TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Hussein Fawaz, Jacopo Talpini, Marco Savi, Silvia Giordano, Omran Ayoub	Detecting Zero-Day Attacks via Reconstruction of Feature Influence and Model Uncertainty	2026	Early Access	Modeling Uncertainty Training	In practical Network Intrusion Detection System (NIDS) deployments, detecting anomalies is only the first step, while determining the exact nature of those anomalies is equally important. Commonly, anomalous traffic is forwarded to a supervised multiclass classifier trained to identify known attack categories. While effective for known threats, this step presents a significant limitation, as zero-day attacks can be misclassified as known attacks. Therefore, there is a need for approaches that go beyond standard classification and can reliably recognize when an input does not conform to any learned attack pattern, i.e., zero-day attacks. To tackle this problem, we propose a novel detection strategy that leverages per-instance feature importance scores from an explainable Artificial Intelligence (XAI) framework and prediction uncertainty estimates derived from an ensemble classifier. To evaluate our approach, we conduct extensive experiments using a leave-one-attack-out strategy across three benchmark datasets, CICIoT2023, NF–TON–IoT, and CIC–DDoS2019, and test performance under two underlying classifiers, namely XG-Boost and Random Forest, demonstrating the model-agnostic nature of our method. Experimental results show that our approach achieves best-case AUROC gains approaching 40% and F1-score improvements of up to 73%, while maintaining positive or near-neutral worst-case performance across datasets, highlighting the effectiveness and robustness of jointly modeling explanation-driven reconstruction error and predictive uncertainty for reliable zero-day threat identification.	10.1109/TNSM.2026.3731401
Francisco Muro, Eduardo Baena, Tomaso De Cola, Sergio Fortes, Raquel Barco	AI-Driven Optimization of Virtual Network Function Allocation in 6G Non-Terrestrial Networks	2026	Early Access	Resource management Optimization Satellites	The integration of 6G technologies into Non-Terrestrial Networks (NTNs) raises a fundamental orchestration problem: how to allocate Virtual Network Functions (VNFs) across satellite and terrestrial domains under tight onboard resource constraints and a continuously changing topology. The virtualized 6G Open Radio Access Network (O-RAN) paradigm makes it possible to run 5G software stacks on Software-Defined Radios (SDRs) based on General Purpose Processors (GPPs), but it also turns VNF placement into a high-dimensional, multi-objective decision that static heuristics and model-based formulations struggle to capture. This paper addresses that gap by introducing an AI-driven VNF allocation framework for 6G-NTN environments built on an O-RAN-based distributed architecture and orchestrated on top of Kubernetes. The VNF allocation problem is formalized for a multi-domain 6G-NTN scenario with constrained satellite resources, and a measurement-based test campaign is designed to characterize the emulated platform in terms of virtual resource utilization and end-to-end performance. The framework couples tree-based machine learning predictors with a gradient-free optimizer to reach the optimal feasible allocation, outperforming two heuristic baselines drawn from the VNF placement literature by reducing the service RTT by up to 39% and delivering up to 3× higher YouTube DL throughput with respect to the best feasible heuristic. Beyond these gains, the proposed framework establishes a measurement-driven, reproducible methodology for VNF allocation in 6GNTN scenarios, demonstrating that AI-driven orchestration can systematically uncover non-obvious resource configurations that purely analytical or static approaches consistently miss.	10.1109/TNSM.2026.3724474
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Pingping Dong, Liying Chen, Xuan Yao, Kai Wang, Lianming Zhang, Jiawei Huang	Fumer: Proactive Time-Shifting for Synchronized Periodic Traffic in Distributed Training	2026	Early Access	Training Timing Modeling	The growth of distributed training models, with parameters now reaching the billion-scale, has shifted the system bottleneck from computation to communication. While Remote Direct Memory Access (RDMA) is widely deployed to improve network performance by circumventing the kernel mechanism, the synchronization-computation cycles under the synchronous parallel mode introduce a highly synchronized and periodic “on-off” bursty traffic pattern, which poses significant challenges to data center networking. Consequently, distributed training suffers from two critical bottlenecks: instantaneous congestion during communication and persistent link idleness during computation. These issues lead to severe bandwidth contention and resource