The complexity of modern network resource management has significantly increased due to the proliferation of IoT devices and the demand for differentiated quality of service (QoS) for user tasks. Cloud-centric service delivery models encounter challenges related to latency and scalability. The integration of software-defined networking and edge computing technologies offers a new paradigm for task processing in networks, leveraging computing power close to the data source to address these issues. However, edge servers often have limited resources, and the diverse QoS requirements of users complicate the achievement of a load-balanced state. To overcome these limitations, this paper explores service demand uncertainty and virtual network embedding (VNE) algorithms to maximize the utilization of a physical infrastructure. We present a service demand-based resource allocation framework that effectively performs the task allocation in scenarios characterized by demand uncertainty. Additionally, we introduce a task-driven VNE algorithm that optimizes a multi-task resource scheduling scheme using a multi-layer policy network. Experimental results demonstrate that our approach reduces resource consumption by an average of 11.24% compared to other algorithms.

With the proliferation of network users, traffic engineering has become increasingly important for the management and optimization of networks. As a crucial component of traffic engineering, the traffic matrix can assist network managers in making informed decisions to optimize resource utilization. However, in the current complex and heterogeneous space-ground integrated network, the cost of direct real-time measurement of traffic matrix is high and the delay is high. To address this challenge, we propose a network traffic estimation algorithm based on time-varying higher-order moments and deep learning, which leverages the time-varying higher-order moments property of traffic to improve the understanding of non-stationary traffic. First, we introduce an extended generalized autoregressive conditional heteroskedasticity model (THM-GARCH) that incorporates higher-order moment information to predict traffic volatility. Then, the THM-GARCH model is integrated with a long short-term memory network, and a dynamic feature update mechanism is developed to address the issue. The experimental results indicate that the proposed algorithm achieves the highest qualitative accuracy among all traffic estimation experiments, with a 17.78% reduction in root mean square error and a 14.69% reduction in mean square error.

The advancement of communication technology has made traffic engineering a critical issue in network systems. The traffic matrix is essential data that supports traffic engineering. The functionality of routing planning, network monitoring, and other modules within intelligent network management systems relies heavily on the network traffic matrix. However, real-time measurement of the network traffic matrix is costly and often suffers from missing or anomalous values. Consequently, long-term network traffic prediction presents significant challenges. Existing methods often fail to comprehensively address the multidimensional characteristics of traffic and the computational costs of the algorithms. To address these issues, we propose an efficient traffic prediction algorithm based on tensor factorization. First, we introduce a non-negative tensor factorization algorithm that accounts for link errors. This algorithm captures the spatial-temporal characteristics of traffic from different modes, thereby enhancing prediction efficiency. Next, we integrate the tensor factor matrix with a seasonal differential autoregressive moving average model in the temporal mode to identify traffic trends and complete the traffic prediction. Experimental results based on real data demonstrate that our algorithm performs exceptionally well in multi-step predictions and in capturing abnormal fluctuations.

Traffic visibility remains a key component for management and security operations. Observing unsolicited and erroneous traffic, such as unanswered traffic or errors, is fundamental to detect misconfiguration, temporary failures or attacks. ChamaleoNet transforms any production network into a transparent monitor to let administrators collect unsolicited and erroneous traffic directed to hosts, whether offline or active, hosting a server or a client, protected by a firewall, or unused addresses. ChamaleoNet is programmed to ignore well-formed traffic and collect only erroneous packets, including those generated by misconfigured or infected internal hosts, and those sent by external actors which scan for services. Engineering such a system poses several challenges, from scalability to privacy. Leveraging the SDN paradigm, ChamaleoNet processes the traffic flowing through a campus/corporate network and focuses on erroneous packets only, lowering the pressure on the collection system while respecting privacy regulations by design. ChamaleoNet enables the seamless integration with active deceptive systems like honeypots that can impersonate unused hosts/ports/services and engage with senders. The SDN in-hardware filtering reduces the traffic to the controller by 96

This paper presents an innovative approach to detecting Distributed Denial of Service (DDoS) attacks in Software-Defined Networking (SDN) environments by integrating dimensionality reduction, feature engineering, and ensemble learning techniques. The proposed method leverages a two-stage dimensionality reduction process utilizing Principal Component Analysis (PCA) and t-Distributed Stochastic Neighbor Embedding (t-SNE), which effectively captures both linear and non-linear patterns in network traffic. Feature augmentation is further achieved through K-Means clustering, which enhances the feature set by providing valuable cluster-based insights, thereby improving model performance. Evaluated on a comprehensive SDN dataset, the approach achieves a highest observed detection accuracy of 99.93% using an ensemble model, highlighting its effectiveness in distinguishing between malicious and benign traffic. Notably, machine learning models such as Random Forest and XGBoost demonstrate exceptional performance, with XGBoost providing outstanding computational efficiency by processing predictions in just 0.187 s. This highlights its suitability for real-time DDoS detection and significantly outpaces traditional methods in both detection accuracy and processing speed. The ensemble learning technique applied further improves classification robustness, making the method highly reliable in dynamic SDN environments. These findings underscore the efficacy of combining dimensionality reduction, feature engineering, and advanced machine learning methods to address critical security challenges in SDN environments, providing a scalable and efficient solution for mitigating DDoS attacks.

