Last updated: 2026-11-09 05:01 UTC
All documents
Number of pages: 178
| Author(s) | Title | Year | Publication | Keywords | ||
|---|---|---|---|---|---|---|
| Muhammad Faizan Ayub, Xiong Li, Khalid Mahmood, Muhammad Asad Saleem, Salman Shamshad, Zahid Ghaffar, Yong Xie | A Lightweight and Secure Key Exchange Protocol for fortifying Home Area Network in Smart Grid | 2026 | Early Access | Protocols Smart grids Authentication Smart meters Costing Security Physical unclonable function Modeling Elliptic curve cryptography Timing Authentication Protocol Secure Key Exchange Access Control Protocol Security Smart Grid Networks | Smart grid networks rely on communication links to support monitoring and control of energy usage. Because these links are open, especially in Home Area Networks (HAN), security problems can occur. Devices may be physically captured, attackers may impersonate legitimate nodes, and temporary secret values may be exposed. Several key exchange protocols have been proposed to address these concerns. In practice, some of them still suffer from security weaknesses, while others introduce high communication and computation costs. In this work, we present a key exchange approach for HAN in smart grid systems based on Elliptic Curve Cryptography (ECC) and Physical Unclonable Functions (PUF). The protocol is analyzed using the Random-or-Real (RoR) model, along with an informal security discussion. Different attack scenarios, including impersonation, disclosure of stored meter data after capture, and ephemeral secret leakage, are considered. We also compare the proposed protocol with existing protocols and based on the comparison results, the proposed protocol shows a reduction of 3.843% in computational cost and 29.49% in communication cost. | 10.1109/TNSM.2026.3746724 |
| Aleksandar Avdalović, Joseph Khoury, Ibrahem AlJabea, Mustafa Hajij, Elias Bou-Harb | Beyond Flat Models: Preserving ICS Topology using Combinatorial Complexes for Hierarchy-Aware Intrusion Detection | 2026 | Early Access | Modeling Cells (biology) Integrated circuits Tagging Ranking (statistics) Image sensors Location awareness Signal detection Security Conferences Industrial Control Systems Intrusion Detection Anomaly Localization Topological Deep Learning Combinatorial Complexes Purdue Model Cyber-Physical Security | Industrial Control Systems (ICS) follow the Purdue model hierarchy, organizing sensors, actuators, Programmable Logic Controllers (PLCs), and supervisory control into distinct hierarchical layers. Despite this inherent structure, existing data-driven intrusion detectors still fail to model this intricate property. To address this gap, we introduce a Hierarchy-Aware Intrusion Detector, HAID, a topology-preserving framework that models an ICS as a Combinatorial Complex (CC), operating solely on process telemetry and trained on benign traces to detect falsified sensor measurements and unauthorized actuator commands. The complex captures devices, functional interactions, and PLC control zones within an ICS. CCs (unlike flat models) encode telemetry across hierarchical levels for training a Topological Neural Network (TNN). As such, HAID enables the embedding of the ICS Purdue model into the learning process, yielding anomaly scores and localization at each of the aforementioned levels. Evaluated on two water testbeds, SWaT and WADI, and on a simulated chemical process, TEP, HAID achieves competitive detection performance (82.7% F1 on SWaT and 50.1% on WADI, averaged over five runs), while providing explicit hierarchical localization unavailable in prior work. Through ablations, we confirm the added-value of hierarchical modeling, as removing the PLC-zone representation reduces F1 by 5.8 percentage points on SWaT and causes detection on WADI to collapse. The largest losses are on attacks that manipulate several devices at once, which device- and interactionlevel signals usually miss. | 10.1109/TNSM.2026.3746967 |
| Yule Han, Kezhi Wang, Yizhe Zhao, Kun Yang | Smart-TCP: An Agentic AI-based Autonomous and Adaptive TCP Protocol | 2026 | Early Access | Modeling Protocols TCP Large language models Arithmetic Context Labeling Sequential analysis History Sequences Agentic AI Large Language Models Small Language Models Network Service Management Transmission Control Protocol (TCP) | The Transmission Control Protocol (TCP) relies on deterministic state machines and sequence-number arithmetic to ensure reliable communication. However, hard-coded protocol logic is difficult to adapt to increasingly complex and dynamic network conditions. This paper proposes Smart-TCP, an agentic AI-based transport protocol framework that organizes TCP control logic as a fast/slow model-assisted decision process. Specifically, a feature-aware classifier routes routine segments to a lightweight Small Language Model (SLM) fast path and anomalous or boundary cases to a Large Language Model (LLM) slow path, while an Arithmetic Logic Unit (ALU) handles deterministic computation of sequence and acknowledgment numbers. A state module maintains