underutilization, ultimately hindering overall training efficiency. To address these challenges, this paper proposes Fumer, a proactive periodic traffic optimization framework that shifts the congestion control paradigm from reactive rate adjustment to proactive time-shifting. Specifically, Fumer leverages In-band Network Telemetry (INT) and Fast Fourier Transform (FFT) with signal-wave separation to decompose interleaved traffic signals, aiming to overcome the lack of periodic awareness. Furthermore, Fumer employs an off-peak transmission optimization algorithm to calculate optimal time-shift values, thereby tackling synchronized congestion and link idleness. By executing proactive off-peak scheduling, Fumer shifts overlapping communication windows into idle periods to smooth traffic peaks in the time domain. Experimental results show that Fumer boosts average path throughput across all workloads to 86.3 Gbps, improving upon DCQCN (42.6 Gbps) by 102.6% and RECC by 22.1%. Furthermore, it reduces the average and 99.9th-percentile iteration times by up to 25.0%-45.4% and 25.5%-49.3%, respectively, demonstrating its efficacy and robustness across diverse large-scale training workloads.	10.1109/TNSM.2026.3728016
Wei Zhang, Shiyun Xiong, Yixin Li, Yan Lei, Hongyi Li	TCAA: An Efficient Blockchain Consensus Based on Transaction Collector and Address Aggregation for UAV Ad Hoc Networks	2026	Early Access		Blockchain technology provides a promising solution to data security and trust challenges in UAV ad hoc networks. However, conventional consensus mechanisms suffer from notable inefficiencies in resource-constrained environments, characterized by high computational and communication overhead, and prolonged consensus latency. To address these limitations, this paper proposes a blockchain consensus mechanism based on Transaction Collector and Address Aggregation (TCAA) for UAV ad hoc networks. We introduce a block proposal algorithm using a transaction collector, which dynamically assigns block proposal rights through a difficulty threshold. This threshold is defined by transaction types and quantities, thereby eliminating dependence on hash competition or voting verification. The block proposal algorithm operates in parallel with the gossip protocol, ensuring randomness in mempool transactions and unpredictability in proposer selection. Moreover, TCAA incorporates an encrypted address aggregation and recognition scheme to accelerate block synchronization. This scheme allows the block sender to proactively discern the state of the receiver’s mempool, which substantially reduces communication rounds and message redundancy across the network. We model the message synchronization process using a two-dimensional Markov chain and derive closed-form expressions for the end-to-end latency, bandwidth consumption, consensus latency, and transaction collection rounds. Experimental results demonstrate that for a block containing 1000 transactions and a RTT of 50 ms, TCAA reduces the end-to-end latency by 29.7%, 25.3%, and 22.9% compared to Compact, Graphene, and XThin, respectively, while achieving a communication complexity of 2n.	10.1109/TNSM.2026.3732846
Rita Ingabire, Antonio Bazco-Nogueras, Vincenzo Mancuso, Luis M. Contreras, Jesús Folgueira	Explainable AI to Understand the Latency Behavior of Public Cloud Service Platforms	2026	Early Access	Clouds Distance measurement Forecasting	Cloud platforms have become a core component of the Internet because most services and products rely on them to host their backends. Estimating and understanding the latency experienced when accessing those cloud platforms is a challenge of growing importance that has not been sufficiently studied. To address this relevant matter, we conducted a three-month measurement campaign, collecting traceroute data every 30 min across 256 source–destination probe pairs. Our specific goal is to analyze whether the current network is able to provide adequate performance for emerging applications and services. We use this dataset to evaluate the performance of forecasting algorithms when predicting cloud latency from both temporal and spatial perspectives, and we leverage post-hoc explainability methods to identify the drivers affecting latency. Several prior studies provide public cloud-latency datasets, but these datasets are generally analyzed in isolation. To close this gap and provide a cross-dataset comparative analysis of cloud-latency measurements, we analyzed the related publicly available datasets and applied a common forecasting and explainability workflow to compare their findings. Our analysis reveals that operators do not require complex methods to predict latency and that distance and a few other simple features are sufficient to achieve operationally accurate predictions. We find latency to be remarkably stable from the user’s perspective, both over the duration of the campaign and across hours of the day, which contrasts with previous findings, and we show that the specific path traversed has a significant impact on latency.	10.1109/TNSM.2026.3730351
