TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Ke He, Muhammad Rizwan Asghar, Jeong Do Yoo, Young Hun Lee, Hyunjae Kang, Huy Kang Kim, Dan Dongseong Kim	Liuer Mihou: A Practical Grey-box Adversarial Attack against Anomaly-based Network Intrusion Detection Systems	2026	Early Access	Modeling Signal detection Timing	Deep learning has gained popularity as a detection algorithm for Network-based Intrusion Detection Systems (NIDS) due to its expressiveness and speed. However, Deep learning algorithms are susceptible to adversarial attacks that introduce imperceptible changes to deceive the Deep learning algorithm into misclassifying the input. Existing adversarial attacks often overlook the practicality and replayability of the attack. In this paper, we present Liuer Mihou (LM), an adversarial attack designed to generate practical and replayable adversarial network packets, specifically targeting unsupervised anomaly-based NIDS deployed in Internet of Things (IoT) networks. The core concept behind LM is to leverage adversarial transferability and generate adversarial packets on a surrogate NIDS while considering predefined, semantic-preserving mutation operations to ensure practicality. To assess the effectiveness of LM, we objectively analyze its evasiveness against five general-purpose machine learning-based outlier detection algorithms (SOM, RRCF, LOF, OCSVM, and FROCC), as well as the state-of-the-art NIDS, Kitsune. Rather than claiming broad practicality, we characterize when and how packet-space attacks remain feasible: we quantify the trade-off between evasion and attack effectiveness, the distortion introduced by physical replay, and the conditions under which the attack transfers across detector families. We further show that LM’s mutation set is extensible beyond timing and size, adding TCP-window and payload-byte operators to evade a header-field-aware detector. Furthermore, we demonstrate that adversarial detectors such as Feature Squeezing and MagNet, as well as defenses designed for unsupervised anomaly detection, are largely ineffective in defending against LM. Moving beyond a theoretical setting, we conduct a replay of LM in two real IoT testbeds to analyze its practicality.	10.1109/TNSM.2026.3742885
Hang Shen, Kerui Li, Xin Liang, Tianjing Wang, Guangwei Bai	LLM-guided RL for Cybersecurity Orchestration	2026	Early Access	Atoms Large language models Security	Cybersecurity orchestration often relies on static playbooks and reinforcement learning (RL) policies defined over predefined action spaces, limiting their adaptability to unfamiliar attacks and changing operational environments. To address this limitation, this paper proposes an adaptive security-orchestration framework that integrates semantic retrieval, large language model (LLM) reasoning, and RL-based decision optimization. First, relevant strategy atoms are retrieved to ground LLM reasoning, while the LLM identifies coverage gaps and generates supplementary defensive actions. The generated atoms are validated against operational constraints and executable action templates before entering the playbook construction phase. Second, a Tree-of-Thoughts (ToT) prompting mechanism evaluates candidate atoms from multiple operational perspectives to improve their relevance and practical utility. Third, a dynamic-action RL mechanism combines semantic action representations, feasibility masking, and LLM-derived action priors to support scenario-dependent candidate action sets. High-quality RL trajectories are subsequently used to align the LLM with effective orchestration decisions. Experiments in a heterogeneous 5G-enabled Internet of Things (5G-IoT) enterprise security environment with real-world vulnerabilities demonstrate that the proposed framework improves robustness under unseen threats and varying operational loads, reduces operational failure rates, and enhances reference-based playbook quality compared with representative RL- and LLM-based baselines.	10.1109/TNSM.2026.3745670
Qaisar Ali, Ihsan Ullah, Youn-Hee Han	Topology-Preserving Virtual Network Embedding Using Persistent Homology and Graph Attention Reinforcement Learning	2026	Early Access	Substrates Topology Joining processes	Virtual Network Embedding (VNE) maps virtual network requests (VNRs) onto shared substrate networks while satisfying node, link, and service constraints. Existing VNE methods mainly optimize resource-centric objectives such as CPU utilization, bandwidth consumption, acceptance ratio, and revenue, but often treat structural service patterns as implicit connectivity requirements. However, patterns such as redundancy loops, hierarchical aggregation, centralized control, and fault-tolerant structures may encode critical service logic, and their degradation can reduce reliability and violate service-level guarantees. This paper proposes TP-VNE, a