connection state, packet history, and key control variables, enabling protocol decisions over the full session context. A scoped Protocol Guard checks candidate decisions against RFC-derived rules before execution. We evaluate Smart-TCP through path classification, atomic packet processing, slow-path anomaly response, and end-to-end session interaction. Experimental results show that Smart-TCP achieves 99.14% action accuracy on 700 slow-path anomaly and fallback samples, and a 100% full-lifecycle success rate over 300 ideal fast-path end-to-end session windows. The ordinary 32-KiB transfer tests achieve a 96.5% completion rate at 20% segment loss. These results suggest that separating model-based protocol decisions from deterministic arithmetic improves the reliability of TCP control for network service operation. | 10.1109/TNSM.2026.3747846 |
| Ramazan Enisoglu, Burak Alp Inan, Muhammed Ali Erbir | MSCANet: A Multi-Scale Channel Attention Network for Encrypted Traffic Classification | 2026 | Early Access | Modeling Transformers Convolutional neural networks Fluid flow Windows Accuracy Seeds (agriculture) Joints Labeling Training Encrypted traffic classification deep learning multi-scale convolution channel attention Transformer network security network service management | Encrypted communication has rendered traditional traffic classification ineffective, creating challenges for QoS provisioning, network management, and security monitoring. Existing deep learning approaches exploit either spatial or sequence-level features in isolation, without jointly modeling multi-scale byte patterns and inter-packet ordering. We propose MSCANet, a hybrid architecture integrating a multi-scale 1D convolutional module, a sequentially applied Efficient Channel Attention (ECA) module, and a Transformer encoder, combining the two feature streams through a learnable weighted concatenation. With approximately 1.18M parameters, MSCANet attains 95.14% mean accuracy on the 20-class USTC-TFC2016 dataset and 92.61–98.01% across three 10-class sub-tasks over five random seeds, at a median per-sample inference latency of 1.29 ms on an NVIDIA RTX 5090 Laptop GPU. Against five baselines re-trained under an identical pipeline and schedule, spanning classical machine learning, CNN-only, attention-BiLSTM, and hybrid CNN–Transformer families, MSCANet is the most accurate on all four sub-tasks, improving over the strongest classical baseline by 6.16 pp and over the closest neural baseline by 2.38 pp while using 17.5% of its parameters and running 3.1× faster. These gains are demonstrated against the five re-trained baselines. Pretrained Transformers such as ET-BERT and YaTC report higher accuracy in their original publications, under their own preprocessing and with a pretraining stage that MSCANet does not use; the advantages we expect relative to them (no pretraining stage and, against ET-BERT, a model two orders of magnitude smaller) were not measured under our protocol, and we position MSCANet within the train-from-scratch regime. | 10.1109/TNSM.2026.3748386 |
| Mona Alghamdi, Atm S. Alam, Asma Cherif | A Context-Aware Action Filter for Deep Reinforcement Learning-Based Task Orchestration in Mobile Edge Computing | 2026 | Early Access | Filtering Servers Filters Learning (artificial intelligence) Delays Modeling Timing Mobile handsets Context-aware services Training Mobile Edge Computing (MEC) task orchestration deep reinforcement learning (DRL) Double Deep Q-Network (DDQN) action filtering action space reduction | The growing complexity and highly dynamic characteristics of Mobile Edge Computing (MEC) environments introduce considerable challenges for Deep Reinforcement Learning (DRL)-based task orchestration. With an increasing number of potential execution nodes, the set of available actions becomes substantially larger, leading to greater exploration complexity and exposing the learning agent to many infeasible or contextually inappropriate decisions. This paper proposes a Context-Aware Action Filter (CAAF) for Double Deep Q-Network (DDQN)-based task orchestration in MEC. CAAF dynamically evaluates candidate edge servers according to task characteristics, resource availability, network conditions, and system context. It combines a composite suitability assessment with an adaptive distribution-aware filtering mechanism that removes less-suitable actions when meaningful differences exist among candidates, while preserving action diversity when their suitability is comparable. The resulting reduced action space is then provided to the DDQN agent for task assignment. Simulation results demonstrate that CAAF-DDQN outperforms conventional DDQN, particularly under high-load conditions, reducing service time and task failure rate by approximately 20.0% and 45.7%, respectively. Scalability experiments with a larger number of edge servers further confirm its effectiveness under enlarged action spaces, achieving reductions of approximately 31.8% in service time and 89.5% in task failure rate without modifying the DDQN architecture or learning hyperparameters. | 10.1109/TNSM.2026.3749201 |
