TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Deemah H. Tashman, Soumaya Cherkaoui	Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks	2026	Early Access	Reconfigurable intelligent surfaces Reliability Optimization	Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems.	10.1109/TNSM.2026.3660728
Yao Xin, Yuqiao Luo, Shufan Cao, Chongwu Dong, Qingfeng Tan	HBT: A Hybrid Bidding Tree for High-Performance Packet Classification	2026	Early Access	Heterojunction bipolar transistors Trees (botanical) Vegetation	Traditional packet classification algorithms based on decision trees often rely on rule replication to increase lookup speed, which inevitably leads to memory explosion. Conversely, existing zero-replication methods frequently suffer from extreme tree depth and structural fragmentation. To address this dilemma, this paper proposes the Hybrid Bidding Tree (HBT), a high-performance architecture designed to enforce zero-replication while sustaining deterministic lookup throughput. First, HBT employs an Overlap-Aware Rule Decomposition (OARD) framework to proactively isolate topologically entangled rules, purifying the primary geometric space. Second, HBT introduces a dynamic competitive bidding mechanism for tree construction. At each node, a discrete bit-selection path and a continuous range-partitioning path compete to determine the optimal splitting strategy based on local geometric heterogeneity. Finally, to guarantee an O(N) memory boundary, unpartitionable residual rules are assigned to a single-level Onion-Peeling fallback structure, preserving linear memory growth while introducing additional sequential checks in the auxiliary path. Experimental evaluations on ClassBench-ng rulesets containing up to 256k rules demonstrate the efficacy of HBT. Compared with state-of-the-art algorithms such as PT-Tree and TupleTree, HBT achieves the highest lookup throughput across all twelve evaluated rulesets at both the 128k and 256k scales, while maintaining strong memory efficiency and highly competitive construction and update latencies.	10.1109/TNSM.2026.3734240
Stephen Jasina, Loqman Salamatian, Joshua Mathews, Scott Anderson, Paul Barford, Mark Crovella, Walter Willinger	Matisse: Visualizing Measured Internet Latencies as Manifolds	2026	Early Access	Manifolds Internet Measurement	Manifolds are complex topological spaces that can be used to represent datasets of real-world measurements. Visualizing such manifolds can help with illustrating their topological characteristics (e.g., curvature) and providing insights into important properties of the underlying data (e.g., anomalies in the measurements). In this paper, we describe a new methodology and system for generating and visualizing manifolds that are inferred from actual Internet latency measurements between different cities and are projected over a 2D Euclidean space (e.g., a geographic map). Our method leverages a series of graphs that capture critical information contained in the data, including well-defined locations (for vertices) and Ricci curvature information (for edges). Our visualization approach then generates a curved surface (manifold) in which (a) geographical locations of vertices are maintained and (b) the Ricci curvature values of the graph edges determine the curvature properties of the manifold. The resulting manifold highlights areas of critical connectivity and defines an instance of “Internet delay space” where latency measurements manifest as geodesics. We describe details of our method and its implementation in a tool, which we call Matisse, for generating, visualizing and manipulating manifolds projected onto a base map. We illustrate Matisse with three case studies: a simple example to demonstrate key concepts, and visualizations of the US and Europe public Internet to show Matisse’s utility.	10.1109/TNSM.2026.3730274
