TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh	Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices	2026	Early Access	Schedules Scheduling Cloning	Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline.	10.1109/TNSM.2026.3694238
Deemah H. Tashman, Soumaya Cherkaoui	Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks	2026	Early Access	Reconfigurable intelligent surfaces Reliability Optimization	Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems.	10.1109/TNSM.2026.3660728
Franck Messaoudi, Luhan Wang, Abdelkader Mekrache, Adlen Ksentini, Bingxuan Li, Jialei Su, Sofiane Messaoudi, Salim El Ghalbzouri	The Brewing Storm in 5G’s Data Plane: Design and Evaluation of a High-Performance eBPF/XDP-Based User Plane Function	2026	Early Access	Quality of service Fluid flow Kernel	This paper presents the design and implementation of a novel 5G UPF leveraging eBPF technology to meet the stringent performance and programmability requirements of emerging 6G systems. Traditional UPF implementations often struggle to balance performance, flexibility, and resource efficiency-challenges particularly critical in CPU- and I/O-constrained edge environments. The proposed eBPF-based UPF architecture mitigates these limitations by embedding core functionalities, such as packet classification, forwarding, and QoS enforcement, directly within the Linux kernel via eBPF programs attached through XDP and tc hook points. Performance evaluation using TRex demonstrates that the proposed solution achieves competitive throughput, low packet loss, and efficient CPU utilization across traffic profiles. Moreover, it maintains full compliance with 5G Core Network standards. Comparative analysis with well-established open-source UPF implementations further underscores its advantages. This work highlights the potential of eBPF as a foundational technology for building next-generation, programmable UPFs optimized for edge cloud deployments in the 6G era.	10.1109/TNSM.2026.3720812
Messaoud Ait-Yahia, Wael Jaafar, Rami Langar	Joint Design of Blockchain-Enabled Service Placement and Task Assignment in Vehicular Fog Computing Networks	2026	Early Access	Delays Timing Optimization	Driven by the evolution of blockchain and fog computing, vehicular networks are increasingly capable of supporting latency-sensitive applications with enhanced security and trust guarantees. However, the joint resource allocation for task offloading and blockchain services has been insufficiently investigated in existing works. To address this gap, this paper proposes a framework for jointly allocating resources of blockchain, users’ virtualized services, and Mobile Edge Computing (MEC) task assignment in Vehicular Fog Computing (VFC) networks. Specifically, we formulate the optimization problem as an integer nonlinear programming model aiming to maximize the satisfaction rate of users’ service requests while minimizing the corresponding blockchain operation time under mobility, queuing, instantiation, and resource constraints. To solve it in a timely manner, we design two-stage hierarchical low-complexity solutions, namely a Particle Swarm Optimization-based Joint Blockchain-enabled Service placement and Task Assignment algorithm (PSO-JBSTA), and a Genetic Algorithm-based approach (GA-JBSTA). Through extensive simulations, we demonstrate the effectiveness of PSO-JBSTA (resp. GA-JBSTA) and their adaptability to network conditions, achieving an average 35% (resp. 24%) improvement in users’ service satisfaction rate and 9.5% (resp. 10.2%) reduction in average blockchain validation delay compared with the baselines.	10.1109/TNSM.2026.3737068
Mohammad Khosravi, Setareh Maghsudi	A Robust Optimization Approach for Regenerator Placement in Fault-Tolerant Networks Under Discrete Cost Uncertainty	2026	Early Access	IP networks Costing Costs	We focus on robust, survivable communication networks, where network links and nodes are affected by an uncertainty set. In this sense, any network links might fail. Besides, a signal can only travel a maximum distance before its quality falls below a certain threshold, necessitating its regeneration by regenerators installed at network nodes. In addition, the price of installing and maintaining regenerators belongs to a discrete uncertainty set. Robust optimization seeks a solution with guaranteed performance against all scenarios modeled in an uncertainty set. Thus, the problem is to find a subset of nodes with minimum cost for the placement of the regenerator, ensuring that all nodes can communicate even if a subset of network links fails. To solve the problem optimally, we propose two solution approaches, including one flow-based and one cut-based integer programming formulation, as well as their iterative exact method. Our theoretical and experimental results show the effectiveness of our methods.	10.1109/TNSM.2026.3740028
