TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Wuzhao Li, Weian Guo	Switch-Coupled Scheduling for Energy-Bounded Heterogeneous Edge AI on Commodity Ethernet	2026	Early Access	Energy Modeling Joining processes	Heterogeneous edge-AI clusters behind commodity Ethernet must jointly manage compute queues, shared links, runtime residency, and energy budgets. We formulate request admission and assignment with per-hop FCFS resources, byte-limited TTL–LRU caches, temperature-dependent service, power uncertainty, deadlines, and tenant shares. Switch-Coupled Dual Scheduling (SCD) combines deadline feasibility, cost-aware energy credits, and device plus tenant virtual debts. Analysis establishes restricted-problem hardness, a state-correct finite-horizon certificate, and guarded commitment bounds. Nominal trace-driven simulations show higher offered on-time success and lower mean response than compute-first. These gains accompany higher task energy, admitted tail latency, and mean peak age of information. The success gain over matched drift-plus-penalty scheduling is incremental. Shared link state limits queue escalation under severe simulated bottlenecks. Elastic tenant allocation restores service under tight budgets while retaining device commitment bounds. Repeated hardware experiments compare scheduling under common resource constraints, execute trained neural and tree models on heterogeneous boards, and measure Ethernet path contention. The results support competitive deadline-oriented control with explicit service and energy trade-offs.	10.1109/TNSM.2026.3752827
Jingyan Wang, Jing Bai, Lina Liu, Fumio Machida, Xiaolin Chang	Improving Dependability of VM-based Multi-Domain Service Function Chain: A Semi-Markov Modeling Approach	2026	Early Access	Aging Availability Modeling	In Network Function Virtualization (NFV) networks, service functions (SFs) can be deployed on virtual machines (VMs) across Multiple domains and then form a Service Function Chain (MSFC) for end-to-end network service provision. It is a fact of life that any software component in a VM-based MSFC must experience software aging after a long period of continuous operation. This paper quantitatively investigates the capability of proactive rejuvenation techniques in reducing the damage of software aging on a VM-based MSFC. We develop a semi-Markov model to capture the behaviors of SFs, VMs, and virtual machine monitors (VMMs) from software aging to recovery under the condition that failure times and recovery times follow general distributions. Note that the holding times of aging events follow exponential distributions. We derive the formulas for calculating the steady-state availability and reliability of the VM-based MSFC composed of multiple SFs running on VMs hosted by VMMs. Sensitivity analysis is also conducted to identify potential dependability bottlenecks. Various numerical and simulated experiments show the approximate accuracy of the proposed model and the metric formulas we derived. The experiment results also indicate that the aging time is an important parameter for VM-based MSFC dependability and the type of failure time distribution has a significant impact on dependability metrics.	10.1109/TNSM.2026.3752685
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Ting-Yu Chang, Cooper Cheng-Yuan Ku	Two-tier Framework with AutoML for Detection and Classification of Multiple Types of Anomalies in Intrusion Attacks	2026	Early Access	Modeling Optimization Probability	Ensuring cybersecurity is paramount for protecting sensitive data and defending against increasingly sophisticated cyberattacks. Consequently, intrusion detection (ID) has become a critical area of research in network security. This paper proposes a two-tier framework that leverages efficient automated machine learning (AutoML) techniques to address data imbalance and optimize feature combinations for ID and classification of multiple types of anomalies. In the first tier, two complementary models are selected: a primary model optimized for overall dataset performance and a secondary model specifically chosen for its effectiveness on balanced data distributions. In the second tier, a probability stacking approach, supported by Out-of-Fold (OOF) cross-validation, integrates insights from the first-tier models. It acts as a binary safety net that successfully recovers rare minority attacks while preventing irreversible information loss. The proposed framework effectively mitigates the adverse effects of data imbalance while requiring only a minimal runtime memory footprint of approximately 44 MB (NSL-KDD) and a total process footprint of 165.52 MB (CIC-IIoT-2025), and achieves a rapid cold-start initialization of 0.85 seconds. These advantages make it well-suited for edge computing. Experimental results on the NSL-KDD dataset demonstrate that the proposed approach achieves an overall accuracy of 99.73%, outperforming many state-of-the-art methods by 0.4-20.6%. Furthermore, evaluations on the CIC-IDS-2017 dataset show a 6.3% accuracy improvement and a significant 36% increase in macro-average recall compared with a random-forest-only (RF-only) model. Moreover, extensive validation on the contemporary CIC-IIoT-2025 dataset reveals a significant 4.20% improvement in Macro F1-score over up-to-date baselines. Finally, evaluations on an independent set with novel attack types (KDDTest+) confirm strong generalization capability, achieving 77.10% accuracy and underscoring the framework's robustness in modern industrial scenarios.	10.1109/TNSM.2026.3747311
