Open-source testbeds for intrusion detection and mitigation enable benchmarking the efficacy of machine-learningbased cyber-defensive systems under increasingly realistic, heterogeneous network scenarios. In this context, the open-world nature of network intrusion detection requires defences to use continual learning strategies to adapt pattern-matching to new attack classes. The cost of periodically fine-tuning pre-trained detectors is not only computational but also encompasses the broader Cyber Threat Intelligence (CTI) life-cycle, which involves collecting, analyzing, and processing raw data into actionable insights. For ML-driven defensive systems, such actionable CTI ultimately takes the form of curated, labelled traffic traces of novel attacks. However, the concurrent optimisation of these intelligence-gathering costs and defence effectiveness has received little attention from the research community. In this respect, this work presents TIGER, an open-source Threat Intelligence Game Environment for Reinforcement learning-based agents to be trained and evaluated toward the optimisation of the costs-benefit trade-off associated with realistic ML-driven cyberdefence life-cycles. TIGER uses realistic network simulation software to model an active-learning game in which an agent learns to timely purchase CTI—abstracted in our environment as labelled samples of Zero-day attacks— to retrain its intrusion detection machinery on new attack patterns, while considering a constrained resource availability scenario.
Sketches have been widely used in network measurement thanks to their low resource overheads. Network-wide sketch deployment is essential for measuring flows across the entire network to enable comprehensive monitoring and decision-making. Most frameworks for network-wide sketch deployment formulate it as a mixed integer linear programming (MILP) problem and utilize commercial solvers such as Gurobi to produce the optimal nodes deployed with sketches. However, the network topology changes frequently. When the topology changes, it is necessary to reconstruct the MILP and re-solve it. Due to the NP hardness, the solvers have to handle a substantial number of variables and constraints, and iteratively converge to the optimal nodes, which is too time-consuming to adapt to frequent topology changes. To this end, a framework for fast network-wide sketch deployment via graph convolution network called FSD-GCN is proposed. Unlike the solvers that gradually converge to the optimal nodes, FSD-GCN transforms the MILP derived from the network-wide sketch deployment problem into a graph-structured representation, and utilizes a graph convolution network to directly obtain the probability of deploying sketches at each node. Meanwhile, an integer linear programming model called NCR is proposed to be used in FSD-GCN, which can achieve maximum flow cover rate with minimum redundant measurement while requiring the fewest deployed nodes. The experimental results show that NCR solved by FSD-GCN can reduce the number of deployed nodes and redundant measurement, while achieving the highest flow cover rate. Meanwhile, compared with the state-of-the-art frameworks using Gurobi, NCR solved by FSD-GCN reduces solving time more than 90%.
The service-based Radio Access Network (RAN) slicing enabled via Software Defined Networking (SDN) and Network Function Virtualization (NFV) can support diverse service requirements and address the rapid data traffic growth from both the vertical industry and the Internet of Things (IoT). However, network slice isolation and resource sharing between slices should be be improved for future wireless network requirements. Firstly, this paper address the isolation enhancement of future wireless networks through Blockchain-Smart-Contract, by creating two smart-contract-based access control to secure access to different service-based RAN applications and secure the sharing of resources. These contract are Verification and Authorization Contract (VAC), as well as Misconduct and Revocation Contract (MRC). The proposed framework is designed to support key 6G service classes, such as enhanced Mobile Broadband (eMBB) and ultra-Reliable Low-Latency Communications (uRLLC), enabling high data rates and low-latency communication. Secondly, to ensure the servicebased RAN achieves better isolation the optimization goal is to minimize the deployment cost to obtain the best deployment scheme. Hence, we divide the service-based RAN slice isolation deployment problem into two sub-problems, i.e., service-based RAN slice isolation and slice deployment problem, by formulating a Mixed Integer Linear Programming (MILP) model to minimize the deployment cost. Finally, to verify the feasibility of the design implementation an experimental platform is built and the results show the architecture achieves isolation enhancement through smart-contract and reduces the deployment cost by 78% and improve the isolation performance by 93% compared to the Blockchain-enabled Network Slice (BcNS) and the service-based RAN.