Xiaodi Wang, Yunwei Dong, Weizhi Meng, Meng Li, Yining Liu	Dropout-Tolerant Privacy-Preserving Aggregation for Federated Mobile Crowdsensing	2026	Early Access	Modeling Privacy Internet of Things	Federated Learning (FL) has emerged as a key enabler for privacy-preserving, decentralized sensing systems, giving rise to Federated Mobile Crowdsensing (F-MCS). A well-known bottleneck in such systems is the inefficiency of synchronous training, which stalls for all participants and is susceptible to stragglers in heterogeneous environments. Although asynchronous FL methods have been explored to alleviate this, they often introduce the critical issue of stale updates, which can degrade model convergence and accuracy. To simultaneously address the challenges of efficiency, staleness, and robustness, this paper proposes a novel Dropout-Tolerant Privacy Aggregation (DTPA) scheme for FL that operates without a trusted third party (TTP). Our solution leverages the distributed decryption feature of the lifted EC-ElGamal cryptosystem to enable secure, decentralized model aggregation. We further introduce an efficient worker selection algorithm to systematically reduce waiting time. Moreover, a dedicated dropout-tolerant mechanism is developed to maintain protocol execution even under a high rate of client failures, thereby enhancing robustness. Security analysis confirms that our scheme fulfills essential privacy and security requirements. Extensive simulations demonstrate that the proposed DTPA scheme significantly improves training efficiency and convergence stability compared to state-of-the-art methods, while remaining practical for deployment on resource-constrained mobile devices.	10.1109/TNSM.2026.3732465
Jesús F. Cevallos-Moreno, Alessandra Rizzardi, Sabrina Sicari, Alberto Coen-Porisini	TIGER: an open-source cyber-Threat Intelligence Game Environment for Reinforcement learning	2026	Early Access	Cyber threat intelligence Labeling Training	Open-source testbeds for intrusion detection and mitigation enable benchmarking the efficacy of machine-learningbased cyber-defensive systems under increasingly realistic, heterogeneous network scenarios. In this context, the open-world nature of network intrusion detection requires defences to use continual learning strategies to adapt pattern-matching to new attack classes. The cost of periodically fine-tuning pre-trained detectors is not only computational but also encompasses the broader Cyber Threat Intelligence (CTI) life-cycle, which involves collecting, analyzing, and processing raw data into actionable insights. For ML-driven defensive systems, such actionable CTI ultimately takes the form of curated, labelled traffic traces of novel attacks. However, the concurrent optimisation of these intelligence-gathering costs and defence effectiveness has received little attention from the research community. In this respect, this work presents TIGER, an open-source Threat Intelligence Game Environment for Reinforcement learning-based agents to be trained and evaluated toward the optimisation of the costs-benefit trade-off associated with realistic ML-driven cyberdefence life-cycles. TIGER uses realistic network simulation software to model an active-learning game in which an agent learns to timely purchase CTI—abstracted in our environment as labelled samples of Zero-day attacks— to retrain its intrusion detection machinery on new attack patterns, while considering a constrained resource availability scenario.	10.1109/TNSM.2026.3732249
Xiaolong Cui, Xuebin Tang, Yuchen Wang, Xinyi Xu, Xiying Fan, Wei Huangfu	Aligning Routing with Service Intent in Logical Networks: A QoS-Driven Graph Attention Reinforcement Learning Framework	2026	Early Access	Routing Quality of service Optimization	Network virtualization enables the creation of multiple logical networks on shared physical infrastructure, each supporting homogeneous traffic with a dedicated Quality of Service (QoS) objective. This shifts the routing problem from arbitrating among heterogeneous flows to holistically orchestrating traffic toward a single service intent. However, existing routing schemes, including those based on Deep Reinforcement Learning (DRL), lack mechanisms to align forwarding decisions with these high-level intents, leading to a performance gap. To bridge it, we propose QGARL, a QoS-driven Graph Attention Reinforcement Learning framework. Its core is an intent-conditioned attention mechanism that dynamically guides a DRL agent’s perception of the network graph based on the service’s QoS intent, enabling the learning of intent-aware routing policies without per-service algorithm redesign. Extensive experiments demonstrate that QGARL consistently outperforms state-of-the-art baselines in intent-weighted QoS utility across diverse services and topologies. This work establishes intent alignment as a guiding principle for routing in logical networks and provides a practical, learning-based framework to achieve it.	10.1109/TNSM.2026.3731467
