TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Ting-Yu Chang, Cooper Cheng-Yuan Ku	Two-tier Framework with AutoML for Detection and Classification of Multiple Types of Anomalies in Intrusion Attacks	2026	Early Access	Modeling Optimization Probability	Ensuring cybersecurity is paramount for protecting sensitive data and defending against increasingly sophisticated cyberattacks. Consequently, intrusion detection (ID) has become a critical area of research in network security. This paper proposes a two-tier framework that leverages efficient automated machine learning (AutoML) techniques to address data imbalance and optimize feature combinations for ID and classification of multiple types of anomalies. In the first tier, two complementary models are selected: a primary model optimized for overall dataset performance and a secondary model specifically chosen for its effectiveness on balanced data distributions. In the second tier, a probability stacking approach, supported by Out-of-Fold (OOF) cross-validation, integrates insights from the first-tier models. It acts as a binary safety net that successfully recovers rare minority attacks while preventing irreversible information loss. The proposed framework effectively mitigates the adverse effects of data imbalance while requiring only a minimal runtime memory footprint of approximately 44 MB (NSL-KDD) and a total process footprint of 165.52 MB (CIC-IIoT-2025), and achieves a rapid cold-start initialization of 0.85 seconds. These advantages make it well-suited for edge computing. Experimental results on the NSL-KDD dataset demonstrate that the proposed approach achieves an overall accuracy of 99.73%, outperforming many state-of-the-art methods by 0.4-20.6%. Furthermore, evaluations on the CIC-IDS-2017 dataset show a 6.3% accuracy improvement and a significant 36% increase in macro-average recall compared with a random-forest-only (RF-only) model. Moreover, extensive validation on the contemporary CIC-IIoT-2025 dataset reveals a significant 4.20% improvement in Macro F1-score over up-to-date baselines. Finally, evaluations on an independent set with novel attack types (KDDTest+) confirm strong generalization capability, achieving 77.10% accuracy and underscoring the framework's robustness in modern industrial scenarios.	10.1109/TNSM.2026.3747311
Zhaogang Shu, Dawei Lin, Haihui Xie, Shuwu Chen	PeriSTNet: A Topology-Anchored Residual Graph Evolution Model for Multi-Step Traffic Matrix Forecasting	2026	Early Access	Forecasting Modeling Matrices	Accurate multi-step Traffic Matrix (TM) forecasting enables Wide Area Network (WAN) operators to plan capacity, anticipate congestion, and assess traffic-engineering actions before service quality is affected. Existing spatio-temporal graph neural networks often rely on a fixed physical topology, whereas fully data-driven and long-sequence models may not explicitly retain network-structure priors. These choices can miss demand correlations induced by routing and application behavior, while recursive decoding can accumulate error at longer horizons. We propose PeriSTNet, a topology-anchored residual graph evolution framework that learns a sparse, phase-conditioned predictive dependency graph around a physical topology prior. This graph is integrated into a Dual-Graph Fusion Gated Recurrent Unit, and a Spatio-Temporal Shortcut stabilizes recursive rollouts. Across Abilene, GÉANT, and CERNET, PeriSTNet achieves lower aggregate MAE, MAPE, and RMSE than the evaluated graph-based and Transformer baselines; horizon-wise, multi-seed, and efficiency analyses support this result under one reproducible protocol. By coupling dynamic predictive dependencies with a stable physical backbone, PeriSTNet provides a lightweight forecasting component for proactive capacity planning and traffic-engineering workflows.	10.1109/TNSM.2026.3753266