Concurrent live virtual-machine (VM) migration is a network and service management problem: the controller must decide not only which VM should move, but also the path, reserved bandwidth rate, and migration mode used while other migrations consume the same hosts, links, and switch queues. This paper presents CAREM, Counterfactual Action Reduction and Evaluation for Migration. CAREM expands each pending VM-to-destination request into feasible path/rate/mode actions, predicts migration time, downtime, energy, and SLA risk with calibrated uncertainty, removes only same-request actions that are certifiably dominated, and passes the retained actions to a residual-state global scheduler. The analysis shows why request-level scoring collapses within-request control structure, when set-wise certified reduction is locally admissible under coverage and measurement-error assumptions, and why fiber-collapsed baselines can incur continuation regret when local choices affect later scheduling. In a 128-host fat-tree simulator, CAREM improves the scalar objective by 22% over the matched collapsed baseline, reducing makespan by 17%, downtime-tail risk by 24%, and energy by 6%. Under common-testbed comparisons with representative SDN, concurrency-aware, SLA-aware, policy-aware, hybrid-mode, and adaptive-placement baselines, CAREM achieves the lowest scalar objective while retaining compatibility with recent hybrid RL/ML mode-selection and placement layers. A 32-host KVM/Open vSwitch prototype confirms lower migration time and downtime with control-loop latency inside the planning interval.
Generative Artificial Intelligence (GAI) has been attracting a massive and rapidly expanding user base worldwide in recent years, resulting in enormous demand for inference requests that cannot be handled efficiently by centralized cloud-based architectures. Edge computing presents a promising approach to mitigate these challenges by leveraging the power of numerous edge devices to better provide GAI services to the users. In this work, we develop a novel two-stage approach to dynamically allocate GAI models and assign user requests to the best edge nodes. In the first stage, we model a joint optimization problem to minimize the expected processing time and decide the optimal model allocation based on predicted user demands. In the second stage, we develop an efficient online approach to assign requests to edge nodes when they arrive, as well as to reallocate GAI models when necessary. Moreover, to address the complexity of the optimization problems in this stage, we leverage Lyapunov optimization framework and Benders decomposition methods to efficiently solve the problems, thereby enabling the proposed approach to quickly adapt to the dynamics of the system. Extensive simulations are conducted to evaluate the performance of the proposed approach and investigate the impacts of important parameters. Simulation results show that the proposed approach can reduce the total processing time by up to 43% with very short running time.
The increasing demand for higher throughput and lower latency in modern applications has driven the evolution of IEEE 802.11 with the introduction ofWi-Fi 7. The new Extremely High Throughput (EHT) amendment enhances performance with Multi-Link Operation (MLO), which allows Wi-Fi stations equipped with multiple radios to transmit and receive concurrently over different frequency links, improving channel access opportunities, reducing latency, and enhancing overall throughput and reliability. However, in scenarios with irregular or high traffic loads across links, MLO can degrade performance due to contention imbalance and inefficient medium access coordination. In particular, TCP flows are highly sensitive to such conditions, as increased contention and collisions can trigger congestion control mechanisms that reduce sending rates and impair throughput. This work investigates the impact of MLO on TCP traffic and proposes a Reinforcement Learning (RL)-based contention control strategy to improve load distribution in congested multi-link environments. The RL-based method dynamically adapts the channel access aggressiveness of stations according to network conditions, mitigating contention imbalances across links and achieving TCP performance improvements while maintaining or, in some cases, improving UDP performance. Simulation results show that the proposed AI-driven contention control provides a flexible and effective solution for traffic balancing in multi-link Wi-Fi 7 networks.
