TNSM Searchable Index

Author(s)	Title	Year	Publication	Keywords
Heng-Ru Zhang, Hong Liu	Center-Aware Pairwise Learning for Deep Semi-supervised Anomaly Detection	2026	Early Access	Modeling Anomaly detection Labeling	Anomaly detection (AD) assists in identifying irregularities within data. Existing works have primarily focused on improving detection for seen anomalies. However, most AD methods struggle to effectively detect unseen anomalies, which are novel types absent in training data and deviate from learned patterns. In this paper, we propose the Center-Aware Pairwise Learning (CAPL) network to effectively capture discriminative patterns of anomalies. For the center-aware component, the network extracts a global center vector that encapsulates the representation of all samples. Center loss regularization is then employed to refocus and adjust the sample features, pulling normal samples closer to the center while pushing anomalies further away. The process enhances robustness against distribution shift, improving the detection of unseen anomalies. For pairwise learning, the network captures relational representations by feature embeddings from positive pairs (normal-normal) and negative pairs (normal-anomaly, anomaly-normal and anomaly-anomaly). This strategy enhances generalization by simultaneously learning various normal/anomalous patterns, mitigating overfitting to labeled anomalies. A comprehensive set of experiments is conducted on 7 benchmark datasets using 7 popular algorithms for comparison. The results show that CAPL significantly outperforms competing methods in detecting seen and unseen anomalies. Source codes are available at https://github.com/zhanghrswpu/CAPL.	10.1109/TNSM.2026.3727684
Martine S. Lenders, Carsten Bormann, Thomas C. Schmidt, Matthias Wählisch	A Leaner and Faster Web: How CBOR Can Improve Dynamic Content Encoding in JSON and DNS over HTTPS	2026	Early Access	Internet of Things Encoding Internet	The Internet community has taken major efforts to decrease latency on the World Wide Web with significant improvements in accelerating content transport and in compressing static content. Less attention, however, has been dedicated to compression of dynamic content. Such content is commonly provided by JSON and DNS over HTTPS. Dynamic content objects continue to grow in size, which increases latency and fosters the digital inequality. In this paper, we propose to mitigate this increase by utilizing Concise Binary Object Representation (CBOR), a standard originally designed for the constrained Internet of Things (IoT) to restrict packet sizes and enable efficient encoding of data objects. We provide protocol design and three new data sets for the evaluation of dynamic content, DNS, and the loading of websites. Our key findings are the following: (i) Switching the data representation from JSON to CBOR reduces data by up to 80%. This size reduction can decrease loading times by up to 13.8% when downloading large objects—even in local setups. (ii) Enabling CBOR for DNS over HTTPS (DoH) and DNS over CoAP (DoC) reduces packet sizes significantly. Compressing only names combined with unpacked CBOR achieves maximum gain of 52.2%, using more complex but still lightweight Packed CBOR allows minimizing packets by up to 95.5%. Our lean decoder for name compression can fit into as little as 314 bytes of build size. Our results clearly show the potential of CBOR outside of IoT scenarios. Parts of this research have already influenced work within the IETF.	10.1109/TNSM.2026.3722114
Franck Messaoudi, Luhan Wang, Abdelkader Mekrache, Adlen Ksentini, Bingxuan Li, Jialei Su, Sofiane Messaoudi, Salim El Ghalbzouri	The Brewing Storm in 5G’s Data Plane: Design and Evaluation of a High-Performance eBPF/XDP-Based User Plane Function	2026	Early Access	Quality of service Fluid flow Kernel	This paper presents the design and implementation of a novel 5G UPF leveraging eBPF technology to meet the stringent performance and programmability requirements of emerging 6G systems. Traditional UPF implementations often struggle to balance performance, flexibility, and resource efficiency-challenges particularly critical in CPU- and I/O-constrained edge environments. The proposed eBPF-based UPF architecture mitigates these limitations by embedding core functionalities, such as packet classification, forwarding, and QoS enforcement, directly within the Linux kernel via eBPF programs attached through XDP and tc hook points. Performance evaluation using TRex demonstrates that the proposed solution achieves competitive throughput, low packet loss, and efficient CPU utilization across traffic profiles. Moreover, it maintains full compliance with 5G Core Network standards. Comparative analysis with well-established open-source UPF implementations further underscores its advantages. This work highlights the potential of eBPF as a foundational technology for building next-generation, programmable UPFs optimized for edge cloud deployments in the 6G era.	10.1109/TNSM.2026.3720812
