TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Yali Yuan, Qianqi Niu, Yachao Yuan	Early-MFC: Enhanced Flow Correlation Attacks on Tor via Multi-view Triplet Networks with Early Network Traffic	2026	Early Access	Fluid flow Correlation Modeling	Flow correlation attacks are an efficient type of network attack, aiming to expose those who use anonymous network services, such as Tor. Conducting such attacks during the early stages of network communication is particularly critical for scenarios demanding rapid decision-making, such as cybercrime detection or financial fraud prevention. Although recent studies have made progress in flow correlation attacks techniques, research specifically addressing flow correlation with early network traffic flow remains limited. Moreover, due to factors such as model complexity, training costs, and real-time requirements, existing technologies cannot be directly applied to flow correlation with early network traffic flow. In this paper, we propose flow correlation attack with early network traffic, named Early-MFC, based on multi-view triplet networks. The proposed approach extracts multi-view traffic features from the payload at the transport layer and the Inter-Packet Delay. It then integrates multi-view flow information, converting the extracted features into shared embeddings. By leveraging techniques such as metric learning, the method optimizes the embeddings space by ensuring that similar flows are mapped closer together while dissimilar flows are positioned farther apart. Finally, Bayesian decision theory is applied to determine flow correlation, enabling high-accuracy flow correlation with early network traffic flow. Furthermore, we investigate flow correlation attacks under extra-early network traffic flow conditions. To address this challenge, we propose Early-MFC+, which utilizes payload data to construct embedded feature representations, ensuring robust performance even with minimal packet availability. Simulation results demonstrate that Early-MFC reduces packet requirements by 80% compared to the state-of-the-art DeepCoFFEA system, while Early-MFC+ maintains formidable attack efficacy even when constrained to only the first ten packets of each flow.	10.1109/TNSM.2026.3714549
Deemah H. Tashman, Soumaya Cherkaoui	Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks	2026	Early Access	Reconfigurable intelligent surfaces Reliability Optimization	Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems.	10.1109/TNSM.2026.3660728
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Dev Gurung, Shiva Raj Pokhrel	LLM-QFL: Distilling Large Language Model for Quantum Federated Learning	2026	Early Access	Modeling Federated learning Large language models	As Quantum Federated Learning (QFL) scales toward distributed quantum networks, managing heterogeneous resources and communication bottlenecks becomes a critical challenge. This research proposes LLM-QFL, an adaptive network service management framework that leverages Large Language Models (LLMs) to optimize the operational efficiency of QFL systems. We introduce a federated distillation method in which locally fine-tuned LLMs serve as autonomous network agents. These agents adaptively manage service parameters by: i) dynamically adjusting local computation intensity (optimizer steps) based on loss gradients, ii) performing variance-aware client selection to minimize network-wide heterogeneity, and iii) implementing intelligent early stopping criteria to conserve bandwidth. By serving as an orchestration layer, LLM-QFL provides a synergy between LLMs and quantum networking. Our contributions include: i) Adaptive Performance and Efficiency: Reducing idle computation and significantly cutting communication overhead; ii) Theoretical Rigor: Convergence guarantees of O(1/T) for the adaptive management protocol; and iii) Scalable Deployment: Implementing PEFT (LoRA/QLoRA) for resource-constrained quantum service nodes.	10.1109/TNSM.2026.3712394
Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh	Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices	2026	Early Access	Schedules Scheduling Cloning	Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline.	10.1109/TNSM.2026.3694238
Masoumeh Safkhani, Mohammad Reza Servati, Fatemeh Rezaei	HEIoT: A Novel Three-Factor Authentication Protocol for Enhanced Security in IoT and Next-Generation Networks	2026	Early Access	Authentication Internet of Things Protocols	The Internet has a significant impact on contemporary society, enabling a wide range of applications, including advanced cellular networks such as 4G, 5G, and 6G. Since these communications occur over shared or open channels, ensuring secure data exchange is of critical importance, as any weakness in the communication infrastructure may compromise system reliability. Device authentication in the Internet of Things (IoT) and user authentication in smart environments, such as smart homes, remain fundamental security challenges. As the first line of defense, authentication mechanisms must be robust, since vulnerabilities at this stage can expose