TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Ramazan Enisoglu, Burak Alp Inan, Muhammed Ali Erbir	MSCANet: A Multi-Scale Channel Attention Network for Encrypted Traffic Classification	2026	Early Access	Modeling Transformers Convolutional neural networks	Encrypted communication has rendered traditional traffic classification ineffective, creating challenges for QoS provisioning, network management, and security monitoring. Existing deep learning approaches exploit either spatial or sequence-level features in isolation, without jointly modeling multi-scale byte patterns and inter-packet ordering. We propose MSCANet, a hybrid architecture integrating a multi-scale 1D convolutional module, a sequentially applied Efficient Channel Attention (ECA) module, and a Transformer encoder, combining the two feature streams through a learnable weighted concatenation. With approximately 1.18M parameters, MSCANet attains 95.14% mean accuracy on the 20-class USTC-TFC2016 dataset and 92.61–98.01% across three 10-class sub-tasks over five random seeds, at a median per-sample inference latency of 1.29 ms on an NVIDIA RTX 5090 Laptop GPU. Against five baselines re-trained under an identical pipeline and schedule, spanning classical machine learning, CNN-only, attention-BiLSTM, and hybrid CNN–Transformer families, MSCANet is the most accurate on all four sub-tasks, improving over the strongest classical baseline by 6.16 pp and over the closest neural baseline by 2.38 pp while using 17.5% of its parameters and running 3.1× faster. These gains are demonstrated against the five re-trained baselines. Pretrained Transformers such as ET-BERT and YaTC report higher accuracy in their original publications, under their own preprocessing and with a pretraining stage that MSCANet does not use; the advantages we expect relative to them (no pretraining stage and, against ET-BERT, a model two orders of magnitude smaller) were not measured under our protocol, and we position MSCANet within the train-from-scratch regime.	10.1109/TNSM.2026.3748386
Francesco Pizzato, Daniele Bringhenti, Fulvio Valenza	Parallelizing Automated Firewall Configuration via Traffic-Aware Decomposition	2026	Early Access	Firewalls (computing) Fluid flow Merging	Automating the configuration of distributed firewalls by refining high-level security requirements is a well-established approach to improve correctness and manageability in modern computer networks. However, existing solutions formulate this task as a single monolithic constraint-solving problem, whose scalability suffers as network size and policy complexity increase. To overcome this limitation, this paper proposes a traffic-aware decomposition approach for the automated, parallel configuration of distributed firewalls. The method decomposes the global refinement problem into cluster-scoped subproblems using a flow-weighted network representation and solves them concurrently before merging the results into a single deployable configuration. The approach is implemented on top of a constraint-based framework and evaluated on representative topologies. The results show substantial runtime reductions, with gains increasing with problem size and reaching up to ∼98% on larger instances, while maintaining satisfactory optimization quality. Moreover, the approach enables the resolution of firewall configuration problems beyond the limits of monolithic formulations.	10.1109/TNSM.2026.3747990
Ting-Yu Chang, Cooper Cheng-Yuan Ku	Two-tier Framework with AutoML for Detection and Classification of Multiple Types of Anomalies in Intrusion Attacks	2026	Early Access	Modeling Optimization Probability	Ensuring cybersecurity is paramount for protecting sensitive data and defending against increasingly sophisticated cyberattacks. Consequently, intrusion detection (ID) has become a critical area of research in network security. This paper proposes a two-tier framework that leverages efficient automated machine learning (AutoML) techniques to address data imbalance and optimize feature combinations for ID and classification of multiple types of anomalies. In the first tier, two complementary models are selected: a primary model optimized for overall dataset performance and a secondary model specifically chosen for its effectiveness on balanced data distributions. In the second tier, a probability stacking approach, supported by Out-of-Fold (OOF) cross-validation, integrates insights from the first-tier models. It acts as a binary safety net that successfully recovers rare minority attacks while preventing irreversible