Mohammad Saberi, Ali Ahmadi Esfidi, Mahdi Dolati, Naeimeh Omidvar	FlexINA: In-Network Aggregation for Accelerating Distributed Machine Learning with Flexible Routing	2026	Early Access	Modeling Switches Timing	The growing scale and complexity of modern machine learning (ML) models have rendered distributed training indispensable. However, as model dimensions expand, communication overhead increasingly dominates the overall training time, creating a critical performance bottleneck. While techniques such as gradient compression offer partial relief, they often incur substantial computational overhead or require specialized hardware. In-network aggregation (INA) has emerged as a compelling alternative, offloading partial computations—such as gradient reduction—directly onto programmable network switches. Yet, current INA frameworks predominantly rely on rigid, static routing schemes or uncoordinated, opportunistic aggregation, fundamentally limiting their capacity to exploit the full potential of programmable data planes. To address this limitation, we formulate the Joint Scheduling-Routing for In-Network Aggregation (JINA) problem. JINA introduces a time-slotted execution model to enable fine-grained temporal scheduling synchronously with spatial routing. By leveraging source routing, it dictates perpacket forwarding paths while explicitly coordinating multi-hop partial aggregation across the network. Furthermore, we propose FlexINA, a scalable optimization framework that solves the JINA problem through a three-phase dimensionality reduction strategy: host-level pre-aggregation, topological switch filtration, and temporal window partitioning. Extensive evaluations across fifteen diverse network topologies demonstrate that FlexINA reduces the total network load by up to 8.3% compared to INA baselines, while maintaining high computational efficiency.	10.1109/TNSM.2026.3740503
Chengsheng Pan, Yingzhi Wang, Huaifeng Shi, Lishang Qin, Xiaosong Cui	DBSDD-AQM: Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management for Edge IoT Networks	2026	Early Access	Delays Satellite broadcasting Internet of Things	Bursty heterogeneous traffic can build persistent queues at edge IoT gateways when the offered load converges on a lower-rate bottleneck. Conventional active queue management (AQM) regulates packet dropping under a fixed buffer capacity, whereas adaptive buffer sizing alone does not coordinate capacity adjustment with queue-removal control. We propose Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management (DBSDD-AQM), which combines a bounded buffersizing loop with a faster continuous queue-removal controller. DBS adjusts the admissible capacity according to sustained queue evolution, while the DDPG Actor selects packet-granular removal actions for the resident backlog. A class-aware extension maps three concurrent service classes to logical FIFO queues sharing the same dynamic physical buffer. DBSDD-AQM is implemented using an NS3-PyTorch framework. Aggregate experiments compare it with RED, ARED, PIE, CoDel, and DQN-AQM, while the class-aware evaluation additionally includes FQ-CoDel and FQ-PIE. Matched-DBS comparisons show similar throughput but different delay–loss operating points among the aggregate controllers, and component ablation distinguishes the effects of capacity adaptation and learned queue removal. Relative to a fixed 50 KB buffer, DBS reduces average queueing delay by 16.23% for UDP and 17.70% for TCP Westwood in controlled transport experiments. In the evaluated three-class overload scenarios, all classes retain nonzero throughput. Class-aware DBSDD-AQM provides stronger D- and T-class differentiation, whereas FQ-CoDel and FQ-PIE produce more uniform class-level outcomes and stronger R-class performance. The measured 95th-percentile batch-one Actor inference latency is 0.109 ms on the reported x86-64 platform.	10.1109/TNSM.2026.3741334
Michael Georgiades, Iacovos Ioannou, Hasan Islam, Ferheen Ayaz, Yun Hou, Kin-Hon Ho	Enhanced Vehicular Edge Offloading through SLA-Based Deep Reinforcement Learning and Risk-Aware Bandits	2026	Early Access	Service level agreements Modeling Timing	This paper investigates service-level agreement (SLA)-aware computation offloading in vehicular edge computing using two complementary online learners. SRM-FA-UCB combines staleness-aware transport exploration, contextual service-time prediction, empirical SLA screening, and selected-arm feedback. SLA-MA-PPO couples a state-dependent SLA action mask with a two-hidden-layer actor–critic, generalized advantage estimation, and cooperative KPI shaping. We evaluate both methods in an extended EdgeCloudSim