Network Intrusion Detection Systems (NIDSs) must incrementally adapt to emerging attacks, even when only a limited amount of labeled network traffic is available. Consequently, Few-Shot Class-Incremental Learning (FSCIL)-based NIDSs have gained growing attention. However, existing FSCIL-based NIDSs are highly vulnerable to label noise in newly-observed attack classes. To address this limitation, we propose NAFN, a noise-aware FSCIL-based NIDS framework that reduces the impact of mislabeled data during incremental adaptation. NAFN consists of two components: (i) Noise Detection, which identifies and removes mislabeled biflows using noise-detection algorithms, and (ii) Feature Sampling, which estimates class-conditional embeddings from clean biflows, calibrates them with base-class statistics, and resamples synthetic features to recover the original biflow count. The framework follows the Rethink Few-Shot (RFS) teacher–student paradigm with lightweight nearest-neighbor or logistic regression classifiers, and various pretraining & memory selection strategies. Experiments on CSE-CIC-IDS2018, Edge-IIoT, and IoT-NID datasets show that NAFN effectively preserves prior knowledge and maintains strong incremental performance even under 50% label noise, consistently improving new-class F1-scores over non-denoised baselines, up to +52%, while being time-efficient and robust in cross-network and high-noise incremental settings. The implementation is publicly available to foster reproducibility.
Congestion is the main bottleneck for throughput improvement in communication networks. Since link buffer is an essential and early indicator for congestion, we formulate a buffer-induced optimization (BIO) flow control problem using the network utilization maximization framework. BIO uses link buffer dynamics to regulate source rates. We then derive a buffer-induced asynchronous gradient (BAG) algorithm using Lagrange duality. BAG allows links to price their buffer and allows sources to compute their rates based on path prices distributedly and iteratively. We prove the convergence and optimality of the source-link iterations under asynchronous price and rate updates. To prevent buffer bloat happening in practical networks, we also adopt a buffer shrink mechanism for BAG. Simulation results show that BAG can quickly sense the changes of network status and dynamically capture the optimal network throughput. BAG also achieves higher throughput and stronger robustness to bursts than the existing rate-based flow control and congestion control algorithms.
Operational deployment of hybrid QKD–PQC security in smart grids requires coordinated planning under coupled service-level agreement (SLA) constraints, including startup latency, sustained key availability, real-time bounds, technology budget, and site storage capacity. This paper presents an SLA-driven network-planning framework solved using feasibility-first bounded local search (FF-BLS). A broad 36,300-run campaign across seven benchmark networks (14–6,495 nodes) maps deployment regimes and algorithmic ablations. Full FF-BLS attains 60.9% feasibility under fixed installed site capacity, while relaxing the site-cap constraint yields 100%. Focused studies further vary storage, technology budget, QKD-adoption target, and startup–traffic stress. FF-BLS reaches 100% feasibility at the highest tested storage multiplier (γ = 0.40), while a restrictive technology budget (b = 0.60) remains independently binding once storage is sufficient. On 246 comparison scenarios, FF-BLS achieves 100% feasibility, whereas unassisted GA, SA, Tabu, and VNS achieve 24.4–58.9%; feasibility-aware initialization and repair substantially improve the generic baselines. A separate 100-instance topology/storage stress benchmark and an aligned CPU–GPU study evaluate robustness and computational scaling. The results show that site storage is the dominant practical bottleneck under fixed installed capacity, while its importance depends on the provisioning regime. Low-to-moderate QKD adoption is most robust under constrained storage, whereas higher adoption becomes feasible when sufficient storage head-room is provisioned. These findings provide practical guidance for scalable quantum-safe smart-grid deployment under stringent SLAs.
Electric Vehicle Charging Stations (EVCSs) have become the heart of electrified transportation infrastructure. Their increasing Internet exposure makes them high-value targets for cyberattacks with potential implications for grid stability. This study presents a comprehensive, data-driven security analysis of globally exposed EV Charging Management Systems (EVCMS), bridging theoretical vulnerability concerns with quantified real-world threats. We discover and assess Internet-exposed EVCMS infrastructure, then deploy multi-component honeypot systems to capture live attack intelligence. Our novel EVCS discovery technique identifies 59,359 EVCMS IPs from 798 vendors, with notable improvements in non-English-speaking regions, overcoming traditional scanning limitations. Security assessment of 17 vulnerability types reveals most critical vulnerabilities remain unaddressed three years after coordinated disclosure. Darknet intelligence analysis reveals 10,647 unique IPs that also appeared in our EVCMS dataset participating in unsolicited scanning throughout 2024 with periodic surges. We deploy a comprehensive honeypot system with proactive engagement that actively induces compromised EVCMS devices to attack our infrastructure, spanning two monitoring phases: a ten-day period with proactive engagement and an eight-month period of long-term passive monitoring. We observed generic IoT threats and found no EVCMS-specific malware in the samples examined. A small portion of human exploration activities is found in the web portal honeypot. We observed liveness probes on both the Linux server honeypots and the OCPP backend, serving as a critical warning of imminent threats demanding immediate vendor attention before escalation to destructive campaigns.
This paper introduces an innovative two-step methodology to model the beamforming training (BFT) medium access control (MAC) behavior of IEEE 802.11ad and IEEE 802.11ay networks, capturing several MAC-layer features specified in the standards that previous work has not considered. The proposed framework jointly employs two discrete-time Markov chains (DTMCs): the first models the individual behavior of each transmitting station (STA), including the dynamic adjustment of the competing STA to account for the idle period, while the second captures the network-wide interactions of all STAs and uses this information to derive the medium access probability at each frame slot during the BFT process. This work introduces two key novel modeling assumptions: (1) the STAs cease access once they successfully access a BFT frame’s slot, and (2) the number of competing STAs dynamically decreases as they enter the idle period after a given number of consecutive collisions, providing a precise representation of BFT MAC operation in IEEE 802.11ad and IEEE 802.11ay standards. We derive the theoretical expressions for the expected number of idle STAs based on probabilities of successful BFT, collisions, and transitions to the idle period.We validate the model’s accuracy through Monte Carlo simulations across diverse network scenarios, showing close alignment with simulation results and improved accuracy over prior models that do not consider these two modeling assumptions. Additionally, we analyze the impact of the collision threshold and idle period duration on BFT goodput, highlighting the model’s ability to compute MAC protocol performance.