Jing Zhang, Chao Luo, Rui Shao	MTG-GAN: A Masked Temporal Graph Generative Adversarial Network for Cross-Domain System Log Anomaly Detection	2026	Early Access	Anomaly detection Adaptation models Generative adversarial networks	Anomaly detection of system logs is crucial for the service management of large-scale information systems. Nowadays, log anomaly detection faces two main challenges: 1) capturing evolving temporal dependencies between log events to adaptively tackle with emerging anomaly patterns, 2) and maintaining high detection capabilities across varies data distributions. Existing methods rely heavily on domain-specific data features, making it challenging to handle the heterogeneity and temporal dynamics of log data. This limitation restricts the deployment of anomaly detection systems in practical environments. In this article, a novel framework, Masked Temporal Graph Generative Adversarial Network (MTG-GAN), is proposed for both conventional and cross-domain log anomaly detection. The model enhances the detection capability for emerging abnormal patterns in system log data by introducing an adaptive masking mechanism that combines generative adversarial networks with graph contrastive learning. Additionally, MTG-GAN reduces dependency on specific data distribution and improves model generalization by using diffused graph adjacency information deriving from temporal relevance of event sequence, which can be conducive to improve cross-domain detection performance. Experimental results demonstrate that MTG-GAN outperforms existing methods on multiple real-world datasets in both conventional and cross-domain log anomaly detection.	10.1109/TNSM.2026.3654642
Deemah H. Tashman, Soumaya Cherkaoui	Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks	2026	Early Access	Reconfigurable intelligent surfaces Reliability Optimization	Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems.	10.1109/TNSM.2026.3660728
Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh	Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices	2026	Early Access	Schedules Scheduling Cloning	Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline.	10.1109/TNSM.2026.3694238
Pingping Dong, Liying Chen, Xuan Yao, Kai Wang, Lianming Zhang, Jiawei Huang	Fumer: Proactive Time-Shifting for Synchronized Periodic Traffic in Distributed Training	2026	Early Access	Training Timing Modeling	The growth of distributed training models, with parameters now reaching the billion-scale, has shifted the system bottleneck from computation to communication. While Remote Direct Memory Access (RDMA) is widely deployed to improve network performance by circumventing the kernel mechanism, the synchronization-computation cycles under the synchronous parallel mode introduce a highly synchronized and periodic “on-off” bursty traffic pattern, which poses significant challenges to data center networking. Consequently, distributed training suffers from two critical bottlenecks: instantaneous congestion during communication and persistent link idleness during computation. These issues lead to severe bandwidth contention and resource underutilization, ultimately hindering overall training efficiency. To address these challenges, this paper proposes Fumer, a proactive periodic traffic optimization framework that shifts the congestion control paradigm from reactive rate adjustment to proactive time-shifting. Specifically, Fumer leverages In-band Network Telemetry (INT) and Fast Fourier Transform (FFT) with signal-wave separation to decompose interleaved traffic signals, aiming to overcome the lack of periodic awareness. Furthermore, Fumer employs an off-peak transmission optimization algorithm to calculate optimal time-shift values, thereby tackling synchronized congestion and link idleness. By executing proactive off-peak scheduling, Fumer shifts overlapping communication windows into idle periods to smooth traffic peaks in the time domain. Experimental results show that Fumer boosts average path throughput across all workloads to 86.3 Gbps, improving upon DCQCN (42.6 Gbps) by 102.6% and RECC by 22.1%. Furthermore, it reduces the average and 99.9th-percentile iteration times by up to 25.0%-45.4% and 25.5%-49.3%, respectively, demonstrating its efficacy and robustness across diverse large-scale training workloads.	10.1109/TNSM.2026.3728016