environment with deterministic SUMO urban-grid mobility, V2X radio, congestion and handover effects, 200–1000 vehicles, and 10 paired replications per load. Among the six primary schemes, SRM-FA-UCB attains the lowest mean SLA violation, service time, and modeled energy with near-unity fairness. Additional controlled attribution with two simple screened heuristics and a screened FA-UCB control shows that the large improvement over conventional FA-UCB is primarily associated with the shared SLA-aware prediction and admissibility-screening stage; no independent endpoint advantage of the more complex post-screen SRM selector is established after Holm correction. SLA-MA-PPO significantly reduces SLA violations, mean service time, and modeled energy relative to PPO-GAE, while ablations identify action masking as its critical component. A controlled change-point experiment does not establish a transient benefit from the restless term. Code, configurations, seeds, and analysis scripts are provided through a public EdgeCloudSim research fork.	10.1109/TNSM.2026.3742669
Ke He, Muhammad Rizwan Asghar, Jeong Do Yoo, Young Hun Lee, Hyunjae Kang, Huy Kang Kim, Dan Dongseong Kim	Liuer Mihou: A Practical Grey-box Adversarial Attack against Anomaly-based Network Intrusion Detection Systems	2026	Early Access	Modeling Signal detection Timing	Deep learning has gained popularity as a detection algorithm for Network-based Intrusion Detection Systems (NIDS) due to its expressiveness and speed. However, Deep learning algorithms are susceptible to adversarial attacks that introduce imperceptible changes to deceive the Deep learning algorithm into misclassifying the input. Existing adversarial attacks often overlook the practicality and replayability of the attack. In this paper, we present Liuer Mihou (LM), an adversarial attack designed to generate practical and replayable adversarial network packets, specifically targeting unsupervised anomaly-based NIDS deployed in Internet of Things (IoT) networks. The core concept behind LM is to leverage adversarial transferability and generate adversarial packets on a surrogate NIDS while considering predefined, semantic-preserving mutation operations to ensure practicality. To assess the effectiveness of LM, we objectively analyze its evasiveness against five general-purpose machine learning-based outlier detection algorithms (SOM, RRCF, LOF, OCSVM, and FROCC), as well as the state-of-the-art NIDS, Kitsune. Rather than claiming broad practicality, we characterize when and how packet-space attacks remain feasible: we quantify the trade-off between evasion and attack effectiveness, the distortion introduced by physical replay, and the conditions under which the attack transfers across detector families. We further show that LM’s mutation set is extensible beyond timing and size, adding TCP-window and payload-byte operators to evade a header-field-aware detector. Furthermore, we demonstrate that adversarial detectors such as Feature Squeezing and MagNet, as well as defenses designed for unsupervised anomaly detection, are largely ineffective in defending against LM. Moving beyond a theoretical setting, we conduct a replay of LM in two real IoT testbeds to analyze its practicality.	10.1109/TNSM.2026.3742885
Hongyuan Cheng, Lihua Yin, Tianqing Zhu, Hongyu Yang, Dexin Zhu, Weixiang Jiang, Nan Wei	Pattern2Bot: A malicious server IP detection model based on self-trained heterogeneous graph neural network	2026	Early Access	Labeling Modeling Signal detection	Botnets play a key role in network attacks such as Distributed Denial-of-Service (DDoS) attacks, spamming and click fraud. Command & Control server is an important node for botmaster to control bots and distribute attack commands. Bot disguise as normal domain requests through DNS traffic, but leave malicious records in DNS logs containing client IP, query domain, server IP and other complex interactions. This information provides important clues for detecting those botnets. In the current study, researchers detect botnets through multiple perspectives, including abstracting DNS communication records into graphs and using graph neural network models for detection. Conventional approaches often necessitate massive labeled datasets for model training, which substantially incurs training costs. Moreover, despite enriching node embeddings via topological relations, graph models often suffer performance degradation when confronted with structural semantic obfuscation from evasion techniques like double-flux. In order to understand the abstract and complex relationship patterns in DNS records while reducing label usage to lower training costs, we propose a botnet Command & Control server detection model based on DNS traffic. This is a self-training heterogeneous graph neural network model that does not require a large number of labels. By integrating the high-order relational semantics derived from multiple meta-paths with the local topologies of target nodes, the model achieves finer-grained structural awareness and semantic abstraction, thereby enhancing detection performance. We validate the effectiveness of the model in a real dataset, and the results show that the model has a better understanding of the special structure possessed by the IPs of Command & Control servers.	10.1109/TNSM.2026.3741111