the entire system to serious threats. To address these challenges, numerous authentication schemes based on cryptographic primitives, including Elliptic Curve Cryptography (ECC), have been proposed. In this paper, we present a comprehensive security analysis of an ECC-based three-factor authentication protocol proposed by Yuan et al. Our analysis shows that the protocol is vulnerable to desynchronization, user impersonation, traceability, and insider attacks, all of which succeed with probability 1 by exploiting at most two protocol phases. To mitigate these weaknesses, we propose an improved authentication scheme, called HEIoT. The proposed scheme is formally analyzed under the Real-or-Random (RoR) model to establish session-key security and is further verified using the Scyther tool. Moreover, a Python-based implementation is provided to demonstrate the practicality of the proposed protocol. Comparative results indicate that HEIoT achieves stronger security while maintaining acceptable communication, computational, and storage overhead.	10.1109/TNSM.2026.3702041
Yongqiang Dong, Jiangnan Sun, Jiawen Li, Yongbo Liu	Learning to Configure Like Engineers: Manual Guided Network Configuration Sketch Generation	2026	Early Access	Modeling Syntactics Large language models	Network configuration automation is a key component of intelligent network operations aiming to transform user intents into executable device configurations. Most existing approaches take a paradigm of parameter filling within predefined sketches, where the sketches have to be crafted manually by engineers and user intents are expressed in a specific format. Other studies follow a routine of synthesizing configurations directly from natural-language intents, taking advantage of large language models (LLMs) and retrieval augmented generation techniques. The results are yet far from satisfactory in practice due to the complexity of the network configuration requirements. A recently proposed example-driven configuration synthesis method (CEGS), attempts to learn from configuration examples provided by vendors. However, its effectiveness is bounded by example coverage, and the method struggles to generalize to new scenarios. To address this, we present LCLE, an end-to-end sketch generation framework that learns how to configure networks from device configuration guides and command references, much as human engineers do. Specifically, LCLE automatically generates configuration sketches from natural-language intents by LLMs with a structured device configuration model (DCM) extracted from vendor manuals. The DCM organizes configuration workflows, command syntax, and view hierarchies into a unified knowledge base that supports LCLE’s retrieval-augmented generation through a three-stage pipeline of intent parsing, sketch generation, and sketch optimization. Extensive experiments on Huawei and Cisco devices show that LCLE significantly improves the semantic completeness and syntactic correctness of the generated configuration sketches. In addition, the framework can be easily extended to new devices and protocols through DCM updates, promising a scalable solution for automated network configuration.	10.1109/TNSM.2026.3710600
Mohammad Rasool Momeni, Abdollah Jabbari, Carol Fung	An Efficient, Secure, and Privacy-Preserving Communication Protocol for Drone-Assisted Disaster Management in Smart Cities	2026	Early Access	Drones Authentication Protocols	Drones (also referred to as unmanned aerial vehicles) have attracted significant attention within smart city ecosystems due to their ability to detect crises promptly and provide real-time support for disaster management services. However, the increasing risks of cyber and physical attacks, along with potential private data leaks, present substantial challenges to their deployment in smart city environments. In this paper, we propose a secure communication protocol that leverages a novel group authentication scheme (GAS), tailored for disaster management services in smart cities. The proposed scheme enables both group key agreement among drones and individual session key establishment between each drone and the control center (CC). Hence, our protocol preserves data confidentiality, message integrity, and data privacy, and verifies the authenticity of communicating parties. We employ physically unclonable functions (PUFs) and reverse fuzzy extractors to withstand critical threats, including physical attacks and machine learning (ML)-based modeling attacks. Our protocol also uses lightweight cryptographic primitives, such as hash-based message authentication codes (HMACs) and exclusive-OR (XOR) operations to ensure efficiency. Comprehensive security analysis using formal proofs and the Scyther tool demonstrates that the proposed scheme resists various attacks while preserving data privacy in IoD-enabled services. Ultimately, performance analysis results confirm that the proposed protocol is efficient and feasible.	10.1109/TNSM.2026.3714291