Shyam Kumar Shrestha, Shiva Raj Pokhrel, Jonathan Kua	Adapting Large Language Models for TCP Fairness over Wi-Fi	2026	Early Access	Large language models TCP Modeling	Designing Transmission Control Protocol (TCP) Congestion Control Algorithms (CCAs) for heterogeneous Wi-Fi networks remains a challenge due to rapidly varying delay, loss, and contention dynamics. These effects often lead to CCA incompatibility, flow unfairness, and starvation among competing TCP flows. Although Deep Reinforcement Learning (DRL) has shown promise in mitigating these challenges, its slow convergence, high training costs, and limited generalization hinder practical deployments. In this paper, we propose TCP-LLM, a learning-augmented transport framework that leverages Large Language Models (LLMs) for compatibility-aware CCA selection. TCP-LLM encodes multivariate TCP time-series into token embeddings and performs single-step discrete CCA decisions through a lightweight LLM decision head. Parameter-efficient low-rank adaptation (LoRA) reduces the number of trainable parameters by approximately two orders of magnitude. Evaluation using traces collected from a physicalWi-Fi testbed with competing TCP Cubic, Bottleneck Bandwidth and Round-trip propagation time (BBR), and Performance-oriented Congestion Control (PCC) flows shows that TCP-LLM achieves the highest mean, geometric-mean, and minimum per-flow throughput among the evaluated schemes. TCP-LLM also exhibits faster and more stable training convergence and supports low-latency bounded inference. These results demonstrate the feasibility of LLM-based sequence adaptation for compatibility-aware transport-layer supervision under heterogeneous wireless conditions.	10.1109/TNSM.2026.3739364
Hongyuan Cheng, Lihua Yin, Tianqing Zhu, Hongyu Yang, Dexin Zhu, Weixiang Jiang, Nan Wei	Pattern2Bot: A malicious server IP detection model based on self-trained heterogeneous graph neural network	2026	Early Access	Labeling Modeling Signal detection	Botnets play a key role in network attacks such as Distributed Denial-of-Service (DDoS) attacks, spamming and click fraud. Command & Control server is an important node for botmaster to control bots and distribute attack commands. Bot disguise as normal domain requests through DNS traffic, but leave malicious records in DNS logs containing client IP, query domain, server IP and other complex interactions. This information provides important clues for detecting those botnets. In the current study, researchers detect botnets through multiple perspectives, including abstracting DNS communication records into graphs and using graph neural network models for detection. Conventional approaches often necessitate massive labeled datasets for model training, which substantially incurs training costs. Moreover, despite enriching node embeddings via topological relations, graph models often suffer performance degradation when confronted with structural semantic obfuscation from evasion techniques like double-flux. In order to understand the abstract and complex relationship patterns in DNS records while reducing label usage to lower training costs, we propose a botnet Command & Control server detection model based on DNS traffic. This is a self-training heterogeneous graph neural network model that does not require a large number of labels. By integrating the high-order relational semantics derived from multiple meta-paths with the local topologies of target nodes, the model achieves finer-grained structural awareness and semantic abstraction, thereby enhancing detection performance. We validate the effectiveness of the model in a real dataset, and the results show that the model has a better understanding of the special structure possessed by the IPs of Command & Control servers.	10.1109/TNSM.2026.3741111