Larisa-Mihaela Tufeanu, Marius-Constantin Vochin, Frank Y. Li	Residual Artifact Governance With ML-Enabled Garbage Collection Prediction in Kubernetes-Based 5G/6G Service-Based Architecture	2026	Early Access	Management Retrieval augmented generation Monitoring	The evolution of the service-based architecture (SBA) requires cloud-native core networks, and its open and modular design nature makes Kubernetes the most eminent platform for SBA implementation. One critical-yet-underexplored issue when deploying the SBA based on Kubernetes is the accumulation of residual artifacts that persist and degrade observability and stability inside Kubernetes clusters. In this paper, we propose residual artifact governance (RAG), a non-intrusive add-on module to the SBA that enforces bounded garbage collection (GC) policies without modifying the underlying architecture. The module follows a master–agent structure: a GC-master derives data-driven machine learning-enabled cleanup policies using the GC data provided by GC-agents, while GC-agents co-located at each network function execute deterministic, auditable cleanup actions. As a proof-of-concept demonstration, we implement a Kubernetes-based prototype to validate the operability and feasibility of RAG. While a machine learning predictor located at the GC-master provides early warning signals on time-to-collapse caused by the accumulation of residual artifacts, periodic fractional cleanup actions at GC-agents keep residual peaks bounded under both nominal and stress leak regimes. Results reveal that the accumulation of residual artifacts can be measured, predicted, and controlled using Kubernetes-native mechanisms through our RAG enhancement while remaining compatible with 3GPP-aligned observability and stability assurance principles.	10.1109/TNSM.2026.3734448
Liwei Zhang, Tong Zhang, Xiaoqin Feng, Wenxue Wu, Hao Yang, Ping Liu, Yanying Ma, Fengyuan Ren	Leveraging Hot Standby Routing to Improve Reliability in TSN	2026	Early Access	Fluid flow Timing Joining processes	Time-Sensitive Networking (TSN) is widely deployed in industrial networks because it can provide deterministic transmission services for Time-Triggered (TT) flows. Link failures pose severe threats to the reliability of TT flows. Frame Replication and Elimination for Reliability (FRER) defined by IEEE 802.1 CB tolerates such failures by transmitting the same frames via disjoint paths, but this introduces excessive bandwidth overhead. To this end, we present a Hot Standby Routing (HSR) mechanism tailored for TSN to ensure the reliability of TT flows while minimizing bandwidth usage. Unlike FRER, HSR can locally reroute a single frame to achieve tolerance to link failures. Specifically, the primary and secondary paths are computed hop-by-hop for each TT flow and installed on the switches in the network. Under normal conditions, the secondary path is in a silent standby state. If the primary path fails, the affected TT flow will be seamlessly rerouted to the secondary path by the local switch for transmission. The simulation results show that HSR can provide highly reliable transmission for TT flows while significantly reducing bandwidth consumption. Furthermore, HSR exhibits stronger robustness in large-scale networks.	10.1109/TNSM.2026.3733170
Vinícius Gruske Domeles, Laura Rodrigues Soares, Jéferson Campos Nobre, Edison Pignaton De Freitas	An Energy Cost-Benefit Analysis of Client-Side VPNs on CPE Devices	2026	Early Access	Energy Licenses Nuclear facility regulation	The reduction of CO2 emissions and conscientious use of energy resources is one of the biggest current challenges. Computer networks and the Internet are no exception to the global necessity of reassessing current energy consumption paradigms, and security mechanisms are some of the most costly in the networking stack. In the other hand, Customer-Premises Equipment (CPE) devices at the edge of the Internet structure play a significant role in service provisioning and securing the connection of the customer. As such, the impact of standard security tools on the energy consumption profile of these devices should be studied in depth. In this context, this work evaluates the energy cost-benefit of client-side Virtual Private Networks (VPNs) implemented on commercial CPE devices. Through experimental measurement and precise instrumentation, both energy consumption and network performance across different traffic profiles are analyzed. The main finding is that the use of VPNs can reduce the energy efficiency of the CPE per megabyte transferred by half, even under moderate load, highlighting a significant energy overhead imposed by security mechanisms on edge devices. Furthermore, the study shows that the most suitable protocol depends directly on scenario-specific requirements. Finally, the study proposes comparative metrics, a device-protocol calibrated model and presents the future directions for assessing the energy impact of Software-Defined Wide Area Network (SD-WAN) architectures.	10.1109/TNSM.2026.3733609