| Mario Chahoud, Hani Sami, Ahmad Hammoud, Rabeb Mizouni, Hadi Otrok, Jamal Bentahar, Azzam Mourad, Chamseddine Talhi | Multi-agent Deep Reinforcement Learning Scheme for On-Demand Federated Learning | 2026 | Early Access | Modeling Federated learning Training Learning (artificial intelligence) Convergence Accuracy Internet of Things Resource management Servers Optimization Federated Learning Multi-Agent Deep Reinforcement Learning On-Demand Federated Learning Client Selection Mobility-Aware Learning Partially Observable Markov Game Centralized Training and Decentralized Execution Edge Computing | The rapid growth of intelligent IoT devices and mobile edge infrastructures has generated massive decentralized data, necessitating efficient and privacy-preserving learning. Federated Learning (FL) enables distributed model training without sharing raw data; however, its performance degrades in dynamic mobile environments due to unpredictable availability, stragglers, and frequent dropouts. In On-Demand FL, training services and models are deployed only when needed rather than relying on always-active infrastructure, requiring orchestrators to adapt to client arrivals, departures, and mobility while efficiently allocating limited resources and maintaining training continuity. Existing client-selection methods rely on static heuristics or centralized Reinforcement Learning models that struggle to scale and adapt to such dynamics. To address these challenges, we propose a cooperative Multi-Agent Deep Reinforcement Learning (MADRL) framework for client selection in On-Demand FL. Multiple orchestrators act as agents under a Centralized Training and Decentralized Execution (CTDE) paradigm. The problem is formulated as a Partially Observable Markov Game (POMG), capturing mobility, partial observability, and distributed decision-making. A mobility-aware reward integrates accuracy, resource efficiency, and a Useful Handoff Bonus to preserve learning continuity. Containerization further enhances adaptability. Experiments demonstrate faster convergence, improved resource utilization, and enhanced robustness under real mobility traces. | 10.1109/TNSM.2026.3750310 |
| Soonbeom Kwon, Yusu Noh, Youngwoo Jang, Illyoung Choi, Byungchul Tak, In-geol Chun, Young-Kyoon Suh | Scalable and Robust Resource Provisioning via Adaptive Task Scheduling for Edge Devices | 2026 | Early Access | Schedules Scheduling Cloning Timing Educational institutions Computers Transcoding Videos Tail Edge computing Edge devices Edge server Resource augmentation Task distribution Kubernetes | Edge devices, such as wearables, drones, and CCTV systems, are vital for real-time data collection in urban intelligence. However, their limited computational and storage capacities pose significant challenges. While offloading to public clouds offers scalability, it often incurs high latency and operational costs. Conversely, centralizing workloads on edge servers may result in the underutilization of high-performance edge devices. To address these limitations, we introduce ERPF, a Kubernetes-based Edge Resource Provisioning Framework that augments the capabilities of heterogeneous edge environments. ERPF orchestrates dynamic volume provisioning, GPU-aware resource allocation, execution context migration, and adaptive task distribution to improve system flexibility and efficiency. Building on this, we propose a novel adaptive task scheduling technique, termed eATS, composed of three key mechanisms: (i) Partition Smoothing Scheme for stable task granularity control, (ii) Resilient Edge Reintegration for failure detection and task reassignment, and (iii) Competitive Task Cloning for speculative execution with fastest-result commitment. The proposed eATS scheme reduces task execution time by up to 27.6%, lowers partition size variability by 8.7×, and improves scheduling robustness across heterogeneous edge devices over the baseline. | 10.1109/TNSM.2026.3694238 |
| Imran Ahmed, Yudai Ogata, Eiji Oki | Multipartite Entanglement Routing Design in Quantum Networks | 2026 | Early Access | Joining processes Trees (botanical) Vegetation Modeling Probability Memory Routing Timing Quantum networks Costing Quantum networks quantum key distribution entanglement routing mixed-integer linear programming multipartite entanglement | Quantum networks enable secure communication and distributed quantum computation using entanglement, quantum teleportation, and the no-cloning theorem. Future quantum networks will support multiparty applications such as multiparty quantum key distribution and quantum secret sharing, which require simultaneous entanglement distribution among multiple users. Therefore, efficient routing that accounts for quantum network constraints is crucial for practical multiparty quantum communications. Although bipartite entanglement routing has been studied extensively, multipartite entanglement routing with probabilistic quantum link generation and fusion operations remains inadequately addressed. This paper