Jiawei Dong, Mohsen Ghafouri, Chadi Assi	Cybersecurity Risks in Electric Vehicle Charging Management Systems	2026	Early Access	IP networks Security Internet of Things	Electric Vehicle Charging Stations (EVCSs) have become the heart of electrified transportation infrastructure. Their increasing Internet exposure makes them high-value targets for cyberattacks with potential implications for grid stability. This study presents a comprehensive, data-driven security analysis of globally exposed EV Charging Management Systems (EVCMS), bridging theoretical vulnerability concerns with quantified real-world threats. We discover and assess Internet-exposed EVCMS infrastructure, then deploy multi-component honeypot systems to capture live attack intelligence. Our novel EVCS discovery technique identifies 59,359 EVCMS IPs from 798 vendors, with notable improvements in non-English-speaking regions, overcoming traditional scanning limitations. Security assessment of 17 vulnerability types reveals most critical vulnerabilities remain unaddressed three years after coordinated disclosure. Darknet intelligence analysis reveals 10,647 unique IPs that also appeared in our EVCMS dataset participating in unsolicited scanning throughout 2024 with periodic surges. We deploy a comprehensive honeypot system with proactive engagement that actively induces compromised EVCMS devices to attack our infrastructure, spanning two monitoring phases: a ten-day period with proactive engagement and an eight-month period of long-term passive monitoring. We observed generic IoT threats and found no EVCMS-specific malware in the samples examined. A small portion of human exploration activities is found in the web portal honeypot. We observed liveness probes on both the Linux server honeypots and the OCPP backend, serving as a critical warning of imminent threats demanding immediate vendor attention before escalation to destructive campaigns.	10.1109/TNSM.2026.3751489
Mayank Ramnani, Shasank Dixit, Sushil Yadav, Saad Ahmed, Sidharth Sharma	Split-Aware Function Placement with Availability Guarantees and Optical Provisioning in vRANs	2026	Early Access	Radio access networks 5G mobile communication Joining processes	The rapid evolution of beyond-5G and emerging 6G networks is driving the need for flexible, reliable, and cost-efficient virtualized Radio Access Network (vRAN) architectures capable of supporting heterogeneous services such as enhanced Mobile Broadband (eMBB), Ultra-Reliable Low-Latency Communication (URLLC), and Massive Machine-Type Communication (mMTC). Future disaggregated RAN systems are expected to rely heavily on network slicing, functional split flexibility, and optical x-haul infrastructures to support stringent performance, scalability, and availability requirements. In this paper, we present an integrated framework for reliable, slice-aware, and functional split-aware Virtual Network Function (VNF) placement with lightpath provisioning in disaggregated vRAN environments. The proposed approach maximizes mobile network operators’ profit by jointly optimizing function placement and optical resource allocation under latency, processing, bandwidth, and availability constraints. We formulate the problem as an Integer Linear Programming (ILP) model with two variants: one that employs unshared backups and another that uses a more cost-efficient shared backup scheme. To address ILP complexity, we develop a heuristic algorithm and a GA-based metaheuristic that provide computationally efficient alternatives for larger instances. Extensive evaluations on topologies up to 128 nodes show that shared backup variants yield up to 18% higher profit, while maintaining up to 5–10% lower normalized CPU usage than unshared counterparts.	10.1109/TNSM.2026.3751852
Deemah H. Tashman, Soumaya Cherkaoui	Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks	2026	Early Access	Reconfigurable intelligent surfaces Reliability Optimization	Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems.	10.1109/TNSM.2026.3660728
Jinzhe Wu, Quansheng Guan, Shugang Hao, Shengming Jiang, F. Richard Yu	Buffer-Induced Optimization Flow Control for Communication Networks	2026	Early Access	Joining processes Delays Throughput	Congestion is the main bottleneck for throughput improvement in communication networks. Since link buffer is an essential and early indicator for congestion, we formulate a buffer-induced optimization (BIO) flow control problem using the network utilization maximization framework. BIO uses link buffer dynamics to regulate source rates. We then derive a buffer-induced asynchronous gradient (BAG) algorithm using Lagrange duality. BAG allows links to price their buffer and allows sources to compute their rates based on path prices distributedly and iteratively. We prove the convergence and optimality of the source-link iterations under asynchronous price and rate updates. To prevent buffer bloat happening in practical networks, we also adopt a buffer shrink mechanism for BAG. Simulation results show that BAG can quickly sense the changes of network status and dynamically capture the optimal network throughput. BAG also achieves higher throughput and stronger robustness to bursts than the existing rate-based flow control and congestion control algorithms.	10.1109/TNSM.2026.3751275