Khaleda Papry, Conrado Boeira, Kazi Hasan, Yue Ju, Zhongwen Zhu, Israat Haque	A Graph Neural Network and Transformer-based Anomaly Detector and Root Cause Analyzer in Radio Access Networks	2026	Early Access	Modeling 5G mobile communication Graph neural networks	The emergence of 5G technology marks a major milestone in the evolution of telecommunication networks, enabling transformative applications such as augmented reality and autonomous vehicles. However, these advancements significantly increase network management complexity and raise critical challenges in failure handling, as 5G-supported applications heavily depend on ultra-reliable, high-performance, and low-latency connectivity. Consequently, automated self-healing mechanisms have become essential, using learning-based approaches to detect anomalies and perform Root Cause Analysis (RCA) with minimal human intervention. Such intelligent systems must effectively capture the inherent spatio-temporal communication patterns among mobile devices (UEs) and radio base stations, using realistic Key Performance Indicators (KPIs) derived from representative Radio Access Networks (RANs). Nevertheless, existing AI-driven solutions often rely on outdated LTE datasets or model only spatial or temporal characteristics in isolation, limiting their effectiveness in highly dynamic 5G RAN environments. This work develops a hybrid Graph Neural Network (GNN) and Transformer-based model, Simba, where the GNN captures spatial dependencies while the Transformer models temporal dynamics for joint anomaly detection and RCA. Then, we generate synthetic yet representative datasets using a calibrated Simu5G simulator aligned with 3GPP specifications. Extensive evaluations under multiple concurrent fault scenarios across both normal and peak-hour RAN operations demonstrate Simba’s superior performance over existing approaches. In particular, Simba consistently achieves an F1-score of at least 0.95 across all evaluated scenarios, representing an 18% improvement over a state-of-the-art baseline detection scheme.	10.1109/TNSM.2026.3728303
Eiji Oki, Masaki Maeda, Ryuta Shiraki	Design of Survivable Entanglement Path Provisioning under Node Failures in Quantum Networks	2026	Early Access	Modeling Joining processes Probability	Quantum networks enable end-to-end quantum communication by leveraging inherently probabilistic processes, such as distributing entanglement between distant nodes and performing entanglement swapping at intermediate repeater nodes. Existing work has focused on maximizing the entanglement path success probability under link failures. However, the occurrence of physical node failures poses a significantly greater challenge to maintaining stable entanglement connections. To tackle this problem, it is necessary to develop a path provisioning design model that can preserve a high end-to-end entanglement success probability despite the occurrence of node failures. This paper proposes a survivable path provisioning design model to determine node- disjoint entanglement paths in quantum networks, which takes into account both the link-level transmission success probabilities and the node-level entanglement swapping success probabilities at nodes. The proposed model aims to maximize the entanglement path success probability for survivability under node failure. We express the proposed design model in the form of an integer linear programming problem. Numerical results show that the proposed model attains greater survivability compared with the baseline algorithms.	10.1109/TNSM.2026.3728093
Jian Wu, Xueshuai Sui, Jun Yao, Leyuan Yang, Guohui Li, Jiadong Sun, Lijun Quan	DAO-Migrator: A Dependency-Aware Orchestration Framework for Service Migration in Hybrid SDN	2026	Early Access	Clouds Decentralized autonomous organization Software defined networking	The evolution of Software-Defined Networking (SDN) has produced a widespread hybrid deployment pattern in which enterprise-operated vendor SDN solutions coexist with internally developed SDN platforms. Because each stack manages its own availability zones (AZs) with distinct interfaces and resource models, migrating cloud services across these heterogeneous environments has become a recurring operational challenge. The scale and dependency complexity of modern service topologies make this task difficult to carry out manually, yet mainstream Infrastructure-as-Code (IaC) tools were not designed with migration-aware process control in mind. This paper presents DAO-Migrator, an orchestration framework that treats service migration as a state-trackable, closed-loop process rather than a sequence of independent