information loss. The proposed framework effectively mitigates the adverse effects of data imbalance while requiring only a minimal runtime memory footprint of approximately 44 MB (NSL-KDD) and a total process footprint of 165.52 MB (CIC-IIoT-2025), and achieves a rapid cold-start initialization of 0.85 seconds. These advantages make it well-suited for edge computing. Experimental results on the NSL-KDD dataset demonstrate that the proposed approach achieves an overall accuracy of 99.73%, outperforming many state-of-the-art methods by 0.4-20.6%. Furthermore, evaluations on the CIC-IDS-2017 dataset show a 6.3% accuracy improvement and a significant 36% increase in macro-average recall compared with a random-forest-only (RF-only) model. Moreover, extensive validation on the contemporary CIC-IIoT-2025 dataset reveals a significant 4.20% improvement in Macro F1-score over up-to-date baselines. Finally, evaluations on an independent set with novel attack types (KDDTest+) confirm strong generalization capability, achieving 77.10% accuracy and underscoring the framework's robustness in modern industrial scenarios.	10.1109/TNSM.2026.3747311
Muhammad Faizan Ayub, Xiong Li, Khalid Mahmood, Muhammad Asad Saleem, Salman Shamshad, Zahid Ghaffar, Yong Xie	A Lightweight and Secure Key Exchange Protocol for fortifying Home Area Network in Smart Grid	2026	Early Access	Protocols Smart grids Authentication	Smart grid networks rely on communication links to support monitoring and control of energy usage. Because these links are open, especially in Home Area Networks (HAN), security problems can occur. Devices may be physically captured, attackers may impersonate legitimate nodes, and temporary secret values may be exposed. Several key exchange protocols have been proposed to address these concerns. In practice, some of them still suffer from security weaknesses, while others introduce high communication and computation costs. In this work, we present a key exchange approach for HAN in smart grid systems based on Elliptic Curve Cryptography (ECC) and Physical Unclonable Functions (PUF). The protocol is analyzed using the Random-or-Real (RoR) model, along with an informal security discussion. Different attack scenarios, including impersonation, disclosure of stored meter data after capture, and ephemeral secret leakage, are considered. We also compare the proposed protocol with existing protocols and based on the comparison results, the proposed protocol shows a reduction of 3.843% in computational cost and 29.49% in communication cost.	10.1109/TNSM.2026.3746724
Yakai Dai, Jia Chen, Xu Huang, Rui Dong, Tao Fu	VISTA: Verified Belief-Centric LLM Agents for Safe Network Management	2026	Early Access	Safety Writing Modeling	Large language model (LLM) agents now commit changes in production network management, where one change can touch routing-protocol state or a Kubernetes NetworkPolicy. The prevailing pipeline emits the change as a single text answer, so the network state, the competing root-cause hypotheses, and the operational invariants travel through the same token stream as the answer—a design that is unsafe on the NetArena dynamic benchmark: on capacity planning, the strongest supervised and retrieval-augmented baselines reach near-perfect correctness while leaving 41% of executed actions unsafe. VISTA gives each hidden quantity a persistent owner: it maintains a typed belief graph over topology and configuration, reasons over an explicit hypothesis trace, and routes every candidate write through a counterfactual verifier that emits a typed proof object, whose structured failure reasons re-enter the next round. On a shared Qwen2.5-Coder-7B backbone and NetArena’s official scorer, no single prompting strategy is safe across capacity planning’s ten query classes. Under π=WITHHOLD (proof failure blocks the write), VISTA reaches safety 1.000 at commit 0.869. Under π=FLAG (proof failure annotates but proceeds), it attains the per-class maximum on all ten classes, lifting safety from the 0.709 per-class oracle envelope to 0.869 at correctness 0.992, commit 1.000, and zero refusals, with a paired query-level margin of 153–0. An ablation attributes the gain: the gate itself does not move the safety rate, which is set by feeding belief and hypothesis structure back into generation, while the gate contributes a commit-time certificate agreeing with the official scorer on 869/869 admitted writes and a rejection whose structure decides repairability (60/86 versus 0/86), at ≈13× latency (3.520 s). On routing and Kubernetes the same workflow trades ≈70% refusal for high safety and is diagnostic, not deployable. Our implementation is released at https://github.com/dai-yakai/VISTA.	10.1109/TNSM.2026.3745152