Rosario Patanè	Dynamic Coalition Formation Under Capacity Constraints: A Regime-Switching Value-Investing Game	2026	Early Access	Games Modeling Resource management	Edge computing service deployment requires the Network Operator (NO) and Service Providers (SPs) to coordinate investment and resource allocation under uncertain demand. This paper develops an audit-based service management framework for daily coalition formation with fixed capacity and service-level agreement (SLA) reservations. A two-stage coalitional game separates infrastructure investment from operational participation. Demand follows a Geometric Random Walk (GRW), and SPs apply an ordered admission and suspension rule using reported marginal contributions. With the NO held fixed, the operational coalition value is submodular; mandatory reservations can produce negative Shapley payoffs. We derive a separable benchmark, compute operational Shapley allocations, and give a sufficient condition for convergence to an individual equilibrium. A probabilistic audit mechanism provides a conditional daily truthfulness guarantee under verified settlement and enforceable penalties. For five service classes over three years, the reference run gains 12.4% over static grand-coalition membership and recovers 94.6% of the full-information optimum. Across 30 runs, the median gain is 13.3%. Sensitivity tests examine policy parameters, capacity and alternative demand models. The gain depends on capacity and update order; abundant capacity can make the admission rule underperform static membership.	10.1109/TNSM.2026.3750592
Mario Chahoud, Hani Sami, Ahmad Hammoud, Rabeb Mizouni, Hadi Otrok, Jamal Bentahar, Azzam Mourad, Chamseddine Talhi	Multi-agent Deep Reinforcement Learning Scheme for On-Demand Federated Learning	2026	Early Access	Modeling Federated learning Training	The rapid growth of intelligent IoT devices and mobile edge infrastructures has generated massive decentralized data, necessitating efficient and privacy-preserving learning. Federated Learning (FL) enables distributed model training without sharing raw data; however, its performance degrades in dynamic mobile environments due to unpredictable availability, stragglers, and frequent dropouts. In On-Demand FL, training services and models are deployed only when needed rather than relying on always-active infrastructure, requiring orchestrators to adapt to client arrivals, departures, and mobility while efficiently allocating limited resources and maintaining training continuity. Existing client-selection methods rely on static heuristics or centralized Reinforcement Learning models that struggle to scale and adapt to such dynamics. To address these challenges, we propose a cooperative Multi-Agent Deep Reinforcement Learning (MADRL) framework for client selection in On-Demand FL. Multiple orchestrators act as agents under a Centralized Training and Decentralized Execution (CTDE) paradigm. The problem is formulated as a Partially Observable Markov Game (POMG), capturing mobility, partial observability, and distributed decision-making. A mobility-aware reward integrates accuracy, resource efficiency, and a Useful Handoff Bonus to preserve learning continuity. Containerization further enhances adaptability. Experiments demonstrate faster convergence, improved resource utilization, and enhanced robustness under real mobility traces.	10.1109/TNSM.2026.3750310
Mona Alghamdi, Atm S. Alam, Asma Cherif	A Context-Aware Action Filter for Deep Reinforcement Learning-Based Task Orchestration in Mobile Edge Computing	2026	Early Access	Filtering Servers Filters	The growing complexity and highly dynamic characteristics of Mobile Edge Computing (MEC) environments introduce considerable challenges for Deep Reinforcement Learning (DRL)-based task orchestration. With an increasing number of potential execution nodes, the set of available actions becomes substantially larger, leading to greater exploration complexity and exposing the learning agent to many infeasible or contextually inappropriate decisions. This paper proposes a Context-Aware Action Filter (CAAF) for Double Deep Q-Network (DDQN)-based task orchestration in MEC. CAAF dynamically evaluates candidate edge servers according to task characteristics, resource availability, network conditions, and system context. It combines a composite suitability assessment with an adaptive distribution-aware filtering mechanism that removes less-suitable