Chenyu Zhao, Xin Li, Tianhao Liu, Shanguo Huang	Joint Design and Operation Phases Availability Evaluation for End-to-End Light-Paths in Optical Networks	2026	Early Access	Modeling Availability Lighting	The rapid growth of high-bandwidth services places stringent requirements on the availability of optical networks. Ensuring high availability in practice hinges on accurate and consistent evaluation of light-path availability in both the design and operation phases. To this end, this paper proposes a unified model for light-path availability evaluation in optical networks that couples an ensemble learning–based failure classifier with a Dynamic Bayesian Network (DBN). In the design phase, the model functions as a model-driven DBN whose transition probabilities are parameterized by historical failure and repair rates, supporting three-state (normal, soft failure, hard failure) modeling at component and path levels under different protection schemes. During the operation phase, the same DBN structure is driven by real-time observations inferred from monitoring data (e.g., input/output optical power) using ensemble learning-based classifiers. This enables the evaluation of instantaneous availability under limited measurement conditions. Furthermore, classification results are mapped to Conditional Probability Tables (CPTs) via confusion matrices to quantify the impact of classifier uncertainty on availability evaluation. Experimental results on a Kafka-based optical-network telemetry testbed show that, under the fault-event-based chronological split, XGBoost achieves an accuracy of 93.24% and a macro-averaged F1-score of 0.8183. Case studies involving different protection schemes and three representative network topologies show how backup end-to-end light paths affect availability and demonstrate the computational feasibility of the model across different network scales. Furthermore, it supports online availability updates and the identification of critical components. This work serves as a reference for optical network management and offers significant guidance for the future design of robust optical network systems.	10.1109/TNSM.2026.3731278
Mohamed Anis Sakka, Fahdah Alalyan, Wael Jaafar, Rami Langar	FML-AD: A Federated Learning Framework with Meta-Model Refinement for Cyberattack Duration Prediction in 5G O-RAN	2026	Early Access	Modeling 5G mobile communication Open RAN	The emergence of fifth-generation (5G) and open radio access network (O-RAN) architectures has expanded the attack surface for cyber threats, creating an urgent need for enhanced and proactive mitigation strategies to ensure the preservation of quality of service (QoS), network reliability, and user data privacy in highly distributed and virtualized environments. In this context, we introduce FML-AD, a federated learning framework with meta-model refinement for adaptive attack duration prediction without centralizing raw training traffic. The proposed method combines a FLAD-trained Transformer for distributed temporal learning with an XGBoost-based second-level regression model that refines the initial predictions using controlled O-RAN testbed examples, thereby reducing prediction errors associated with the benchmark-to-deployment distribution shift. Extensive evaluation on the CICIoT2023 dataset shows that FML-AD improves prediction accuracy compared with conventional centralized and federated baselines. Furthermore, an evaluation on a controlled 5G O-RAN testbed involving ten TCP SYN and UDP flooding scenarios provides a proof-of-concept demonstration of the feasibility of the proposed post-detection prediction pipeline in the evaluated configuration. A separate exploratory transfer-learning assessment using 5G V2X radio-jamming scenarios and leave-one-scenario-out (LOSO) validation further examines whether the duration-prediction pipeline can be adapted to a different disruption mechanism under limited target-domain data. For the considered jamming configurations, several operating points in the early 3–5 sec range also produce favorable prediction results, providing preliminary evidence of transferability.	10.1109/TNSM.2026.3731093