Arshee Naz, Sakshi Maurya, Karan Verma, Geeta Sikka	GRLDR: Space Debris-Aware Adaptive Routing for LEO Satellite Networks Using Graph Reinforcement Learning	2026	Early Access	Routing Satellites Low earth orbit satellites	The growing density of space debris in Low Earth Orbit (LEO) poses a serious challenge to the reliability of satellite communication networks. Existing LEO routing protocols primarily optimize hop count or latency, overlooking debris-induced risks that lead to frequent link disruptions. This paper proposes a Graph Reinforcement Learning-based Debris-Aware Adaptive Routing (GRLDR) framework that integrates Graph Neural Networks (GNNs) and Deep Reinforcement Learning (DRL) to enable intelligent, risk-aware routing in dynamic LEO satellite networks. Real satellite and debris orbital data from Space-Track.org are propagated using the SGP4 model to construct a debris-aware dynamic network graph. Debris risk is quantified using interruption time and radar cross-section features and categorized into low, medium, and high-risk levels. A Graph Attention Network extracts spatial and risk-aware features, while a DRL agent learns routing policies that jointly minimize debris risk, hop count, and end-to-end delay. Simulation results show that the proposed approach significantly reduces debris-exposed routing paths while maintaining low delay, achieving 98.8% hop optimality, up to 28% risk reduction, and a 100% routing success rate compared with conventional routing schemes. This work provides a scalable learning-driven solution for safe and resilient routing in LEO satellite networks.	10.1109/TNSM.2026.3753808
Yichen Zhang, Di Chen, Kaijie Zhu, Zekun Tao, Wei Lin, Rui Zheng	Beyond Valley-Free: Transformer-based AS Path Inference Using Path Embedding	2026	Early Access	Border Gateway Protocol Routing Ranking (statistics)	Gaining insight into autonomous system (AS)-level paths is essential for understanding Internet routing behaviors and enhancing inter-domain routing security. Due to increasingly complex Internet topology and limited measurement access (e.g., router-side ICMP restrictions), few AS paths can be accurately observed, making AS path inference a necessity. However, most existing inference methods are developed based on the valley-free constraint. This limits their ability to capture real-world dynamic routing behaviors. In this paper, we propose PathRank, a Transformer-based method that infers AS paths from a source-AS to a destination-prefix through probability-based ranking, thereby closely reflecting real-world inter-domain routing complexities. From observable BGP data, PathRank generates candidate paths, encodes them as embeddings for a self-attention mechanism to capture cross-hop dependencies, and employs a prefix-length-weighted loss function during training to reflect real-world traffic impacts.We conduct experiments on large-scale public BGP datasets covering IPv4 and IPv6. PathRank places the observed BGP path among the top-10 ranked candidates in 96.82% (IPv4) and 96.65% (IPv6) of test cases, outperforming the strongest external baseline by 4.20 and 11.72 percentage points, respectively. On non-valley-free cases, where valley-free-constrained methods degrade significantly, PathRank maintains inference performance.	10.1109/TNSM.2026.3752819
Junxiong Lin, Xiuyi Zhao, Pan Li, Tian-Yu Zuo, Mingyi Liu, Hailiang Zhao, Yichuan Jiang, Jiuchuan Jiang, Kai Di, Ning Luo	Hallucination-Aware Teaming for Reliable Service Composition in LLM-Driven Industrial Agent Networks	2026	Early Access	Modeling Large language models Educational institutions	Large-language-model-driven (LLM-driven) industrial agents increasingly exchange intermediate results through service-composition pipelines, so an upstream hallucination can corrupt several downstream decisions. We formulate hallucination-aware teaming (HATP), which jointly considers capability coverage, distinct-base-family redundancy, resource budgets, and chain-level error propagation, and prove that its deterministic special case is NP-hard. We then propose HAT, a polynomial-time heuristic that combines master-driven recruitment with self-consistency, cross-agent agreement, external-constraint signals, and bounded fallback. In five simulator settings with 200 paired trials each, HAT has the highest mean Acc and lowest mean HPL in four settings; LLM Debate leads in Easy, and the HAT–Debate Acc differences in Easy and Complex are not significant after Holm correction. A 100-instance exact-enumeration study yields a 0.95% median relative utility gap and an approximately 10× median speedup for the tractable HATP instantiation with upstream discount and fallback disabled and a fixed scalar utility with normalized propagation length. Paired ablations show clear contributions from Phase B, bounded fallback, and the combined trust mechanism, whereas most individual trust-signal effects overlap with uncertainty. In a fixed 50-task live-LLM check using five 8B–30B model families, HAT attains Acc 0.280 versus 0.300 for Beta-Reputation and does not lead every comparator on propagation length. The live study is therefore a limited test outside the simulator and does not show that HAT is generally better in deployment.	10.1109/TNSM.2026.3752977