resource operations. The framework introduces a formal Migration Quadruple to standardize per-resource workflows, a Dynamic Context Passing mechanism to automatically bridge runtime-discovered parameters from investigation to execution, and production-grade assurance primitives including hierarchical concurrency control and instance-granular atomic rollback. Evaluated in a Mobile Cloud production environment over one year of operation, DAO-Migrator achieves an approximately 50-fold reduction in end-to-end delivery time for 100-port migrations (i.e., execution time plus the manual preparation overhead that competing tools offload to operators), reduces Mean Time to Repair (MTTR) by over 90%, and maintains transactional consistency across evaluated failure scenarios, while imposing no measurable overhead on the target cloud’s control plane.	10.1109/TNSM.2026.3727666
Alex Piccioni, Andrea Marotta, Claudia Rinaldi, Dajana Cassioli, Fabio Graziosi	From Ground to Air: Making Mobile Networks Ready for Urban Air Mobility	2026	Early Access	Urban air mobility Modeling Optimization	Urban Air Mobility (UAM) is expected to be an innovative component of future transportation systems. It introduces great flexibility (additional degrees of freedom) to mobility in 3D space and paves the way to novel design methodologies of wireless communication networks to support both critical and non-critical communications. Main requirements for these networks are high reliability, low latency, and high throughput, barely addressable with existing terrestrial networks unless these are upgraded on the basis of a thorough assessment of coverage capabilities and network planning methodologies. This work investigates the suitability of modern mobile networks, such as 5G and forthcoming 6G, to enable the delicate UAM operations and identifies the gaps to be filled in. The study introduces an enhanced evaluation framework based on a system-level simulator tailored to UAM-specific characteristics in realistic scenarios. Our methodology allows us to determine the minimum number of enhanced Base Stations (eBSs) that must be upgraded to satisfy the considered throughput and BLock Error Rate (BLER) requirements under the adopted system assumptions. The framework integrates a channel-aware selection strategy that prioritizes the upgrades in the subset of base stations that allow the provisioning of the most favorable aggregated link conditions. We explore a variety of realistic deployment scenarios, analyzing the impact of parameters such as UAM Vehicle (UV) population, performance requirements, transmit power, and target BLER on achievable network performance. The results highlight the trade-offs between infrastructure density and service quality, offering practical guidelines for network operators to design UAM-ready deployments along the evolution path toward 6G systems.	10.1109/TNSM.2026.3728202
Liang Liu, Wenbin Zhai, Feng Wang, Youwei Ding, Wanying Lu, Weizhi Meng	Federated Semi-Supervised and Semi-Asynchronous Learning for Anomaly Detection in IoT Networks	2026	Early Access	Labeling Modeling Internet of Things	The expansive attack surfaces and device heterogeneity of Internet of Things (IoT) networks pose significant challenges for anomaly detection. While Federated Learning (FL) enables privacy-preserving detection, existing FL methods typically assume fully labeled client data, which is unrealistic for practical IoT deployments. Resource constraints and network heterogeneity further complicate the trade-off among training efficiency, detection accuracy, and communication overhead. To address these challenges, we propose FedS3A, a Federated Semi-Supervised and Semi-Asynchronous learning framework for IoT anomaly detection. FedS3A operates in a practical disjoint semi-supervised setting where the server holds limited labeled data and clients possess extensive unlabeled data. We apply pseudo-labeling with a dynamically decaying weight to balance server-side supervised training and client-side unsupervised learning. To improve round efficiency, we introduce a semi-asynchronous model update and staleness-tolerant distribution scheme that scales client contributions to the global model based on local model staleness and participation frequency. We also adopt a group-based aggregation function to mitigate the impact of non-IID client data, and utilize sparse difference transmission to reduce communication overhead. We evaluate FedS3A on the CIC-IDS2017 and Edge-IIoTset datasets, and the results demonstrate that FedS3A consistently outperforms representative FL approaches in detection performance and round efficiency. FedS3A achieves over 98% accuracy even under non-IID settings while reducing communication costs by approximately 50%.	10.1109/TNSM.2026.3727228