topology-preserving and pattern-aware VNE framework that integrates persistent-homology-assisted structural characterization, graph attention-based representation learning, and proximal policy optimization. Persistent homology extracts multi-scale topological signatures from VNRs and substrate candidate regions, while complementary graph features distinguish acyclic structures such as stars and trees. A graph attention network learns topology-aware node embeddings by combining resource and structural features, and a PPO agent performs sequential node and link mapping under feasibility-aware action masking. Finally, a topology verification module validates the path-induced embedded subgraph before resource commitment. Simulation results show that TP-VNE improves the acceptance ratio from 48.5% to 83.5% at λarr = 0.20 and increases long-term average revenue from 2,780 to 4,980 compared with Baseline PPO, while achieving 89.3% pattern preservation accuracy with acceptable embedding overhead. Scalability experiments on GT-ITM substrates with up to 1000 nodes further demonstrate the robustness of TP-VNE under increasing network size.	10.1109/TNSM.2026.3744368
Michael Georgiades, Iacovos Ioannou, Hasan Islam, Ferheen Ayaz, Yun Hou, Kin-Hon Ho	Enhanced Vehicular Edge Offloading through SLA-Based Deep Reinforcement Learning and Risk-Aware Bandits	2026	Early Access	Service level agreements Modeling Timing	This paper investigates service-level agreement (SLA)-aware computation offloading in vehicular edge computing using two complementary online learners. SRM-FA-UCB combines staleness-aware transport exploration, contextual service-time prediction, empirical SLA screening, and selected-arm feedback. SLA-MA-PPO couples a state-dependent SLA action mask with a two-hidden-layer actor–critic, generalized advantage estimation, and cooperative KPI shaping. We evaluate both methods in an extended EdgeCloudSim environment with deterministic SUMO urban-grid mobility, V2X radio, congestion and handover effects, 200–1000 vehicles, and 10 paired replications per load. Among the six primary schemes, SRM-FA-UCB attains the lowest mean SLA violation, service time, and modeled energy with near-unity fairness. Additional controlled attribution with two simple screened heuristics and a screened FA-UCB control shows that the large improvement over conventional FA-UCB is primarily associated with the shared SLA-aware prediction and admissibility-screening stage; no independent endpoint advantage of the more complex post-screen SRM selector is established after Holm correction. SLA-MA-PPO significantly reduces SLA violations, mean service time, and modeled energy relative to PPO-GAE, while ablations identify action masking as its critical component. A controlled change-point experiment does not establish a transient benefit from the restless term. Code, configurations, seeds, and analysis scripts are provided through a public EdgeCloudSim research fork.	10.1109/TNSM.2026.3742669
Huiqi Zhao, Zhiying Sun, Gang Liu, Fang Fan	PMDC: A Prior Knowledge Constrained Multimodal Method for Encrypted Malicious Traffic Detection Integrating Difficulty Awareness and Confusion Rectification	2026	Early Access	Modeling Payloads Fluid flow	Encrypted network traffic is increasingly exploited for covert malicious activities, complicating detection. Current approaches often rely on black-box models that make limited use of domain knowledge and struggle to distinguish similar malware families, leading to performance degradation under evolving traffic distributions. We propose PMDC, a dual-branch multimodal model for encrypted malicious traffic detection at the bidirectional-flow level. PMDC uses an improved MobileViT branch to capture spatial patterns from the spatialized payload representation with header-derived priors and flow-level statistical knowledge, while a Temporal Convolutional Network (TCN) branch captures fine-grained packet-level temporal patterns and long-range behavioral dependencies. A difficulty-aware global fusion mechanism selects a single pair of branch weights on the validation set by considering classification confidence, uncertainty, and historical stability, and applies the selected weights to all test samples. Additionally, a directed low-rank residual rectification module (CARM) helps separate easily confused malware families while largely preserving the decisions for other classes. Experiments on four benchmark datasets show that PMDC achieves consistently strong accuracy, F1-score, TPR, and FPR compared with representative baselines, and shows non-catastrophic degradation under packet-loss perturbations. On a small self-built power-grid dataset collected from a single attack incident, PMDC correctly identifies all 64 malicious flows with a false positive rate of 0.73%, providing preliminary evidence of binary cross-scenario detection capability under this limited setting.	10.1109/TNSM.2026.3742766