Ahlem Menaceur, Hamza Drid, Mohamed Rahouti, Yasmine Medjadba, Abdellah Chehri	Priority-Aware Dual-Queue Buffering for Reactive SDN Fault Management with Reduced Loss	2026	Early Access	Software defined networking Joining processes Loading	Software-Defined Networking (SDN) provides controller-driven flexibility for network and service management, yet reactive failure recovery often suffers from a recovery gap between fault detection and the installation of updated forwarding rules. Packets arriving during this interval are vulnerable to loss, while rerouted flows may overload specific links, undermining service continuity. To address these challenges, this paper proposes a dual-priority, queue-assisted reactive recovery mechanism that integrates traffic classification and buffering at the data plane. The design assigns flows to a high-priority queue (HPQ) or a low-priority queue (LPQ), ensuring that critical traffic is preserved while the controller completes rerouting. Evaluation on a 9-switch custom topology and the 16-node NSFNET backbone demonstrates that the proposed approach reduces packet loss (from 10.3% to 5.4% in the 9-switch topology and to below 1.9% in NSFNET) and improves post-failure load distribution, decreasing congested and surcharged links by 37.6% and 20.6%, respectively, compared to conventional reactive recovery. These results highlight that priority-aware buffering during the recovery gap enhances resilience, scalability, and operational efficiency for SDN fault and service management.	10.1109/TNSM.2026.3744288
Aymen Daoud, Md. Zoheb Hassan, Georges Kaddoum	SpectraTwin: Generative Intelligence-Powered Digital Twin for Dynamic Spectrum Awareness	2026	Early Access	Modeling Radio frequency Labeling	Spectrum monitoring and classification under evolving RF spectrum landscapes are key enablers of spectrum awareness for dynamic spectrum management and interference detection in 6G networks. Although artificial intelligence (AI) and machine learning (ML) techniques have shown promising performance in spectrum classification, most existing models are static, non-generative, and optimized for specific training environments. As a result, channel distribution shifts, model brittleness, and the scarcity of labeled RF data for fine-tuning AI/ML models lead to significant performance degradation in evolving RF spectrum landscapes. In this context, digital twin (DT) provides a promising approach by maintaining a virtual representation of the RF spectrum environment that supports what-if analysis, data generation, and iterative model updates. In this paper, we propose SpectraTwin, a multi-AI-enabled, adaptive, and self-evolving DT framework for multi-timescale spectrum classification under evolving RF spectrum states and incrementally increasing task complexity. SpectraTwin integrates three tightly coupled modules: (i) a Dynamic Mask Generative Adversarial Network (GAN) that serves as the virtual replica of the RF spectrum environment, synthesizing realistic, classand channel-conditioned spectrograms on demand to mitigate RF data scarcity; (ii) a continual learning-based spectrum classification model that incrementally adapts to evolving RF environments while preserving prior knowledge; and (iii) an active-learning-inspired orchestration module that decides when to adapt, which classes to synthesize, and which exemplars to retain, so that model updates are performed in response to detected change rather than on a fixed retraining schedule. By jointly combining generative, continual, and active learning, SpectraTwin enables robust spectrum awareness through (a) faithful emulation of RF spectrum evolution, (b) detection of domain distribution shifts, and (c) efficient incremental adaptation under non-stationary conditions while maintaining a favorable balance between accuracy and forgetting. Simulation results on both custom dynamic RF datasets and multiple benchmark datasets (consisting of simulated and real-world signal captures) show that SpectraTwin achieves superior adaptability and classification performance compared with existing approaches.	10.1109/TNSM.2026.3743810