Jing Zhang, Chao Luo, Rui Shao	MTG-GAN: A Masked Temporal Graph Generative Adversarial Network for Cross-Domain System Log Anomaly Detection	2026	Early Access	Anomaly detection Adaptation models Generative adversarial networks	Anomaly detection of system logs is crucial for the service management of large-scale information systems. Nowadays, log anomaly detection faces two main challenges: 1) capturing evolving temporal dependencies between log events to adaptively tackle with emerging anomaly patterns, 2) and maintaining high detection capabilities across varies data distributions. Existing methods rely heavily on domain-specific data features, making it challenging to handle the heterogeneity and temporal dynamics of log data. This limitation restricts the deployment of anomaly detection systems in practical environments. In this article, a novel framework, Masked Temporal Graph Generative Adversarial Network (MTG-GAN), is proposed for both conventional and cross-domain log anomaly detection. The model enhances the detection capability for emerging abnormal patterns in system log data by introducing an adaptive masking mechanism that combines generative adversarial networks with graph contrastive learning. Additionally, MTG-GAN reduces dependency on specific data distribution and improves model generalization by using diffused graph adjacency information deriving from temporal relevance of event sequence, which can be conducive to improve cross-domain detection performance. Experimental results demonstrate that MTG-GAN outperforms existing methods on multiple real-world datasets in both conventional and cross-domain log anomaly detection.	10.1109/TNSM.2026.3654642
Aleksandar Avdalović, Joseph Khoury, Ibrahem AlJabea, Mustafa Hajij, Elias Bou-Harb	Beyond Flat Models: Preserving ICS Topology using Combinatorial Complexes for Hierarchy-Aware Intrusion Detection	2026	Early Access	Modeling Cells (biology) Integrated circuits	Industrial Control Systems (ICS) follow the Purdue model hierarchy, organizing sensors, actuators, Programmable Logic Controllers (PLCs), and supervisory control into distinct hierarchical layers. Despite this inherent structure, existing data-driven intrusion detectors still fail to model this intricate property. To address this gap, we introduce a Hierarchy-Aware Intrusion Detector, HAID, a topology-preserving framework that models an ICS as a Combinatorial Complex (CC), operating solely on process telemetry and trained on benign traces to detect falsified sensor measurements and unauthorized actuator commands. The complex captures devices, functional interactions, and PLC control zones within an ICS. CCs (unlike flat models) encode telemetry across hierarchical levels for training a Topological Neural Network (TNN). As such, HAID enables the embedding of the ICS Purdue model into the learning process, yielding anomaly scores and localization at each of the aforementioned levels. Evaluated on two water testbeds, SWaT and WADI, and on a simulated chemical process, TEP, HAID achieves competitive detection performance (82.7% F1 on SWaT and 50.1% on WADI, averaged over five runs), while providing explicit hierarchical localization unavailable in prior work. Through ablations, we confirm the added-value of hierarchical modeling, as removing the PLC-zone representation reduces F1 by 5.8 percentage points on SWaT and causes detection on WADI to collapse. The largest losses are on attacks that manipulate several devices at once, which device- and interactionlevel signals usually miss.	10.1109/TNSM.2026.3746967
Jiawei Dong, Mohsen Ghafouri, Chadi Assi	Cybersecurity Risks in Electric Vehicle Charging Management Systems	2026	Early Access	IP networks Security Internet of Things	Electric Vehicle Charging Stations (EVCSs) have become the heart of electrified transportation infrastructure. Their increasing Internet exposure makes them high-value targets for cyberattacks with potential implications for grid stability. This study presents a comprehensive, data-driven security analysis of globally exposed EV Charging Management Systems (EVCMS), bridging theoretical vulnerability concerns with quantified real-world threats. We discover and assess Internet-exposed EVCMS infrastructure, then deploy multi-component honeypot systems to capture live attack intelligence. Our novel EVCS discovery technique identifies 59,359 EVCMS IPs from 798 vendors, with notable improvements in non-English-speaking regions, overcoming traditional scanning limitations. Security assessment of 17 vulnerability types reveals most critical vulnerabilities remain unaddressed three years after coordinated disclosure. Darknet intelligence analysis reveals 10,647 unique IPs that also appeared in our EVCMS dataset participating in unsolicited scanning throughout 2024 with periodic surges. We deploy a comprehensive honeypot system with proactive engagement that actively induces compromised EVCMS devices to attack our infrastructure, spanning two monitoring phases: a ten-day period with proactive engagement and an eight-month period of long-term passive monitoring. We observed generic IoT threats and found no EVCMS-specific malware in the samples examined. A small portion of human exploration activities is found in the web portal honeypot. We observed liveness probes on both the Linux server honeypots and the OCPP backend, serving as a critical warning of imminent threats demanding immediate vendor attention before escalation to destructive campaigns.	10.1109/TNSM.2026.3751489