Shigen Shen, Muxi Li, Yizhou Shen, Jingnan Dong, Wenlong Ke, Ruilong Deng, Tian Wang	DeSPU: Privacy-Compliant Decentralized Sparse Personalized Federated Unlearning for Edge Intelligence-Enabled IoT Networks	2026	Early Access	Internet of Things Modeling Maintenance engineering	Edge intelligence-enabled Internet of Things (Edge-IoT) increasingly relies on decentralized on-device learning to reduce cloud dependence and keep locally collected IoT data on terminal devices. However, deployed models may still memorize privacy-sensitive class-level knowledge and must support deletion requests after training. This paper studies class-level federated unlearning in a serverless Edge-IoT workflow where each IoT client maintains a sparse personalized IoT-local model and exchanges model information only with neighbors. We propose DeSPU, a decentralized sparse personalized federated unlearning framework under a practical deletion-window protocol. DeSPU estimates a target-class direction with a lightweight dual-model mechanism, applies semantic-layer adaptive linear unlearning to suppress target knowledge, and performs topology-aware local repair regularized by cached neighbor snapshots collected during routine peer-to-peer training. The online unlearning path does not store historical gradients and does not introduce additional post-request model communication beyond routine decentralized exchanges; the one-time β calibration scan is reported separately, and the calibrated β can be reused under the same configuration. To propagate deletion status beyond the requester, DeSPU also attaches a metadata-only forgetting flag to those routine exchanges and invalidates affected cached neighbor references at receiving clients. Experiments on CIFAR-10, MNIST, CIFAR-100, and CINIC-10 show near-zero target-class accuracy with high retained accuracy, up to ∼ 4.7 × 103 speedup over full retraining on CIFAR-10, and membership-inference ROC-AUC close to random guessing. Additional analyses over seeds, requester clients, target classes, cache staleness, sparsity, communication, and hardware cost further demonstrate the practicality and limitations of DeSPU for privacy-compliant Edge-IoT deployments. The project link is available at https: //github.com/aaaM2002/UN_CODE.	10.1109/TNSM.2026.3743397
Chenxin Zhou, Cheng Huang, Qiang Zhang, Qiliang Xie, Zeqing Li	NESTTOR: Detecting Tor-over-Proxy Traffic with Factorized Decisions	2026	Early Access	Fluid flow Labeling Protocols	Tor users can place an encrypted proxy between the client and the Tor network to conceal the exposed entry connection. This additional layer also transforms the Tor byte stream through protocol framing, buffering, and TCP segmentation before an observer sees the outer client-to-proxy flow. The transformation breaks stable packet-to-cell alignment and raises two questions. We ask which Tor behaviors remain observable across different proxies and how a detector should combine the presence of an outer proxy with the presence of Tor traffic. Existing datasets primarily study Tor and proxy traffic as separate targets and provide limited support for answering these questions under a unified evaluation protocol. We propose NESTTOR, which trains a proxy gate and a proxy-conditioned Tor detector separately and combines their decisions with an AND rule. Its stage-based features capture relative connection evolution without reconstructing Tor cells. We construct a longitudinal benchmark of 349,891 bidirectional TCP flows that distinguishes Tor-over-Proxy (ToP), Pure Proxy, Direct Tor, and Ordinary traffic across four proxy protocols, 1,663 domains, and approximately 18 months. NESTTOR achieves 99.45% macro-F1 on confirmatory data from unseen domains and 88.50% on later captures.	10.1109/TNSM.2026.3743261