Hailey Shakespear-Miles, Sima Barzegar, Marc Ruiz, Luis Velasco	Multi-Agent Autonomous 6G Service Control with Intelligent Reconfiguration	2026	Early Access	Modeling Training Delays	Future 6G services will require strict performance guarantees, especially in terms of delay, end-to-end (e2e) across multiple network domains including packet and radio segments. While deterministic transport and slice-based capacity allocation can improve segment-level performance, ensuring e2e Network Service (NS) performance remains challenging as it requires making decisions Near–Real-Time (Near-RT) on a per-service basis, which does not fit well within the typical centralized control and orchestration hierarchy. Multi-agent systems (MAS), where a number of distributed agents collaborate, has demonstrated its capabilities for such Near-RT control. Agents equipped with Deep Reinforcement Learning (DRL) engines autonomously made traffic routing decisions based on e2e telemetry measurements. In this paper, we extend such MAS solutions for NS traffic routing focused on covering several issues that appear under frequent NS reconfiguration, e.g., caused by end device mobility. In addition, we define a lifecycle for NS operation that includes the initial MAS deployment, model reconfiguration during operation, and NS reconfiguration. The proposed lifecycle requires the definition of DRL training and validation procedures to produce models ready to be deployed with guaranteed performance under certain network conditions. In addition, model selection algorithms are defined for the lifecycle scenarios. In case of NS reconfiguration, a procedure for probe testing the actual network conditions is proposed to improve model selection. Evaluation across a meaningful set of network and traffic scenarios shows that the MAS is able to maintain e2e delay guarantees under all the lifecycle scenarios.	10.1109/TNSM.2026.3713972
Huakun Huang, Longtao Guo, Lingjun Zhao, Qinglin Yang, Wensheng Zhang	Line-level Smart Contract Vulnerability Detection via Semantic-Syntactic Feature Extraction and Global-Local Attention Network	2026	Early Access	Signal detection Modeling Codes	Smart contracts, a core component of Ethereum, automate the execution and management of transactions. However, potential vulnerabilities in smart contracts may trigger serious financial losses or even systemic risks. While existing vulnerability detection methods have achieved certain results, they are still deficient in the precision of line-level vulnerability localization and the breadth of supported vulnerability categories. Against this challenge, this paper proposes a line-level vulnerability detection method with semantic-syntactic feature extraction and global-local attention network. The method utilizes pre-trained model and abstract syntax tree to extract semantic-syntactic features of the code lines, and constructs multiple graph structures to realize the global feature representation of the contract. Based on that, the local network is responsible for extracting line-level features, the global network extracts structured global features, and the two are effectively fused through the attention mechanism. Experimental results show that the method achieves high accuracy and good generalization in the detection of multiple vulnerability categories, with an average F1-score of more than 98% for line-level detection and more than 96% for contract-level detection. This study improves the accuracy of line-level vulnerability detection and provides a valuable technical path for smart contract security research.	10.1109/TNSM.2026.3714059
Jorge Mirande, Tijani Chahed, Salah Eddine Elayoubi	Optimal transport of multimodal visual-haptic metaverse flows in the presence of eMBB traffic	2026	Early Access	Metaverse Resource management Enhanced mobile broadband	We study resource allocation for multiple metaverse users in 5G networks and beyond. To ensure an immersive experience, one should consider the multimodal nature of the metaverse, where each user generates multiple coupled flows, e.g., visual and haptic, characterized by joint Quality of Experience (QoE) requirements, for instance in terms of subjective Just Noticeable Difference (JND) metric. These flows can be transported via 5G services, such as Ultra Reliable Low Latency Communications (URLLC) for the haptic flow and enhanced Mobile Broadband (eMBB) for the visual one. Furthermore, the metaverse users share the radio resources with classical eMBB users. We formulate an optimization problem to maximize the weighted sum of visual throughput for metaverse users and the throughput of eMBB users relative to their minimum requirements, subject to fairness and feasibility constraints. Our approach accounts for discrete Modulation and Coding Schemes (MCS) and heterogeneous radio conditions. Numerical results show that our proposed scheme effectively balances throughput, fairness, and immersive-experience requirements, avoiding the feasibility violations observed under equal allocation and reducing immersive-constraint violations by approximately 19% with respect to a non-immersive baseline. We eventually make use of real haptic traffic traces to evaluate computation time and performance under varying haptic requirements.	10.1109/TNSM.2026.3714067