Mohammad Saberi, Ali Ahmadi Esfidi, Mahdi Dolati, Naeimeh Omidvar	FlexINA: In-Network Aggregation for Accelerating Distributed Machine Learning with Flexible Routing	2026	Early Access	Modeling Switches Timing	The growing scale and complexity of modern machine learning (ML) models have rendered distributed training indispensable. However, as model dimensions expand, communication overhead increasingly dominates the overall training time, creating a critical performance bottleneck. While techniques such as gradient compression offer partial relief, they often incur substantial computational overhead or require specialized hardware. In-network aggregation (INA) has emerged as a compelling alternative, offloading partial computations—such as gradient reduction—directly onto programmable network switches. Yet, current INA frameworks predominantly rely on rigid, static routing schemes or uncoordinated, opportunistic aggregation, fundamentally limiting their capacity to exploit the full potential of programmable data planes. To address this limitation, we formulate the Joint Scheduling-Routing for In-Network Aggregation (JINA) problem. JINA introduces a time-slotted execution model to enable fine-grained temporal scheduling synchronously with spatial routing. By leveraging source routing, it dictates perpacket forwarding paths while explicitly coordinating multi-hop partial aggregation across the network. Furthermore, we propose FlexINA, a scalable optimization framework that solves the JINA problem through a three-phase dimensionality reduction strategy: host-level pre-aggregation, topological switch filtration, and temporal window partitioning. Extensive evaluations across fifteen diverse network topologies demonstrate that FlexINA reduces the total network load by up to 8.3% compared to INA baselines, while maintaining high computational efficiency.	10.1109/TNSM.2026.3740503
Hongyuan Cheng, Lihua Yin, Tianqing Zhu, Hongyu Yang, Dexin Zhu, Weixiang Jiang, Nan Wei	Pattern2Bot: A malicious server IP detection model based on self-trained heterogeneous graph neural network	2026	Early Access	Labeling Modeling Signal detection	Botnets play a key role in network attacks such as Distributed Denial-of-Service (DDoS) attacks, spamming and click fraud. Command & Control server is an important node for botmaster to control bots and distribute attack commands. Bot disguise as normal domain requests through DNS traffic, but leave malicious records in DNS logs containing client IP, query domain, server IP and other complex interactions. This information provides important clues for detecting those botnets. In the current study, researchers detect botnets through multiple perspectives, including abstracting DNS communication records into graphs and using graph neural network models for detection. Conventional approaches often necessitate massive labeled datasets for model training, which substantially incurs training costs. Moreover, despite enriching node embeddings via topological relations, graph models often suffer performance degradation when confronted with structural semantic obfuscation from evasion techniques like double-flux. In order to understand the abstract and complex relationship patterns in DNS records while reducing label usage to lower training costs, we propose a botnet Command & Control server detection model based on DNS traffic. This is a self-training heterogeneous graph neural network model that does not require a large number of labels. By integrating the high-order relational semantics derived from multiple meta-paths with the local topologies of target nodes, the model achieves finer-grained structural awareness and semantic abstraction, thereby enhancing detection performance. We validate the effectiveness of the model in a real dataset, and the results show that the model has a better understanding of the special structure possessed by the IPs of Command & Control servers.	10.1109/TNSM.2026.3741111
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Yakai Dai, Jia Chen, Xu Huang, Rui Dong, Tao Fu	VISTA: Verified Belief-Centric LLM Agents for Safe Network Management	2026	Early Access	Safety Writing Modeling	Large language model (LLM) agents now commit changes in production network management, where one change can touch routing-protocol state or a Kubernetes NetworkPolicy. The prevailing pipeline emits the change as a single text answer, so the network state, the competing root-cause hypotheses, and the operational invariants travel through the same token stream as the answer—a design that is unsafe on the NetArena dynamic benchmark: on capacity planning, the strongest supervised and retrieval-augmented baselines reach near-perfect correctness while leaving 41% of executed actions unsafe. VISTA gives