Martine S. Lenders, Carsten Bormann, Thomas C. Schmidt, Matthias Wählisch	A Leaner and Faster Web: How CBOR Can Improve Dynamic Content Encoding in JSON and DNS over HTTPS	2026	Early Access	Internet of Things Encoding Internet	The Internet community has taken major efforts to decrease latency on the World Wide Web with significant improvements in accelerating content transport and in compressing static content. Less attention, however, has been dedicated to compression of dynamic content. Such content is commonly provided by JSON and DNS over HTTPS. Dynamic content objects continue to grow in size, which increases latency and fosters the digital inequality. In this paper, we propose to mitigate this increase by utilizing Concise Binary Object Representation (CBOR), a standard originally designed for the constrained Internet of Things (IoT) to restrict packet sizes and enable efficient encoding of data objects. We provide protocol design and three new data sets for the evaluation of dynamic content, DNS, and the loading of websites. Our key findings are the following: (i) Switching the data representation from JSON to CBOR reduces data by up to 80%. This size reduction can decrease loading times by up to 13.8% when downloading large objects—even in local setups. (ii) Enabling CBOR for DNS over HTTPS (DoH) and DNS over CoAP (DoC) reduces packet sizes significantly. Compressing only names combined with unpacked CBOR achieves maximum gain of 52.2%, using more complex but still lightweight Packed CBOR allows minimizing packets by up to 95.5%. Our lean decoder for name compression can fit into as little as 314 bytes of build size. Our results clearly show the potential of CBOR outside of IoT scenarios. Parts of this research have already influenced work within the IETF.	10.1109/TNSM.2026.3722114
Xiaodi Wang, Yunwei Dong, Weizhi Meng, Meng Li, Yining Liu	Dropout-Tolerant Privacy-Preserving Aggregation for Federated Mobile Crowdsensing	2026	Early Access	Modeling Privacy Internet of Things	Federated Learning (FL) has emerged as a key enabler for privacy-preserving, decentralized sensing systems, giving rise to Federated Mobile Crowdsensing (F-MCS). A well-known bottleneck in such systems is the inefficiency of synchronous training, which stalls for all participants and is susceptible to stragglers in heterogeneous environments. Although asynchronous FL methods have been explored to alleviate this, they often introduce the critical issue of stale updates, which can degrade model convergence and accuracy. To simultaneously address the challenges of efficiency, staleness, and robustness, this paper proposes a novel Dropout-Tolerant Privacy Aggregation (DTPA) scheme for FL that operates without a trusted third party (TTP). Our solution leverages the distributed decryption feature of the lifted EC-ElGamal cryptosystem to enable secure, decentralized model aggregation. We further introduce an efficient worker selection algorithm to systematically reduce waiting time. Moreover, a dedicated dropout-tolerant mechanism is developed to maintain protocol execution even under a high rate of client failures, thereby enhancing robustness. Security analysis confirms that our scheme fulfills essential privacy and security requirements. Extensive simulations demonstrate that the proposed DTPA scheme significantly improves training efficiency and convergence stability compared to state-of-the-art methods, while remaining practical for deployment on resource-constrained mobile devices.	10.1109/TNSM.2026.3732465
Muhammad Muhammad Bala, Abdullahi Uwaisu Muhammad, Kamaluddeen Ibrahim Yarima, Aseel Smerat, Mulikatu Yakubu Ibrahim, Safiyanu Yahaya, Hamza Adamu	Isolation and Optimization Cost of Service-based Radio Access Network Slicing: A Smart-Contract-Based Approach	2026	Early Access	Network slicing Smart contracts Radio access networks	The service-based Radio Access Network (RAN) slicing enabled via Software Defined Networking (SDN) and Network Function Virtualization (NFV) can support diverse service requirements and address the rapid data traffic growth from both the vertical industry and the Internet of Things (IoT). However, network slice isolation and resource sharing between slices should be be improved for future wireless network requirements. Firstly, this paper address the isolation enhancement of future wireless networks through Blockchain-Smart-Contract, by creating two smart-contract-based access control to secure access to different service-based RAN applications and secure the sharing of resources. These contract are Verification and Authorization Contract (VAC), as well as Misconduct and Revocation