Xiaolan Ji, Biao Han, Yuedong Xu, Jinshu Su	ICCP: Towards Congestion Control Agent via Controlling Logic Decoupling and Algorithm Integration	2026	Early Access	Algorithms Fluid flow Modeling	To address the limitations of single congestion control algorithms (CCAs) in dynamic and heterogeneous network environments, selecting an appropriate algorithm from a pool of existing ones has become a widely adopted strategy. Existing mechanisms, however, are typically constrained by the Linux kernel’s unified abstractions, which limit the flexibility of selecting from a small set of in-kernel CCAs. Learning-based CCAs further increase the deployment cost because their inference logic is often compute-intensive and can block concurrent flows when executed within a synchronous control path. In this paper, we present ICCP, a unified congestion control framework that supports both heuristic and compute-intensive algorithms for concurrent flows. Rather than introducing a new reinforcement learning method, ICCP provides a three-layer, decoupled runtime framework consisting of the protocol stack, the user-space algorithm library, and the congestion control agent. ICCP uses asynchronous request handling, a shared proxy, and a “zero-copy” serialization-based RPC path to support both batch and single-inference modes with controlled communication overhead. We implement three distinct reinforcement learning-based congestion control algorithms within ICCP, including Sage, Orca, and DTCC, to evaluate the framework using representative compute-intensive CCAs. Simulations and real-world experiments demonstrate that ICCP maintains robust and efficient communication and inference performance as the number of concurrent flows increases. Overall, ICCP provides a practical runtime framework for integrating, evaluating, and deploying heterogeneous congestion control algorithms in multi-flow environments.	10.1109/TNSM.2026.3714992
Abdullah Othman, Georges Kaddoum, João V. C. Evangelista, Minh Au, Basile L. Agba	Joint Digital Twin Synchronization Scheduling and Resource Allocation for Post-Disaster Wireless Networks	2026	Early Access	Modeling Synchronization Cells (biology)	Digital twins (DTs) of wireless networks rely on accurate channel information to support resource allocation decisions. In post-disaster scenarios, the physical environment changes abruptly, rendering the DT’s pre-disaster channel model obsolete. Since restoring DT accuracy requires synchronization with the physical network through costly environmental updates, a fundamental tradeoff emerges between synchronization cost and decision quality. This paper formulates the joint optimization of DT synchronization scheduling, user–base station association, and uplink power control as a mixed-integer nonlinear program that maximizes the minimum user rate subject to synchronization budget and resource constraints. We decompose the problem into three subproblems solved via successive convex approximation and prove convergence of the alternating procedure to a stationary point. For the synchronization subproblem, we propose both a model-unaware formulation based on a coverage linear program requiring only user trajectory information, and a modelaware formulation that additionally exploits post-disaster channel knowledge to optimize the sync schedule for rate maximization. To characterize the impact of positioning uncertainty on the cell-based spatial model, we derive a closed-form expression for the cell-misclassification probability and develop a semi-analytical utility model that predicts the optimal grid resolution as a function of localization accuracy. The results of our simulations based on ray-traced channel data confirm that the proposed model-unaware sync closes 64–81% of the gap to the full-knowledge oracle across a range of system parameters, while the model-aware variant achieves 79–91% when post-disaster channels are available. The model-unaware approach thus exhibits the lowest sensitivity to DT model errors among all tested methods, making it the preferred choice when channel estimates are imperfect.	10.1109/TNSM.2026.3714917
Sanku Kumar Roy, Mohamed Samshad, Ketan Rajawat	UNet: A Generic and Reliable Multi-UAV Communication and Networking System Architecture for Heterogeneous Applications	2026	Early Access	Autonomous aerial vehicles Architecture Computer architecture	The rapid growth of UAV applications necessitates a robust communication and networking system architecture capable of addressing the diverse requirements of various applications concurrently, rather than relying on applicationspecific solutions. This paper proposes a generic and reliable multi-UAV communication and networking system architecture designed to support the varying demands of heterogeneous applications, including short-range and long-range communication, star and mesh topologies, different data rates, and multiple wireless standards. Our architecture is designed for both ad hoc and infrastructure networks, ensuring seamless connectivity throughout the network. Additionally, we present the design of a multi-protocol UAV gateway that enables interoperability among various communication protocols to enhance connectivity. Furthermore, we introduce a data processing and service layer framework with a graphical user interface of a ground control station that facilitates remote control and monitoring from any location at any time. We practically implemented the proposed architecture and evaluated its performance using different metrics, demonstrating its effectiveness.	10.1109/TNSM.2026.3715386