actions when meaningful differences exist among candidates, while preserving action diversity when their suitability is comparable. The resulting reduced action space is then provided to the DDQN agent for task assignment. Simulation results demonstrate that CAAF-DDQN outperforms conventional DDQN, particularly under high-load conditions, reducing service time and task failure rate by approximately 20.0% and 45.7%, respectively. Scalability experiments with a larger number of edge servers further confirm its effectiveness under enlarged action spaces, achieving reductions of approximately 31.8% in service time and 89.5% in task failure rate without modifying the DDQN architecture or learning hyperparameters.	10.1109/TNSM.2026.3749201
Yichen Zhang, Di Chen, Kaijie Zhu, Zekun Tao, Wei Lin, Rui Zheng	Beyond Valley-Free: Transformer-based AS Path Inference Using Path Embedding	2026	Early Access	Border Gateway Protocol Routing Ranking (statistics)	Gaining insight into autonomous system (AS)-level paths is essential for understanding Internet routing behaviors and enhancing inter-domain routing security. Due to increasingly complex Internet topology and limited measurement access (e.g., router-side ICMP restrictions), few AS paths can be accurately observed, making AS path inference a necessity. However, most existing inference methods are developed based on the valley-free constraint. This limits their ability to capture real-world dynamic routing behaviors. In this paper, we propose PathRank, a Transformer-based method that infers AS paths from a source-AS to a destination-prefix through probability-based ranking, thereby closely reflecting real-world inter-domain routing complexities. From observable BGP data, PathRank generates candidate paths, encodes them as embeddings for a self-attention mechanism to capture cross-hop dependencies, and employs a prefix-length-weighted loss function during training to reflect real-world traffic impacts.We conduct experiments on large-scale public BGP datasets covering IPv4 and IPv6. PathRank places the observed BGP path among the top-10 ranked candidates in 96.82% (IPv4) and 96.65% (IPv6) of test cases, outperforming the strongest external baseline by 4.20 and 11.72 percentage points, respectively. On non-valley-free cases, where valley-free-constrained methods degrade significantly, PathRank maintains inference performance.	10.1109/TNSM.2026.3752819
Zijian Zhao, Davide Di Monda, Domenico Ciuonzo, Yipeng Wang, Antonio Pescapè	Network Intrusion Detection Adaptability under Spurious Labels: A Noise-Aware Few-Shot Class-Incremental Learning Framework	2026	Early Access	Labeling Noise Internet of Things	Network Intrusion Detection Systems (NIDSs) must incrementally adapt to emerging attacks, even when only a limited amount of labeled network traffic is available. Consequently, Few-Shot Class-Incremental Learning (FSCIL)-based NIDSs have gained growing attention. However, existing FSCIL-based NIDSs are highly vulnerable to label noise in newly-observed attack classes. To address this limitation, we propose NAFN, a noise-aware FSCIL-based NIDS framework that reduces the impact of mislabeled data during incremental adaptation. NAFN consists of two components: (i) Noise Detection, which identifies and removes mislabeled biflows using noise-detection algorithms, and (ii) Feature Sampling, which estimates class-conditional embeddings from clean biflows, calibrates them with base-class statistics, and resamples synthetic features to recover the original biflow count. The framework follows the Rethink Few-Shot (RFS) teacher–student paradigm with lightweight nearest-neighbor or logistic regression classifiers, and various pretraining & memory selection strategies. Experiments on CSE-CIC-IDS2018, Edge-IIoT, and IoT-NID datasets show that NAFN effectively preserves prior knowledge and maintains strong incremental performance even under 50% label noise, consistently improving new-class F1-scores over non-denoised baselines, up to +52%, while being time-efficient and robust in cross-network and high-noise incremental settings. The implementation is publicly available to foster reproducibility.	10.1109/TNSM.2026.3752751
