As deep learning (DL) continues to advance, effective feature extraction from large-scale data remains crucial for enhancing model performance. To leverage the advantages of the frequency domain, such as concentrated signal energy, prominent data features, and rich detailed characteristics, this paper proposes a novel frequency-domain feature extraction method. However, existing frequency component selection algorithms often struggle to adapt to diverse tasks, tend to yield only locally optimal solutions, and require prolonged processing times. To overcome these limitations, we introduce the Adaptive Fast Frequency Selection (AFFS) algorithm, which seamlessly integrates a frequency component selection factor layer into DL models to identify globally optimal frequency combinations suited to various downstream tasks. We further analyze the relationship between selected frequency components and model performance, providing theoretical guarantees regarding optimality, robustness, and generalization error bounds. Moreover, a fast selection procedure is developed to exploit the empirically observed rapid convergence of the selection-factor ranking, significantly accelerating the selection process. Extensive experiments on five datasets, ten DL models, and two subsequent tasks demonstrate that AFFS achieves superior performance: even when the input data size is reduced to only 10% of the original frequency features, model classification accuracy improves by approximately 1%, while the early stopping mechanism shortens the selection process by about 80%.

To satisfy the unprecedented Quality of Experience (QoE) and stringent latency Service Level Agreements (SLAs) of emerging interactive applications, modern Content Delivery Networks (CDNs) are deploying massively decentralized edge nodes. However, this paradigm shift poses a significant challenge: optimal traffic scheduling fundamentally depends on acquiring real-time, full-coverage end-to-end path latency data to prevent SLA violations. Current measurement methods cannot scale to monitor every possible user-to-node path, and traditional prediction approaches (e.g., relying on additional segmented measurements or low-rank matrix decomposition) fail to achieve satisfactory accuracy on the resulting extremely sparse datasets. In this work, we present ADePT (Application Delay PredicTion), a novel data-driven causal inference framework that provides comprehensive and precise latency predictions without requiring additional measurements. By explicitly decoupling user-side temporal variations (e.g., last-mile congestion) and node-side spatial variations (e.g., core propagation delays), ADePT successfully extracts high-dimensional latent embeddings from limited measurement data to infer the end-to-end path latency for any potential scheduling decision. Evaluated on a massive real-world dataset from a leading edge CDN, ADePT reduces prediction errors by 19.6% and achieves a median absolute error of 4.3 ms. Consequently, integrating ADePT's accurate predictions into CDN traffic scheduling significantly improves scheduling decisions, increasing the ratio of traffic meeting strict applications' latency requirements by 1.66 & times;.

Network emulation has become an indispensable methodology for evaluating next-generation network architectures, offering a critical balance between experimental fidelity and operational scalability. However, its effectiveness is fundamentally constrained by inefficiencies in emulating large-scale networks, particularly during virtual network construction. This bottleneck arises from mandatory serialization of virtual link instantiation and operating system (OS) kernel-level notification overheads, which collectively degrade performance by orders of magnitude on 10K-node topologies. Departure from the current practice that employs a multi-machine framework for improvements, we propose SplitNN (Split Network and Namespace), a novel single-machine network emulation paradigm that breaks the serialization constraint through multi-VM (virtual machines) partitioning, and reduces notification overheads via namespace segmentation. Extensive evaluations show that SplitNN constructs 10K-node virtual networks within 1–5 minutes on a single machine, achieving a 98.5%–99.2% reduction in construction time compared to state-of-the-art emulators. While primarily a single-machine solution, SplitNN seamlessly integrates with multi-machine deployments, complementing them by enabling cumulative gains in both scalability and efficiency.

Driven by the increasingly complex and decision-oriented demands of time series analysis, we introduce the Semantic-Conditional Time Series Reasoning task, which extends conventional time series analysis beyond purely numerical modeling to incorporate contextual and semantic understanding. To further enhance the mode's reasoning capabilities on complex time series problems, we propose a two-round reinforcement learning framework: the first round strengthens the mode's perception of fundamental temporal primitives, while the second focuses on semantic-conditioned reasoning. The resulting model, KairosVL, achieves competitive performance across both synthetic and real-world tasks. Extensive experiments and ablation studies demonstrate that our framework not only boosts performance but also preserves intrinsic reasoning ability and significantly improves generalization to unseen scenarios. To summarize, our work highlights the potential of combining semantic reasoning with temporal modeling and provides a practical framework for real-world time series intelligence, which is in urgent demand.

