TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh	Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices	2026	Early Access	Schedules Scheduling Cloning	Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline.	10.1109/TNSM.2026.3694238
Jing Zhang, Chao Luo, Rui Shao	MTG-GAN: A Masked Temporal Graph Generative Adversarial Network for Cross-Domain System Log Anomaly Detection	2026	Early Access	Anomaly detection Adaptation models Generative adversarial networks	Anomaly detection of system logs is crucial for the service management of large-scale information systems. Nowadays, log anomaly detection faces two main challenges: 1) capturing evolving temporal dependencies between log events to adaptively tackle with emerging anomaly patterns, 2) and maintaining high detection capabilities across varies data distributions. Existing methods rely heavily on domain-specific data features, making it challenging to handle the heterogeneity and temporal dynamics of log data. This limitation restricts the deployment of anomaly detection systems in practical environments. In this article, a novel framework, Masked Temporal Graph Generative Adversarial Network (MTG-GAN), is proposed for both conventional and cross-domain log anomaly detection. The model enhances the detection capability for emerging abnormal patterns in system log data by introducing an adaptive masking mechanism that combines generative adversarial networks with graph contrastive learning. Additionally, MTG-GAN reduces dependency on specific data distribution and improves model generalization by using diffused graph adjacency information deriving from temporal relevance of event sequence, which can be conducive to improve cross-domain detection performance. Experimental results demonstrate that MTG-GAN outperforms existing methods on multiple real-world datasets in both conventional and cross-domain log anomaly detection.	10.1109/TNSM.2026.3654642
Hongyuan Cheng, Lihua Yin, Tianqing Zhu, Hongyu Yang, Dexin Zhu, Weixiang Jiang, Nan Wei	Pattern2Bot: A malicious server IP detection model based on self-trained heterogeneous graph neural network	2026	Early Access	Labeling Modeling Signal detection	Botnets play a key role in network attacks such as Distributed Denial-of-Service (DDoS) attacks, spamming and click fraud. Command & Control server is an important node for botmaster to control bots and distribute attack commands. Bot disguise as normal domain requests through DNS traffic, but leave malicious records in DNS logs containing client IP, query domain, server IP and other complex interactions. This information provides important clues for detecting those botnets. In the current study, researchers detect botnets through multiple perspectives, including abstracting DNS communication records into graphs and using graph neural network models for detection. Conventional approaches often necessitate massive labeled datasets for model training, which substantially incurs training costs. Moreover, despite enriching node embeddings via topological relations, graph models often suffer performance degradation when confronted with structural semantic obfuscation from evasion techniques like double-flux. In order to understand the abstract and complex relationship patterns in DNS records while reducing label usage to lower training costs, we propose a botnet Command & Control server detection model based on DNS traffic. This is a self-training heterogeneous graph neural network model that does not require a large number of labels. By integrating the high-order relational semantics derived from multiple meta-paths with the local topologies of target nodes, the model achieves finer-grained structural awareness and semantic abstraction, thereby enhancing detection performance. We validate the effectiveness of the model in a real dataset, and the results show that the model has a better understanding of the special structure possessed by the IPs of Command & Control servers.	10.1109/TNSM.2026.3741111
Yingjie Hu, Weiping Wang, Shigeng Zhang, Hong Song, Ziheng Huang, Song Guo	Dual-State Representation Learning for Multi-Granularity IoT Device Identification	2026	Early Access	Internet of Things Modeling Training	The rapid growth of IoT devices has increased demand for traffic-based network asset management and security monitoring. Most existing methods operate in closed-set settings and may misclassify unseen devices as known models or return only an unknown label. To address this problem, this paper proposes a multi-granularity IoT device identification method based on dual-state representation learning. Device identity is modeled at three levels: type, manufacturer, and model, retaining type and manufacturer information when the device model cannot be reliably identified. The method extracts statistical, sequence, and raw-byte features and learns sequence and byte embeddings from idle and behavior traffic. Self-supervised learning and contrastive learning are used to improve the discriminative ability of representations. A state-aware gating mechanism then dynamically fuses the dual-state embeddings. Multi-task classification heads and confidence thresholds are used to support joint identification and rejection. Experiments on three public datasets show over 98% accuracy for known-device identification. The method also achieves over 97% accuracy for type and manufacturer prediction on the unknown-model test set and over 95% rejection rate for unknown models. Online deployment achieves an average latency of 3.1 ms and a throughput of 322 samples/s, demonstrating practical potential in open network environments.	10.1109/TNSM.2026.3738728