Aymen Daoud, Md. Zoheb Hassan, Georges Kaddoum	SpectraTwin: Generative Intelligence-Powered Digital Twin for Dynamic Spectrum Awareness	2026	Early Access		Spectrum monitoring and classification under evolving RF spectrum landscapes are key enablers of spectrum awareness for dynamic spectrum management and interference detection in 6G networks. Although artificial intelligence (AI) and machine learning (ML) techniques have shown promising performance in spectrum classification, most existing models are static, non-generative, and optimized for specific training environments. As a result, channel distribution shifts, model brittleness, and the scarcity of labeled RF data for fine-tuning AI/ML models lead to significant performance degradation in evolving RF spectrum landscapes. In this context, digital twin (DT) provides a promising approach by maintaining a virtual representation of the RF spectrum environment that supports what-if analysis, data generation, and iterative model updates. In this paper, we propose SpectraTwin, a multi-AI-enabled, adaptive, and self-evolving DT framework for multi-timescale spectrum classification under evolving RF spectrum states and incrementally increasing task complexity. SpectraTwin integrates three tightly coupled modules: (i) a Dynamic Mask Generative Adversarial Network (GAN) that serves as the virtual replica of the RF spectrum environment, synthesizing realistic, classand channel-conditioned spectrograms on demand to mitigate RF data scarcity; (ii) a continual learning-based spectrum classification model that incrementally adapts to evolving RF environments while preserving prior knowledge; and (iii) an active-learning-inspired orchestration module that decides when to adapt, which classes to synthesize, and which exemplars to retain, so that model updates are performed in response to detected change rather than on a fixed retraining schedule. By jointly combining generative, continual, and active learning, SpectraTwin enables robust spectrum awareness through (a) faithful emulation of RF spectrum evolution, (b) detection of domain distribution shifts, and (c) efficient incremental adaptation under non-stationary conditions while maintaining a favorable balance between accuracy and forgetting. Simulation results on both custom dynamic RF datasets and multiple benchmark datasets (consisting of simulated and real-world signal captures) show that SpectraTwin achieves superior adaptability and classification performance compared with existing approaches.	10.1109/TNSM.2026.3743810
Lei Liu, Yong Wang, Qian He, Junqi Chen, Yuming Liu, Baokang Zhao	Accelerating Full-Node Repair in Erasure-Coded Storage via Adaptive In-Network Aggregation	2026	Early Access		The erasure-coded data redundancy mechanism is extensively adopted in distributed storage systems to guarantee data reliability with low storage redundancy. However, recovering a failed node (full-node repair) inherently incurs high network overhead and latency. Existing full-node repair methods typically allocate tasks at block granularity, making it difficult to align each helper’s transmitted data volume with its available upload bandwidth. In addition, receiver-side download bottlenecks further limit repair throughput. To address these challenges, we propose FinRepair, a full-node repair framework that couples fine-grained task allocation with adaptive in-network aggregation (INA). FinRepair first formulates upload task allocation as a constrained max-min problem, and solves it with an iterative maximum flow-based algorithm, which determines the sub-block sizes and helper assignments. It then employs a bipartite graph-based placement strategy to scatter reconstructed blocks across storage nodes, and performs in-network aggregation for selected sub-blocks to satisfy each receiver’s download constraint. We establish a necessary and sufficient condition for upload allocations and prove the optimality of the selective in-network aggregation rule. We implement FinRepair with a Tofino programmable switch and 16 storage nodes. Experimental results show that FinRepair improves repair throughput by 16.85%–46.20% compared with state-of-the-art methods, while applying in-network aggregation to only 22.86%–32.43% of sub-blocks.	10.1109/TNSM.2026.3743621
Di Wu, Jian Xu	LLM-LogHGC: Hypergraph Enhanced Unsupervised Log Parsing with Lightweight LLMs	2026	Early Access		Log parsing converts log messages into structured data, serving as a critical step in log analysis. Traditional log parsers rely on predefined rules or on trainable models that require labeled data. Although they are effective in particular settings, they exhibit limited generalizability and struggle to handle complex log data. Recent advances in large language models (LLMs) have enabled LLM-based log parsers to achieve outstanding performance. However, existing LLM-based parsers exhibit limited sensitivity to structural information, and pose privacy risks when using commercial models. Log data naturally exhibits pronounced structural patterns, and its intrinsic regularities implicitly encode log template information, enabling lightweight LLMs to parse it accurately. In this paper, we