Cloud platforms have become a core component of the Internet because most services and products rely on them to host their backends. Estimating and understanding the latency experienced when accessing those cloud platforms is a challenge of growing importance that has not been sufficiently studied. To address this relevant matter, we conducted a three-month measurement campaign, collecting traceroute data every 30 min across 256 source–destination probe pairs. Our specific goal is to analyze whether the current network is able to provide adequate performance for emerging applications and services. We use this dataset to evaluate the performance of forecasting algorithms when predicting cloud latency from both temporal and spatial perspectives, and we leverage post-hoc explainability methods to identify the drivers affecting latency. Several prior studies provide public cloud-latency datasets, but these datasets are generally analyzed in isolation. To close this gap and provide a cross-dataset comparative analysis of cloud-latency measurements, we analyzed the related publicly available datasets and applied a common forecasting and explainability workflow to compare their findings. Our analysis reveals that operators do not require complex methods to predict latency and that distance and a few other simple features are sufficient to achieve operationally accurate predictions. We find latency to be remarkably stable from the user’s perspective, both over the duration of the campaign and across hours of the day, which contrasts with previous findings, and we show that the specific path traversed has a significant impact on latency.
The rise of network function virtualization (NFV) technology has enabled virtual network functions (VNF) and service function chains (SFCs) to develop into standard paradigms for service delivery. The uncertain traffic brought about by edge computing has made it a key issue to figure out how to deploy VNFs for network load balancing. However, traditional methods are limited to SFC embedding solutions and resource management and pay less attention to traffic. To address the above issue, this paper takes into account the spatio-temporal characteristics of network traffic and the traffic scheduling after VNF deployment to solve the load balanced VNF deployment problem. We formalize the problem into an NP-hard nonlinear integer programming problem, which will be solved with the proposed algorithm adaptive VNF deployment and load balanced traffic scheduling (AdpVDLTS). AdpVDLTS divides network time into large and small time slots to operate on traffic and VNFs simultaneously, and achieves load balancing through traffic prediction and collaboration with VNF deployment. Compared with the excellent existing algorithms, AdpVDLTS can maintain more stable load balancing, higher throughput, lower deployment cost, and lower latency. In addition, the effectiveness of the traffic prediction algorithm is proved by ablation experiments.
In modern video streaming systems, clients typically make independent bitrate decisions without full knowledge of network conditions, often leading to inefficient resource usage and unstable quality. Network-assisted adaptive streaming is rapidly gaining importance in Network and Service Management (NSM), as operators strive to deliver consistently high Quality of Experience (QoE) under dynamic traffic conditions. This paper introduces FROG, a novel, real-time Software-Defined Networking (SDN)-assisted framework designed to coordinate multi-server and multipath HTTP Adaptive Streaming (HAS) using standardized metrics carriage: Common Media Client Data (CMCD) and Common Media Server Data (CMSD). FROG employs an innovative two-stage optimization workflow in which an initial Linear Programming (LP) model rapidly determines feasible bandwidth bounds, server selection, and path capacities, thereby transforming the remaining optimization into a sequential layer-selection process for coordinated quality selection and flow allocation. This decomposition enables sub-second optimization at the scale of thousands of users, while buffer-aware client feedback is integrated to proactively prevent stalls and maintain system stability. Experiments on an emulated SDN testbed demonstrate that FROG achieves QoE comparable to that of the optimal MILP solution on tractable instances while virtually eliminating video stalls, and significantly reduces quality oscillations, outperforming state-of-the-art network-assisted approaches by up to 2.32× under playback-driven evaluation scenarios. Scalability experiments with up to 4,000 clients further demonstrate sub-second optimization runtimes, confirming the practicality of FROG for large-scale deployments.
This paper presents a software-defined Time-Sensitive Networking (TSN) architecture that implements the IEEE 802.1Qcr Asynchronous Traffic Shaper (ATS) using Extended Berkeley Packet Filter (eBPF) technology within Linux-based TSN bridges. By moving traffic shaping logic to the kernel level, our solution eliminates the need for dedicated hardware and enables dynamic, programmable control of frame filtering, metering, and queuing. A Software-Defined Networking (SDN) controller complements the design, providing centralized orchestration of TSN behavior through standardized interfaces and a unified network view. We implement the ATS scheduling model to compute and enforce per-stream eligibility times, supporting time-aware scheduling of concurrent streams within the same priority class. This enables deterministic traffic delivery, which is critical for industrial automation and control. Our approach allows seamless integration into existing infrastructures and aligns with the flexibility objectives of Industry 5.0. Performance evaluations demonstrate accurate scheduling behavior under heterogeneous traffic conditions and quantify the delay introduced by a TSN bridge for multiple coexisting streams.