Sparse network monitoring, a breakthrough technology for cost-effective network-wide monitoring, has garnered significant attention from researchers and network equipment providers. By measuring only a subset of paths and nodes, it leverages the network’s low-rank property to obtain comprehensive monitoring data. However, a previously unnoticed vulnerability called the "global diffusion vulnerability" poses a significant threat to sparse network monitoring. This vulnerability suggests that if a few measurement samples are tainted, the entire network monitoring data can become inaccurate, leading to potential network failures and adverse effects on routing and bandwidth allocation. This paper presents the first exploration of the "global diffusion vulnerability" to launch effective attacks on sparse network monitoring. Sparse monitoring often employs various imputation models to estimate unmeasured data and collects multiple perspectives of network-wide data over extended periods. The challenges in attacking sparse monitoring lie in designing perturbations that can impact all views of network-wide data over time, regardless of the specific imputation models, while remaining unobtrusive. To tackle these challenges, we propose ModelFreeUP, the first perturbation generation algorithm designed for sparse network monitoring. ModelFreeUP creates imputation model-free, universal, and unobtrusive perturbations that exert a significant influence on multiple perspectives of network-wide data over time. Our experiments demonstrate that ModelFreeUP effectively disrupts the sparse monitoring process, causing substantial deviations in the network-wide monitoring data at a relatively low attack cost. Furthermore, when the manipulated monitoring data is used for downstream routing tasks, it triggers 100% Maximum Link Utilization in the Abilene network, indicating network congestion or failure. By shedding light on these critical mismeasurement issues, our work emphasizes the need for robust countermeasures against adversarial attacks in the network monitoring domain.

RAN-CN signaling is the pivotal enabler of collaboration between the Radio Access Network (RAN) and the Core Network (CN) in user context management, handover control, QoS assurance, and session management. However, signaling parsing remains underexplored, and current solutions suffer from high latency and limited flexibility, making them inadequate for the strict performance requirements of 6G. In this paper, we conduct an in-depth analysis and identify three progressive and intertwined challenges that impede the optimization of signaling parsing: the sequential parsing mechanism, inherent Information Element asymmetries, and strict compatibility requirements. To address these challenges and enable deployable, lowlatency, and flexible parsing, we leverage unexploited fields in RAN-CN signaling and their semantic information to accelerate parsing. Building on this insight, we propose SigBooster- a novel parsing framework that simultaneously achieves low latency and high flexibility while maintaining full compatibility to ensure deployability. Experimental results show that SigBooster achieves system latency on par with the current lowest-latency baseline, while reducing signaling size by $63 \%-75 \%$. Furthermore, it reduces average latency by 50% compared to the standard solution. Beyond performance gains, SigBooster demonstrates strong generalizability, with the ability to extend to at least 12 other widely-used mobile protocols. These results highlight SigBooster's potential to significantly enhance mobile network performance and accelerate the realization of 6G networks.

The modern transport protocol QUIC is designed to enhance network performance and security, but it remains vulnerable to handshake flooding attacks. Such attacks exhaust CPU resources by forcing the server to perform expensive cryptographic operations via a large number of handshaking requests. QUIC provides a built-in defense mechanism, the Retry mechanism, to mitigate these attacks. However, our experiments reveal that it can still become a performance bottleneck under large-scale QUIC handshake floods due to substantial computational overhead. In this paper, we design and implement TurboRetry, a split design, that offloads the Retry mechanism onto DPUs to efficiently mitigate QUIC handshake floods. TurboRetry partitions the tasks of the Retry into two categories, and then assigns them to the DPUs and the host, respectively. To preserve QUIC semantics and reduce the coordination overhead, TurboRetry designs an extended Retry token format and an efficient cooperation scheme. In addition, TurboRetry offloads the connection authorization task to the on-path DPA to further improve both performance and security. Our evaluation shows that TurboRetry outperforms the host-side implementation by a wide margin, improving throughput by 10-20×.

In recent years, large language models (LLMs) have driven substantial intelligent transformation across diverse industries. Commercial LLM training is typically performed over data center networks (DCNs) comprising hundreds to thousands of GPUs, with multiple devices collocated per node. As network scale expands, inter-node communication becomes a primary bottleneck to training efficiency. Network-state simulators therefore play a crucial role by enabling cost-effective evaluation of network configurations and parallelization strategies through faithful emulation of DCN dynamics during LLM training. However, existing simulators are constrained by a efficiency-fidelity tradeoff, as packet-level simulators (PLSs) incur prohibitive runtime overhead, whereas flow-level simulators (FLSs) compromise essential modeling accuracy. In this paper, we develop , a hybrid-granularity network-state simulator that exploits intrinsic network dynamics in LLM training to adaptively switch simulation granularity. Specifically, employs packet-level simulation during non-steady phases with transient fluctuations and flow-level simulation during steady phases with periodic patterns, thereby accelerating execution while preserving high fidelity. Moreover, it requires no specialized hardware, supports single-machine deployment, and is compatible with existing simulators. Experiments based representative commercial LLM workloads, including ChatGPT, DeepSeek, and Qwen, show that achieves up to 15.4× speedup under single parallelization strategy and 7.8× under hybrid parallelization strategies while maintaining high accuracy.

