Re-ranking is the critical final step in object re-identification systems, responsible for effectively ordering a list of candidate objects to more closely align with the desired target objects. While existing methods often focus on single-stage feature vector extraction due to resource limitations, these approaches can result in rankings filled with inconsistent or even misaligned images in terms of key attributes like color, pose, and clothing. To tackle these challenges, we create a ReID(Re-Ranking through Image Description) framework, which uses deep semantic information to improve re-ranking through contextually enhanced features. This substantially increases the accuracy of object re-identification. Our primary contributions are as follows: 1. We create a richly annotated dataset based on real-world images for training an object semantic extraction model. 2. We design the ReID framework, which digs deep into the appearance similarities of objects within images and employs an end-to-end matching algorithm for re-ranking, thereby enhancing re-identification accuracy. 3. Extensive experiments show that, in both supervised and unsupervised scenarios, our approach significantly outperforms the state-of-the-art on large-scale datasets for vehicle and person re-identification.

Multivariate time series (MTS) forecasting is a critical task, yet existing models often struggle to capture the complex, hierarchical nature of real-world data. Many existing methods operate at a single temporal resolution, failing to model cross-level dependencies, and face a trade-off between capturing long-range patterns and maintaining computational efficiency. To address these limitations, we propose FSTDiff (Fourier Spatio-Temporal Diffusion Model), a probabilistic forecasting framework that excels in multi-scale and global dependency modeling. The core of our approach is a novel noise network, the Multi-scale Fourier Network, which synergistically combines a U-Net architecture with the Fourier Neural Operator. The U-Net provides a hierarchical framework to capture temporal patterns at multiple scales, while FNO serves as the efficient backbone for modeling global correlations within each scale. This noise network is guided by a powerful encoder that utilizes automatic series decomposition to provide a clean, high-quality historical context. Extensive experiments on seven public datasets demonstrate that FSTDiff establishes a new state-of-the-art in probabilistic forecasting, achieving an average CRPS improvement of 6.4%. We provide our source code at https://github.com/xuyifeiiie/FSTDiff to facilitate reproducibility. Index Terms—Multivariate times series forecasting, Spatiotemporal data, Probabilistic forecasting, Conditional diffusion model

The automated translation of natural language into penetration testing commands represents a critical challenge in cybersecurity. Although Large Language Models demonstrate considerable potential in this domain, they frequently generate syntactically invalid commands or hallucinate non-existent parameters. To address these limitations, we propose Penetron, a framework that enhances command generation accuracy through a novel two-stage training paradigm. In the first stage, supervised fine-tuning is performed on a curated Chain-of-Thought dataset to cultivate fundamental reasoning capabilities. In the second stage, the model is further optimized via reinforcement learning with Generative Reward Policy Optimization, guided by a composite reward function that jointly evaluates structural validity and semantic correctness. To facilitate systematic evaluation, we introduce NL2PEN-KALI, a benchmark specifically designed for penetration testing scenarios. Experimental results show that Penetron achieves substantial improvements over state-of-the-art models on both NL2PEN-KALI and the public NL2SH-ALFA benchmark, producing commands with higher syntactic validity and contextual relevance.

The A* algorithm is one of the most common analog integrated circuit (IC) routing techniques. As the number of nets increases, the routing order of this heuristic routing algorithm will affect the routing results immensely. Currently, artificial intelligence (AI) technologies are widely applied in IC physical design to accelerate layout design. In this paper, we propose a reinforcement model based on net order selection. We construct multichannel images of routing data and extract features of the coordinates of routing pins through an attention mechanism. After training, the model outputs an optimized net order, which is then used to perform routing with a bidirectional A* algorithm, thereby improving both the speed and efficiency of the routing process. Experimental results on cases based on 130-nm and 180-nm processes show that the proposed method can achieve a 2.5 % reduction in wire length and a 3.7 % decrease in the number of vias compared to state-of-the-art methods for analog IC routing. In terms of computational efficiency, the bidirectional A* algorithm improves performance by 7.3 % over the unidirectional A* algorithm in decision-making scenarios and by 51.09 % in the path-planning process. Simulation results further demonstrate that, compared with manual and advanced automation methods, the overall performance of the layout achieved by our method aligns most closely with schematic performance.