Qing Qian, Longwen Ran, Ruixue Tang, Huan Wang, Hongfa Ding, Yunhe Cui	SATEEN: A Heterogeneous Graph Neural Network for Saturation Attack Detection in SDN	2026	Early Access	Fluid flow Switches Modeling	SDN decouples the control plane from the data plane, enabling flexible network management. However, it is increasingly threatened by saturation attacks that target both switch flow tables and controller resources. Existing attack detection methods often focus on individual flows or network topology alone, neglecting the inherent interdependencies among flows and devices. This limitation can result in incomplete information aggregation and suboptimal detection performance. To address these challenges, we propose SATEEN, a GNN-based saturation attack detection method that leverages a heterogeneous Device-Flow Graph and a novel heterogeneous convolution model, HEGNN. The DevFlow-Graph explicitly models interactions among hosts, flows, and switches, incorporating multiple types of edges to capture structural and semantic relationships. HEGNN partitions the DevFlow-Graph into edge-type-specific subgraphs, computes attention-weighted aggregations within each subgraph, and integrates multi-layer information to generate expressive node embeddings for accurate attack classification. Experiments conducted on both FatTree and Agis topologies, using real-world background traffic, demonstrate that SATEEN significantly outperforms existing methods in detection accuracy and stability across different topologies and traffic patterns.	10.1109/TNSM.2026.3745553
Huiqi Zhao, Zhiying Sun, Gang Liu, Fang Fan	PMDC: A Prior Knowledge Constrained Multimodal Method for Encrypted Malicious Traffic Detection Integrating Difficulty Awareness and Confusion Rectification	2026	Early Access	Modeling Payloads Fluid flow	Encrypted network traffic is increasingly exploited for covert malicious activities, complicating detection. Current approaches often rely on black-box models that make limited use of domain knowledge and struggle to distinguish similar malware families, leading to performance degradation under evolving traffic distributions. We propose PMDC, a dual-branch multimodal model for encrypted malicious traffic detection at the bidirectional-flow level. PMDC uses an improved MobileViT branch to capture spatial patterns from the spatialized payload representation with header-derived priors and flow-level statistical knowledge, while a Temporal Convolutional Network (TCN) branch captures fine-grained packet-level temporal patterns and long-range behavioral dependencies. A difficulty-aware global fusion mechanism selects a single pair of branch weights on the validation set by considering classification confidence, uncertainty, and historical stability, and applies the selected weights to all test samples. Additionally, a directed low-rank residual rectification module (CARM) helps separate easily confused malware families while largely preserving the decisions for other classes. Experiments on four benchmark datasets show that PMDC achieves consistently strong accuracy, F1-score, TPR, and FPR compared with representative baselines, and shows non-catastrophic degradation under packet-loss perturbations. On a small self-built power-grid dataset collected from a single attack incident, PMDC correctly identifies all 64 malicious flows with a false positive rate of 0.73%, providing preliminary evidence of binary cross-scenario detection capability under this limited setting.	10.1109/TNSM.2026.3742766
Aleksandar Avdalović, Joseph Khoury, Ibrahem AlJabea, Mustafa Hajij, Elias Bou-Harb	Beyond Flat Models: Preserving ICS Topology using Combinatorial Complexes for Hierarchy-Aware Intrusion Detection	2026	Early Access	Modeling Cells (biology) Integrated circuits	Industrial Control Systems (ICS) follow the Purdue model hierarchy, organizing sensors, actuators, Programmable Logic Controllers (PLCs), and supervisory control into distinct hierarchical layers. Despite this inherent structure, existing data-driven intrusion detectors still fail to model this intricate property. To address this gap, we introduce a Hierarchy-Aware Intrusion Detector, HAID, a topology-preserving framework that models an ICS as a Combinatorial Complex (CC), operating solely on process telemetry and trained on benign traces to detect falsified sensor measurements and unauthorized actuator commands. The complex captures devices, functional interactions, and PLC control zones within an ICS. CCs (unlike flat models) encode telemetry across hierarchical levels for training a Topological Neural Network (TNN). As such, HAID enables the embedding of the ICS Purdue model into the learning process, yielding anomaly scores and localization at each of the aforementioned levels. Evaluated on two water testbeds, SWaT and WADI, and on a simulated chemical process, TEP, HAID achieves competitive detection performance (82.7% F1 on SWaT and 50.1% on WADI, averaged over five runs), while providing explicit hierarchical localization unavailable in prior work. Through ablations, we confirm the added-value of hierarchical modeling, as removing the PLC-zone representation reduces F1 by 5.8 percentage points on SWaT and causes detection on WADI to collapse. The largest losses are on attacks that manipulate several devices at once, which device- and interactionlevel signals usually miss.	10.1109/TNSM.2026.3746967