each hidden quantity a persistent owner: it maintains a typed belief graph over topology and configuration, reasons over an explicit hypothesis trace, and routes every candidate write through a counterfactual verifier that emits a typed proof object, whose structured failure reasons re-enter the next round. On a shared Qwen2.5-Coder-7B backbone and NetArena’s official scorer, no single prompting strategy is safe across capacity planning’s ten query classes. Under π=WITHHOLD (proof failure blocks the write), VISTA reaches safety 1.000 at commit 0.869. Under π=FLAG (proof failure annotates but proceeds), it attains the per-class maximum on all ten classes, lifting safety from the 0.709 per-class oracle envelope to 0.869 at correctness 0.992, commit 1.000, and zero refusals, with a paired query-level margin of 153–0. An ablation attributes the gain: the gate itself does not move the safety rate, which is set by feeding belief and hypothesis structure back into generation, while the gate contributes a commit-time certificate agreeing with the official scorer on 869/869 admitted writes and a rejection whose structure decides repairability (60/86 versus 0/86), at ≈13× latency (3.520 s). On routing and Kubernetes the same workflow trades ≈70% refusal for high safety and is diagnostic, not deployable. Our implementation is released at https://github.com/dai-yakai/VISTA.	10.1109/TNSM.2026.3745152
Aymen Daoud, Md. Zoheb Hassan, Georges Kaddoum	SpectraTwin: Generative Intelligence-Powered Digital Twin for Dynamic Spectrum Awareness	2026	Early Access	Modeling Radio frequency Labeling	Spectrum monitoring and classification under evolving RF spectrum landscapes are key enablers of spectrum awareness for dynamic spectrum management and interference detection in 6G networks. Although artificial intelligence (AI) and machine learning (ML) techniques have shown promising performance in spectrum classification, most existing models are static, non-generative, and optimized for specific training environments. As a result, channel distribution shifts, model brittleness, and the scarcity of labeled RF data for fine-tuning AI/ML models lead to significant performance degradation in evolving RF spectrum landscapes. In this context, digital twin (DT) provides a promising approach by maintaining a virtual representation of the RF spectrum environment that supports what-if analysis, data generation, and iterative model updates. In this paper, we propose SpectraTwin, a multi-AI-enabled, adaptive, and self-evolving DT framework for multi-timescale spectrum classification under evolving RF spectrum states and incrementally increasing task complexity. SpectraTwin integrates three tightly coupled modules: (i) a Dynamic Mask Generative Adversarial Network (GAN) that serves as the virtual replica of the RF spectrum environment, synthesizing realistic, classand channel-conditioned spectrograms on demand to mitigate RF data scarcity; (ii) a continual learning-based spectrum classification model that incrementally adapts to evolving RF environments while preserving prior knowledge; and (iii) an active-learning-inspired orchestration module that decides when to adapt, which classes to synthesize, and which exemplars to retain, so that model updates are performed in response to detected change rather than on a fixed retraining schedule. By jointly combining generative, continual, and active learning, SpectraTwin enables robust spectrum awareness through (a) faithful emulation of RF spectrum evolution, (b) detection of domain distribution shifts, and (c) efficient incremental adaptation under non-stationary conditions while maintaining a favorable balance between accuracy and forgetting. Simulation results on both custom dynamic RF datasets and multiple benchmark datasets (consisting of simulated and real-world signal captures) show that SpectraTwin achieves superior adaptability and classification performance compared with existing approaches.	10.1109/TNSM.2026.3743810
Jing Zhang, Chao Luo, Rui Shao	MTG-GAN: A Masked Temporal Graph Generative Adversarial Network for Cross-Domain System Log Anomaly Detection	2026	Early Access	Anomaly detection Adaptation models Generative adversarial networks	Anomaly detection of system logs is crucial for the service management of large-scale information systems. Nowadays, log anomaly detection faces two main challenges: 1) capturing evolving temporal dependencies between log events to adaptively tackle with emerging anomaly patterns, 2) and maintaining high detection capabilities across varies data distributions. Existing methods rely heavily on domain-specific data features, making it challenging to handle the heterogeneity and temporal dynamics of log data. This limitation restricts the deployment of anomaly detection systems in practical environments. In this article, a novel framework, Masked