Multiple Radio Access Technology (multi-RAT) environments provide a promising foundation for service-aware communication in intelligent transportation systems (ITS) and smart cities. However, traffic steering (TS) in highly mobile and ultra-dense vehicular networks remains challenging due to dynamic network conditions, heterogeneous RAT capabilities, varying vehicle requirements, packet loss, latency, and frequent ping-pong RAT switching. In this context, we propose Holistic Intelligent Traffic Steering (HITS), a proactive bi-level TS management framework for multi-RAT vehicular networks. HITS integrates centralized network-wide guidance with local vehicleside decision-making. At the central level, a Graph Convolutional Network–Long Short-Term Memory (GCN–LSTM) model captures holistic spatio-temporal network dynamics and evaluates RAT optimality. At the local level, a State-Action-Reward- State-Action (SARSA) reinforcement learning agent performs adaptive, vehicle-specific RAT selection using local observations and central-level optimality guidance. Results show that HITS achieves up to 6.5% higher average throughput, reduces packet loss ratio by more than 30.2%, lowers latency by nearly 12.2%, and reduces the ping-pong RAT switching rate by over 24% compared with baseline and state-of-the-art (SoTA) TS approaches.
Distributed Denial of Service (DDoS) attacks threaten service continuity in next-generation networks, where autonomous mitigation must suppress attack traffic without unnecessarily degrading legitimate service. This paper presents Sentinel, a neuro-symbolic co-evolutionary framework for DDoS-aware network and service management. Sentinel combines a Proximal Policy Optimization (PPO) defender with a symbolic safety layer that repairs unsafe actions, enforces domain-specific constraints, and supports interpretable rule crystallization. Training further uses a Hall-of-Fame archive of historical attackers and benchmark checkpoint selection to mitigate late-stage co-evolutionary degradation. We evaluate Sentinel over 2,000 generations and 10 independent seeds across benign, mild-attack, strong-attack, chaos/flash-crowd, and held-out ICMP flood scenarios. Results show that Sentinel Pareto-dominates the ShieldOnly ablation on mild, strong, and chaos scenarios under a joint service-quality, leakage, and outage criterion, and Pareto-dominates unshielded PPO on zero-shot ICMP. In the ICMP setting, Sentinel eliminates severe outages in the evaluated scenario (0 vs. 145.7 for PPO) and reduces leakage by 8.6 percentage points through symbolic ICMP overrides. Benchmark checkpointing reduces strong-attack leakage by 8.1 percentage points and severe outages by 98.3 steps relative to the final checkpoint. Rule crystallization achieves 97.97% held-out accuracy using a depth-4 decision tree over four interpretable traffic features. Strict SLA compliance is not achieved under attack conditions, and all results are simulation-based within the modeled traffic and attack distributions.
Microservice applications commonly rely on service-mesh circuit breakers to maintain resilience under dynamic workloads. In platforms such as Istio, circuit breaking is enforced through connection and request-queue limits, making performance highly sensitive to parameter choices that static configurations cannot adapt across traffic phases. This paper proposes an SLO-aware reinforcement learning controller that adjusts Istio circuit-breaker parameters from runtime telemetry. The controller operates in the control plane through standard APIs and requires no changes to application code or data-plane components. A compact state representation and bounded incremental action space support stable, interpretable online adaptation. The controller is trained and evaluated on a real single-node Kubernetes cluster: training uses sustained heavy open-loop overload, while evaluation uses stochastic non-stationary moderate and heavy open-loop workloads. Results show that under heavy overload the controller substantially reduces tail latency relative to unprotected deployments, tuned static circuit breakers, and recent heuristic and adaptive baselines, while matching the strongest baseline on success rate. Under milder load it preserves high success within the latency SLO. These results show that reinforcement learning can provide effective adaptive traffic management for service-mesh environments.