Ryota Nakamura, Kengo Urata, Shigeaki Harada	A Virtual Network Embedding Method Enhancing Self-consumption of Renewable Energy	2026	Early Access	Timing Joining processes Real-time systems	To achieve carbon neutrality in telecommunications networks, renewable energy (RE) must be utilized more efficiently despite its inherent fluctuations. These fluctuations often cause mismatches between power generation and demand, leading to surplus power in some sites and shortages in others. To address this issue, we formulate the problem of maximizing RE use in the allocation of virtualized ICT workloads, which can be realized through techniques such as VM live migration across sites and time periods. To efficiently solve the formulated problem, we propose a heuristic search method that leverages virtualization to enable VM workload migration across sites and time periods, thereby optimizing resource allocation according to RE availability. The proposed method is designed to increase RE consumption while managing trade-offs with communication quality and equipment efficiency. Simulation results demonstrate that our approach can improve RE utilization by up to 30% while maintaining acceptable performance, even under prediction errors. These findings highlight the potential of virtualization-based control frameworks for building more sustainable and environmentally conscious telecommunications networks.	10.1109/TNSM.2026.3726977
Raeed Al-Sabri, Abdullatif Albaseer, Mohamed Abdallah, Ala Al-Fuqaha	DMGCRL: Dynamic Multi-Scale Graph Contrastive Representation Learning For Network Intrusion Detection	2026	Early Access	Modeling Intrusion detection Labeling	Graph neural networks (GNNs) have recently attracted significant attention in network intrusion detection systems (NIDS) due to their ability to model network traffic as graphs and capture complex relationships within network flows. However, existing GNN-based methods face critical limitations: they rely on limited or noisy labeled data and struggle to detect threats at various scales, ranging from local anomalies (e.g., port scanning) to coordinated subnetwork attacks (e.g., botnets) and global network-wide campaigns (e.g., DDoS attacks). To bridge this gap, we propose Dynamic Multiscale Graph Contrastive Representation Learning (DMGCRL), a self-supervised framework that hierarchically models network intrusions at different levels. At the node level, DMGCRL constructs structure-aware subnetworks around individual traffic flows to capture fine-grained behavioral deviations. For subnetwork-level threats, it employs substructure-aware pooling to identify coordinated anomalies among clustered malicious nodes. Finally, at the global level, DMGCRL derives representations that reflect the holistic state of the network, enabling detection of large-scale threats, such as distributed malware propagation. DMGCRL designs a shared GNN encoder with a multi-level contrastive loss to align multiscale representations while largely eliminating label dependence. It learns discriminative features from unlabeled traffic, refines decision boundaries without supervision, and reveals anomalies by contrasting related and unrelated nodes across scales. Performance evaluation was conducted on five publicly available network traffic datasets for binary and multiclass detection. Results show that DMGCRL consistently outperforms SOTA methods, achieving an F1 score of 99.86% on NF-CSECIC-IDS2018-V2 and 96.11% on NF-UNSW-NB15-V2 under binary detection and the lowest mean false positive rates, 1.28% and 2.33% under multiclass detection on the two datasets.	10.1109/TNSM.2026.3726282
Qiru Chen, Xinping Guan, Lei Xu, Yanzhou Zhang, Qimin Xu, Cailian Chen	Knowledge-Aware Schedulability Analysis for Time-Sensitive Networking: A GNN-Based Method	2026	Early Access	Modeling Fluid flow Schedules	Industrial automation is rapidly evolving toward flexible production. This transition requires networks to ensure the deterministic transmission of varying traffic sets across different production stages. Consequently, the system must be capable of rapidly analyzing whether fixed network resources can accommodate all service requirements prior to actual scheduling. While Time-Sensitive Networking (TSN) provides the deterministic transmission for such environments, existing schedulability assessments rely on exhaustive scheduling tests. However, the scheduling process is inherently an NP-hard constraint satisfaction problem, whose heavy computational overhead severely limits deployment agility. Therefore, it is critical