Temporal Graph Generative Adversarial Network (MTG-GAN), is proposed for both conventional and cross-domain log anomaly detection. The model enhances the detection capability for emerging abnormal patterns in system log data by introducing an adaptive masking mechanism that combines generative adversarial networks with graph contrastive learning. Additionally, MTG-GAN reduces dependency on specific data distribution and improves model generalization by using diffused graph adjacency information deriving from temporal relevance of event sequence, which can be conducive to improve cross-domain detection performance. Experimental results demonstrate that MTG-GAN outperforms existing methods on multiple real-world datasets in both conventional and cross-domain log anomaly detection.	10.1109/TNSM.2026.3654642
Chengsheng Pan, Yingzhi Wang, Huaifeng Shi, Lishang Qin, Xiaosong Cui	DBSDD-AQM: Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management for Edge IoT Networks	2026	Early Access	Delays Satellite broadcasting Internet of Things	Bursty heterogeneous traffic can build persistent queues at edge IoT gateways when the offered load converges on a lower-rate bottleneck. Conventional active queue management (AQM) regulates packet dropping under a fixed buffer capacity, whereas adaptive buffer sizing alone does not coordinate capacity adjustment with queue-removal control. We propose Dynamic Buffer Sizing-Based Deep Deterministic Active Queue Management (DBSDD-AQM), which combines a bounded buffersizing loop with a faster continuous queue-removal controller. DBS adjusts the admissible capacity according to sustained queue evolution, while the DDPG Actor selects packet-granular removal actions for the resident backlog. A class-aware extension maps three concurrent service classes to logical FIFO queues sharing the same dynamic physical buffer. DBSDD-AQM is implemented using an NS3-PyTorch framework. Aggregate experiments compare it with RED, ARED, PIE, CoDel, and DQN-AQM, while the class-aware evaluation additionally includes FQ-CoDel and FQ-PIE. Matched-DBS comparisons show similar throughput but different delay–loss operating points among the aggregate controllers, and component ablation distinguishes the effects of capacity adaptation and learned queue removal. Relative to a fixed 50 KB buffer, DBS reduces average queueing delay by 16.23% for UDP and 17.70% for TCP Westwood in controlled transport experiments. In the evaluated three-class overload scenarios, all classes retain nonzero throughput. Class-aware DBSDD-AQM provides stronger D- and T-class differentiation, whereas FQ-CoDel and FQ-PIE produce more uniform class-level outcomes and stronger R-class performance. The measured 95th-percentile batch-one Actor inference latency is 0.109 ms on the reported x86-64 platform.	10.1109/TNSM.2026.3741334
Franck Messaoudi, Luhan Wang, Abdelkader Mekrache, Adlen Ksentini, Bingxuan Li, Jialei Su, Sofiane Messaoudi, Salim El Ghalbzouri	The Brewing Storm in 5G’s Data Plane: Design and Evaluation of a High-Performance eBPF/XDP-Based User Plane Function	2026	Early Access	Quality of service Fluid flow Kernel	This paper presents the design and implementation of a novel 5G UPF leveraging eBPF technology to meet the stringent performance and programmability requirements of emerging 6G systems. Traditional UPF implementations often struggle to balance performance, flexibility, and resource efficiency-challenges particularly critical in CPU- and I/O-constrained edge environments. The proposed eBPF-based UPF architecture mitigates these limitations by embedding core functionalities, such as packet classification, forwarding, and QoS enforcement, directly within the Linux kernel via eBPF programs attached through XDP and tc hook points. Performance evaluation using TRex demonstrates that the proposed solution achieves competitive throughput, low packet loss, and efficient CPU utilization across traffic profiles. Moreover, it maintains full compliance with 5G Core Network standards. Comparative analysis with well-established open-source UPF implementations further underscores its advantages. This work highlights the potential of eBPF as a foundational technology for building next-generation, programmable UPFs optimized for edge cloud deployments in the 6G era.	10.1109/TNSM.2026.3720812