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Diogo Pereira, Rodolfo Oliveira, Daniel Benevides Da Costa, Hyong Kim	Performance Assessment of Beamforming Training Protocols in IEEE 802.11ad/ay Networks	2026	Early Access	Modeling Probability Media Access Control	This paper introduces an innovative two-step methodology to model the beamforming training (BFT) medium access control (MAC) behavior of IEEE 802.11ad and IEEE 802.11ay networks, capturing several MAC-layer features specified in the standards that previous work has not considered. The proposed framework jointly employs two discrete-time Markov chains (DTMCs): the first models the individual behavior of each transmitting station (STA), including the dynamic adjustment of the competing STA to account for the idle period, while the second captures the network-wide interactions of all STAs and uses this information to derive the medium access probability at each frame slot during the BFT process. This work introduces two key novel modeling assumptions: (1) the STAs cease access once they successfully access a BFT frame’s slot, and (2) the number of competing STAs dynamically decreases as they enter the idle period after a given number of consecutive collisions, providing a precise representation of BFT MAC operation in IEEE 802.11ad and IEEE 802.11ay standards. We derive the theoretical expressions for the expected number of idle STAs based on probabilities of successful BFT, collisions, and transitions to the idle period.We validate the model’s accuracy through Monte Carlo simulations across diverse network scenarios, showing close alignment with simulation results and improved accuracy over prior models that do not consider these two modeling assumptions. Additionally, we analyze the impact of the collision threshold and idle period duration on BFT goodput, highlighting the model’s ability to compute MAC protocol performance.	10.1109/TNSM.2026.3751488
Shengye Gong, Hui Yang, Qiuyan Yao, Xin Li, Tiankuo Yu, Wenxin Liu, Yang Zhao, Yucong Liu, Jie Zhang, Mohamed Cheriet	Resilient Hierarchical Polyhedron-based Configuration Protection for Large-Scale Multi-Domain Optical Networks	2026	Early Access	High performance computing Joining processes Protection	Large-scale multi-domain optical networks are increasingly exposed to spatially correlated and concurrent failures, while monolithic pre-configured protection structures incur rapidly increasing global search complexity and protection-resource costs under heterogeneous physical constraints. To address this challenge, this paper proposes a resilient Hierarchical Polyhedron-based Configuration (HPC) architecture that decomposes a monolithic global survivability requirement into adaptive intra-domain connectivity constraints and a compact inter-domain connectivity constraint. To alleviate resource imbalance caused by topology-only network partitioning, a Topology-Resource Aware Domain Partitioning (TRADP) algorithm is developed to construct protection-supportable sub-domains by jointly considering topological structure and physical resource distribution. To avoid imposing a rigid protection level on heterogeneous domains, HPC assigns adaptive intra-domain connectivity targets according to local failure exposure and physical resource supportability. To reduce the complexity of cross-domain protection while preserving physical feasibility, a super-node abstraction and physical bridge-link mapping mechanism is employed to construct the inter-domain protection backbone under capacity, spectrum, and SRLG constraints. Extensive evaluations on networks of up to 1000 nodes and representative GEANT and NSFNET topologies demonstrate that HPC-TRADP maintains a recovery rate of 92.94% at 1000 nodes and 85.82% even when 30% of physical links fail concurrently. It further reduces protection overhead by up to 79.60% relative to p-KECS while maintaining efficient recovery paths, demonstrating a favorable balance between survivability, resource efficiency, and scalability.	10.1109/TNSM.2026.3750417
Byungchang Kim, Shinyoung Lue, Seonyeong Hwang, Youhee Park, Yeji Lee, Jaemin Jeong, Peter Bloodsworth, Euiseok Hwang	GRIDS: Generalized Representation-based Intrusion Detection System via Federated Contrastive Learning	2026	Early Access	Modeling Labeling Intrusion detection	Existing AI-based intrusion detection systems are typically trained for specific network environments, leading to significant performance degradation when deployed in different settings or exposed to evolving attack strategies. We propose GRIDS (Generalized Representation-based Intrusion Detection System), a federated contrastive learning framework for cross-environment intrusion detection that keeps raw traffic data local. GRIDS employs a Transformer-based encoder trained with supervised contrastive learning across distributed network environments, learning