to develop a method that can rapidly predict the constraint satisfiability of diverse traffic sets without repetitive and time-consuming scheduling. In this work, given the inherent graph-structured nature of network infrastructure and traffic patterns, we design a graph neural network model to explicitly capture complex spatial dependencies. As node attributes, sparse basic traffic features are distilled as expert knowledge and integrated, thereby enhancing prediction accuracy. When a traffic set is deemed unschedulable, we explore the traffic features and links with the greatest impact. Based on this, a feature-driven rerouting strategy is proposed to find a more schedulable traffic behavior. The evaluation results show that the model demonstrates the capability to process thousands of datasets within hundreds of microseconds, while guaranteeing a prediction accuracy of over 90% and an increase in the count in schedulable flows by about 25% compared to the standard Dijkstra’s shortest path algorithm baseline.	10.1109/TNSM.2026.3724835
Lin Cong, Junru Cai, Ying Wang, Peng Yu, Xuesong Qiu, Shaoyong Guo, Ao Xiong	Dynamic E2E Channel Orchestration in Metro Transport Network	2026	Early Access	Algorithms Optimization Timing	In the era of 5G and beyond, the hard-isolated channels enabled by time slot cross-connects in metro transport network (MTN) effectively meet the demands of emerging network services for low latency, low jitter, flexible bandwidth, and secure isolation. However, the dynamic arrival and departure of tenant virtual network request (VNRs) lead to resource fragmentation within the MTN transport network, resulting in inefficient resource utilization. To mitigate network resource fragmentation, we formulate the MTN dynamic channel orchestration problem and propose a fragmentation-aware MTN dynamic channel orchestration method. This method comprises two key components: a greedy graph-reconstruction-based channel mapping algorithm and a fragmentation-aware channel reconfiguration algorithm. The former optimizes MTN channel resource allocation to achieve static channel orchestration, while the latter, leveraging a simulated annealing-based channel reconfiguration strategy, dynamically adjusts channel allocations based on the static orchestration results, thereby reducing fragmentation levels. Compared to existing approaches, under varying network load conditions, the proposed channel mapping algorithm reduces the consumption of network time slot resources by 16.3% -20.6%, while the channel reconfiguration algorithm significantly lowers the levels of network fragmentation by 48.7% -79.5%, and reduces the running time by 91.3%–94.2% compared with the baseline.	10.1109/TNSM.2026.3723823
Ping He, Yu Yao, Xu Li, Yao Hu, Wei Yang	FIGAN: Diversity-Oriented Traffic Generation for Industrial Protocol Format Inference	2026	Early Access	Protocols Modeling Fuzzing	Protocol Format Inference is a pivotal step in the reverse engineering of proprietary protocols, yet its effectiveness is constrained by the scarcity of high-quality training data. In industrial control systems, the rigid and cyclical nature of traffic results in a "long-tail" distribution, where diverse functional scenarios are severely underrepresented. Existing generative approaches, primarily designed for fuzzing or intrusion detection, fail to resolve the intrinsic conflict between syntactic validity and semantic diversity required for protocol format inference. To bridge this gap, we propose FIGAN, a stage-wise decoupled generative framework tailored to synthesize high-fidelity traffic for protocol format inference. By isolating flexible distribution learning from rigid syntax enforcement, FIGAN liberates the generative process to extrapolate novel payload variations from a continuous latent space, effectively surmounting the limitations of sparse seed data. Specifically, the framework integrates three synergistic modules: first, heuristic pre-processing that constructs semantic templates as a prior knowledge base; second, a generative adversarial architecture optimized via discrete relaxation to explore high-dimensional payload patterns independently of syntax rules; and finally, a closed-loop verification mechanism that performs syntactic calibration and functional validation against simulated device responses. Evaluations on four real-world protocols (Modbus TCP, S7Comm, Omron FINS, and DNP3) demonstrate that FIGAN significantly outperforms state-of-the-art baselines. The source code has been open-sourced https://github.com/MissHP111/FIGAN.	10.1109/TNSM.2026.3717268