Mohammad Saberi, Ali Ahmadi Esfidi, Mahdi Dolati, Naeimeh Omidvar	FlexINA: In-Network Aggregation for Accelerating Distributed Machine Learning with Flexible Routing	2026	Early Access	Modeling Switches Timing	The growing scale and complexity of modern machine learning (ML) models have rendered distributed training indispensable. However, as model dimensions expand, communication overhead increasingly dominates the overall training time, creating a critical performance bottleneck. While techniques such as gradient compression offer partial relief, they often incur substantial computational overhead or require specialized hardware. In-network aggregation (INA) has emerged as a compelling alternative, offloading partial computations—such as gradient reduction—directly onto programmable network switches. Yet, current INA frameworks predominantly rely on rigid, static routing schemes or uncoordinated, opportunistic aggregation, fundamentally limiting their capacity to exploit the full potential of programmable data planes. To address this limitation, we formulate the Joint Scheduling-Routing for In-Network Aggregation (JINA) problem. JINA introduces a time-slotted execution model to enable fine-grained temporal scheduling synchronously with spatial routing. By leveraging source routing, it dictates perpacket forwarding paths while explicitly coordinating multi-hop partial aggregation across the network. Furthermore, we propose FlexINA, a scalable optimization framework that solves the JINA problem through a three-phase dimensionality reduction strategy: host-level pre-aggregation, topological switch filtration, and temporal window partitioning. Extensive evaluations across fifteen diverse network topologies demonstrate that FlexINA reduces the total network load by up to 8.3% compared to INA baselines, while maintaining high computational efficiency.	10.1109/TNSM.2026.3740503
Yule Han, Kezhi Wang, Yizhe Zhao, Kun Yang	Smart-TCP: An Agentic AI-based Autonomous and Adaptive TCP Protocol	2026	Early Access	Modeling Protocols TCP	The Transmission Control Protocol (TCP) relies on deterministic state machines and sequence-number arithmetic to ensure reliable communication. However, hard-coded protocol logic is difficult to adapt to increasingly complex and dynamic network conditions. This paper proposes Smart-TCP, an agentic AI-based transport protocol framework that organizes TCP control logic as a fast/slow model-assisted decision process. Specifically, a feature-aware classifier routes routine segments to a lightweight Small Language Model (SLM) fast path and anomalous or boundary cases to a Large Language Model (LLM) slow path, while an Arithmetic Logic Unit (ALU) handles deterministic computation of sequence and acknowledgment numbers. A state module maintains connection state, packet history, and key control variables, enabling protocol decisions over the full session context. A scoped Protocol Guard checks candidate decisions against RFC-derived rules before execution. We evaluate Smart-TCP through path classification, atomic packet processing, slow-path anomaly response, and end-to-end session interaction. Experimental results show that Smart-TCP achieves 99.14% action accuracy on 700 slow-path anomaly and fallback samples, and a 100% full-lifecycle success rate over 300 ideal fast-path end-to-end session windows. The ordinary 32-KiB transfer tests achieve a 96.5% completion rate at 20% segment loss. These results suggest that separating model-based protocol decisions from deterministic arithmetic improves the reliability of TCP control for network service operation.	10.1109/TNSM.2026.3747846