Byungchang Kim, Shinyoung Lue, Seonyeong Hwang, Youhee Park, Yeji Lee, Jaemin Jeong, Peter Bloodsworth, Euiseok Hwang	GRIDS: Generalized Representation-based Intrusion Detection System via Federated Contrastive Learning	2026	Early Access	Modeling Labeling Intrusion detection	Existing AI-based intrusion detection systems are typically trained for specific network environments, leading to significant performance degradation when deployed in different settings or exposed to evolving attack strategies. We propose GRIDS (Generalized Representation-based Intrusion Detection System), a federated contrastive learning framework for cross-environment intrusion detection that keeps raw traffic data local. GRIDS employs a Transformer-based encoder trained with supervised contrastive learning across distributed network environments, learning a shared representation without exchanging sensitive traffic data. The encoder embeds network flow features into a latent space where semantically similar traffic patterns cluster together, enabling effective anomaly detection via k-nearest neighbor scoring. Evaluated on four heterogeneous NetFlow datasets, GRIDS outperforms existing federated IDS baselines on average with a single unified model. In leave-one-out cross-validation, a substantial portion of the detection capability of GRIDS transfers to network environments unseen during training, and the level of transfer varies across target networks. Deployment at such a network requires no labeled attack data or fine-tuning. It uses the benign traffic of the network as the kNN reference set and its unlabeled traffic for normalization and threshold calibration. The framework targets deployments in which a single model protects multiple heterogeneous networks.	10.1109/TNSM.2026.3748922
Shengye Gong, Hui Yang, Qiuyan Yao, Xin Li, Tiankuo Yu, Wenxin Liu, Yang Zhao, Yucong Liu, Jie Zhang, Mohamed Cheriet	Resilient Hierarchical Polyhedron-based Configuration Protection for Large-Scale Multi-Domain Optical Networks	2026	Early Access	High performance computing Joining processes Protection	Large-scale multi-domain optical networks are increasingly exposed to spatially correlated and concurrent failures, while monolithic pre-configured protection structures incur rapidly increasing global search complexity and protection-resource costs under heterogeneous physical constraints. To address this challenge, this paper proposes a resilient Hierarchical Polyhedron-based Configuration (HPC) architecture that decomposes a monolithic global survivability requirement into adaptive intra-domain connectivity constraints and a compact inter-domain connectivity constraint. To alleviate resource imbalance caused by topology-only network partitioning, a Topology-Resource Aware Domain Partitioning (TRADP) algorithm is developed to construct protection-supportable sub-domains by jointly considering topological structure and physical resource distribution. To avoid imposing a rigid protection level on heterogeneous domains, HPC assigns adaptive intra-domain connectivity targets according to local failure exposure and physical resource supportability. To reduce the complexity of cross-domain protection while preserving physical feasibility, a super-node abstraction and physical bridge-link mapping mechanism is employed to construct the inter-domain protection backbone under capacity, spectrum, and SRLG constraints. Extensive evaluations on networks of up to 1000 nodes and representative GEANT and NSFNET topologies demonstrate that HPC-TRADP maintains a recovery rate of 92.94% at 1000 nodes and 85.82% even when 30% of physical links fail concurrently. It further reduces protection overhead by up to 79.60% relative to p-KECS while maintaining efficient recovery paths, demonstrating a favorable balance between survivability, resource efficiency, and scalability.	10.1109/TNSM.2026.3750417