Bita Fatemipour, Zhe Zhang, Marc St-Hilaire	Adaptive Routing Optimization with Cost and Deadline Awareness Using Hierarchical Deep Reinforcement Learning	2026	Early Access	Costing Costs Routing	Timely and cost-efficient data transfers in large-scale networks remain challenging due to diverse topologies, non-uniform pricing models, and variable traffic demands. Existing literature often relies on multi-objective optimization, employing heuristic methods to reduce computational complexity; however, these approaches typically assume stable or predictable demand and struggle to scale effectively. Reinforcement Learning (RL) has been explored for its adaptability, yet many RL-based methods remain single-objective or topology-agnostic. This paper introduces CD-DRL, a hierarchical Deep RL framework that jointly optimizes transmission cost and deadline satisfaction, two objectives that often conflict in large-scale networks, through two cooperative agents. A routing agent, built on a Graph Neural Network, selects paths over a structured, multi-binary action space, enabling topology-aware routing across varying network scales and demand patterns. An adaptive tuning agent observes network state and recent performance to dynamically adjust the cost-deadline tradeoff to best fit current conditions. This hierarchical design allows CD-DRL to respond to dynamic network events such as congestion and bandwidth fluctuations, where no single fixed tradeoff remains optimal. We validate CD-DRL through extensive experiments on diverse backbone topologies and request distributions under static and time-varying network conditions. Compared with a state-of-the-art GNN-based RL method and traditional heuristics, CD-DRL improves the deadline-met ratio by up to 25% while maintaining competitive total cost and demonstrating strong scalability. Additionally, CD-DRL achieves faster execution time than mathematical optimization baselines, enabling high-throughput, latency-sensitive routing in dynamic environments.	10.1109/TNSM.2026.3731031
Deepak Kanneganti, Sajib Mistry, Sheik Mohammad Mostakim Fattah, Erik Elmroth, Aneesh Krishna, Monowar Bhuyan	Performance Drift Detection in Machine Learning as a Service (MLaaS) for IoT Environments	2026	Early Access	Modeling Signal detection Internet of Things	Machine Learning as a Service (MLaaS) is a powerful cloud paradigm enabling data-driven intelligent applications in Internet of Things (IoT) environments, widely adopted across healthcare, smart homes, and industry due to its costeff-ectiveness. However, the dynamic nature of IoT frequently alters data distributions, affecting MLaaS stability, while periodic MLaaS updates further introduce performance drift. Unlike traditional ML systems, MLaaS clients operate as black-box users without access to internal data or parameters, making drift detection particularly challenging. To address this, we propose a novel MLaaS Performance Drift Detection framework for IoT environments. The framework first employs an MLaaS extraction model that learns service behavior from input–output pairs and identifies prediction-influenced features. Building on this, the proposed MLaaS Performance Drift Detection (MPDD) model jointly captures variations in input data and MLaaS behavior.We further design an Adaptive-Temporal Performance Drift Detection Mechanism (APDDM) that dynamically adjusts monitoring frequency based on behavioral and data variations, enabling timely drift detection for effective service management. Extensive experiments on real-world datasets demonstrate that MPDD achieves up to 22–25% accuracy improvement over baseline drift detection methods. APDDM provides an average accuracy gain of approximately 4% and reduces the miss detection rate by around 9% compared to fixed-interval monitoring.	10.1109/TNSM.2026.3732372
Jindian Liu, Zhuo Li, Hao Xun, Yu Zhang, Peng Luo, Qiang Li, Kaihua Liu	FSD-GCN: Fast Network-wide Sketch Deployment via Graph Convolution Network	2026	Early Access	Fluid flow Topology Measurement	Sketches have been widely used in network measurement thanks to their low resource overheads. Network-wide sketch deployment is essential for measuring flows across the entire network to enable comprehensive monitoring and decision-making. Most frameworks for network-wide sketch deployment formulate it as a mixed integer linear programming (MILP) problem and utilize commercial solvers such as Gurobi to produce the optimal nodes deployed with sketches. However, the network topology changes frequently. When the topology changes, it is necessary to reconstruct the MILP and re-solve it. Due to the NP hardness, the solvers have to handle a substantial number of variables and constraints, and iteratively converge to the optimal nodes, which is too time-consuming to adapt to frequent topology changes. To this end, a framework for fast network-wide sketch deployment via graph convolution network called FSD-GCN is proposed. Unlike the solvers that gradually converge to the optimal nodes, FSD-GCN transforms the MILP derived from the network-wide sketch deployment problem into a graph-structured representation, and utilizes a graph convolution network to directly obtain the probability of deploying sketches at each node. Meanwhile, an integer linear programming model called NCR is proposed to be used in FSD-GCN, which can achieve maximum flow cover rate with minimum redundant measurement while requiring the fewest deployed nodes. The experimental results show that NCR solved by FSD-GCN can reduce the number of deployed nodes and redundant measurement, while achieving the highest flow cover rate. Meanwhile, compared with the state-of-the-art frameworks using Gurobi, NCR solved by FSD-GCN reduces solving time more than 90%.	10.1109/TNSM.2026.3731617