Contract (MRC). The proposed framework is designed to support key 6G service classes, such as enhanced Mobile Broadband (eMBB) and ultra-Reliable Low-Latency Communications (uRLLC), enabling high data rates and low-latency communication. Secondly, to ensure the servicebased RAN achieves better isolation the optimization goal is to minimize the deployment cost to obtain the best deployment scheme. Hence, we divide the service-based RAN slice isolation deployment problem into two sub-problems, i.e., service-based RAN slice isolation and slice deployment problem, by formulating a Mixed Integer Linear Programming (MILP) model to minimize the deployment cost. Finally, to verify the feasibility of the design implementation an experimental platform is built and the results show the architecture achieves isolation enhancement through smart-contract and reduces the deployment cost by 78% and improve the isolation performance by 93% compared to the Blockchain-enabled Network Slice (BcNS) and the service-based RAN.	10.1109/TNSM.2026.3732250
Hussein Fawaz, Jacopo Talpini, Marco Savi, Silvia Giordano, Omran Ayoub	Detecting Zero-Day Attacks via Reconstruction of Feature Influence and Model Uncertainty	2026	Early Access	Modeling Uncertainty Training	In practical Network Intrusion Detection System (NIDS) deployments, detecting anomalies is only the first step, while determining the exact nature of those anomalies is equally important. Commonly, anomalous traffic is forwarded to a supervised multiclass classifier trained to identify known attack categories. While effective for known threats, this step presents a significant limitation, as zero-day attacks can be misclassified as known attacks. Therefore, there is a need for approaches that go beyond standard classification and can reliably recognize when an input does not conform to any learned attack pattern, i.e., zero-day attacks. To tackle this problem, we propose a novel detection strategy that leverages per-instance feature importance scores from an explainable Artificial Intelligence (XAI) framework and prediction uncertainty estimates derived from an ensemble classifier. To evaluate our approach, we conduct extensive experiments using a leave-one-attack-out strategy across three benchmark datasets, CICIoT2023, NF–TON–IoT, and CIC–DDoS2019, and test performance under two underlying classifiers, namely XG-Boost and Random Forest, demonstrating the model-agnostic nature of our method. Experimental results show that our approach achieves best-case AUROC gains approaching 40% and F1-score improvements of up to 73%, while maintaining positive or near-neutral worst-case performance across datasets, highlighting the effectiveness and robustness of jointly modeling explanation-driven reconstruction error and predictive uncertainty for reliable zero-day threat identification.	10.1109/TNSM.2026.3731401
Mohamed Zalat, Chris Barber, Babak Esfandiari, Thomas Kunz	A Reusable Network Digital Twin Architecture for QoS-Centric Network Management	2026	Early Access	Modeling Fluid flow Optimization	We propose a network digital twin approach for Quality of Service (QoS)-centric network management and demonstrate it on multiple network management problems. Our network digital twin involves running many ”what-if?” network configurations using a fast inference model for predicting network behavior, and applying the best configuration found based on the criteria of the network operator. We demonstrate the flexibility of this approach by applying it to 3 different network management problems: Interior Gateway Protocol (IGP) weight optimization, Border Gateway Protocol (BGP) route assignments, and gray fault detection and localization. We test our approach for each application on various OMNeT++ topologies and compare it to existing benchmarks in the respective literature. Our results indicate that the proposed network digital twin approach performs comparably to existing benchmarks in the network management problems explored and sometimes outperforms them in quality of service metrics.	10.1109/TNSM.2026.3737654