Chenxin Zhou, Cheng Huang, Qiang Zhang, Qiliang Xie, Zeqing Li	NESTTOR: Detecting Tor-over-Proxy Traffic with Factorized Decisions	2026	Early Access		Tor users can place an encrypted proxy between the client and the Tor network to conceal the exposed entry connection. This additional layer also transforms the Tor byte stream through protocol framing, buffering, and TCP segmentation before an observer sees the outer client-to-proxy flow. The transformation breaks stable packet-to-cell alignment and raises two questions. We ask which Tor behaviors remain observable across different proxies and how a detector should combine the presence of an outer proxy with the presence of Tor traffic. Existing datasets primarily study Tor and proxy traffic as separate targets and provide limited support for answering these questions under a unified evaluation protocol. We propose NESTTOR, which trains a proxy gate and a proxy-conditioned Tor detector separately and combines their decisions with an AND rule. Its stage-based features capture relative connection evolution without reconstructing Tor cells. We construct a longitudinal benchmark of 349,891 bidirectional TCP flows that distinguishes Tor-over-Proxy (ToP), Pure Proxy, Direct Tor, and Ordinary traffic across four proxy protocols, 1,663 domains, and approximately 18 months. NESTTOR achieves 99.45% macro-F1 on confirmatory data from unseen domains and 88.50% on later captures.	10.1109/TNSM.2026.3743261
Shyam Kumar Shrestha, Shiva Raj Pokhrel, Jonathan Kua	Adapting Large Language Models for TCP Fairness over Wi-Fi	2026	Early Access		Designing Transmission Control Protocol (TCP) Congestion Control Algorithms (CCAs) for heterogeneous Wi-Fi networks remains a challenge due to rapidly varying delay, loss, and contention dynamics. These effects often lead to CCA incompatibility, flow unfairness, and starvation among competing TCP flows. Although Deep Reinforcement Learning (DRL) has shown promise in mitigating these challenges, its slow convergence, high training costs, and limited generalization hinder practical deployments. In this paper, we propose TCP-LLM, a learning-augmented transport framework that leverages Large Language Models (LLMs) for compatibility-aware CCA selection. TCP-LLM encodes multivariate TCP time-series into token embeddings and performs single-step discrete CCA decisions through a lightweight LLM decision head. Parameter-efficient low-rank adaptation (LoRA) reduces the number of trainable parameters by approximately two orders of magnitude. Evaluation using traces collected from a physicalWi-Fi testbed with competing TCP Cubic, Bottleneck Bandwidth and Round-trip propagation time (BBR), and Performance-oriented Congestion Control (PCC) flows shows that TCP-LLM achieves the highest mean, geometric-mean, and minimum per-flow throughput among the evaluated schemes. TCP-LLM also exhibits faster and more stable training convergence and supports low-latency bounded inference. These results demonstrate the feasibility of LLM-based sequence adaptation for compatibility-aware transport-layer supervision under heterogeneous wireless conditions.	10.1109/TNSM.2026.3739364
Zheng Gao, Danfeng Sun, Kai Wang, Junjie Hu, Huifeng Wu	Dynamic Protocol and Service Negotiation via Device Dialogue for Resource-Constraint IoT Access	2026	Early Access		The rapid growth of the Internet of Things (IoT) has resulted in highly heterogeneous device environments, where diverse communication protocols and data formats coexist. Existing device access approaches mainly rely on static protocol configurations and predefined data interpretation mechanisms, causing redundant data acquisition and excessive resource consumption on resource-constrained edge nodes. To address these challenges, this paper proposes a Device Dialogue-based Protocol and Service Negotiation (DPSN) framework for resource-efficient IoT device access. DPSN first employs a lightweight dialogue mechanism to determine application-specific service requirements between devices and applications, thereby avoiding unnecessary data acquisition. Based on the negotiated services, a DRL-based adaptation mechanism is developed to dynamically select suitable protocol–interpreter combinations while minimizing edge resource consumption under latency and semantic quality constraints. The adaptation problem is formulated as a discrete decision-making process and solved by a Double Deep Q-Network (DDQN). Furthermore, a dynamic compilation strategy is designed to deploy only the selected protocol and interpreter modules, reducing unnecessary storage overhead at edge nodes. The proposed framework is implemented and evaluated in a mobile communication base station data acquisition scenario involving 1000 edge nodes. Experimental results demonstrate that DPSN satisfies service performance requirements while significantly reducing edge resource consumption compared with representative baseline methods, validating its effectiveness for large-scale and resource-constrained IoT deployments.	10.1109/TNSM.2026.3741850