propose LLM-LogHGC, a log parsing framework enhanced with hypergraph structures, deployable on lightweight open-source LLMs. Without requiring manually labeled logs for contextual learning or fine-tuning, it leverages the hypergraph structure to capture latent relationships and similarities between logs to assist parsing. Specifically, LLM-LogHGC models each log message as a hyperedge, with the tokens in the message serving as nodes, thereby constructing the log hypergraph. Logs are preliminarily partitioned based on hyperedge connectivity. Subsequently, LLM-LogHGC uses a specially designed Masked Attention Hypergraph Convolutional Network to learn hyperedge embeddings and compute their similarities. Finally, similar log messages are input into the LLM for parsing. We introduce a template cache to reduce LLM queries and a structural verification mechanism to mitigate LLM-induced errors, improving parsing efficiency and accuracy. Comprehensive experiments on public datasets demonstrate that LLM-LogHGC outperforms state-of-the-art methods.	10.1109/TNSM.2026.3743629
Shyam Kumar Shrestha, Shiva Raj Pokhrel, Jonathan Kua	Adapting Large Language Models for TCP Fairness over Wi-Fi	2026	Early Access		Designing Transmission Control Protocol (TCP) Congestion Control Algorithms (CCAs) for heterogeneous Wi-Fi networks remains a challenge due to rapidly varying delay, loss, and contention dynamics. These effects often lead to CCA incompatibility, flow unfairness, and starvation among competing TCP flows. Although Deep Reinforcement Learning (DRL) has shown promise in mitigating these challenges, its slow convergence, high training costs, and limited generalization hinder practical deployments. In this paper, we propose TCP-LLM, a learning-augmented transport framework that leverages Large Language Models (LLMs) for compatibility-aware CCA selection. TCP-LLM encodes multivariate TCP time-series into token embeddings and performs single-step discrete CCA decisions through a lightweight LLM decision head. Parameter-efficient low-rank adaptation (LoRA) reduces the number of trainable parameters by approximately two orders of magnitude. Evaluation using traces collected from a physicalWi-Fi testbed with competing TCP Cubic, Bottleneck Bandwidth and Round-trip propagation time (BBR), and Performance-oriented Congestion Control (PCC) flows shows that TCP-LLM achieves the highest mean, geometric-mean, and minimum per-flow throughput among the evaluated schemes. TCP-LLM also exhibits faster and more stable training convergence and supports low-latency bounded inference. These results demonstrate the feasibility of LLM-based sequence adaptation for compatibility-aware transport-layer supervision under heterogeneous wireless conditions.	10.1109/TNSM.2026.3739364
Tao Zhang	How to select blockchain applications for covert communication	2026	Early Access	Bitcoin Privacy Receivers	With characteristics like decentralization, transparency, anonymity and security, blockchain is an ideal platform for covert communication. How to select suitable blockchain platform is important to achieve secure and efficient covert communication with blockchain in practical scenarios. However, there is no systematical evaluation metrics currently. In the paper, we propose the first evaluation system with 10 key evaluation metrics from identity privacy, information stealthiness, robustness, performance and cost to systematically evaluate blockchain based covert communication schemes. Then different blockchain applications are compared with these metrics, comparative analysis shows that these blockchain applications have both advantages and disadvantages for covert communication. In the future, blockchain applications with improved privacy protection, lower latency and transaction fee can be explored in covert communication scenarios. Our work can lay the foundation and provide guidelines to assess blockchain based covert communication schemes and select blockchain applications suitable for covert communication.	10.1109/TNSM.2026.3742609
Huiqi Zhao, Zhiying Sun, Gang Liu, Fang Fan	PMDC: A Prior Knowledge Constrained Multimodal Method for Encrypted Malicious Traffic Detection Integrating Difficulty Awareness and Confusion Rectification	2026	Early Access	Modeling Payloads Fluid flow	Encrypted network traffic is increasingly exploited for covert malicious activities, complicating detection. Current approaches often rely on black-box models that make limited use of domain knowledge and struggle to distinguish similar malware families, leading to performance degradation under evolving traffic distributions. We propose PMDC, a dual-branch multimodal model for encrypted malicious traffic detection at the bidirectional-flow level. PMDC uses an improved MobileViT