Byungchang Kim, Shinyoung Lue, Seonyeong Hwang, Youhee Park, Yeji Lee, Jaemin Jeong, Peter Bloodsworth, Euiseok Hwang	GRIDS: Generalized Representation-based Intrusion Detection System via Federated Contrastive Learning	2026	Early Access	Modeling Labeling Intrusion detection	Existing AI-based intrusion detection systems are typically trained for specific network environments, leading to significant performance degradation when deployed in different settings or exposed to evolving attack strategies. We propose GRIDS (Generalized Representation-based Intrusion Detection System), a federated contrastive learning framework for cross-environment intrusion detection that keeps raw traffic data local. GRIDS employs a Transformer-based encoder trained with supervised contrastive learning across distributed network environments, learning a shared representation without exchanging sensitive traffic data. The encoder embeds network flow features into a latent space where semantically similar traffic patterns cluster together, enabling effective anomaly detection via k-nearest neighbor scoring. Evaluated on four heterogeneous NetFlow datasets, GRIDS outperforms existing federated IDS baselines on average with a single unified model. In leave-one-out cross-validation, a substantial portion of the detection capability of GRIDS transfers to network environments unseen during training, and the level of transfer varies across target networks. Deployment at such a network requires no labeled attack data or fine-tuning. It uses the benign traffic of the network as the kNN reference set and its unlabeled traffic for normalization and threshold calibration. The framework targets deployments in which a single model protects multiple heterogeneous networks.	10.1109/TNSM.2026.3748922
Miguel Familiar-Cabero	Zero-Parameter 3GPP Protocol Prior for Infrastructure-to-CNF Event Correlation in AI-Native Mobile Core Networks	2026	Early Access	Modeling Protocols 3GPP	A zero-parameter protocol prior derived from a 3GPP Release 19 knowledge graph constrains cross-attention between infrastructure and core-network event streams to the 50 admissible (event-type, procedure-step) pairs, removing 98.6% of candidates while preserving over 99% of causal links. Evaluated on 360 scenarios spanning six 3GPP procedure families (12 scenario types) and 631,748 protocol-admissible pairs from one commercial 5G Core deployment, the method achieves leave-one-type-out cross-validated macro AUC-PR 0.823 across heldout fault types and in-sample AUC-PR skill 0.972 (0.973±0.002 over 5 seeds). On the protocol-admissible candidate set (P), the protocol-constrained neural correlation model (PCNC) outperforms an unconstrained Transformer (skill 0.901), GNN-GAT (0.935), and two gated tabular baselines (logistic regression, 0.355; gradient-boosted trees, 0.737); a no-context ablation decomposes the gap: learned sequence embeddings account for 93% of the improvement over gradient-boosted trees (Δ = +0.218), while attention-routed context adds 7% (+0.017). Controlled ablations attribute the dominant discrimination to the protocol gate (Δ Skill = +0.077, p = 0.011 cluster bootstrap) and timer bounds (+0.084), not the encoder backbone (\|Δ\| ≤ 0.006, not significant). Leave-one-EI-type-out transfer confirms that the structural prior generalizes: 12 of 14 infrastructure event types score adequately without pattern-specific supervision (mean skill 0.708). Cross-operator robustness is validated by timer perturbation (skill ≥ 0.945 at 0.5–1.0× normative values) and single-procedure KG dropout (skill ≥ 0.968). Fail-closed behavior is confirmed empirically: novel infrastructure event types absent from the KG receive exactly zero correlation score.	10.1109/TNSM.2026.3749666
Mona Alghamdi, Atm S. Alam, Asma Cherif	A Context-Aware Action Filter for Deep Reinforcement Learning-Based Task Orchestration in Mobile Edge Computing	2026	Early Access	Filtering Servers Filters	The growing complexity and highly dynamic characteristics of Mobile Edge Computing (MEC) environments introduce considerable challenges for Deep Reinforcement Learning (DRL)-based task orchestration. With an increasing number of potential execution nodes, the set of available actions becomes substantially larger, leading to greater exploration complexity and exposing the learning agent to many infeasible or contextually inappropriate decisions. This paper proposes a Context-Aware Action Filter (CAAF) for Double Deep Q-Network (DDQN)-based task orchestration in MEC. CAAF dynamically evaluates candidate edge servers according to task characteristics, resource availability, network conditions, and system context. It combines a composite suitability assessment with an adaptive distribution-aware filtering mechanism that removes less-suitable actions when meaningful differences exist among candidates, while preserving action diversity when their suitability is comparable. The resulting reduced action space is then provided to the DDQN agent for task assignment. Simulation results demonstrate that CAAF-DDQN outperforms conventional DDQN, particularly under high-load conditions, reducing service time and task failure rate by approximately 20.0% and 45.7%, respectively. Scalability experiments with a larger number of edge servers further confirm its effectiveness under enlarged action spaces, achieving reductions of approximately 31.8% in service time and 89.5% in task failure rate without modifying the DDQN architecture or learning hyperparameters.	10.1109/TNSM.2026.3749201