a shared representation without exchanging sensitive traffic data. The encoder embeds network flow features into a latent space where semantically similar traffic patterns cluster together, enabling effective anomaly detection via k-nearest neighbor scoring. Evaluated on four heterogeneous NetFlow datasets, GRIDS outperforms existing federated IDS baselines on average with a single unified model. In leave-one-out cross-validation, a substantial portion of the detection capability of GRIDS transfers to network environments unseen during training, and the level of transfer varies across target networks. Deployment at such a network requires no labeled attack data or fine-tuning. It uses the benign traffic of the network as the kNN reference set and its unlabeled traffic for normalization and threshold calibration. The framework targets deployments in which a single model protects multiple heterogeneous networks.	10.1109/TNSM.2026.3748922
Vincent Sheh, Yao Chiang, Hung-Yu Wei	Two-Timescale Service Orchestration for Dependable Multi-Region Edge Analytics under Adversarial Workloads	2026	Early Access	Modeling Delays Routing	Adversarial workloads can saturate the shared CPU budget of edge nodes, undermining the continuous availability that safety-critical analytics require. Co-locating an inline intrusion detection system (IDS) can filter malicious traffic but creates contention with analytics inference over the same budget, producing a defense-service resource tradeoff. This tradeoff is destabilized by two mechanisms: adaptive Yo-Yo attacks that exploit container scaling delay, and load-based offloading that ignores cross-region IDS mismatch. We propose a two-timescale orchestration framework that jointly minimizes service-level objective (SLO) violations, residual malicious leakage, and benign quality degradation. A long-timescale multi-agent reinforcement learning policy partitions CPU between inspection and inference, internalizing scaling delay and coordinating across regions to suppress oscillatory reallocation. A short-timescale heuristic routes inspection traffic to receivers with compatible detection models, preventing the mismatched-IDS errors that load-based routing would induce. Compared with a representative state-of-the-art baseline, the framework achieves up to 68.8% lower SLO violation rate, 90.9% lower residual malicious leakage, and 64.6% fewer reallocations.	10.1109/TNSM.2026.3753027
Franck Messaoudi, Luhan Wang, Abdelkader Mekrache, Adlen Ksentini, Bingxuan Li, Jialei Su, Sofiane Messaoudi, Salim El Ghalbzouri	The Brewing Storm in 5G’s Data Plane: Design and Evaluation of a High-Performance eBPF/XDP-Based User Plane Function	2026	Early Access	Quality of service Fluid flow Kernel	This paper presents the design and implementation of a novel 5G UPF leveraging eBPF technology to meet the stringent performance and programmability requirements of emerging 6G systems. Traditional UPF implementations often struggle to balance performance, flexibility, and resource efficiency-challenges particularly critical in CPU- and I/O-constrained edge environments. The proposed eBPF-based UPF architecture mitigates these limitations by embedding core functionalities, such as packet classification, forwarding, and QoS enforcement, directly within the Linux kernel via eBPF programs attached through XDP and tc hook points. Performance evaluation using TRex demonstrates that the proposed solution achieves competitive throughput, low packet loss, and efficient CPU utilization across traffic profiles. Moreover, it maintains full compliance with 5G Core Network standards. Comparative analysis with well-established open-source UPF implementations further underscores its advantages. This work highlights the potential of eBPF as a foundational technology for building next-generation, programmable UPFs optimized for edge cloud deployments in the 6G era.	10.1109/TNSM.2026.3720812