branch to capture spatial patterns from the spatialized payload representation with header-derived priors and flow-level statistical knowledge, while a Temporal Convolutional Network (TCN) branch captures fine-grained packet-level temporal patterns and long-range behavioral dependencies. A difficulty-aware global fusion mechanism selects a single pair of branch weights on the validation set by considering classification confidence, uncertainty, and historical stability, and applies the selected weights to all test samples. Additionally, a directed low-rank residual rectification module (CARM) helps separate easily confused malware families while largely preserving the decisions for other classes. Experiments on four benchmark datasets show that PMDC achieves consistently strong accuracy, F1-score, TPR, and FPR compared with representative baselines, and shows non-catastrophic degradation under packet-loss perturbations. On a small self-built power-grid dataset collected from a single attack incident, PMDC correctly identifies all 64 malicious flows with a false positive rate of 0.73%, providing preliminary evidence of binary cross-scenario detection capability under this limited setting.	10.1109/TNSM.2026.3742766
João Gabriel Pazinato De Bittencourt, Fábio Gonçalves De Oliveira, Edson José Pacheco, Carlos Marcelo Pedroso	Packet-Level Causal Certification of Tail-Latency and Reliability Control in O-RAN Slicing	2026	Early Access	Radio access networks Regional area networks Context	An O-RAN slice controller holds two levers, the resource-block budget and the scheduling discipline, and reads an aggregate proxy that can pass a slice dropping packets or overrunning its latency bound. A lever that correlates with a key performance indicator need not control it. We answer, at the packet level, which lever an operator may act on. We evaluate compliance over every generated packet and lower-bound the probability that a lever both achieved compliance and was necessary for it. The bound carries information only when computed within each operating context and then standardized. The other order reduces to the average treatment effect, and the two coincide whenever the lever effect keeps its sign. A zero-sum allocation lever breaks that condition: the budget it grants one slice is taken from another. Over 3,720 runs one lever effect reverses from +0.32 to −0.66 with the neighbour’s load while averaging −0.008, so the pooled bound is zero and the stratified bound 0.156. Two contrasts on that lever, averaging −0.008 and 0.000, certify at 0.156 and at zero, which the pooled average effect cannot separate. The error guarantee covers false declarations of an effect, not the safety of acting on one.	10.1109/TNSM.2026.3740306
Ara Cho, Yeram Kang, Hyesook Lim	A New Flow Table Update Method Using Invertible Bloom Filters in SDN-IoT and SDN-IoV Environments	2026	Early Access		Reducing the communication overhead associated with flow table updates is important for software-defined networking (SDN) in dynamic Internet of Things (IoT) and Internet of Vehicles (IoV) environments, where a large number of flow entries must be installed to accommodate diverse devices and traffic flows. However, the OpenFlow protocol updates resulting in considerable communication overhead between the controller and the switches when a large number of flow entries are added or modified. To address this limitation, we propose an invertible Bloom filter (IBF)-based differential flow table synchronization method that represents the updated flow table as a compact IBF and transmits it to the switch only once. The switch reconstructs the updated flow table by decoding a difference-IBF (d-IBF), which is generated from the received IBF and the IBF constructed from its own local flow table. This differential synchronization mechanism reduces both communication overhead and update latency while preserving correct flow table reconstruction. The comparative analysis shows that the proposed method successfully reconstructs updated flow tables and reduces the communication cost by up to 49.35% compared with the conventional OpenFlow update method when installing 50 flow entries. Decoding experiments show that the proposed method sustains a decoding success rate above 99.9% for flow tables ranging from 1,000 to 1,000,000 entries. Mininet-based evaluations using OpenFlow confirm that the proposed method reduces actual control-channel communication cost in both single-switch and multi-switch environments, achieving reductions of up to 36.1% and 33.3%, respectively. Furthermore, to demonstrate the hardware implementation feasibility of the proposed method, we implement a d-IBF decoding hardware accelerator on an FPGA-based switch platform.	10.1109/TNSM.2026.3743515