Martha Cash, Charlotte Fowler, Alexander M. Wyglinski	On the Role of Time Series Clustering in Traffic Matrix Prediction	2026	Early Access	Fluid flow Timing Modeling	This paper analyzes the role of time-series clustering in traffic matrix (TM) prediction. Traffic flows within a TM often exhibit heterogeneous behavior, which can reduce the effectiveness of global forecasting models that predict all flows jointly. To address this, we propose a clustering-based prediction framework that groups flows into smaller subsets and trains separate predictors for each group. We evaluate four traffic-flow representations for clustering, namely histogram, autocorrelation function (ACF), power spectral density (PSD), and naïve partitioning, and analyze how both the representation choice and the number of clusters affect prediction performance. Experiments using the publicly available Abilene and GÉANT datasets show that clustering consistently improves over global forecasting baselines, while remaining substantially less costly than local prediction. The results further show that most of the performance gain is achieved at moderate values of K, with diminishing returns as the number of clusters increases. Although different clustering representations produce different partitions of the traffic flows, they often achieve similar root mean squared error (RMSE). This suggests that the main benefit of clustering lies in decomposing the TM prediction task into smaller subproblems, while the exact cluster structure plays a more limited role in determining overall prediction accuracy.	10.1109/TNSM.2026.3747898
Mengyao Li, Sebastian Troia, Jean Pierre Asdikian, Giacomo Sguotti, Yingqian Zhang, Guido Maier	Hierarchical Auction-Based 5G Network Slicing with Region-based Multi-MNO Deployment	2026	Early Access	Resource management Modeling Radio access networks	Network slicing enables multiple virtual networks to share 5G network infrastructure while meeting heterogeneous service requirements. In parallel, region-based control in multi- Mobile Network Operators (MNOs) deployments has emerged, where each MNO manages a subregion of the network topology. This paper presents a two-level hierarchical combinatorial auction for end-to-end 5G Radio Access Network (RAN) slicing among MNOs, Mobile Virtual Network Operators (MVNOs), and users. At the upper level, MNOs provide slice resources to MVNOs. At the lower level, MVNOs allocate the slices to users. The framework considers dynamic demand, as requests may arrive at different times and remain active for different timeslots. A pair-bid mechanism is used to perform buyer–seller matching at both levels. The auction first selects the requests that can be accepted. The selection tries to keep the accepted bid value high without ignoring the electricity cost. After the winners are known, their payments are calculated using a VCG-like criticalvalue rule. The model also reflects the fact that different MNOs serve different regions and may have different infrastructure costs. In the simulations, the heuristic obtains higher welfare than both baselines. Simulations show that the heuristic improves welfare compared with two baseline methods, achieving up to 13.6% and 20.7% gains while maintaining scalability across different topologies.	10.1109/TNSM.2026.3747595