Although 5G networks are more efficient in terms of power consumption to traffic ratio, efforts still need to be made to further increase energy efficiency not only for the radio part, but also with respect to the growing cloud component with edge servers. Consolidation of traffic workloads onto shared infrastructures is a key feature of cloud computing to reduce energy consumption, and logical functionality placement plays a key role in this regard. Here, in the cloud RAN context, we propose a unified and energy-aware logical placement of 5G E2E functionalities, i.e., distributed units (DUs), centralized units (CUs), and user plane functions (UPFs), together with traffic routing. The placement problem is formulated as a large-scale integer linear program and solved using a column generation-based decomposition technique, complemented by an efficient heuristic to ensure tractability and improved scalability. The model captures key network and cloud (compute) resources, jointly optimizing the placement of DU, CU, and UPF components, along with traffic routing, to minimize energy consumption while maintaining low latency and high Quality of Service (QoS). Numerical results, based on an open Montreal traffic dataset, demonstrate that the proposed column generation algorithm achieves near-optimal solutions, while the heuristic approach offers significantly better scalability with consistently strong performance. The proposed methods reduce energy consumption by up to 14% and maintain low-latency service delivery. Furthermore, the results highlight that static, peak-time-based placement strategies can lead to inefficiencies throughout the day, emphasizing the importance of accounting for broader temporal traffic patterns.
Modern decentralized applications frequently employ one-to-many messaging over dynamic recipient groups, a paradigm we term Selected Group Broadcasting (SGB). Though one-to-one traffic models (e.g., M/M/1 queue) are well studied, traffic characterization for one-to-many connectivity remains underdeveloped. In this paper, we investigate the delay distribution of one-to-many traffic over an SGB in a wide-area communication system. Depending on the underlying network input, the SGB problem naturally decomposes into two distinct paradigms: SGBs (for Sequential inputs) and SGBp (for Parallel inputs). Asymptotic analysis reveals that SGBs and SGBp are governed by fundamentally different stochastic dynamics, necessitating dedicated modeling approaches for each. This paper focuses exclusively on the SGBs paradigm, providing a rigorous analytical treatment and establishing an operatortheoretic performance framework. For first-order statistics of SGBs, we derive exact closed-form solutions under exponential inter-ACK interval (ACK Interval) inputs. By exploiting the rational Laplace-domain structure of the forward operator, we extend the model to precisely compute output distributions for any non-negative distribution input. Furthermore, we introduce an equivalent SGBs analysis scheme via the inverse operator, enabling the transformation of continuous commit-time distributions into physically interpretable ACK Interval profiles. For second-order statistics, we establish a formalized functional hypothesis under exponential ACK Intervals, validated via simulation. We verify the derived probability density functions with simulated delays; the results are confirmed via Kolmogorov-Smirnov tests.
Deep learning-based network intrusion detection systems (NIDSs) in the Industrial Internet of things (IIoT) are inevitably prone to producing misclassified samples. Correction models can identify and correct these samples to reduce the total error rate (TER) of NIDSs. Existing correction models fail to account for the uneven distribution of misclassified samples in the prediction intervals of NIDSs due to IIoT data imbalance, re-sulting in over-correction and increased TERs. Given this, we propose a novel correction model called Correction Forest for correcting the misclassified samples of NIDSs targeting imbalanced IIoT network traffic dataset. Correction Forest adopts a generation-correction strategy. The generation process divides the output values of NIDSs with imbalanced dataset into fine-grained bins, and then generates novel misclassification features for each bin using a balanced hybrid Random Forest. The correction process calculates feature importance score for misclassification features and corrects misclassification samples by a K-Nearest Neighbors (KNN) -based algorithm. Evaluated on 15 imbalanced IIoT datasets with varying malicious sample ratios, Correction Forest significantly outperforms 4 state-of-the-art models. Under the 1.25% setting of NSL-KDD, Correction Forest improves F1-Score from 0.3144 to 0.7345, an absolute gain of 0.4201. On the TON_IoT at 12.5%, it achieves a maximum R.TER of 0.3750 among the state-of-the-art models.