Abdullatif Albaseer, Elmahdi Bentafat, Mohamed Abdallah, Saif Al-Kuwari, Marwa Qaraqe	Incentive-Driven Honeypot Defense: A Multi-Agent DRL Framework for Securing Smart Grid Networks	2026	Early Access	Pricing Timing Learning (artificial intelligence)	Honeypot defenses present a robust solution for securing the Advanced Metering Infrastructure (AMI) against sophisticated cyberattacks. The efficacy of AMI defenses relies on the strategic deployment of honeypots by Small-scale Power Suppliers (SPSs) and the subsequent exchange of defense data with Traditional Power Retailers (TPRs). However, existing methods are limited by their requirement for prior information exchange and their inability to specify targeted services (i.e., protocols), making them impractical for dynamic environments. In addition, previous approaches have predominantly overlooked critical aspects such as service allocation and competition among SPSs. To address these challenges, we propose a novel Deep Reinforcement Learning (DRL)-based Stackelberg leader-follower game framework that facilitates tailored service allocation and fosters competition among SPSs. We leverage the Multi-Agent Deep Deterministic Policy Gradient (MADDPG) algorithm, which combines centralized training and distributed execution, to enable each SPS to autonomously learn optimal strategies that consider defense data quality and attack rates, without requiring prior knowledge of deployment costs or the actions of other SPSs. This adaptability minimizes the overhead associated with information exchange and improves the defense of vulnerable services. In particular, our method operates by requiring data collection, as each SPS functions as an independent learning agent that generates its own training experiences. Extensive simulations demonstrate that our proposed DRL-driven approach significantly outperforms baseline methods in different performance metrics. It achieves higher utility for both SPSs and TPR while maintaining lower operational costs.	10.1109/TNSM.2026.3715400
Zening Li, Pin-Han Ho	Topology-Constrained Generative Modeling for Performance Monitoring and Structural Anomaly Definition in Optical Transport Networks	2026	Early Access	Windows Modeling Semantics	Electrical-layer performance monitoring (PM) in optical transport networks is reported as window-aggregated counters, under which propagation delay and signal regeneration boundaries are not directly observable. Consequently, different impairment mechanisms can lead to statistically similar PM trajectories, leaving PM-only methods without a principled notion of nominal behavior or anomaly detectability. To address this limitation, this paper proposes Topology-Constrained Partially Observed Dynamical System (TC-PODS). TC-PODS defines a topology-consistent nominal predictive reference directly in PM space by introducing a latent impairment state (LAT) that enforces service-path propagation and regeneration semantics as supervisory constraints, while explicitly modeling the irreversible projection induced by windowed PM observation. This formulation disambiguates nominal variability from anomalous behavior under partial observability and defines anomalies as PM trajectories that are incompatible with any topology-consistent nominal generation. By shifting PM analysis from algorithm-centric detection toward detectability-aware inference under the deployed observation protocol, TC-PODS provides a principled framework for forecasting and anomaly interpretation under partial observability, with future applications to structure-aware failure management.	10.1109/TNSM.2026.3715222
S A Harish, S Vignesh, Divya Pathak, Anil Kumar Sharma, Praveen Tammana	Anomaly Detection in In-Network Fast ReRoute Systems	2026	Early Access	Fluid flow Planing Delays	High-speed programmable data planes provide opportunities to implement data-driven fast reroute systems that quickly adapt to varying network conditions (e.g., congestion, failures) and improve network performance. The core of these systems has packet-processing algorithms running in the data plane that continuously look for traffic patterns (e.g., too many retransmissions) specific to a network condition (e.g., link failure) and take appropriate action (e.g., reroute). Despite their benefits, they also increase the potential attack surface. Adversaries can generate malicious traffic patterns resembling those anticipated by a fast reroute system and trick the system. Doing so would lead to poor network performance due to incorrect reroute decisions. In this paper, we propose a mechanism to detect whether the fast reroute systems are under the influence of malicious traffic patterns. Our key idea is to model the expected behavior using benign traffic features and use the model as a reference to determine whether the system is under the influence of adversaries. Using realistic attack traces, we demonstrate attacks on two fast reroute systems and successfully detect those attacks using the proposed detection mechanism.	10.1109/TNSM.2026.3715353