proposes a routing model for multipartite entanglement distribution that explicitly incorporates the probabilistic nature of quantum operations and maximizes the probability of successfully distributing a Greenberger-Horne-Zeilinger (GHZ) state to all requesting users under practical quantum network constraints. We formulate this model as a mixed-integer linear programming (MILP) problem. We prove that finding the optimal Steiner entanglement tree under the proposed model is NP-hard. For large-scale scenarios where MILP becomes computationally intractable, we develop a heuristic approach. Numerical results demonstrate that the proposed model achieves a higher entanglement tree success probability and greater robustness than baseline methods across diverse network conditions, including scenarios with stringent quantum memory constraints and large terminal sets. | 10.1109/TNSM.2026.3751204 |
| Jian Ye, Gaolei Fei, Jiajie Li, Xuemeng Zhai, Guangmin Hu, Ming Liang | Network topology inference via time-frequency consistency analysis of end-to-end traffic time series | 2026 | Early Access | Timing Topology Measurement Probes Frequency Modeling Trees (botanical) Vegetation Joining processes Tomography Network topology inference network tomography time-frequency consistency contrastive learning | In this paper, we study the classical network tomography problem of tree topology inference using end-to-end measurement. Traditional methods rely on time series correlations to measure shared path lengths. However, time-varying and non-stationary background traffic often biases these measurements. To overcome this, we comprehensively explore end-to-end traffic time series via time-frequency consistency analysis. Specifically, we jointly characterize time series in both time and frequency domains, imposing a consistency constraint. This ensures embeddings of the same time series across domains remain close in the latent space, providing a robust description of traffic dynamics. Our contrastive learning approach effectively highlights similarities among flows on common paths and distinguishes those on disjoint paths, thereby mitigating background traffic interference. Extensive evaluations across widely used probing strategies and metrics demonstrate that our embedding significantly enhances time series correlation and accurately measures shared paths. | 10.1109/TNSM.2026.3749558 |
| Shubhani Aggarwal, Georges Kaddoum | QSB-SHA: Quantum-secured Blockchain for Smart Home Authentication | 2026 | Early Access | Authentication Smart homes Internet of Things Modeling Security Smart devices Measurement Protocols Technology Cryptography Blockchain Quantum Key Distribution GHZ states Smart Homes Mutual Authentication | Today, IoT enables smart home users to remotely connect with household appliances via the Internet. Sensor-equipped smart devices are widely deployed in smart homes to collect and manage information regardless of user location. However, ensuring the secure and private accessibility of these devices in a centralized manner remains a major concern. The emergence of blockchain and quantum computing, with their enhanced information processing capabilities on decentralized platforms, offers a viable solution to this issue. Consequently, there is a need for cryptographic primitives that can withstand both quantum and classical attacks. To address this concern in the present study, we propose a quantum-secured blockchain (QSB) framework for smart home authentication (SHA). The proposed framework employs quantum key distribution (QKD) and maximally entangled states on a decentralized platform to enable secure key distribution and mutual authentication between smart home users and devices. Furthermore, our approach integrates quantum passwords and quantum digital signatures to verify and validate legitimate users, thereby ensuring security and privacy. The framework is simulated using the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool for formal security analysis. We also conduct an informal security analysis and compare the performance of our proposed scheme with that of the previously proposed solutions. The results demonstrate that our framework outperforms existing approaches across various performance evaluation metrics. | 10.1109/TNSM.2026.3747090 |
| Qaisar Ali, Ihsan Ullah, Youn-Hee Han | Topology-Preserving Virtual Network Embedding Using Persistent Homology and Graph Attention Reinforcement Learning | 2026 | Early Access | Substrates Topology Joining processes Optimization Manganese Training Bandwidth Central Processing Unit Costing Costs Virtual Network Embedding Topology Preservation Pattern-Aware Embedding Persistent Homology Topological Data Analysis Graph Attention Networks Deep Reinforcement Learning Proximal Policy Optimization Network Virtualization 6G Networks Resource Allocation | Virtual Network Embedding (VNE) maps virtual network requests (VNRs) onto shared substrate networks while satisfying node, link, and service constraints. Existing VNE methods mainly optimize resource-centric objectives