-Networks | Deep learning has become widely used in Android malware detection, but its black-box nature raises trust concerns, limiting its use in critical security areas. To address this, various interpretation methods have been proposed. Unfortunately, these solutions often suffer from inconsistent results and poor adaptability to model updates. In this work, we propose XDQNMal, a Deep Q-Networks (DQN)-based global interpretation framework designed to uncover the critical features that drive decisions in deep learning-based malware detectors. To enhance the reliability of interpretation, XDQNMal captures API call frequency features derived from the runtime behavior of each application (App). Then, it unites a DQN model with the TabPFN detection model to work collaboratively, using variations in detection results as reward signals. These signals guide the DQN model to gradually identify the most impactful features as interpretations for the detection model’s decisions. Our experimental evaluation on real-world datasets demonstrates that the proposed XDQNMal framework generates reliable interpretation for deep learning-based malware detection models. For instance, suppressing the critical features identified by XDQNMal leads to an average decrease of 20.30% in the probability that the malicious sample is predicted as malicious, highlighting the pivotal role these features play in the model’s decision-making. | 10.1109/TNSM.2026.3699408 |
| Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh | Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices | 2026 | Early Access | Schedules Scheduling Cloning Timing Educational institutions Computers Transcoding Videos Tail Edge computing Edge devices Edge server Resource augmentation Task distribution Kubernetes | Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline. | 10.1109/TNSM.2026.3694238 |
| Deemah H. Tashman, Soumaya Cherkaoui | Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks | 2026 | Early Access | Reconfigurable intelligent surfaces Reliability Optimization Security MISO Array signal processing Vectors Satellites Reflection Interference Beamforming cascaded channels cognitive radio networks deep reinforcement learning dynamic hybrid reconfigurable intelligent surfaces energy harvesting poisoning attacks | Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems. | 10.1109/TNSM.2026.3660728 |
| Emilio Paolini, Andrea Pinto, Luca Valcarenghi, Flavio Esposito | Programmable In-Network Aggregation for Communication-Aware Federated Learning in 5G RANs | 2026 | Early Access | Modeling Timing Training Federated learning Accuracy 5G mobile communication Convergence Aggregates Labeling Point cloud compression Federated Learning Mobile Networks Wireless In-Network Aggregation Grouping | Federated Learning (FL) enables collaborative model training without sharing raw data, making it attractive for privacy-preserving applications at the wireless edge. However, when executed over real 5G networks, FL performance degrades due to uplink congestion, heterogeneous client capabilities, and intermittent connectivity. Most existing approaches attempt to mitigate these issues indirectly by optimizing clients (through adaptive participation, local training, or selection strategies) or by optimizing models (via pruning, quantization, or compression), but they ignore potential network bottlenecks. This paper introduces FLAG, an FL architecture that embeds innetwork aggregation directly into 5G gNodeBs, transforming the network into an active participant in the learning process. In particular, FLAG performs parameter aggregation at line rate within the 5G Service Data Adaptation Protocol layer and incorporates three mechanisms: Partial-Contribution Correction for loss-tolerant averaging, a timer-driven pipeline for real-time scheduling, and a deadline-based grouping strategy to mitigate stragglers. Experiments with realistic wireless emulation show that FLAG achieves up to 5.1× faster time-to-accuracy and maintains accuracy within 0.8% of a loss-free baseline, while reducing gNB-to-server bandwidth by aggregating pergNB rather than per-client. FLAG requires no modifications to clients or the parameter server, demonstrating how 5G-aware system design can make federated learning scalable, efficient, and resilient under real-world wireless conditions. | 10.1109/TNSM.2026.3697723 |
| Kunpeng Zheng, Huibin Zhang, Yongli Zhao, Yuan Cao, Wei Wang, Xin Li, Zhuangzhuang Ma, Lihan Zhao, Jie Zhang | Sun-Outage-Aware Topology Modeling and Adaptive Routing for Optical Satellite Networks | 2026 | Early Access | Sun Interrupters Joining processes Satellites Routing Algorithms Modeling Timing Topology Interference Optical inter-satellite links optical service connections optical satellite network sun outage topology modeling | Optical satellite networks, supported by optical inter-satellite links (OISLs), provide reliable and low-latency optical connectivity. However, periodic and predictable sun outage events significantly compromise OISL availability, leading to frequent OISL interruptions and reduced network reliability. Existing routing algorithms often overlook the regularity of sun outage-induced interrupts and their differentiated impacts on services, resulting in degraded service performance. To address this challenge, this paper proposes a sun outage-enhanced time discretization OISL model and introduces a sun outage link-aware routing (SOLR) algorithm. By incorporating joint awareness of sun outage patterns and service requirements, SOLR employs an adaptive optimization mechanism to dynamically adjust routing decisions within temporal windows. Experimental results demonstrate that SOLR extends stable path durations by 39.9%, reduces interruption rates by 28.5%, and decreases blocking rates by 36.4%, significantly outperforming link-state-based routing algorithms. By effectively mitigating the impact of sun outages, SOLR ensures continuous optical service connections. This interruption-tolerant framework bridges network modeling and service provisioning, offering a robust solution for mission-critical service in optical satellite networks. | 10.1109/TNSM.2026.3697856 |