Large language model (LLM)-powered agents show promise in automating web tasks but struggle with vague user instructions and implicit preferences, especially in personalized domains. Prior works attempt to address this via user profiles or intent modeling, yet they often treat profiles as static, unstructured text and resort to clarification only after failures, leading to inefficiency and error accumulation. We propose ClueUp (Clarification as User-centric Exploration with User Profiles), which builds hierarchical slot-based profiles with uncertainty scores, employs an uncertainty-aware decision policy that balances clarification with execution, and incorporates feedback-driven profile updates for long-term consistency. Evaluations show that ClueUp significantly outperforms state-of-the-art (SOTA) baselines in personalized understanding and task efficiency.

Recently, Large Language Models (LLMs) based Web Agents have shown significant potential in web understanding and interaction tasks. However, their personalization ability and user experience remain limited by the ambiguity and dynamic nature of user intent, struggling to model diverse user interests and track intent changes over time. To address these challenges, this paper proposes Orion, a novel personalized Web Agent. Orion adopts a global-micro profiling mechanism to balance users' long-term stable preferences and scenario-based needs, and introduces context-aware interest retrieval to enhance personalization. Additionally, we design adaptive profile tracking and proactive disambiguation mechanisms to effectively address the continuous evolution of user intent in multi-turn interactions. Orion is optimized through end-to-end online reinforcement learning, improving personalized reasoning and decision-making ability in real interactive scenarios. Experiments demonstrate that Orion significantly outperforms state-of-the-art baselines in personalized understanding and task efficiency.

Microservice systems generate fragmented and misaligned multi-modal data, including metrics, logs, and traces, posing a major challenge for AIOps, which requires coherent system-state representations for downstream analytics. Existing approaches typically model spatio-temporal relations at a coarse granularity or are tailored to specific tasks, limiting their generalizability across different O&M scenarios. To address these limitations, we propose M3RL, a unified pre-training and fine-tuning framework for learning robust and transferable system-state representations. At its core, the spatio-temporal network (STNet) performs fine-grained semantic fusion of multi-modal data along both temporal and spatial dimensions and models evolving communication-driven dependencies among services. We further pre-train STNet with three complementary objectives: denoising reconstruction for robustness, future prediction for temporal evolution modeling, and causal contrastive learning for node-level discriminability. Extensive experiments on two public benchmark datasets demonstrate that M3RL consistently outperforms recent state-of-the-art baselines across key downstream tasks, reducing state prediction MAE by 1.9%, increasing anomaly detection F1 by 4.7%, and improving root cause localization HR@1 by 4.8% on average. These results show that M3RL provides a robust and transferable representation backbone for multiple AIOps tasks.

QUIC adapts well to complex network situations due to mechanisms such as 0/I-RTT handshake and fast retransmission. It has now become a new star in the era of IoT. However, a phenomenon reveals the security risks of QUIC. Studies indicate that the internet is exposed to an average of four QUIC flood attacks per hour. The efficiency -oriented features of QUIC introduce vulnerabilities, making it particularly susceptible to attacks. In IoT scenarios, protocol security often depends on the design of the protocol itself and the middlewares. However, QUIC's design does not prioritize security as its highest concern and due to the ossification of middleboxes, the server-side defense is the only option. Therefore, we propose the QShield framework to seek breakthroughs from an engineering perspective. Based on the SDN principles, QShield consists of three parts. At the application layer, QUIC applications can utilize this library to implement strategy development and enable data sharing. A user-space library operates as the control layer, facilitating realtime bidirectional data transfers between the kernel and user space via a suite of APIs. In the data layer, QShield core blocks attack packets at the lowest layer of the Linux network protocol stack using eBPF technology. QShield effectively resists client -side attacks, and experimental results show that QShield can reduce the server's CPU usage for processing attack packets by nearly 5W/c, thereby essentially restoring normal Queries Per Second and bandwidth, reducing the bandwidth amplification by about 68% on the specific QUIC implementation.