Hamidreza Mazandarani, Masoud Shokrnezhad, Tarik Taleb	A Semantic-Aware Multiple Access Scheme Leveraging Spatial Redundancy for Uplink-Dominant Network Services	2026	Early Access	Timing Titanium Modeling	The transition toward semantic-aware communication offers a paradigm shift for next-generation mobile networks, promising to decouple information significance from raw data transmission. Despite advances in semantic extraction, the integration of semantic intelligence into the Medium Access Control (MAC) layer remains underexplored, particularly in exploiting spatial correlations among users. To address this, we introduce a novel multiple access scheme designed for uplink-dominant network services. This framework optimizes the trade-off between spectrum utilization and sustainability by formulating variable-packet-length access as distinct α-fairness and energy efficiency problems. A key innovation of our approach is the quantification of spatial redundancies through novel metrics of self-throughput and assisted-throughput, which account for the semantic correlation of data across user equipment. We analyze these formulations to identify optimal bounds before proposing PRISM (Protocol for Redundancy Identification in Semantic Multiple-access). Grounded in Model-free Multi-Agent Deep Reinforcement Learning (MADRL), PRISM enables devices to autonomously govern spectrum access using only local observations. Extensive evaluations demonstrate that PRISM successfully leverages redundancies to outperform semantic-oblivious schemes, achieving up to 90% of the centralized optimal benchmark and improving both objectives by up to 2× across diverse user-semantic association matrices. These results validate PRISM as a viable candidate for future distributed mobile network applications, complemented by orthogonal Multiple Access Schemes where signals are multiplexed in the semantic domain.	10.1109/TNSM.2026.3737571
Nilesh Chakraborty, Petar Djukic, Burak Kantarci	Aggressive-YoYo: Exploiting Intent-Semantic Misalignment in AI-Native 6G Management Planes	2026	Early Access	Central Processing Unit Management Modeling	Intent-Based Networking (IBN) enables operators to express high-level service objectives that are automatically translated into low-level control and orchestration policies. In AI-native 6G management planes, semantic misalignment during this translation can induce unsafe configurations that amplify conventional resource-exhaustion attacks. We investigate this vulnerability through aggressive-YoYo, a compound threat combining YoYo-style burst traffic with prematurely configured Kubernetes readiness probes. We implement an end-to-end Intent-to-Configuration pipeline that resolves natural-language service intents into structured policies, compiles them into Kubernetes probe settings, and evaluates the resulting behavior using a representative slice-assurance management function on Google Kubernetes Engine (GKE). Controlled readiness-delay experiments show that premature readiness can increase replica provisioning, aggregate CPU and memory consumption, storage activity, and request failures, while inducing non-trivial service-level tradeoffs. Similar resource amplification under a different N1-family machine type and deployment zone indicates that the effect is not specific to a single configuration.We further analyze readiness misconfiguration across multiple Kubernetes scaling mechanisms and derive service-specific safe and amplifying configuration regions. From the detection perspective, we show-case that aggressive-YoYo is detectable using fully supervised temporal classifiers evaluated with cycle-disjoint testing and feature-set ablation; the best configuration achieves an average accuracy of 92.6%. Under scarce aggressive-YoYo supervision, i.e., limited exposure to aggressive-YoYo traces, the supervised approach improves detection over the one-class setting. These results show that intent-semantic misalignment creates measurable cross-layer management risks and motivate semantic validation and telemetry-aware monitoring for trustworthy AI-native 6G orchestration.	10.1109/TNSM.2026.3736983
Abdul Samim, Attiq Ur Rehman, KyungHi Chang	Intelligent Handover Management for 6G LEO Satellite Constellations: A Predictive Multi-Agent PPO Approach	2026	Early Access	Satellites Handover Loading	The integration of Low Earth Orbit (LEO) satellite constellations into 6G networks promises ubiquitous connectivity, yet poses unprecedented challenges for handover management due to rapid orbital motion and dynamic channel conditions. Traditional reactive handover algorithms, designed for quasistatic terrestrial networks, fail to address the multi-dimensional optimization requirements of LEO systems where satellites move at velocities exceeding 7 km/s and user-satellite connections last only 2-4 minutes. This paper proposes a Predictive Multi-Agent Proximal Policy Optimization (PMA-PPO) framework