Amr Aboeleneen, Mohamed Abdallah, Aiman Erbad, Amr Mohamed	ZTCI: Zero-Touch Cooperative Immersion, a Plug-and-Deploy Deep Reinforcement Learning-Based Framework for Resource Allocation and Cooperation in the Metaverse	2026	Early Access	Resource management Modeling Metaverse	The Metaverse requires edge providers, termed Metaverse Service Stations (MSSs), to provision high-quality virtual environments (VEs) and faithful digital twins (DTs) for heterogeneous virtual venues under tight compute and network budgets. In multi-MSS deployments, localized demand surges can overwhelm one station while neighboring stations remain underutilized. Cooperation is therefore essential but challenging because venue requirements are heterogeneous, demand is bursty, and proximity-based neighborhood sets change over time. These dynamics motivate zero-touch operation that requires neither retraining nor reconfiguration at deployment. We introduce the General Optimized Agent (GOA), a plug-and- deploy Deep Reinforcement Learning (DRL) agent that jointly optimizes per-venue VE/DT service levels and inter- MSS resource sharing. GOA is trained through staged curriculum learning and uses a position-aware set encoder with learned positional embeddings and attention-based pooling to map variable-size neighbor sets to fixed-dimensional representations. This design yields a single policy that generalizes across MSS types, budget levels, and dynamic team sizes. Extensive evaluation shows that GOA improves request satisfaction, load balancing, and cost efficiency over representative baselines, supporting scalable, zero-touch Metaverse cooperation under realistic infrastructure constraints.	10.1109/TNSM.2026.3737187
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Mohammad Khosravi, Setareh Maghsudi	A Robust Optimization Approach for Regenerator Placement in Fault-Tolerant Networks Under Discrete Cost Uncertainty	2026	Early Access	IP networks Costing Costs	We focus on robust, survivable communication networks, where network links and nodes are affected by an uncertainty set. In this sense, any network links might fail. Besides, a signal can only travel a maximum distance before its quality falls below a certain threshold, necessitating its regeneration by regenerators installed at network nodes. In addition, the price of installing and maintaining regenerators belongs to a discrete uncertainty set. Robust optimization seeks a solution with guaranteed performance against all scenarios modeled in an uncertainty set. Thus, the problem is to find a subset of nodes with minimum cost for the placement of the regenerator, ensuring that all nodes can communicate even if a subset of network links fails. To solve the problem optimally, we propose two solution approaches, including one flow-based and one cut-based integer programming formulation, as well as their iterative exact method. Our theoretical and experimental results show the effectiveness of our methods.	10.1109/TNSM.2026.3740028
Mubashir Murshed, Glaucio H. S. Carvalho, Robson E. De Grande	Holistic Intelligent Traffic Steering Management in Multi-RAT Vehicular Networks	2026	Early Access	Radio access technologies Rats Vehicles	Multiple Radio Access Technology (multi-RAT) environments provide a promising foundation for service-aware communication in intelligent transportation systems (ITS) and smart cities. However, traffic steering (TS) in highly mobile and ultra-dense vehicular networks remains challenging due to dynamic network conditions, heterogeneous RAT capabilities, varying vehicle requirements, packet loss, latency, and frequent ping-pong RAT switching. In this context, we propose Holistic Intelligent Traffic Steering (HITS), a proactive bi-level TS management framework for multi-RAT vehicular networks. HITS integrates centralized network-wide guidance with local vehicleside decision-making. At the central level, a Graph Convolutional Network–Long Short-Term Memory (GCN–LSTM) model captures holistic spatio-temporal network dynamics and evaluates RAT optimality. At the local level, a State-Action-Reward- State-Action (SARSA) reinforcement learning agent performs adaptive, vehicle-specific RAT selection using local observations and central-level optimality guidance. Results show that HITS achieves up to 6.5% higher average throughput, reduces packet loss ratio by more than 30.2%, lowers latency by nearly 12.2%, and reduces the ping-pong RAT switching rate by over 24% compared with baseline and state-of-the-art (SoTA) TS approaches.	10.1109/TNSM.2026.3729840