Web service administrators must ensure the stability of multiple systems by promptly detecting anomalies in Key Performance Indicators (KPIs). Achieving the goal of "train once, infer across scenarios" remains a fundamental challenge for time series anomaly detection models. Beyond improving zero-shot generalization, such models must also flexibly handle sequences of varying lengths during inference, ranging from one hour to one week, without retraining. Conventional approaches rely on sliding-window encoding and self-supervised learning, which restrict inference to fixed-length inputs. Large Language Models (LLMs) have demonstrated remarkable zero-shot capabilities across general domains. However, when applied to time series data, they face inherent limitations due to context length. To address this issue, we propose ViTs, a Vision-Language Model (VLM)-based framework that converts time series curves into visual representations. By rescaling time series images, temporal dependencies are preserved while maintaining a consistent input size, thereby enabling efficient processing of arbitrarily long sequences without context constraints. Training VLMs for this purpose introduces unique challenges, primarily due to the scarcity of aligned time series image-text data. To overcome this, we employ an evolutionary algorithm to automatically generate thousands of high-quality image-text pairs and design a three-stage training pipeline consisting of: (1) time series knowledge injection, (2) anomaly detection enhancement, and (3) anomaly reasoning refinement. Extensive experiments demonstrate that ViTs substantially enhance the ability of VLMs to understand and detect anomalies in time series data. All datasets and code will be publicly released at: https://anonymous.4open.science/r/ViTs-C484/.

As the reasoning capabilities of Large Language Models (LLMs) continue to advance, LLM-based agent systems offer advantages in flexibility and interpretability over traditional systems, garnering increasing attention. However, despite the widespread research interest and industrial application of agent systems, these systems, like their traditional counterparts, frequently encounter anomalies. These anomalies lead to instability and insecurity, hindering their further development. Therefore, a comprehensive and systematic approach to the operation and maintenance of agent systems is urgently needed. Unfortunately, current research on the operations of agent systems is sparse. To address this gap, we have undertaken a survey on agent system operations with the aim of establishing a clear framework for the field, defining the challenges, and facilitating further development. Specifically, this paper begins by systematically defining anomalies within agent systems, categorizing them into intra-agent anomalies and inter-agent anomalies. Next, we introduce a novel and comprehensive operational framework for agent systems, dubbed Agent System Operations (AgentOps). We provide detailed definitions and explanations of its four key stages: monitoring, anomaly detection, root cause localization, and resolution.

Packet classification is a fundamental operation in modern network systems, playing a central role in traffic management, security enforcement, and policy execution. While traditional algorithms have achieved low lookup latency in static scenarios, emerging applications impose more demanding requirements—not only fast lookup, but also high-frequency online updates and strong scalability. Existing approaches often struggle to handle large rule sets or support rules with an increasing number of matching fields, making them unsuitable for dynamic and large-scale network environments.In this work, we propose TupleChain for fast on-line update table lookup with multifaceted scalability.We group rules based on their masks, each maintained using a hash table, and explore the connections among rule groups to skip unnecessary hash probes for faster searches. We show via theoretical analysis and extensive experiments that the proposed scheme offers competitive computational complexity, strong scalability, and high performance in both search and update operations. TupleChain can process millions of packets per second, while simultaneously handling millions of on-line updates per second at the same time, and its lookup speed remains stable even when processing large flow table with 10 million rules or entries containing up to 100 match fields.

Real-time network anomaly detection is essential for maintaining security and service reliability, yet it remains challenging in modern deployments where traffic (or latency) data arrive as streams and the underlying tensor size varies over time due to node churn and adaptive measurement policies. Existing online tensor decomposition based detectors typically assume single-aspect growth (often only along time) and fixed multilinear ranks, which can lead to inconsistent factor updates, error accumulation, and degraded detection under multi-aspect evolution. This paper proposes MLOTD, a meta-learning and adaptiverank online Tucker decomposition framework for joint online low-rank modeling and anomaly separation on streaming network tensors. MLOTD introduces shared meta-factors that coordinate local subtensor updates through alternating local adaptation and lightweight global meta-updates, thereby aligning incremental learning with a global objective and mitigating forgetting when multiple modes expand. To cope with evolving normal-pattern complexity, we further develop a singular-value energy based mechanism that adaptively selects multilinear ranks online with negligible overhead. Anomalies are extracted via efficient residual screening within an alternating optimization loop. Extensive experiments on three real-world datasets (Abilene, GE´ANT, and the Seattle) under diverse random and temporally structured anomaly settings demonstrate that MLOTD consistently achieves a better TPR-FPR trade-off than representative baselines while maintaining practical per-batch runtime. These results verify that combining meta-learning based structural transfer with adaptive rank control yields accurate, stable, and scalable online anomaly detection in dynamic network environments.