for SNR-aware load-balanced handover management in dual-layer LEO satellite networks. The framework integrates three core components: Gated Recurrent Unit (GRU) networks for temporal forecasting of channel conditions and satellite loads, distributed PPO agents for autonomous handover decision-making, and a coordination mechanism that balances signal quality with load distribution. Through comprehensive simulations of a realistic dual-layer constellation, PMA-PPO achieves significant performance improvements: up to 77.7% reduction in handover failure rates, 74.06% reduction in satellite overload duration, 35.13% improvement in throughput fairness, and ping-pong handover rates consistently below the practical 5% threshold across all load conditions, compared to state-of-the-art base-line approaches. The proposed approach achieves polynomial computational complexity versus exponential cost for exhaustive optimization, making it suitable for real-time deployment in large-scale LEO constellations.	10.1109/TNSM.2026.3735527
Marco Garofalo, Luca D’Agati, Laura García, Rafael Asorey-Cacheda, Antonio-Javier Garcia-Sanchez, Joan Garcia-Haro, Antonio Puliafito, Giovanni Merlino, Francesco Longo	Trustless SLA Enforcement and Roaming in LoRaWAN through Smart Contracts	2026	Early Access	Roaming Service level agreements LoRaWAN	LoRaWAN is widely used for Internet of Things (IoT) services that require long-range, low-power wireless connectivity. As deployments grow, roaming between different network operators becomes increasingly important to maintain service continuity for mobile IoT devices. In practice, however, roaming still depends on bilateral agreements and trusted intermediaries, which limit scalability and reduce transparency in multi-operator settings. This work introduces a blockchain-based roaming architecture that uses Algorand smart contracts to automate Service Level Agreement (SLA) management between providers. The system supports dynamic roaming agreements, immutable packet accounting, and transparent settlement. In our system, the enforced guarantee concerns forwarding-level service quality at the roaming interface, namely payment conditional on observed delivery ratio, rather than deterministic radio-layer latency or jitter guarantees. We implemented the full infrastructure, including a custom Gateway Bridge that extracts the Network Identifier (NetID), a blockchain service that interacts with Algorand smart contracts for SLA validation, and a decentralized provider catalog for operator discovery. We evaluated the system on a testbed with production-grade ChirpStack network servers and compared it with our previous non-blockchain implementation. Both versions achieve comparable throughput (5800–5900 packets/minute with 1000 devices) and maintain 99% packet forwarding efficiency. Blockchain integration adds measurable overhead, including a forwarding latency overhead in the 400–490 ms range for SLA validation, largely independent of the underlying network delay, but remains acceptable for delay-tolerant IoT services. Overall, the results show that decentralized LoRaWAN roaming can be implemented without breaking compatibility with existing network architectures.	10.1109/TNSM.2026.3734694
Siyu Jiang, Feng Guo, Di Chen, Yuan Liu, Ying Chen, Weijun Sun, Yu Wang, Shen Su	Smart Contract Vulnerability Detection via Mask Consistency with Dynamic Margin Adjustment	2026	Early Access	Labeling Modeling Smart contracts	With the rise of smart contract applications, new attacks that exploit contract vulnerabilities continue to emerge, and effective vulnerability detection methods are urgently needed. Deep learning-based methods have shown excellent performance. However, for new types of vulnerabilities, due to the lack of real labels to help the model learn subtle code differences, previous methods have difficulty distinguishing between vulnerable contracts and safe contracts with similar key code segments, resulting in false negatives. To address this problem, this paper proposes a smart contract vulnerability detection method that uses mask consistency (MC) and dynamic margin adjustment (DMA). Unlike traditional Masked Language Modeling (MLM) in CodeBERT that performs token-level reconstruction for general representation learning, our MC enforces classification-level consistency between a masked student network and an unmasked EMA teacher network at the semantic graph block level under semi-supervised domain adaptation. This enhances the model’s discriminative