Franck Messaoudi, Luhan Wang, Abdelkader Mekrache, Adlen Ksentini, Bingxuan Li, Jialei Su, Sofiane Messaoudi, Salim El Ghalbzouri	The Brewing Storm in 5G’s Data Plane: Design and Evaluation of a High-Performance eBPF/XDP-Based User Plane Function	2026	Early Access	Quality of service Fluid flow Kernel	This paper presents the design and implementation of a novel 5G UPF leveraging eBPF technology to meet the stringent performance and programmability requirements of emerging 6G systems. Traditional UPF implementations often struggle to balance performance, flexibility, and resource efficiency-challenges particularly critical in CPU- and I/O-constrained edge environments. The proposed eBPF-based UPF architecture mitigates these limitations by embedding core functionalities, such as packet classification, forwarding, and QoS enforcement, directly within the Linux kernel via eBPF programs attached through XDP and tc hook points. Performance evaluation using TRex demonstrates that the proposed solution achieves competitive throughput, low packet loss, and efficient CPU utilization across traffic profiles. Moreover, it maintains full compliance with 5G Core Network standards. Comparative analysis with well-established open-source UPF implementations further underscores its advantages. This work highlights the potential of eBPF as a foundational technology for building next-generation, programmable UPFs optimized for edge cloud deployments in the 6G era.	10.1109/TNSM.2026.3720812
Haotian Lu, Yuning Dong, Guanming Lu, Pingping Tang, Jiong Jin	Federated Unknown Traffic Detection with Enhanced Contrastive Pre-training and Prototyping	2026	Early Access	Modeling Training Federated learning	With the increasing demand for privacy and distributed data compliance, federated learning (FL) has become a promising paradigm for collaborative network traffic classification (NTC) without sharing raw traffic data. However, real-world network environments are inherently open, where the emergence of new applications and unknown attacks introduces open-set challenges. To ensure service quality and network security, models need not only to classify known traffic classes accurately but also to identify unknown ones. Despite recent efforts to extend FL to Open-Set NTC (OSNTC), most current FL methods are still confined to the closed-set assumption, leaving the challenge of Federated OSNTC (FedOSNTC) largely unresolved. Therefore, this paper proposes FedUTD, a novel Federated Unknown Traffic Detection framework that introduces: (1) multi-scale prefix truncation, a customized contrastive learning strategy that leverages multi-granularity traffic characteristics to enhance feature discriminability; (2) an improved federated communication mechanism that enriches the transmitted information through pseudo-sample generation to mitigate data heterogeneity while retaining substantially lower communication cost; (3) a lightweight dual-layer OSNTC approach designed to reduce local training and inference overhead during local unknown-traffic detection. Extensive experiments on four real-world network traffic datasets demonstrate that FedUTD consistently outperforms existing methods, achieving an F1 gain of 5–21%.	10.1109/TNSM.2026.3739767
Yonglin Huang, Ping Du, Xixuan Zhou, Mingji Dong, Jiayu Zhou, Yu Cen, Min Shi, Hongbo Li, Xiaoliang Chen, Zuqing Zhu	Two-Tier Cooperative Routing Leveraging GSL Diversity for Large-Scale LEO Satellite Networks	2026	Early Access	Satellites Routing Low earth orbit satellites	Nowadays, the fast development of large-scale low Earth orbit (LEO) satellite networks has been pushing for highly-efficient routing schemes that can realize quality-of-service (QoS) aware routing adaptively. However, the dynamic nature of LEO satellite networks and the capacity mismatch between their inter-satellite links (ISLs) and ground-satellite links (GSLs) make QoS-aware routing very challenging. In this work, we propose a two-tier cooperative routing framework (namely, 2T-CoR) to leverage GSL diversity and deflection routing for effectively relieving congestion, thereby improving QoS parameters such as packet loss rate and end-to-end (E2E) latency. We first develop a time-sliced model to utilize the orbital periodicity of LEO satellite networks for accelerating their routing calculations. Then, a two-tier cooperative routing algorithm is designed to seamlessly synergize orbital periodicity with GSL-state awareness to efficiently reduce congestion as well as improving GSL utilization. Extensive simulations with a constellation of 3; 840 LEO satellites verify the effectiveness of our proposal over the state-of-the-arts.	10.1109/TNSM.2026.3740700