Border Gateway Protocol (BGP) serves as the defacto standard for inter-domain routing, yet it fundamentally lacks authentication and validation mechanisms, leaving the global Internet infrastructure vulnerable to both malicious attacks and inadvertent misconfigurations. Traditional detection approaches often fall short in accurately identifying prefix hijacking, particularly in small-scale events, and typically produce results that are difficult to interpret. To address these limitations, this paper proposes CF-BAD, a novel anomaly detection framework. Specifically, to capture the subtle patterns characteristic of small-scale anomalies, we construct a dual-granular feature tensor that integrates both time- and frequency-domain information derived from raw BGP data. We further introduce an adaptive mask mechanism tailored for the Swin-Transformer architecture, enabling enhanced representation learning across both coarse- and fine-grained knowledge. Our detection model also incorporates a Long Short-Term Memory (LSTM) unit to effectively capture long- and short-term temporal dependencies. To improve interpretability, we devise a novel layer-wise root cause analysis (RCA) method that provides explainable insights via hierarchical decomposition. Extensive experiments conducted on 15 real-world anomaly events comprising 343 million BGP messages in total demonstrate that our framework achieves state-of-the-art performance in both detection and RCA accuracy across the majority of cases.

Low-latency cloud rendering enables mobile users to experience high-quality, real-time 3D graphics but achieving low Motion-to-Photon (MTP) latency while maintaining smooth playback is a significant challenge. Our real-world measurement study identifies Receive-to-Composition (R2C) latency, caused by ineffective jitter buffer management, as the primary factor contributing to increased MTP latency. To address this, we introduce JitBright, a client-side optimization strategy that dynamically reduces MTP latency through adaptive jitter buffer management. By adjusting buffer levels based on smoothing playback probability and implementing proactive keyframe requests to mitigate frame dependency, JitBright minimizes both active and passive waiting times.

The Network Repository Function (NRF) is the service router of the 5G/6G Service-Based Architecture (SBA), yet the rapid growth in network function (NF) population and profile complexity has turned it into a critical performance bottleneck. Prior work primarily targeted the search cost of the NRF, overlooking the soaring CPU time spent on repeatedly serializing and deserializing large JSON NF profiles during discovery. This paper dissects the dual bottleneck and presents H2-NRF, a new NRF architecture that simultaneously achieves near-constant-time discovery and minimal serialization overhead on the critical path. H2-NRF introduces a multi-attribute hierarchical index that prunes the candidate set with O(1) lookups, and a store-once, return-verbatim profile pipeline that validates and indexes profiles once while preserving the original JSON string alongside a lightweight attribute cache for residual filtering. We implement H2-NRF on Free5GC with Redis-backed storage and conduct extensive macro- and micro-benchmarks against the stock NRF and multiple indexed baselines. The prototype drives discovery latency to a flat curve regardless of the number of registered profiles, maintains constant high user equipment (UE) handling capacity while baseline solutions degrade significantly, and reduces control-plane establishment time substantially. H2-NRF demonstrates a practical, Third Generation Partnership Project (3GPP)-compliant path toward NRF scalability for future mobile core networks.

When networked system failures occur, automatically performing Root Cause Analysis (RCA) using observability data is critical for ensuring networked system reliability. Recently, LLM-based agents have shown promise for automating this diagnosis process through advanced reasoning and autonomous exploration. However, existing observability frameworks remain archaic, characterized by fragmented data silos, incompatible schemas, and insufficient semantic metadata, preventing agents from establishing the complex relationships required for effective RCA. To address these challenges, we present UModel, a unified ontological framework that shifts observability from data-centric to object-centric modeling. UModel constructs a virtual ontological layer where heterogeneous telemetry, entities, and expert knowledge are standardized as objects and interconnected via semantic graphs. In addition, we introduce U-SPL, a pipeline-based query interface that enables agents to autonomously explore system topologies and correlate multimodal data. By re-modeling the "AIOps 2025 Challenge" dataset using UModel, the precision of root cause localization improved by 8