such as CPU utilization, bandwidth consumption, acceptance ratio, and revenue, but often treat structural service patterns as implicit connectivity requirements. However, patterns such as redundancy loops, hierarchical aggregation, centralized control, and fault-tolerant structures may encode critical service logic, and their degradation can reduce reliability and violate service-level guarantees. This paper proposes TP-VNE, a topology-preserving and pattern-aware VNE framework that integrates persistent-homology-assisted structural characterization, graph attention-based representation learning, and proximal policy optimization. Persistent homology extracts multi-scale topological signatures from VNRs and substrate candidate regions, while complementary graph features distinguish acyclic structures such as stars and trees. A graph attention network learns topology-aware node embeddings by combining resource and structural features, and a PPO agent performs sequential node and link mapping under feasibility-aware action masking. Finally, a topology verification module validates the path-induced embedded subgraph before resource commitment. Simulation results show that TP-VNE improves the acceptance ratio from 48.5% to 83.5% at λarr = 0.20 and increases long-term average revenue from 2,780 to 4,980 compared with Baseline PPO, while achieving 89.3% pattern preservation accuracy with acceptable embedding overhead. Scalability experiments on GT-ITM substrates with up to 1000 nodes further demonstrate the robustness of TP-VNE under increasing network size. | 10.1109/TNSM.2026.3744368 |
| Mohammad Saberi, Ali Ahmadi Esfidi, Mahdi Dolati, Naeimeh Omidvar | FlexINA: In-Network Aggregation for Accelerating Distributed Machine Learning with Flexible Routing | 2026 | Early Access | Modeling Switches Timing Routing Machine learning Training Runtime Memory Loading Topology Distributed Machine Learning Programmable Networks In-Network Computing | The growing scale and complexity of modern machine learning (ML) models have rendered distributed training indispensable. However, as model dimensions expand, communication overhead increasingly dominates the overall training time, creating a critical performance bottleneck. While techniques such as gradient compression offer partial relief, they often incur substantial computational overhead or require specialized hardware. In-network aggregation (INA) has emerged as a compelling alternative, offloading partial computations—such as gradient reduction—directly onto programmable network switches. Yet, current INA frameworks predominantly rely on rigid, static routing schemes or uncoordinated, opportunistic aggregation, fundamentally limiting their capacity to exploit the full potential of programmable data planes. To address this limitation, we formulate the Joint Scheduling-Routing for In-Network Aggregation (JINA) problem. JINA introduces a time-slotted execution model to enable fine-grained temporal scheduling synchronously with spatial routing. By leveraging source routing, it dictates perpacket forwarding paths while explicitly coordinating multi-hop partial aggregation across the network. Furthermore, we propose FlexINA, a scalable optimization framework that solves the JINA problem through a three-phase dimensionality reduction strategy: host-level pre-aggregation, topological switch filtration, and temporal window partitioning. Extensive evaluations across fifteen diverse network topologies demonstrate that FlexINA reduces the total network load by up to 8.3% compared to INA baselines, while maintaining high computational efficiency. | 10.1109/TNSM.2026.3740503 |
| Shyam Kumar Shrestha, Shiva Raj Pokhrel, Jonathan Kua | Adapting Large Language Models for TCP Fairness over Wi-Fi | 2026 | Early Access | Large language models TCP Modeling Training Fluid flow Information rates Throughput Wireless fidelity Learning (artificial intelligence) Management Transmission Control Protocol Congestion Control Algorithms Fairness Wi-Fi | Designing Transmission Control Protocol (TCP) Congestion Control Algorithms (CCAs) for heterogeneous Wi-Fi networks remains a challenge due to rapidly varying delay, loss, and contention dynamics. These effects often lead to CCA incompatibility, flow unfairness, and starvation among competing TCP flows. Although Deep Reinforcement Learning (DRL) has shown promise in mitigating these challenges, its slow convergence, high training costs, and limited generalization hinder practical deployments. In this paper, we propose TCP-LLM, a learning-augmented transport framework that leverages Large Language Models (LLMs) for compatibility-aware CCA selection. TCP-LLM encodes multivariate TCP time-series into token embeddings and performs single-step discrete CCA decisions through a lightweight LLM decision head. Parameter-efficient low-rank adaptation (LoRA) reduces the number of trainable parameters by approximately two orders of magnitude. Evaluation using traces collected from a physicalWi-Fi testbed with competing TCP Cubic, Bottleneck Bandwidth and Round-trip propagation time (BBR), and Performance-oriented Congestion Control (PCC) flows shows that TCP-LLM achieves the highest mean, geometric-mean, and minimum per-flow throughput among the evaluated schemes. TCP-LLM also exhibits faster and more stable training convergence and supports low-latency bounded inference. These results demonstrate the feasibility of LLM-based sequence adaptation for compatibility-aware transport-layer supervision under heterogeneous wireless conditions. | 10.1109/TNSM.2026.3739364 |