Agentic systems, powered by Large Language Models (LLMs), assist network engineers with network configuration synthesis and network troubleshooting tasks. For network troubleshooting, progress is hindered by the absence of standardized and accessible benchmarks for evaluating LLM agents in dynamic network settings at low operational effort. We present NIKA, the largest public benchmark to date for LLM-driven network incident diagnosis and troubleshooting. NIKA targets both domain experts and especially AI researchers alike, providing zero-effort replay of real-world network scenarios, and establishing well-defined agent-network interfaces for quick agent prototyping. NIKA comprises hundreds of curated network incidents, spanning five network scenarios, from data centers to ISP networks, and covers 54 representative network issues. Lastly, NIKA is modular and extensible by design, offering APIs to facilitate the integration of new network scenarios and failure cases. We evaluate state-of-the-art LLM agents on NIKA and find that while larger models succeed more often in detecting network issues, they still struggle to localize faults and identify root causes. NIKA is open-source and available to the community: https://github.com/sands-lab/nika.

The Digital Twin Network (DTN) establishes a real-time virtual mirror of physical networks. Data collection plays an essential role in DTN, which collects the status data of physical network for building highly consistent digital twins. In this paper, we present a network-wide data collection scheme based on In-band Network Telemetry (INT). To build a lifelike mirror of the physical network, the probing path set is required to cover all links so that network topology, traffic load, and port-level device information is captured. We present a Latency-aware High-degree Replicated First (LHRF) vertex-cut graph partitioning algorithm to partition the network into several balanced subgraphs while trying to replicate the high-degree vertexes among partitions first. LHRF aims to balance the length and accumulated latency of the probing paths. With shorter and stabler probing latencies, the information received by digital twin can reflect the latest and consistent network-wide status. To prevent the packets from being fragmented due to overlong paths, a deep limited search (DLS) based path planning algorithm is employed to generate non-overlapped probing paths covering all edges in the separated subgraphs. Simulation results demonstrate that the proposed scheme generates more balanced INT paths with constrained path length and shorter, stabler probing delay.

The convergence of Internet of Things (IoT) devices with Software-Defined Networking (SDN) in healthcare environments collectively referred to as Software-Defined IoT (SDIoT) offers enhanced operational flexibility and patient care. However, this integration introduces critical security vulnerabilities, particularly Distributed Denial-of-Service (DDoS) attacks that can disrupt the availability of essential medical services. Existing centralized intrusion detection systems (IDS) struggle with scalability, privacy preservation, and responsiveness in such sensitive environments. In this work, we propose FedT-DDoS, a distributed, privacy-preserving DDoS detection framework tailored for SDIoT healthcare systems. FedT-DDoS employs a Federated Multi-Layer Perceptron (FMLP) model to enable collaborative learning across edge devices without exposing sensitive patient data. To improve robustness against non-IID data and adversarial clients, the system integrates the FedProx algorithm at the client side and a Trimmed Mean aggregation strategy on the server. Evaluated on the InSDN dataset, FedT-DDoS achieves a detection accuracy of 99.52%, precision of 99.50%, and recall of 99.52%, with an inference latency of 0.03 ms per sample and convergence within 15 communication rounds. Furthermore, SHAP-based feature attribution and confusion matrix analysis confirm its high interpretability and effectiveness across diverse attack types. Within a programmable SDN architecture, the proposed FedTDDoS framework is designed to support fine-grained, real-time mitigation while preserving data privacy and ensuring scalability. These findings establish FedT-DDoS as a robust and practical solution for securing modern SDIoT healthcare infrastructures.