In the AIOps realm, precise system state forecasting is essential, particularly within microservices architectures, where may have dynamic deployments, varied call paths, and cascading effects complicate spatio-temporal relationships. Existing time series forecasting methods, which emphasize temporal patterns, fall short in capturing the critical spatial dimensions. Spatio-temporal graph methods, while useful, often overlook temporal trends and the length of forecast horizons. Furthermore, existing research about microservices tends to undervalue the role of network metrics and topological structures in reflecting system dynamics. This paper presents STMformer, a novel model designed for microservices state forecasting, adept at managing multi-node and multivariate time series based on diverse spatio-temporal relationships. It harnesses dynamic network connections and topological insights to model complex spatio-temporal interactions and incorporates a PatchCrossAttention module for global cascading effect analysis. Based on a microservices-based dataset we collect with our developed tool, we demonstrated that STMformer outperformed existing methods, reducing MAE by 8.6% and MSE by 2.2% in forecasting tasks. The source code is available at https://github.com/xuyifeiiie/STMformer.

Automating penetration testing is crucial for enhancing cybersecurity, yet current Large Language Models (LLMs) face significant limitations in this domain, including poor error handling, inefficient reasoning, and an inability to perform complex end-to-end tasks autonomously. To address these challenges, we introduce Pentest-R1, a novel framework designed to optimize LLM reasoning capabilities for this task through a two-stage reinforcement learning pipeline. We first construct a dataset of over 500 real-world, multi-step walkthroughs, which Pentest-R1 leverages for offline reinforcement learning (RL) to instill foundational attack logic. Subsequently, the LLM is fine-tuned via online RL in an interactive Capture The Flag (CTF) environment, where it learns directly from environmental feedback to develop robust error self-correction and adaptive strategies. Our extensive experiments on the Cybench and AutoPenBench benchmarks demonstrate the framework's effectiveness. On AutoPenBench, Pentest-R1 achieves a 24.2% success rate, surpassing most state-of-the-art models and ranking second only to Gemini 2.5 Flash. On Cybench, it attains a 15.0% success rate in unguided tasks, establishing a new state-of-the-art for open-source LLMs and matching the performance of top proprietary models. Ablation studies confirm that the synergy of both training stages is critical to its success.

Accurate traffic forecasting in base station networks is crucial for efficient network management, resource allocation, and ensuring quality of service. This paper introduces BetaStack, a novel network-specific Large Language Model (LLM) designed to enhance base station traffic prediction. Unlike existing approaches, BetaStack incorporates physical constraints and a specialized network protocol embedding layer that captures the hierarchical structure of network traffic data. Through fine-tuning with these network-specific adaptations and a self-regressive prediction mechanism, BetaStack effectively leverages the powerful sequence modeling capabilities of LLMs to address the intricacies of network traffic. Extensive experiments on realworld data from base station cells in Guangdong, China demonstrate that BetaStack achieves significant performance improvements over both state-of-the-art time-series forecasting models and specialized network traffic prediction models. These results underscore the potential of BetaStack to improve the accuracy of network traffic prediction, enabling more efficient network management. The code can be found in https: //github.com/lqf0624/BetaStack.git.

The widespread use of encryption protocols and increasing privacy demands have significantly increased encrypted traffic, creating new challenges for network monitoring and threat detection. Current methods struggle with diverse scenarios and distinguish between subtle traffic patterns within webpages of the same application. To address these challenges, we introduce ANT-ET, an end-to-end multimodal framework designed for fine-grained encrypted webpage traffic fingerprinting. ANT-ET leverages a transformer to model payload semantics and constructs a traffic interaction graph to capture both temporal and spatial characteristics of packet interactions. Additionally, ANT-ET incorporates a gradient reversal layer to improve generalization by facilitating domain-invariant feature learning across related webpages. Experimental results demonstrate ANT-ET’s superior performance compared to various baseline models, which were evaluated using a proprietary encrypted webpage traffic dataset and three public datasets. Ablation studies confirm the effectiveness of different framework components, while sensitivity and complexity analyses further validate ANT-ET’s robustness and flexibility.