| Hongyuan Cheng, Lihua Yin, Tianqing Zhu, Hongyu Yang, Dexin Zhu, Weixiang Jiang, Nan Wei | Pattern2Bot: A malicious server IP detection model based on self-trained heterogeneous graph neural network | 2026 | Early Access | Labeling Modeling Signal detection Training Botnet Servers IP networks Sequential analysis Conferences Security Botnet detection Self-supervised Graph neural network Command & Control service | Botnets play a key role in network attacks such as Distributed Denial-of-Service (DDoS) attacks, spamming and click fraud. Command & Control server is an important node for botmaster to control bots and distribute attack commands. Bot disguise as normal domain requests through DNS traffic, but leave malicious records in DNS logs containing client IP, query domain, server IP and other complex interactions. This information provides important clues for detecting those botnets. In the current study, researchers detect botnets through multiple perspectives, including abstracting DNS communication records into graphs and using graph neural network models for detection. Conventional approaches often necessitate massive labeled datasets for model training, which substantially incurs training costs. Moreover, despite enriching node embeddings via topological relations, graph models often suffer performance degradation when confronted with structural semantic obfuscation from evasion techniques like double-flux. In order to understand the abstract and complex relationship patterns in DNS records while reducing label usage to lower training costs, we propose a botnet Command & Control server detection model based on DNS traffic. This is a self-training heterogeneous graph neural network model that does not require a large number of labels. By integrating the high-order relational semantics derived from multiple meta-paths with the local topologies of target nodes, the model achieves finer-grained structural awareness and semantic abstraction, thereby enhancing detection performance. We validate the effectiveness of the model in a real dataset, and the results show that the model has a better understanding of the special structure possessed by the IPs of Command & Control servers. | 10.1109/TNSM.2026.3741111 |
| Byungchang Kim, Shinyoung Lue, Seonyeong Hwang, Youhee Park, Yeji Lee, Jaemin Jeong, Peter Bloodsworth, Euiseok Hwang | GRIDS: Generalized Representation-based Intrusion Detection System via Federated Contrastive Learning | 2026 | Early Access | Modeling Labeling Intrusion detection Training Federated learning Fluid flow Internet of Things Contrastive learning Artificial intelligence Signal detection Intrusion detection system federated learning contrastive learning anomaly detection network security transformer encoder | Existing AI-based intrusion detection systems are typically trained for specific network environments, leading to significant performance degradation when deployed in different settings or exposed to evolving attack strategies. We propose GRIDS (Generalized Representation-based Intrusion Detection System), a federated contrastive learning framework for cross-environment intrusion detection that keeps raw traffic data local. GRIDS employs a Transformer-based encoder trained with supervised contrastive learning across distributed network environments, learning a shared representation without exchanging sensitive traffic data. The encoder embeds network flow features into a latent space where semantically similar traffic patterns cluster together, enabling effective anomaly detection via k-nearest neighbor scoring. Evaluated on four heterogeneous NetFlow datasets, GRIDS outperforms existing federated IDS baselines on average with a single unified model. In leave-one-out cross-validation, a substantial portion of the detection capability of GRIDS transfers to network environments unseen during training, and the level of transfer varies across target networks. Deployment at such a network requires no labeled attack data or fine-tuning. It uses the benign traffic of the network as the kNN reference set and its unlabeled traffic for normalization and threshold calibration. The framework targets deployments in which a single model protects multiple heterogeneous networks. | 10.1109/TNSM.2026.3748922 |