Yifan Zeng, Zihui Gu, Peijia Zheng, Huiyu Zhou	A Federated Semi-Supervised Framework for Data Efficiency and Privacy-Preserving Intrusion Detection in Internet of Things	2026	Early Access	Internet of Things Modeling Labeling	The Internet of Things (IoT) forms the foundation of modern smart environments, enabling intelligent industries, homes, cities, healthcare, and autonomous systems. However, as IoT devices increasingly connect to cloud platforms and the Internet, they become highly vulnerable to network intrusions that can lead to critical data breaches and service disruptions. This paper proposes a Contrastive Federated Semi-Supervised Learning Network Intrusion Detection framework (CFedSSL-NID), specifically tailored to enhance the security of IoT communications. It addresses practical scenarios where clients lack labeled data and computational resources, and where data privacy is paramount. The CFedSSL-NID framework enhances detection performance and robustness. It uniquely achieves this by synergistically leveraging abundant, unlabeled data from distributed IoT gateways through self-supervised contrastive learning, while optimally integrating supervised signals from a central server. This dual approach enables highly accurate intrusion detection while substantially mitigating the reliance on scarce and costly labeled data. Experiments on the TON-IoT, UNSW-NB15, and NSL-KDD datasets show that CFedSSL-NID outperforms federated and centralized baselines; additional evaluations under Non-IID data, asynchronous participation, and malicious-client updates confirm robustness, while communication and edge-inference analyses indicate its deployment feasibility.	10.1109/TNSM.2026.3742261
Ahmed Métwalli, Moustafa H. Aly, Heba A. Fayed, Waleed K. Badawi	MITO: Physics-Gated Multi-Domain Digital-Twin Orchestration for 6G Network and Service Management	2026	Early Access	Modeling Management Joining processes	Heterogeneous sixth-generation (6G) services can fail through coupled degradation across radio access, photonic fronthaul, free-space optical backhaul, and the service-monitoring plane. These domains are commonly optimized independently by existing artificial-intelligence controllers, for which limited support is provided for safe closed-loop service management. Multi-domain Intelligent Twin Orchestration (MITO) is presented as a trace-driven, physics-gated network digital twin for cross-domain service assurance. Four domain-evidence sources totaling 41,554 records are synchronized; 15 scheduled agent tasks are executed through a safety-gated directed acyclic graph; time-varying cross-domain coupling is learned; contradictory evidence is robustly fused; and service-level recovery actions are calibrated. The evaluated trace-driven synchronization/update path requires 0.289 ms on average (p95: 0.347 ms), while the one-time validation threshold calibration requires 41.93 ms and the online FUSE/FALLBACK/BLOCK threshold decision requires approximately 0.0003 ms (0.3 μs). Under three-step telemetry delay and structured missingness, reference-aligned state consistency is reduced to 0.950 and 0.983, with action agreement of 0.915 and 0.971. Through validation-only service-specific policy calibration, a macro-F1 of 0.514 and balanced accuracy of 0.538 are obtained while FUSE, FALLBACK, and BLOCK are all produced on held-out data. On the measured 15-task DAG, a p95 makespan of 224.2 ms is achieved by the best safety-preserving scheduler, whereas lower latency under unconstrained full parallelism is accompanied by an unsafe-action rate of 1.0. Coupling recovery, ablations, attacks, and distribution shifts are also evaluated.	10.1109/TNSM.2026.3741431
Mohammad Saberi, Ali Ahmadi Esfidi, Mahdi Dolati, Naeimeh Omidvar	FlexINA: In-Network Aggregation for Accelerating Distributed Machine Learning with Flexible Routing	2026	Early Access	Modeling Switches Timing	The growing scale and complexity of modern machine learning (ML) models have rendered distributed training indispensable. However, as model dimensions expand, communication overhead increasingly dominates the overall training time, creating a critical performance bottleneck. While techniques such as gradient compression offer partial relief, they often incur substantial computational overhead or require specialized hardware. In-network aggregation (INA) has emerged as a compelling alternative, offloading partial computations—such as gradient reduction—directly onto programmable network switches. Yet, current INA frameworks predominantly rely on rigid, static routing schemes or uncoordinated, opportunistic aggregation, fundamentally limiting their capacity to exploit the full potential of programmable data planes. To address this limitation, we formulate the Joint Scheduling-Routing for In-Network Aggregation (JINA) problem. JINA introduces a time-slotted execution model to enable fine-grained temporal scheduling synchronously with spatial routing. By leveraging source routing, it dictates perpacket forwarding paths while explicitly coordinating multi-hop partial aggregation across the network. Furthermore, we propose FlexINA, a scalable optimization framework that solves the JINA problem through a three-phase dimensionality reduction strategy: host-level pre-aggregation, topological switch filtration, and temporal window partitioning. Extensive evaluations across fifteen diverse network topologies demonstrate that FlexINA reduces the total network load by up to 8.3% compared to INA baselines, while maintaining high computational efficiency.	10.1109/TNSM.2026.3740503