Junior Momo Ziazet, Brigitte Jaumard	Energy Efficient Placement of Logical Functionalities in 5G Networks	2026	Early Access	Energy Copper Modeling	Although 5G networks are more efficient in terms of power consumption to traffic ratio, efforts still need to be made to further increase energy efficiency not only for the radio part, but also with respect to the growing cloud component with edge servers. Consolidation of traffic workloads onto shared infrastructures is a key feature of cloud computing to reduce energy consumption, and logical functionality placement plays a key role in this regard. Here, in the cloud RAN context, we propose a unified and energy-aware logical placement of 5G E2E functionalities, i.e., distributed units (DUs), centralized units (CUs), and user plane functions (UPFs), together with traffic routing. The placement problem is formulated as a large-scale integer linear program and solved using a column generation-based decomposition technique, complemented by an efficient heuristic to ensure tractability and improved scalability. The model captures key network and cloud (compute) resources, jointly optimizing the placement of DU, CU, and UPF components, along with traffic routing, to minimize energy consumption while maintaining low latency and high Quality of Service (QoS). Numerical results, based on an open Montreal traffic dataset, demonstrate that the proposed column generation algorithm achieves near-optimal solutions, while the heuristic approach offers significantly better scalability with consistently strong performance. The proposed methods reduce energy consumption by up to 14% and maintain low-latency service delivery. Furthermore, the results highlight that static, peak-time-based placement strategies can lead to inefficiencies throughout the day, emphasizing the importance of accounting for broader temporal traffic patterns.	10.1109/TNSM.2026.3729149
Jianer Zhou, Xinyi Qiu, Zhenyu Li, Gareth Tyson, Encheng Yu, Weichao Li, Heng Pan, Xinyi Zhang, Zhiwei Xu	Themis: An Adjustable Congestion Control Framework for Improving Video QoE	2026	Early Access	Quality of experience Videos Fluid flow	Optimizing congestion control algorithms (CCAs) has the potential to enhance video quality of experience (QoE). The goal of this work is to devise a congestion control framework that (i) ensures that individual users enjoy high video QoE, while (ii) minimizing variance, such that QoE is fairly distributed across all users, especially in fluctuating network, such as cellular network. We present Themis, a video-centric congestion control framework. Themis first uses a distributed approach to allocate a fair target QoE for each client. Based on this fair QoE, Themis then selects congestion control actions to optimize for video QoE (rather than throughput) based on application-layer signals provided by the client. Thus, rather than trying to maximize a flow’s (fair) share of bandwidth, Themis optimizes a flow’s share of the QoE budget. We evaluate Themis in both emulated and production networks. We show that in cellular network Themis achieves a 12.4% QoE improvement compared with BBR, and 37.1% QoE standard deviation decrease compared with the state-of-the-art, Minerva.	10.1109/TNSM.2026.3732350
Yuya Miyaoka, Masaki Inoue, Kengo Urata, Shigeaki Harada	Chat-Driven Optimal Management for Virtual Network Services	2026	Early Access	Modeling Large language models Central Processing Unit	This paper proposes a chat-driven network management framework that integrates natural language processing (NLP) with optimization-based virtual network allocation, enabling intuitive and reliable reconfiguration of virtual network services. Conventional intent-based networking (IBN) methods depend on statistical language models to interpret user intent, but cannot guarantee the feasibility of generated configurations. To overcome this, we develop a two-stage framework consisting of an Interpreter, which extracts intent from natural language prompts using NLP, and an Optimizer, which computes feasible virtual machine (VM) placement and routing via integer linear programming. In particular, the Interpreter translates user chats into update directions, i.e., whether to increase, decrease, or maintain parameters such as CPU demand and latency bounds, thereby enabling iterative refinement of the network configuration. In this paper, two distinct Interpreter implementations are introduced: a Sentence-BERT model with support vector machine (SVM) classifiers and a large language model (LLM). Experiments in single-user and multi-user settings show that the framework dynamically updates VM placement and routing while preserving feasibility. The LLM-based approach achieves higher accuracy with fewer labeled samples, whereas the Sentence-BERT with SVM classifiers provides significantly lower latency suitable for real-time operation. We also compare our cascade structure method with an end-to-end LLM approach, highlighting our proposed method’s high level of reliability.	10.1109/TNSM.2026.3726950
Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh	Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices	2026	Early Access	Schedules Scheduling Cloning	Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline.	10.1109/TNSM.2026.3694238
Martine S. Lenders, Carsten Bormann, Thomas C. Schmidt, Matthias Wählisch	A Leaner and Faster Web: How CBOR Can Improve Dynamic Content Encoding in JSON and DNS over HTTPS	2026	Early Access	Internet of Things Encoding Internet	The Internet community has taken major efforts to decrease latency on the World Wide Web with significant improvements in accelerating content transport and in compressing static content. Less attention, however, has been dedicated to compression of dynamic content. Such content is commonly provided by JSON and DNS over HTTPS. Dynamic content objects continue to grow in size, which increases latency and fosters the digital inequality. In this paper, we propose to mitigate this increase by utilizing Concise Binary Object Representation (CBOR), a standard originally designed for the constrained Internet of Things (IoT) to restrict packet sizes and enable efficient encoding of data objects. We provide protocol design and three new data sets for the evaluation of dynamic content, DNS, and the loading of websites. Our key findings are the following: (i) Switching the data representation from JSON to CBOR reduces data by up to 80%. This size reduction can decrease loading times by up to 13.8% when downloading large objects—even in local setups. (ii) Enabling CBOR for DNS over HTTPS (DoH) and DNS over CoAP (DoC) reduces packet sizes significantly. Compressing only names combined with unpacked CBOR achieves maximum gain of 52.2%, using more complex but still lightweight Packed CBOR allows minimizing packets by up to 95.5%. Our lean decoder for name compression can fit into as little as 314 bytes of build size. Our results clearly show the potential of CBOR outside of IoT scenarios. Parts of this research have already influenced work within the IETF.	10.1109/TNSM.2026.3722114
Raeed Al-Sabri, Abdullatif Albaseer, Mohamed Abdallah, Ala Al-Fuqaha	DMGCRL: Dynamic Multi-Scale Graph Contrastive Representation Learning For Network Intrusion Detection	2026	Early Access	Modeling Intrusion detection Labeling	Graph neural networks (GNNs) have recently attracted significant attention in network intrusion detection systems (NIDS) due to their ability to model network traffic as graphs and capture complex relationships within network flows. However, existing GNN-based methods face critical limitations: they rely on limited or noisy labeled data and struggle to detect threats at various scales, ranging from local anomalies (e.g., port scanning) to coordinated subnetwork attacks (e.g., botnets) and global network-wide campaigns (e.g., DDoS attacks). To bridge this gap, we propose Dynamic Multiscale Graph Contrastive Representation Learning (DMGCRL), a self-supervised framework that hierarchically models network intrusions at different levels. At the node level, DMGCRL constructs structure-aware subnetworks around individual traffic flows to capture fine-grained behavioral deviations. For subnetwork-level threats, it employs substructure-aware pooling to identify coordinated anomalies among clustered malicious nodes. Finally, at the global level, DMGCRL derives representations that reflect the holistic state of the network, enabling detection of large-scale threats, such as distributed malware propagation. DMGCRL designs a shared GNN encoder with a multi-level contrastive loss to align multiscale representations while largely eliminating label dependence. It learns discriminative features from unlabeled traffic, refines decision boundaries without supervision, and reveals anomalies by contrasting related and unrelated nodes across scales. Performance evaluation was conducted on five publicly available network traffic datasets for binary and multiclass detection. Results show that DMGCRL consistently outperforms SOTA methods, achieving an F1 score of 99.86% on NF-CSECIC-IDS2018-V2 and 96.11% on NF-UNSW-NB15-V2 under binary detection and the lowest mean false positive rates, 1.28% and 2.33% under multiclass detection on the two datasets.	10.1109/TNSM.2026.3726282