| Deemah H. Tashman, Soumaya Cherkaoui | Trustworthy AI-Driven Dynamic Hybrid RIS: Joint Optimization and Reward Poisoning-Resilient Control in Cognitive MISO Networks | 2026 | Early Access | Reconfigurable intelligent surfaces Reliability Optimization Security MISO Array signal processing Vectors Satellites Reflection Interference Beamforming cascaded channels cognitive radio networks deep reinforcement learning dynamic hybrid reconfigurable intelligent surfaces energy harvesting poisoning attacks | Cognitive radio networks (CRNs) are a key mechanism for alleviating spectrum scarcity by enabling secondary users (SUs) to opportunistically access licensed frequency bands without harmful interference to primary users (PUs). To address unreliable direct SU links and energy constraints common in next-generation wireless networks, this work introduces an adaptive, energy-aware hybrid reconfigurable intelligent surface (RIS) for underlay multiple-input single-output (MISO) CRNs. Distinct from prior approaches relying on static RIS architectures, our proposed RIS dynamically alternates between passive and active operation modes in real time according to harvested energy availability. We also model our scenario under practical hardware impairments and cascaded fading channels. We formulate and solve a joint transmit beamforming and RIS phase optimization problem via the soft actor-critic (SAC) deep reinforcement learning (DRL) method, leveraging its robustness in continuous and highly dynamic environments. Notably, we conduct the first systematic study of reward poisoning attacks on DRL agents in RIS-enhanced CRNs, and propose a lightweight, real-time defense based on reward clipping and statistical anomaly filtering. Numerical results demonstrate that the SAC-based approach consistently outperforms established DRL base-lines, and that the dynamic hybrid RIS strikes a superior trade-off between throughput and energy consumption compared to fully passive and fully active alternatives. We further show the effectiveness of our defense in maintaining SU performance even under adversarial conditions. Our results advance the practical and secure deployment of RIS-assisted CRNs, and highlight crucial design insights for energy-constrained wireless systems. | 10.1109/TNSM.2026.3660728 |
| Martha Cash, Charlotte Fowler, Alexander M. Wyglinski | On the Role of Time Series Clustering in Traffic Matrix Prediction | 2026 | Early Access | Fluid flow Timing Modeling Matrices Histograms Training Distance measurement Forecasting Runtime Clustering methods Traffic Matrix Prediction Time Series Clustering Traffic Flows Machine Learning Network Management | This paper analyzes the role of time-series clustering in traffic matrix (TM) prediction. Traffic flows within a TM often exhibit heterogeneous behavior, which can reduce the effectiveness of global forecasting models that predict all flows jointly. To address this, we propose a clustering-based prediction framework that groups flows into smaller subsets and trains separate predictors for each group. We evaluate four traffic-flow representations for clustering, namely histogram, autocorrelation function (ACF), power spectral density (PSD), and naïve partitioning, and analyze how both the representation choice and the number of clusters affect prediction performance. Experiments using the publicly available Abilene and GÉANT datasets show that clustering consistently improves over global forecasting baselines, while remaining substantially less costly than local prediction. The results further show that most of the performance gain is achieved at moderate values of K, with diminishing returns as the number of clusters increases. Although different clustering representations produce different partitions of the traffic flows, they often achieve similar root mean squared error (RMSE). This suggests that the main benefit of clustering lies in decomposing the TM prediction task into smaller subproblems, while the exact cluster structure plays a more limited role in determining overall prediction accuracy. | 10.1109/TNSM.2026.3747898 |
| Jian Liu, Jinhong Chen, Eldar Sabanovic, Jinliang Liu, Engang Tian, Oh-Min Kwon | Predictor-Enhanced Constrained Reinforcement Learning for Networked CAV Platoons: A Dual-Redundancy Scheme | 2026 | Early Access | Timing Vehicles Learning (artificial intelligence) Event detection Modeling Titanium Limiting Silicon Vectors Testing Connected and automated vehicles dynamic event-triggered mechanism false data injection attacks model-free reinforcement learning prescribed performance control | This paper investigates resilient tracking control for connected and automated vehicle (CAV) platoons under false data injection (FDI) attacks and prescribed spacing constraints. A kinematics-based state predictor is combined with a dynamic event-triggered mechanism (ETM) to provide smooth trajectories from sparse, FDI-corrupted measurements while reducing communication use. Prescribed performance control (PPC) maps the predicted spacing error into an unconstrained state for continuous-time actor-critic reinforcement learning (RL). The actor-critic controller learns an approximate tracking policy without identifying the unknown nonlinear drift. A locally sensed, saturated proportional-derivative fallback controller can override the learned command when the measured spacing error approaches the prescribed boundary. These two control paths form the dual-redundancy scheme. The analysis excludes finite-time accumulation of triggering instants, establishes input-to-state stability of the prediction-error subsystem, and gives conditional ultimate bounds for the prediction error and sampled adaptive weights under the stated input and approximation-domain conditions. Matched ablations and multi-seed tests evaluate communication use, fallback activation, and the responses to scalar and vector attacks. | 10.1109/TNSM.2026.3748969 |