Tian-Yu Zuo, Xiuyi Zhao, Pan Li, Junxiong Lin, Mingyi Liu, Jiuchuan Jiang, Gengyu Lyu, Kai Di, Ning Luo	PrivKV-Sched: Budgeted Cross-Tenant KV-Cache Reuse for Multi-Tenant LLM Serving	2026	Early Access	Modeling Pricing Testing	Enterprise LLM services need faster responses and less repeated computation. Shared KV caches store computation results for reuse by later requests with matching input. However, content has different sharing permissions, and maximizing hits alone can permit reuse outside the authorized scope, creating privacy risks. Businesses that explicitly allow limited cross-user reuse also need to control its total amount. We propose PrivKV, which incorporates content permissions and reuse allowances into scheduling. For each request, it checks cached content and jointly selects a worker and reuse length based on saved computation, allowance consumption, and worker load. When spending is high, a dynamic price favors lower-cost reuse. An optional pre-execution check reserves the required allowance, preventing concurrent requests from spending the same balance twice. We compare methods with equal allowances on public request data and disable each control to examine its role. Tests cover different scales and inputs, small optimal solutions, and real GPU execution measuring service performance and scheduling overhead. Budget adjustment reduces unauthorized reuse, while pre-execution checks prevent overspending. With a common replacement rule, PrivKV retains about 96% of unconstrained cache hits. Real-model tests also verify the feasibility of pre-execution checks. For businesses allowing limited cross-user reuse, PrivKV applies content permissions and usage allowances to shared caches, limiting total unauthorized reuse while retaining computational savings.	10.1109/TNSM.2026.3745203
Deemah H. Tashman, Soumaya Cherkaoui	Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks	2026	Early Access	Reconfigurable intelligent surfaces Reliability Optimization	Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems.	10.1109/TNSM.2026.3660728
Stefano Servillo, Pietro Spadaccino, Marta Burocchi, Stavros Konstantaras, Flavio Luciani, Francesca Cuomo	AS-SETs Are Not Enough: From IRR Filtering Failures to Stateful Validation in IXP Route Servers	2026	Early Access	Filtering Filters Border Gateway Protocol	Internet Exchange Points (IXPs) provide critical infrastructure for Autonomous Systems (ASes) to interconnect and exchange traffic efficiently. To support scalable peering, IXPs use Route Servers (RSes), which allow ASes to exchange routes with multiple peers through a single Border Gateway Protocol (BGP) session. However, BGP’s implicit trust model exposes inter-domain routing to misconfigurations and threats. IXPs mitigate this through filtering techniques leveraging Resource Public Key Infrastructure (RPKI) and Internet Routing Registries (IRRs), which rely on AS-SET objects. However, improper AS-SET validation may lead to incorrect filtering of both invalid and valid announcements. In this paper, we characterize such vulnerabilities and show that they enable prefix hijacking through IXPs as well as the rejection of RPKI-valid announcements. Based on public internet data, we analyze AS-SET content quality, which could exacerbate both vulnerabilities. Moreover, we quantify them using one month of real-world routing data from the RSes of two European IXPs, NAMEX and AMS-IX, identifying 17,721 unauthorized announcements accepted and 294,112 RPKI-valid announcements rejected, and assess their presence across IXPs worldwide. Guided by these findings, we design a mitigation strategy consisting of a stateful validation pipeline that conditions IRR validation on RPKI and ASPA outcomes. We show how to implement it in practice through OpenBGPD, and we validate it in an emulated IXP topology.	10.1109/TNSM.2026.3745205
Ahlem Menaceur, Hamza Drid, Mohamed Rahouti, Yasmine Medjadba, Abdellah Chehri	Priority-Aware Dual-Queue Buffering for Reactive SDN Fault Management with Reduced Loss	2026	Early Access	Software defined networking Joining processes Loading	Software-Defined Networking (SDN) provides controller-driven flexibility for network and service management, yet reactive failure recovery often suffers from a recovery gap between fault detection and the installation of updated forwarding rules. Packets arriving during this interval are vulnerable to loss, while rerouted flows may overload specific links, undermining service continuity. To address these challenges, this paper proposes a dual-priority, queue-assisted reactive recovery mechanism that integrates traffic classification and buffering at the data plane. The design assigns flows to a high-priority queue (HPQ) or a low-priority queue (LPQ), ensuring that critical traffic is preserved while the controller completes rerouting. Evaluation on a 9-switch custom topology and the 16-node NSFNET backbone demonstrates that the proposed approach reduces packet loss (from 10.3% to 5.4% in the 9-switch topology and to below 1.9% in NSFNET) and improves post-failure load distribution, decreasing congested and surcharged links by 37.6% and 20.6%, respectively, compared to conventional reactive recovery. These results highlight that priority-aware buffering during the recovery gap enhances resilience, scalability, and operational efficiency for SDN fault and service management.	10.1109/TNSM.2026.3744288