Cross-modal hashing techniques provide an effective method for large-scale cross -modal search due to their ability to handle multiple data types and their efficient storage and computation performance. To achieve excellent performance, deep supervised cross-modal hashing methods require extensive training data from various classes. However, when new classes emerge in the database, existing cross modal hashing methods typically need to retrain the image and text encoders and regenerate hash codes for all data, which is impractical for large-scale retrieval systems. In this paper, we introduce an innovative cross -modal incremental hashing framework called Deep Incremental Cross-Modal Hashing Network (DICIVIHN), which can learn hash codes incrementally. The DICMHN framework is capable of directly learning the hash codes of newly emerging images and texts while maintaining the integrity of existing hash codes. Moreover, this framework ensures the accuracy of query results by modeling the correlation between query images and matching texts, as well as between query texts and matching images, while preserving the distinctions between images and texts. Extensive experiments conducted on multiple cross-modal benchmark datasets demonstrate that our proposed DICMHN framework significantly reduces training time and outperforms existing state-of-the-art methods.

Large Language Models (LLMs) have demonstrated remarkable performance across various domains, showcasing significant potential for long-term time series forecasting (LTSF), and consequently attracting substantial research interest. In LTSF, temporal decomposition has been widely adopted in existing models, including both Transformer-based and linear models, to enhance predictive capabilities. However, our experiments indicate that a simplistic integration of these decomposition methods into LLMs can lead to overfitting, even though they are effective in traditional models. In this paper, we propose PaSTS, a novel framework designed to integrate decomposition methods into LLMs through a specialized temporal synthesis layer, thereby improving predictive accuracy and mitigating overfitting of LLMs in LTSF tasks. Empirical evaluation of our framework provides evidence supporting the effective integration of LLMs with temporal decomposition techniques. Furthermore, applying our synthesis method to the decomposed series in several traditional models that employ seasonal-trend decomposition demonstrates its adaptability.

Knowledge Distillation, an effective model compression technique, transfers knowledge from a large teacher model to a smaller student model, reducing computational costs while maintaining model performance. In large-scale retrieval tasks, maintaining the consistency of retrieval result rankings is crucial. However, traditional distillation methods focus on aligning the feature vectors extracted by the student model with those of the teacher model, which often fails to preserve ranking consistency in complex retrieval tasks. To address this issue, we propose a reinforcement learning-based multi-teacher knowledge distillation framework to optimize ranking consistency. By incorporating reinforcement learning strategies, the framework dynamically selects and adjusts the weights of multiple teacher models, enabling the student model to better learn from different teachers and accurately maintain retrieval rankings. Experimental results demonstrate that the proposed method significantly improves ranking consistency and retrieval performance on several benchmark datasets.

The placement of analog Integrated Circuits (ICs) plays a critical role in their physical design. The objective is to minimize the Half-Perimeter Wire Length (HPWL) while satisfying complex analog IC constraints, such as symmetry. Unlike digital ICs, analog ICs are highly sensitive to parasitic effects, making device symmetry crucial for optimal circuit performance. However, existing methods, including both machine learning-based and analytical approaches, struggle to meet strict symmetry constraints. In machine learning-based methods, training a general model is challenging due to the limited diversity of the training data. In analytical methods, the difficulty lies in formulating symmetry constraints as a convex function, which is necessary for gradient-based optimization of the placement. To address the issue, we formulate the placement process as a Markov decision process and propose SACPlace, a multi-agent deep reinforcement learning method for Symmetry-Aware analog Circuit Placement. SACPlace initially extracts layout information and various constraints as the input information for placement refinement and evaluation. Subsequently, SACPlace constructs multi-agent policy networks for symmetry-aware placement by refining placement guided by the evaluation of optimal symmetry quality. Following this, SACPlace constructs multilayer perceptron-based critic networks to embed placement information for evaluating symmetry quality. This evaluation reward will be used for guiding placement refinement. Experimental results from four public analog ICs instances demonstrate that our method achieves the lowest actual wirelength and area while fully satisfying symmetry and common constraints, outperforming state-of-the-art methods. Additionally, simulation results on real-world analog ICs show better performance than these methods and even manual designs.