Mario Chahoud, Hani Sami, Ahmad Hammoud, Rabeb Mizouni, Hadi Otrok, Jamal Bentahar, Azzam Mourad, Chamseddine Talhi	Multi-agent Deep Reinforcement Learning Scheme for On-Demand Federated Learning	2026	Early Access	Modeling Federated learning Training	The rapid growth of intelligent IoT devices and mobile edge infrastructures has generated massive decentralized data, necessitating efficient and privacy-preserving learning. Federated Learning (FL) enables distributed model training without sharing raw data; however, its performance degrades in dynamic mobile environments due to unpredictable availability, stragglers, and frequent dropouts. In On-Demand FL, training services and models are deployed only when needed rather than relying on always-active infrastructure, requiring orchestrators to adapt to client arrivals, departures, and mobility while efficiently allocating limited resources and maintaining training continuity. Existing client-selection methods rely on static heuristics or centralized Reinforcement Learning models that struggle to scale and adapt to such dynamics. To address these challenges, we propose a cooperative Multi-Agent Deep Reinforcement Learning (MADRL) framework for client selection in On-Demand FL. Multiple orchestrators act as agents under a Centralized Training and Decentralized Execution (CTDE) paradigm. The problem is formulated as a Partially Observable Markov Game (POMG), capturing mobility, partial observability, and distributed decision-making. A mobility-aware reward integrates accuracy, resource efficiency, and a Useful Handoff Bonus to preserve learning continuity. Containerization further enhances adaptability. Experiments demonstrate faster convergence, improved resource utilization, and enhanced robustness under real mobility traces.	10.1109/TNSM.2026.3750310
Rosario Patanè	Dynamic Coalition Formation Under Capacity Constraints: A Regime-Switching Value-Investing Game	2026	Early Access	Games Modeling Resource management	Edge computing service deployment requires the Network Operator (NO) and Service Providers (SPs) to coordinate investment and resource allocation under uncertain demand. This paper develops an audit-based service management framework for daily coalition formation with fixed capacity and service-level agreement (SLA) reservations. A two-stage coalitional game separates infrastructure investment from operational participation. Demand follows a Geometric Random Walk (GRW), and SPs apply an ordered admission and suspension rule using reported marginal contributions. With the NO held fixed, the operational coalition value is submodular; mandatory reservations can produce negative Shapley payoffs. We derive a separable benchmark, compute operational Shapley allocations, and give a sufficient condition for convergence to an individual equilibrium. A probabilistic audit mechanism provides a conditional daily truthfulness guarantee under verified settlement and enforceable penalties. For five service classes over three years, the reference run gains 12.4% over static grand-coalition membership and recovers 94.6% of the full-information optimum. Across 30 runs, the median gain is 13.3%. Sensitivity tests examine policy parameters, capacity and alternative demand models. The gain depends on capacity and update order; abundant capacity can make the admission rule underperform static membership.	10.1109/TNSM.2026.3750592
Ivette Kembely Carrera Manosalvas, Paulo Freitas De Araujo-Filho, Georges Kaddoum, Hadi Otrok	Unsupervised Hybrid Quantum-Classical Generative Adversarial Network-Based Intrusion Detection System for 6G-enabled Internet of Things	2026	Early Access	Modeling Signal detection Generative adversarial networks	The emergence of sixth-generation (6G) mobile networks contributes to the widespread adoption of critical Internet-of-Things (IoT) applications, such as telesurgery and autonomous vehicles. However, such advancements expand attack surfaces and make traditional security mechanisms insufficient. While machine learning (ML)-based intrusion detection systems (IDSs) have been increasingly adopted to detect attacks in such heterogeneous and dynamic environments, their complex architectures often result in high computational costs and latency, making them unsuitable for the real-time demands of 6G-enabled IoT applications. To address these challenges, we propose a novel unsupervised quantum generative adversarial network (QGAN)-based IDS. Our solution enhances the GAN generator’s ability to model complex data distributions by combining a parametrized quantum circuit with a classical neural network (NN), while maintaining a lightweight classical discriminator (fewer than 2.000 parameters) at the edge. This design significantly reduces computational complexity and minimizes detection times, since only the classical discriminator is used during inference. Experimental results demonstrate that our solution achieves competitive detection rates with an ultra-low inference latency of 0,22 ms, outperforming state-of-the-art GAN-based and transformer-based IDSs by over 2,81 times. Therefore, our architecture provides a resource-efficient security framework that delivers the ultra-low latency and high detection rates essential for next-generation IoT applications.	10.1109/TNSM.2026.3747752