Shubhani Aggarwal, Georges Kaddoum	QSB-SHA: Quantum-secured Blockchain for Smart Home Authentication	2026	Early Access	Authentication Smart homes Internet of Things	Today, IoT enables smart home users to remotely connect with household appliances via the Internet. Sensor-equipped smart devices are widely deployed in smart homes to collect and manage information regardless of user location. However, ensuring the secure and private accessibility of these devices in a centralized manner remains a major concern. The emergence of blockchain and quantum computing, with their enhanced information processing capabilities on decentralized platforms, offers a viable solution to this issue. Consequently, there is a need for cryptographic primitives that can withstand both quantum and classical attacks. To address this concern in the present study, we propose a quantum-secured blockchain (QSB) framework for smart home authentication (SHA). The proposed framework employs quantum key distribution (QKD) and maximally entangled states on a decentralized platform to enable secure key distribution and mutual authentication between smart home users and devices. Furthermore, our approach integrates quantum passwords and quantum digital signatures to verify and validate legitimate users, thereby ensuring security and privacy. The framework is simulated using the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool for formal security analysis. We also conduct an informal security analysis and compare the performance of our proposed scheme with that of the previously proposed solutions. The results demonstrate that our framework outperforms existing approaches across various performance evaluation metrics.	10.1109/TNSM.2026.3747090
Messaoud Ait-Yahia, Wael Jaafar, Rami Langar	Joint Design of Blockchain-Enabled Service Placement and Task Assignment in Vehicular Fog Computing Networks	2026	Early Access	Delays Timing Optimization	Driven by the evolution of blockchain and fog computing, vehicular networks are increasingly capable of supporting latency-sensitive applications with enhanced security and trust guarantees. However, the joint resource allocation for task offloading and blockchain services has been insufficiently investigated in existing works. To address this gap, this paper proposes a framework for jointly allocating resources of blockchain, users’ virtualized services, and Mobile Edge Computing (MEC) task assignment in Vehicular Fog Computing (VFC) networks. Specifically, we formulate the optimization problem as an integer nonlinear programming model aiming to maximize the satisfaction rate of users’ service requests while minimizing the corresponding blockchain operation time under mobility, queuing, instantiation, and resource constraints. To solve it in a timely manner, we design two-stage hierarchical low-complexity solutions, namely a Particle Swarm Optimization-based Joint Blockchain-enabled Service placement and Task Assignment algorithm (PSO-JBSTA), and a Genetic Algorithm-based approach (GA-JBSTA). Through extensive simulations, we demonstrate the effectiveness of PSO-JBSTA (resp. GA-JBSTA) and their adaptability to network conditions, achieving an average 35% (resp. 24%) improvement in users’ service satisfaction rate and 9.5% (resp. 10.2%) reduction in average blockchain validation delay compared with the baselines.	10.1109/TNSM.2026.3737068
Stefano Servillo, Pietro Spadaccino, Marta Burocchi, Stavros Konstantaras, Flavio Luciani, Francesca Cuomo	AS-SETs Are Not Enough: From IRR Filtering Failures to Stateful Validation in IXP Route Servers	2026	Early Access	Filtering Filters Border Gateway Protocol	Internet Exchange Points (IXPs) provide critical infrastructure for Autonomous Systems (ASes) to interconnect and exchange traffic efficiently. To support scalable peering, IXPs use Route Servers (RSes), which allow ASes to exchange routes with multiple peers through a single Border Gateway Protocol (BGP) session. However, BGP’s implicit trust model exposes inter-domain routing to misconfigurations and threats. IXPs mitigate this through filtering techniques leveraging Resource Public Key Infrastructure (RPKI) and Internet Routing Registries (IRRs), which rely on AS-SET objects. However, improper AS-SET validation may lead to incorrect filtering of both invalid and valid announcements. In this paper, we characterize such vulnerabilities and show that they enable prefix hijacking through IXPs as well as the rejection of RPKI-valid announcements. Based on public internet data, we analyze AS-SET content quality, which could exacerbate both vulnerabilities. Moreover, we quantify them using one month of real-world routing data from the RSes of two European IXPs, NAMEX and AMS-IX, identifying 17,721 unauthorized announcements accepted and 294,112 RPKI-valid announcements rejected, and assess their presence across IXPs worldwide. Guided by these findings, we design a mitigation strategy consisting of a stateful validation pipeline that conditions IRR validation on RPKI and ASPA outcomes. We show how to implement it in practice through OpenBGPD, and we validate it in an emulated IXP topology.	10.1109/TNSM.2026.3745205