ability by adding contextual information of similar code segments as additional clues. Specifically, we define a student network to learn masked contracts, a teacher network to learn complete contracts, and implement few-shot learning through semi-supervised domain adaptation. In this process, the student network is helped to learn to correctly distinguish similar contracts by fusing contextual information. In order to guide students more effectively, we use DMA to screen high-quality pseudo-labels. We conduct extensive experiments on open source real-world vulnerability datasets, and the results show that our method significantly outperforms current mainstream deep learning methods in detecting six types of vulnerabilities. This approach also pioneers the application of domain adaptation and integrates MC with DMA in vulnerability detection, providing guidance for detecting different types of vulnerabilities.	10.1109/TNSM.2026.3733072
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh	Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices	2026	Early Access	Schedules Scheduling Cloning	Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline.	10.1109/TNSM.2026.3694238
Jing Zhang, Chao Luo, Rui Shao	MTG-GAN: A Masked Temporal Graph Generative Adversarial Network for Cross-Domain System Log Anomaly Detection	2026	Early Access	Anomaly detection Adaptation models Generative adversarial networks	Anomaly detection of system logs is crucial for the service management of large-scale information systems. Nowadays, log anomaly detection faces two main challenges: 1) capturing evolving temporal dependencies between log events to adaptively tackle with emerging anomaly patterns, 2) and maintaining high detection capabilities across varies data distributions. Existing methods rely heavily on domain-specific data features, making it challenging to handle the heterogeneity and temporal dynamics of log data. This limitation restricts the deployment of anomaly detection systems in practical environments. In this article, a novel framework, Masked Temporal Graph Generative Adversarial Network (MTG-GAN), is proposed for both conventional and cross-domain log anomaly detection. The model enhances the detection capability for emerging abnormal patterns in system log data by introducing an adaptive masking mechanism that combines generative adversarial networks with graph contrastive learning. Additionally, MTG-GAN reduces dependency on specific data distribution and improves model generalization by using diffused graph adjacency information deriving from temporal relevance of event sequence, which can be conducive to improve cross-domain detection performance. Experimental results demonstrate that MTG-GAN outperforms existing methods on multiple real-world datasets in both conventional and cross-domain log anomaly detection.	10.1109/TNSM.2026.3654642
José Antonio Pastor Valera, Martin Husák, Jesús García Rodríguez, Jorge Bernal Bernabé, Antonio Skarmeta	Real Time Cyber Situational Awareness for 6G Networks Leveraging Spatial Metrics	2026	Early Access	Modeling Timing Fluid flow	The dynamic and heterogeneous nature of 6G networks demands continuous, real-time cyber situational awareness (CSA) to support cognitive security operations such as behavior analysis, threat hunting, and adaptive defense. Traditional CSA frameworks like CRUSOE capture structural and mission-level data but cannot process the dynamic, high-frequency telemetry typical of 6G environments. This paper presents the Extended Infrastructure and Service Information Model (EISIM) and its implementation within a Cyber Situational Awareness Platform (CSAP) designed for real-time, context-aware security management. CSAP aggregates and models data from diverse sources into a unified graph representing assets, flows, services, and vulnerabilities, enabling continuous assessment of operational and security posture. The platform introduces novel spatial risk metrics, including Flow Load Centrality and Operational Risk Centrality, which integrate topological position, traffic intensity, vulnerability exposure, and resource capacity to quantify risk, exposure, and criticality. By combining workflow-driven data collection with real-time spatial analytics, CSAP enhances situational awareness and decision-making within 6G Security Operation Centers (6G-SOCs), enabling proactive identification of critical network elements and improved resilience through cognitive, data-driven management.	10.1109/TNSM.2026.3734629