Intelligent network operations increasingly rely on structured anomaly knowledge to support anomaly analysis, alert correlation, and root-cause investigation. However, under emerging and few-shot anomaly scenarios, anomaly-related knowledge graphs are often incomplete, which limits their operational value. To address this issue, this paper studies the problem of few-shot anomaly knowledge completion and proposes a Neighbor-Enhanced Knowledge Graph Completion model (NEKC). NEKC employs a similarity-aware neighbor selection mechanism to retain semantically relevant neighbors while introducing diversity constraints to avoid representation bias caused by overly homogeneous neighborhoods. An attention mechanism is further used to dynamically weight neighbor entities, and a Transformer-based encoder is adopted to capture contextual dependencies for task-specific relation representation. To evaluate the proposed method, experiments are conducted on the generic few-shot knowledge graph completion benchmark NELL and on a constructed Network Anomaly Knowledge Graph (NAKG) derived from public anomaly-related knowledge sources. The results show that NEKC achieves moderate overall improvements on NELL, whereas its advantages are more evident on NAKG compared with representative baseline methods in few-shot link prediction and knowledge completion tasks. These results indicate that NEKC can effectively improve the completeness of anomaly knowledge graphs and provide semantic support for downstream anomaly analysis in intelligent network operations.
Paxos consensus protocol is widely used in distributed systems, yet their performance can degrade under heterogeneous workloads and deadline-constrained requests. Traditional priority-based Paxos extensions rely on static scheduling policies that are unable to adapt to dynamically changing urgency. This paper proposes a deadline-aware scheduling framework for Paxos based on the Shortest Remaining Processing Time (SRPT) discipline. The proposed approach dynamically prioritizes requests according to their expected completion behavior and their likelihood of meeting assigned deadlines, enabling preemptive scheduling decisions at the consensus leader. An analytical queueing model is developed to characterize the mean waiting time, mean residence time, and mean response time under SRPT scheduling. Using these results, a probabilistic measure of deadline satisfaction is derived and employed to guide scheduling decisions. Analytical and numerical evaluations demonstrate that the proposed framework significantly improves deadline satisfaction while preserving the delay-optimal properties of SRPT, making it well suited for latency-sensitive Paxos deployments.
Onion messages (OMs) in the Lightning Network (LN) enable private communication between nodes through onion routing. While they support important functionalities such as static invoices and asynchronous payments, they can also be exploited for spam. To counter this, the Basis of Lightning Technology Specifications (BOLTs) recommend implementing rate limiting on OM forwarding. Limiting the rate, however, opens the door for an adversary to degrade the OM service by flooding the network—anonymously, thanks to onion routing. In this paper, we analyze and quantify the impact of DoS attacks on the OM service. Following the approach suggested in the literature, we study a policy in which per-peer forwarding limits and forwarding-node selection probabilities are proportional to publicly observable channel-capacity weights. Our analysis shows that OMs are most resilient against DoS attacks when the honest nodes’ public-capacity weights are uniformly distributed. However, the distribution of these weights in LN is highly non-uniform, as demonstrated in prior empirical studies and confirmed by our analysis of three network snapshots spanning 2022–2026. To improve resilience under such skewed conditions, we propose restricting forwarding-node selection to a carefully selected subset of nodes. For the evaluated setting l = L = 3, at a common adversarial public-capacity weight of approximately 14.30 BTC—equivalent to about USD 1 million at the reference BTC/USD rate used in our evaluation—the top-target per-connection adversary matches the strong optimal aggregate-budget adversary in each snapshot. Their OM failure probabilities range from 40.9% to 56.7% when the full network is available for forwarding-node selection. Restricting selection to the optimized subsets reduces these probabilities to 3.6%–3.9%, with corresponding analytical upper bounds of 6.2%–6.9%.