Antonio Iacobelli, Giorgio Franceschelli, Lorenzo Rinieri, Mirco Musolesi, Marco Prandini, Franco Callegati	SIP-Classifier: Unsupervised Classification of SIP-IMS Signaling with Transformer and Clustering	2026	Early Access	Modeling Sequences Sequential analysis	Ensuring the reliability of voice services in 5G networks requires effective detection of anomalies in IMS signaling. However, this task remains challenging due to the architectural complexity of IMS and the large volume of signaling data. In this paper, we propose SIP-Classifier, an unsupervised methodology that combines Transformer-based representation learning with clustering to identify anomalous SIP sequences. The approach encodes SIP messages through protocol-aware tokenization, learns latent representations via an autoregressive Transformer, and clusters them to distinguish valid from anomalous flows. We evaluate the method on real-world IMS data collected from operational 5G networks. It achieves 98% accuracy, 98% precision, 95% recall, and a 96% F1-score, significantly outperforming state-of-the-art approaches.	10.1109/TNSM.2026.3715301
Kaifei Peng, Yanbiao Li, Wenbin Li, Yuxuan Chen, Xian Yu, Xin Wang, Bo Pang, Gaogang Xie	Rethinking Virtual Network Construction for Network Emulation at Scale: Analysis, Modeling, and Optimization	2026	Early Access	Virtual machines Memory Timing	Network emulation has become an indispensable methodology for evaluating next-generation network architectures, offering a critical balance between experimental fidelity and operational scalability. However, its effectiveness is fundamentally constrained by inefficiencies in emulating large-scale networks, particularly during virtual network construction. This bottleneck arises from mandatory serialization of virtual link instantiation and operating system (OS) kernel-level notification overheads, which collectively degrade performance by orders of magnitude on 10K-node topologies. Departure from the current practice that employs a multi-machine framework for improvements, we propose SplitNN (Split Network and Namespace), a novel single-machine network emulation paradigm that breaks the serialization constraint through multi-VM (virtual machines) partitioning, and reduces notification overheads via namespace segmentation. Extensive evaluations show that SplitNN constructs 10K-node virtual networks within 1–5 minutes on a single machine, achieving a 98.5%–99.2% reduction in construction time compared to state-of-the-art emulators. While primarily a single-machine solution, SplitNN seamlessly integrates with multi-machine deployments, complementing them by enabling cumulative gains in both scalability and efficiency.	10.1109/TNSM.2026.3715559
Qing Wu, Xijia Dong, Leyou Zhang, Yue Lei, Zilong Yan	Cloud-Assisted Verifiable and Updatable Private Set Union Protocol for Enhancing Network Intrusion Detection	2026	Early Access	Protocols Clouds Security	As network intrusion detection systems (NIDS) play an increasingly critical role in large-scale network environments, multiple organizations, Internet Service Providers (ISPs), and security service providers often maintain independent IP blacklists. Due to the dynamic nature of malicious IP addresses and their cross-organizational propagation, inter-organizational blacklist sharing is essential for improving network intrusion detection. However, traditional blacklist exchange mechanisms risk exposing participants’ complete blacklist information, and curious organizations may infer another organization’s detection strategies from the shared IP intersection, leading to privacy breaches.To address this issue, this paper proposes a Cloud-Assisted Verifiable and Updatable Private Set Union (CVU-PSU) protocol, which leverages the multi-query Reverse Private Membership Test (mq-RPMT) protocol and Oblivious Transfer (OT) technology to ensure privacy-preserving inter-organizational blacklist sharing. The protocol utilizes cloud computing to reduce the computational and communication overhead of participants in the mq-RPMT protocol while incorporating a verification mechanism to ensure the correctness of the cloud’s returned results. Furthermore, the protocol supports real-time blacklist updates, enabling adaptation to rapidly changing malicious IP addresses.Experimental results demonstrate that the proposed protocol achieves efficient inter-organizational blacklist sharing with low communication and computational costs while preserving privacy, thereby enhancing the real-time performance and accuracy of network intrusion detection systems.	10.1109/TNSM.2026.3716071