Wei Sai, Yihui Lu, Xin Guo	A Privacy-Preserving Security Framework for Multi-Party Data Fusion Computing Based on Homomorphic Encryption	2026	Early Access	Security Protocols Information rates	To prevent plaintext exposure in multi-party collaborative computing, this paper proposes a distributed secure multi-party computation protocol based on the Cheon-Kim-Kim-Song (CKKS) homomorphic encryption scheme. Data is encoded and encrypted at the source into CKKS complex polynomial ciphertext, enabling vectorized fusion under shared evaluation keys and threshold decryption in a decentralized architecture without a trusted central authority. Experiments on heterogeneous multi-institution datasets demonstrate low numerical error (9.0×10⁻⁷ at polynomial order 2¹⁶ and depth 12), effective scalability (throughput increasing from 1.12×10⁵ to 1.32×10⁵ ops/s and latency decreasing from 56 ms to 38 ms as nodes scale from 4 to 16), and strong robustness (70% decryption success at a 60% threshold and 95% recovery under malicious interference), showing that the framework achieves efficient computation with strict privacy protection for cross-party data fusion.	10.1109/TNSM.2026.3717343
Shuang Zheng, Xing Zhang, Michael Sheng, Haixu Wang, Wenbo Wang	Beam Hopping Low Earth Orbit Satellite Resource Allocation for Differentiated Services and Robustness Analysis under Model Attacks	2026	Early Access	Beams Satellites Resource management	Beam hopping (BH)-enabled Low Earth Orbit (LEO) satellites play a pivotal role in next-generation communication networks, providing global coverage, improving spectrum efficiency, and supporting flexible adaptation to heterogeneous service demands. To fully exploit these capabilities, artificial intelligence (AI) techniques are increasingly employed for dynamic resource allocation and power management. However, limited onboard resources and potential adversarial perturbations pose challenges to both efficiency and robustness. To address these issues, we leverage digital twin technology to accurately capture the spatio-temporal dynamics of user–satellite visibility, providing precise state information for decision-making. Building on this, we formulate a joint optimization framework for BH scheduling and power allocation as a Markov Decision Process and propose the BRIDGE—BH with Reinforcement learning incorporating Integrated Dirichlet and Gumbel-TopK Exploration—which integrates a quality of service (QoS)-driven subchannel scheduling mechanism to ensure efficient and differentiated resource allocation. The model’s robustness is systematically evaluated under three classical adversarial attacks. Simulation results demonstrate that our approach achieves superior energy efficiency, service throughput, and fairness, while the robustness analysis shows stable performance under the considered bounded adversarial perturbations.	10.1109/TNSM.2026.3710750
Depeng Xu, Guozhen Cheng, Hongchao Hu, Quan Ren, Xiaohan Yang, Kangxu Wang	STNet: Multi-Scale Spatiotemporal Learning and Adaptive Fusion for Few-Shot Tor Traffic Classification	2026	Early Access	Modules (abstract algebra) Modeling Accuracy	The Tor network’s anonymity is increasingly exploited for cybercrime, creating a demand for accurate traffic classification under strict few-shot constraints. While recent efforts like WF-Transformer demonstrate strong temporal modeling capabilities, they still require abundant labeled data and struggle to generalize under defense-induced distortions and open-world unknown traffic. To address these gaps, we propose STNet (SpatioTemporal Multi-scale Augmentation and fusion Network), an episode-based few-shot learning architecture for Tor traffic classification. Unlike simple module stacking, STNet adopts a modular decoupling design: (1) a Multi-Scale Spatiotemporal Feature Fusion (MSMF) module captures packet-level and flow-level patterns to resist obfuscation; (2) scenario-adaptive modules tackle domain shifts in closed-world settings and feature scarcity in open-world settings; and (3) a Hierarchical Layer Attention (HLA) mechanism dynamically fuses heterogeneous features from different deployment positions. Extensive experiments on real-world Tor traffic show that STNet consistently outperforms representative baselines including WF-Transformer. In closed-world settings, it limits the accuracy drop under WalkieTalkie obfuscation to 13.6 percentage points. In open-world 10-shot evaluation, it achieves 92.1% AU-COVR and 79.1% unknown-class F1-score, surpassing the best baseline by 4.9 and 6.0 percentage points, respectively. These results demonstrate the effectiveness of decoupling universal feature extraction from scenario-specific adaptation in few-shot Tor traffic analysis.	10.1109/TNSM.2026.3722541