Diogo Pereira, Rodolfo Oliveira, Daniel Benevides Da Costa, Hyong Kim	Performance Assessment of Beamforming Training Protocols in IEEE 802.11ad/ay Networks	2026	Early Access	Modeling Probability Media Access Control	This paper introduces an innovative two-step methodology to model the beamforming training (BFT) medium access control (MAC) behavior of IEEE 802.11ad and IEEE 802.11ay networks, capturing several MAC-layer features specified in the standards that previous work has not considered. The proposed framework jointly employs two discrete-time Markov chains (DTMCs): the first models the individual behavior of each transmitting station (STA), including the dynamic adjustment of the competing STA to account for the idle period, while the second captures the network-wide interactions of all STAs and uses this information to derive the medium access probability at each frame slot during the BFT process. This work introduces two key novel modeling assumptions: (1) the STAs cease access once they successfully access a BFT frame’s slot, and (2) the number of competing STAs dynamically decreases as they enter the idle period after a given number of consecutive collisions, providing a precise representation of BFT MAC operation in IEEE 802.11ad and IEEE 802.11ay standards. We derive the theoretical expressions for the expected number of idle STAs based on probabilities of successful BFT, collisions, and transitions to the idle period.We validate the model’s accuracy through Monte Carlo simulations across diverse network scenarios, showing close alignment with simulation results and improved accuracy over prior models that do not consider these two modeling assumptions. Additionally, we analyze the impact of the collision threshold and idle period duration on BFT goodput, highlighting the model’s ability to compute MAC protocol performance.	10.1109/TNSM.2026.3751488
Zijian Zhao, Davide Di Monda, Domenico Ciuonzo, Yipeng Wang, Antonio Pescapè	Network Intrusion Detection Adaptability under Spurious Labels: A Noise-Aware Few-Shot Class-Incremental Learning Framework	2026	Early Access	Labeling Noise Internet of Things	Network Intrusion Detection Systems (NIDSs) must incrementally adapt to emerging attacks, even when only a limited amount of labeled network traffic is available. Consequently, Few-Shot Class-Incremental Learning (FSCIL)-based NIDSs have gained growing attention. However, existing FSCIL-based NIDSs are highly vulnerable to label noise in newly-observed attack classes. To address this limitation, we propose NAFN, a noise-aware FSCIL-based NIDS framework that reduces the impact of mislabeled data during incremental adaptation. NAFN consists of two components: (i) Noise Detection, which identifies and removes mislabeled biflows using noise-detection algorithms, and (ii) Feature Sampling, which estimates class-conditional embeddings from clean biflows, calibrates them with base-class statistics, and resamples synthetic features to recover the original biflow count. The framework follows the Rethink Few-Shot (RFS) teacher–student paradigm with lightweight nearest-neighbor or logistic regression classifiers, and various pretraining & memory selection strategies. Experiments on CSE-CIC-IDS2018, Edge-IIoT, and IoT-NID datasets show that NAFN effectively preserves prior knowledge and maintains strong incremental performance even under 50% label noise, consistently improving new-class F1-scores over non-denoised baselines, up to +52%, while being time-efficient and robust in cross-network and high-noise incremental settings. The implementation is publicly available to foster reproducibility.	10.1109/TNSM.2026.3752751
Jinzhe Wu, Quansheng Guan, Shugang Hao, Shengming Jiang, F. Richard Yu	Buffer-Induced Optimization Flow Control for Communication Networks	2026	Early Access	Joining processes Delays Throughput	Congestion is the main bottleneck for throughput improvement in communication networks. Since link buffer is an essential and early indicator for congestion, we formulate a buffer-induced optimization (BIO) flow control problem using the network utilization maximization framework. BIO uses link buffer dynamics to regulate source rates. We then derive a buffer-induced asynchronous gradient (BAG) algorithm using Lagrange duality. BAG allows links to price their buffer and allows sources to compute their rates based on path prices distributedly and iteratively. We prove the convergence and optimality of the source-link iterations under asynchronous price and rate updates. To prevent buffer bloat happening in practical networks, we also adopt a buffer shrink mechanism for BAG. Simulation results show that BAG can quickly sense the changes of network status and dynamically capture the optimal network throughput. BAG also achieves higher throughput and stronger robustness to bursts than the existing rate-based flow control and congestion control algorithms.	10.1109/TNSM.2026.3751275