Penetration testing is a vital practice for identifying and mitigating vulnerabilities in cybersecurity systems, but its manual execution is labor-intensive and time-consuming. Existing large language model (LLM)-assisted or automated penetration testing approaches often suffer from inefficiencies, such as a lack of contextual understanding and excessive, unstructured data generation. This paper presents VulnBot, an automated penetration testing framework that leverages LLMs to simulate the collaborative workflow of human penetration testing teams through a multi-agent system. To address the inefficiencies and reliance on manual intervention in traditional penetration testing methods, VulnBot decomposes complex tasks into three specialized phases: reconnaissance, scanning, and exploitation. These phases are guided by a penetration task graph (PTG) to ensure logical task execution. Key design features include role specialization, penetration path planning, inter-agent communication, and generative penetration behavior. Experimental results demonstrate that VulnBot outperforms baseline models such as GPT-4 and Llama3 in automated penetration testing tasks, particularly showcasing its potential in fully autonomous testing on real-world machines.

Relational Triple Extraction (RTE) focuses on extracting triples from sentences, a crucial task in the automatic construction of knowledge graphs. Large Language Models (LLMs) have the ability to automatically extract triples from text through appropriate instructions or fine-tuning. However, due to the bias between LLMs training data and inference data, the previous LLM-based triple extraction method ignores many potentially valuable knowledge and lacks noise filtering, which greatly limits the capability of RTE model. To address these challenges, we propose Candidate Prompt Enhancement and Noise Filtering Relational Triple Extraction Framework Based on Large Language Models (CNRel), which combines small pre-trained language model and LLMs. Specifically, we first utilize a candidate entity pair extraction and filtering block, based on a small pre-trained language model, to extract and refine all possible entity pairs in the text, ensuring the capture of as much valuable information as possible Then, a fine-tuned LLMs such as LLaMA is then used to predict the relationship between the candidate entity pairs and extract as many triples as possible. Finally, Noise Filter block filter the extracted triples through LLMs, and remove the wrong triples, which greatly improve the precision of the RTE model. Experiments on several public datasets show that CNRel achieves state-of-the-art among all previous mainstream relational triple extraction methods, and we conduct a widely ablation experiments to reveal the contribution of each component to the overall performance.

Microservice architecture is gradually replacing traditional monolithic applications, but its modular design introduces new security challenges in service interactions. To ensure the security of the entire microservices system, it is crucial to implement strict network policies that prevent a compromised service from maliciously exploiting or affecting other properly functioning microservices. However, the dynamic and large-scale nature of microservices makes traditional manual policy configuration impractical. This paper presents a network policy generation method based on service topology. Our approach comprises two fundamental techniques: (1) a real-time service topology generation method that leverages configuration files and network plugins to dynamically capture service interactions, and (2) an automatic network policy generation method based on the derived service topology. The effectiveness of the proposed method is validated through experiments on three popular microservice applications. The results demonstrate that our method can generate fine-grained and efficient network policies, reducing the time overhead by an average of 38

Video streams continue to dominate network traffic. Regulating video traffic is crucial because some videos may contain malicious content that harms society. The key foundation of regulation is identifying encrypted video traffic, primarily based on fingerprinting techniques. However, QUIC is becoming a mainstream video transport protocol similar to TCP, and its end-to-end encryption renders traditional packet-based fingerprint extraction methods ineffective. Besides, unstable network environments can lead to video data loss or retransmissions, disrupting fingerprint continuity and, thus, the effectiveness of identification. Furthermore, with ongoing booming video numbers, deep learning-based algorithms display poor real-time identification capability because they require extensive training resources and time to learn new video patterns every time. To address these challenges, we propose a two-stage encrypted video traffic identification method, TSIV. We designed a fingerprint extraction method for QUIC encrypted traffic relying on the flow feature. Additionally, we developed Hit Model based on Term Frequency-Inverse Document Frequency (TF-IDF) and Corrective Dynamic Time Wrapping (C-DTW) to perform the two-stage fingerprint matching, considering both the distribution and temporal sequence characteristics of video data, to handle potential issues caused by fingerprint discontinuity. The experimental results demonstrate that TSIV significantly improves accuracy and speed under ideal and poor conditions, outperforming existing methods.