Chenxin Zhou, Cheng Huang, Qiang Zhang, Qiliang Xie, Zeqing Li	NESTTOR: Detecting Tor-over-Proxy Traffic with Factorized Decisions	2026	Early Access	Fluid flow Labeling Protocols	Tor users can place an encrypted proxy between the client and the Tor network to conceal the exposed entry connection. This additional layer also transforms the Tor byte stream through protocol framing, buffering, and TCP segmentation before an observer sees the outer client-to-proxy flow. The transformation breaks stable packet-to-cell alignment and raises two questions. We ask which Tor behaviors remain observable across different proxies and how a detector should combine the presence of an outer proxy with the presence of Tor traffic. Existing datasets primarily study Tor and proxy traffic as separate targets and provide limited support for answering these questions under a unified evaluation protocol. We propose NESTTOR, which trains a proxy gate and a proxy-conditioned Tor detector separately and combines their decisions with an AND rule. Its stage-based features capture relative connection evolution without reconstructing Tor cells. We construct a longitudinal benchmark of 349,891 bidirectional TCP flows that distinguishes Tor-over-Proxy (ToP), Pure Proxy, Direct Tor, and Ordinary traffic across four proxy protocols, 1,663 domains, and approximately 18 months. NESTTOR achieves 99.45% macro-F1 on confirmatory data from unseen domains and 88.50% on later captures.	10.1109/TNSM.2026.3743261
Yifan Zeng, Zihui Gu, Peijia Zheng, Huiyu Zhou	A Federated Semi-Supervised Framework for Data Efficiency and Privacy-Preserving Intrusion Detection in Internet of Things	2026	Early Access	Internet of Things Modeling Labeling	The Internet of Things (IoT) forms the foundation of modern smart environments, enabling intelligent industries, homes, cities, healthcare, and autonomous systems. However, as IoT devices increasingly connect to cloud platforms and the Internet, they become highly vulnerable to network intrusions that can lead to critical data breaches and service disruptions. This paper proposes a Contrastive Federated Semi-Supervised Learning Network Intrusion Detection framework (CFedSSL-NID), specifically tailored to enhance the security of IoT communications. It addresses practical scenarios where clients lack labeled data and computational resources, and where data privacy is paramount. The CFedSSL-NID framework enhances detection performance and robustness. It uniquely achieves this by synergistically leveraging abundant, unlabeled data from distributed IoT gateways through self-supervised contrastive learning, while optimally integrating supervised signals from a central server. This dual approach enables highly accurate intrusion detection while substantially mitigating the reliance on scarce and costly labeled data. Experiments on the TON-IoT, UNSW-NB15, and NSL-KDD datasets show that CFedSSL-NID outperforms federated and centralized baselines; additional evaluations under Non-IID data, asynchronous participation, and malicious-client updates confirm robustness, while communication and edge-inference analyses indicate its deployment feasibility.	10.1109/TNSM.2026.3742261
Messaoud Ait-Yahia, Wael Jaafar, Rami Langar	Joint Design of Blockchain-Enabled Service Placement and Task Assignment in Vehicular Fog Computing Networks	2026	Early Access	Delays Timing Optimization	Driven by the evolution of blockchain and fog computing, vehicular networks are increasingly capable of supporting latency-sensitive applications with enhanced security and trust guarantees. However, the joint resource allocation for task offloading and blockchain services has been insufficiently investigated in existing works. To address this gap, this paper proposes a framework for jointly allocating resources of blockchain, users’ virtualized services, and Mobile Edge Computing (MEC) task assignment in Vehicular Fog Computing (VFC) networks. Specifically, we formulate the optimization problem as an integer nonlinear programming model aiming to maximize the satisfaction rate of users’ service requests while minimizing the corresponding blockchain operation time under mobility, queuing, instantiation, and resource constraints. To solve it in a timely manner, we design two-stage hierarchical low-complexity solutions, namely a Particle Swarm Optimization-based Joint Blockchain-enabled Service placement and Task Assignment algorithm (PSO-JBSTA), and a Genetic Algorithm-based approach (GA-JBSTA). Through extensive simulations, we demonstrate the effectiveness of PSO-JBSTA (resp. GA-JBSTA) and their adaptability to network conditions, achieving an average 35% (resp. 24%) improvement in users’ service satisfaction rate and 9.5% (resp. 10.2%) reduction in average blockchain validation delay compared with the baselines.	10.1109/TNSM.2026.3737068