| Shengye Gong, Hui Yang, Qiuyan Yao, Xin Li, Tiankuo Yu, Wenxin Liu, Yang Zhao, Yucong Liu, Jie Zhang, Mohamed Cheriet | Resilient Hierarchical Polyhedron-based Configuration Protection for Large-Scale Multi-Domain Optical Networks | 2026 | Early Access | High performance computing Joining processes Protection Topology Costing Optical fiber networks Algorithms Modeling Architecture Computer architecture Network survivability multi-domain optical network network protection hierarchical polyhedron-based protection | Large-scale multi-domain optical networks are increasingly exposed to spatially correlated and concurrent failures, while monolithic pre-configured protection structures incur rapidly increasing global search complexity and protection-resource costs under heterogeneous physical constraints. To address this challenge, this paper proposes a resilient Hierarchical Polyhedron-based Configuration (HPC) architecture that decomposes a monolithic global survivability requirement into adaptive intra-domain connectivity constraints and a compact inter-domain connectivity constraint. To alleviate resource imbalance caused by topology-only network partitioning, a Topology-Resource Aware Domain Partitioning (TRADP) algorithm is developed to construct protection-supportable sub-domains by jointly considering topological structure and physical resource distribution. To avoid imposing a rigid protection level on heterogeneous domains, HPC assigns adaptive intra-domain connectivity targets according to local failure exposure and physical resource supportability. To reduce the complexity of cross-domain protection while preserving physical feasibility, a super-node abstraction and physical bridge-link mapping mechanism is employed to construct the inter-domain protection backbone under capacity, spectrum, and SRLG constraints. Extensive evaluations on networks of up to 1000 nodes and representative GEANT and NSFNET topologies demonstrate that HPC-TRADP maintains a recovery rate of 92.94% at 1000 nodes and 85.82% even when 30% of physical links fail concurrently. It further reduces protection overhead by up to 79.60% relative to p-KECS while maintaining efficient recovery paths, demonstrating a favorable balance between survivability, resource efficiency, and scalability. | 10.1109/TNSM.2026.3750417 |
| Ivette Kembely Carrera Manosalvas, Paulo Freitas De Araujo-Filho, Georges Kaddoum, Hadi Otrok | Unsupervised Hybrid Quantum-Classical Generative Adversarial Network-Based Intrusion Detection System for 6G-enabled Internet of Things | 2026 | Early Access | Modeling Signal detection Generative adversarial networks Timing Internet of Things Training Architecture Computer architecture Machine learning Fluid flow 6G Internet of Things (IoT) Intrusion Detection Systems (IDS) Generative Adversarial Networks (GAN) Quantum Machine Learning (QML) Security | The emergence of sixth-generation (6G) mobile networks contributes to the widespread adoption of critical Internet-of-Things (IoT) applications, such as telesurgery and autonomous vehicles. However, such advancements expand attack surfaces and make traditional security mechanisms insufficient. While machine learning (ML)-based intrusion detection systems (IDSs) have been increasingly adopted to detect attacks in such heterogeneous and dynamic environments, their complex architectures often result in high computational costs and latency, making them unsuitable for the real-time demands of 6G-enabled IoT applications. To address these challenges, we propose a novel unsupervised quantum generative adversarial network (QGAN)-based IDS. Our solution enhances the GAN generator’s ability to model complex data distributions by combining a parametrized quantum circuit with a classical neural network (NN), while maintaining a lightweight classical discriminator (fewer than 2.000 parameters) at the edge. This design significantly reduces computational complexity and minimizes detection times, since only the classical discriminator is used during inference. Experimental results demonstrate that our solution achieves competitive detection rates with an ultra-low inference latency of 0,22 ms, outperforming state-of-the-art GAN-based and transformer-based IDSs by over 2,81 times. Therefore, our architecture provides a resource-efficient security framework that delivers the ultra-low latency and high detection rates essential for next-generation IoT applications. | 10.1109/TNSM.2026.3747752 |