Tao Zhang	How to select blockchain applications for covert communication	2026	Early Access	Bitcoin Privacy Receivers	With characteristics like decentralization, transparency, anonymity and security, blockchain is an ideal platform for covert communication. How to select suitable blockchain platform is important to achieve secure and efficient covert communication with blockchain in practical scenarios. However, there is no systematical evaluation metrics currently. In the paper, we propose the first evaluation system with 10 key evaluation metrics from identity privacy, information stealthiness, robustness, performance and cost to systematically evaluate blockchain based covert communication schemes. Then different blockchain applications are compared with these metrics, comparative analysis shows that these blockchain applications have both advantages and disadvantages for covert communication. In the future, blockchain applications with improved privacy protection, lower latency and transaction fee can be explored in covert communication scenarios. Our work can lay the foundation and provide guidelines to assess blockchain based covert communication schemes and select blockchain applications suitable for covert communication.	10.1109/TNSM.2026.3742609
Huiqi Zhao, Zhiying Sun, Gang Liu, Fang Fan	PMDC: A Prior Knowledge Constrained Multimodal Method for Encrypted Malicious Traffic Detection Integrating Difficulty Awareness and Confusion Rectification	2026	Early Access	Modeling Payloads Fluid flow	Encrypted network traffic is increasingly exploited for covert malicious activities, complicating detection. Current approaches often rely on black-box models that make limited use of domain knowledge and struggle to distinguish similar malware families, leading to performance degradation under evolving traffic distributions. We propose PMDC, a dual-branch multimodal model for encrypted malicious traffic detection at the bidirectional-flow level. PMDC uses an improved MobileViT branch to capture spatial patterns from the spatialized payload representation with header-derived priors and flow-level statistical knowledge, while a Temporal Convolutional Network (TCN) branch captures fine-grained packet-level temporal patterns and long-range behavioral dependencies. A difficulty-aware global fusion mechanism selects a single pair of branch weights on the validation set by considering classification confidence, uncertainty, and historical stability, and applies the selected weights to all test samples. Additionally, a directed low-rank residual rectification module (CARM) helps separate easily confused malware families while largely preserving the decisions for other classes. Experiments on four benchmark datasets show that PMDC achieves consistently strong accuracy, F1-score, TPR, and FPR compared with representative baselines, and shows non-catastrophic degradation under packet-loss perturbations. On a small self-built power-grid dataset collected from a single attack incident, PMDC correctly identifies all 64 malicious flows with a false positive rate of 0.73%, providing preliminary evidence of binary cross-scenario detection capability under this limited setting.	10.1109/TNSM.2026.3742766
Chengsheng Pan, Yingzhi Wang, Huaifeng Shi, Lishang Qin, Xiaosong Cui	DBSDD-AQM: Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management for Edge IoT Networks	2026	Early Access	Delays Satellite broadcasting Internet of Things	Bursty heterogeneous traffic can build persistent queues at edge IoT gateways when the offered load converges on a lower-rate bottleneck. Conventional active queue management (AQM) regulates packet dropping under a fixed buffer capacity, whereas adaptive buffer sizing alone does not coordinate capacity adjustment with queue-removal control. We propose Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management (DBSDD-AQM), which combines a bounded buffersizing loop with a faster continuous queue-removal controller. DBS adjusts the admissible capacity according to sustained queue evolution, while the DDPG Actor selects packet-granular removal actions for the resident backlog. A class-aware extension maps three concurrent service classes to logical FIFO queues sharing the same dynamic physical buffer. DBSDD-AQM is implemented using an NS3-PyTorch framework. Aggregate experiments compare it with RED, ARED, PIE, CoDel, and DQN-AQM, while the class-aware evaluation additionally includes FQ-CoDel and FQ-PIE. Matched-DBS comparisons show similar throughput but different delay–loss operating points among the aggregate controllers, and component ablation distinguishes the effects of capacity adaptation and learned queue removal. Relative to a fixed 50 KB buffer, DBS reduces average queueing delay by 16.23% for UDP and 17.70% for TCP Westwood in controlled transport experiments. In the evaluated three-class overload scenarios, all classes retain nonzero throughput. Class-aware DBSDD-AQM provides stronger D- and T-class differentiation, whereas FQ-CoDel and FQ-PIE produce more uniform class-level outcomes and stronger R-class performance. The measured 95th-percentile batch-one Actor inference latency is 0.109 ms on the reported x86-64 platform.	10.1109/TNSM.2026.3741334