Aleksandar Avdalović, Joseph Khoury, Ibrahem AlJabea, Mustafa Hajij, Elias Bou-Harb	Beyond Flat Models: Preserving ICS Topology using Combinatorial Complexes for Hierarchy-Aware Intrusion Detection	2026	Early Access	Modeling Cells (biology) Integrated circuits	Industrial Control Systems (ICS) follow the Purdue model hierarchy, organizing sensors, actuators, Programmable Logic Controllers (PLCs), and supervisory control into distinct hierarchical layers. Despite this inherent structure, existing data-driven intrusion detectors still fail to model this intricate property. To address this gap, we introduce a Hierarchy-Aware Intrusion Detector, HAID, a topology-preserving framework that models an ICS as a Combinatorial Complex (CC), operating solely on process telemetry and trained on benign traces to detect falsified sensor measurements and unauthorized actuator commands. The complex captures devices, functional interactions, and PLC control zones within an ICS. CCs (unlike flat models) encode telemetry across hierarchical levels for training a Topological Neural Network (TNN). As such, HAID enables the embedding of the ICS Purdue model into the learning process, yielding anomaly scores and localization at each of the aforementioned levels. Evaluated on two water testbeds, SWaT and WADI, and on a simulated chemical process, TEP, HAID achieves competitive detection performance (82.7% F1 on SWaT and 50.1% on WADI, averaged over five runs), while providing explicit hierarchical localization unavailable in prior work. Through ablations, we confirm the added-value of hierarchical modeling, as removing the PLC-zone representation reduces F1 by 5.8 percentage points on SWaT and causes detection on WADI to collapse. The largest losses are on attacks that manipulate several devices at once, which device- and interactionlevel signals usually miss.	10.1109/TNSM.2026.3746967
Jing Zhang, Chao Luo, Rui Shao	MTG-GAN: A Masked Temporal Graph Generative Adversarial Network for Cross-Domain System Log Anomaly Detection	2026	Early Access	Anomaly detection Adaptation models Generative adversarial networks	Anomaly detection of system logs is crucial for the service management of large-scale information systems. Nowadays, log anomaly detection faces two main challenges: 1) capturing evolving temporal dependencies between log events to adaptively tackle with emerging anomaly patterns, 2) and maintaining high detection capabilities across varies data distributions. Existing methods rely heavily on domain-specific data features, making it challenging to handle the heterogeneity and temporal dynamics of log data. This limitation restricts the deployment of anomaly detection systems in practical environments. In this article, a novel framework, Masked Temporal Graph Generative Adversarial Network (MTG-GAN), is proposed for both conventional and cross-domain log anomaly detection. The model enhances the detection capability for emerging abnormal patterns in system log data by introducing an adaptive masking mechanism that combines generative adversarial networks with graph contrastive learning. Additionally, MTG-GAN reduces dependency on specific data distribution and improves model generalization by using diffused graph adjacency information deriving from temporal relevance of event sequence, which can be conducive to improve cross-domain detection performance. Experimental results demonstrate that MTG-GAN outperforms existing methods on multiple real-world datasets in both conventional and cross-domain log anomaly detection.	10.1109/TNSM.2026.3654642
Jian Liu, Jinhong Chen, Eldar Sabanovic, Jinliang Liu, Engang Tian, Oh-Min Kwon	Predictor-Enhanced Constrained Reinforcement Learning for Networked CAV Platoons: A Dual-Redundancy Scheme	2026	Early Access	Timing Vehicles Learning (artificial intelligence)	This paper investigates resilient tracking control for connected and automated vehicle (CAV) platoons under false data injection (FDI) attacks and prescribed spacing constraints. A kinematics-based state predictor is combined with a dynamic event-triggered mechanism (ETM) to provide smooth trajectories from sparse, FDI-corrupted measurements while reducing communication use. Prescribed performance control (PPC) maps the predicted spacing error into an unconstrained state for continuous-time actor-critic reinforcement learning (RL). The actor-critic controller learns an approximate tracking policy without identifying the unknown nonlinear drift. A locally sensed, saturated proportional-derivative fallback controller can override the learned command when the measured spacing error approaches the prescribed boundary. These two control paths form the dual-redundancy scheme. The analysis excludes finite-time accumulation of triggering instants, establishes input-to-state stability of the prediction-error subsystem, and gives conditional ultimate bounds for the prediction error and sampled adaptive weights under the stated input and approximation-domain conditions. Matched ablations and multi-seed tests evaluate communication use, fallback activation, and the responses to scalar and vector attacks.	10.1109/TNSM.2026.3748969