The integration of edge computing with LEO satellite broadband networks (LSBNs) offers a transformative potential, yet remains underexplored in the optimization of joint computation offloading and resource allocation (JCORA). This problem is compounded by the issues of load imbalance and hybrid action spaces. To tackle them, we firstly propose a multi-level edge computing architecture that leverages the inter-satellite links to enable collaborative offloading among neighboring satellites, thereby enhancing global resource utilization and load balance in LSBNs. Moreover, existing studies demonstrate the benefits of deep reinforcement learning (DRL) for JCORA optimization but struggle with the complexities of hybrid action spaces. To address this, we elaborate a novel hierarchical multi-agent DRL (HMADRL) framework that decomposes the JCORA problem into two-layered subproblems, namely global computation offloading and local resource allocation. This decomposition effectively mitigates the challenge posed by hybrid action spaces. The computation offloading subproblem is formulated as a delayed-reward partially observable Markov decision process, optimized by using multi-agent deep Q-networks specialized in discrete action outputs. Meanwhile, the resource allocation subproblem is addressed through the deep deterministic policy gradient model, adept at handling continuous actions. Extensive experiments validate our approach, demonstrating improvements in delay reduction, outrage rate, and load balancing compared to baselines.

Nonterrestrial networks (NTNs) enabled Internet of Things (IoT) extends connectivity to remote and underserved areas, enhances network reliability and coverage, and supports diverse IoT applications in challenging environments, such as rural, maritime, and disaster-stricken regions. As an emerging and fast-evolving IoT scheme, NTN-enabled IoT requires extensive evaluation to ensure effective deployment in real-world scenarios, such as connectivity, performance, and security evaluation. Since conducting testing in remote and diverse environments is logistically challenging and costly, we propose a generative artificial intelligence (GAI)-based synthetic traffic generation framework that facilitates comprehensive traffic analysis and performance evaluation. The proposed framework employs a GAI model to learn the traffic pattern and generate synthetic traffic from historical data. Our approach includes an embedding-based model for representing network flow attributes and a conditional generative adversarial network (CGAN) for generating traffic flows. Considering both source-destination information and statistical features achieves more comprehensive characterization of traffic flows. Finally, the simulation results demonstrate that the proposed approach can generate high quality traffic that conforms to real data distribution and shows obvious difference between multiple applications.

Artificial Intelligence (AI) and Large Language Models (LLMs), are increasingly finding application in network-related tasks, such as network configuration synthesis [22] and dialogue-based interfaces to network measurements [23], among others. In this preliminary work, we restrict our focus to the application of AI agents to network troubleshooting and elaborate on the need for a standardized, reproducible, and open benchmarking platform, where to build and evaluate AI agents with low operational effort. This platform primarily aims at standardize and democratize the experimentation with AI agents, by enabling researchers and practitioners - including non-domain experts such as ML/AI engineers- to evaluate AI agents on curated problem sets, without concerns for underlying operational complexities. We present a modular and extensible benchmarking framework that supports widely adopted network emulators [3, 18, 20, 21]. It targets an extensible set of network issues in diverse real-world scenarios - e.g., data centers, access, WAN, etc. - and orchestrates the end-to-end evaluation workflows, including failure injection, telemetry instrumentation and collection, and agent performance evaluation. Agents can be easily connected through a single Application Programming Interface (API) to an emulation platform and rapidly evaluated. The code is publicly available at https://github.com/zhihao1998/LLM4NetLab.

This paper introduces a novel approach for detecting Distributed Denial of Service (DDoS) attacks in Software-Defined Networking (SDN) environments, addressing the critical need for accurate and efficient threat detection in modern network infrastructures. The proposed method integrates dimensionality reduction, feature engineering, and machine learning (ML) into a cohesive pipeline. Specifically, it combines Principal Component Analysis (PCA) and t-Distributed Stochastic Neighbor Embedding (t-SNE) for dimensionality reduction, followed by K-Means clustering to enhance feature representation. Cluster assignments (Benign/Attack) derived from the t-SNE-reduced data are incorporated as a new feature, enabling classifiers to detect latent attack patterns more effectively than traditional methods. When evaluated on a real-world SDN dataset, the method significantly outperformed existing approaches, achieving over 99.9% accuracy with Random Forest (RF) and XGBoost classifiers. Notably, XGBoost processed data in just 0.2 seconds, demonstrating exceptional suitability for real-time applications. Furthermore, the ensemble model, combining RF and XGBoost, achieved the highest overall accuracy of 99.93%, an AUC of 1.00, and an execution time of 1.61 seconds. These results underscore the proposed approach's substantial improvements in accuracy and computational efficiency making it a robust solution for addressing critical network security challenges in SDN environments.

Federated learning (FL) in Industrial IoT (IIoT) facilitates collaborative model training across distributed edge devices, ensuring data privacy and localized insights without centralized data aggregation. However, the networked parameter sharing mechanism in FL renders it vulnerable to exploitation by man-in-the-middle (MITM) attackers, potentially disrupting the model training process. To mitigate this threat, this article presents a novel blockchain-reinforced FL architecture aimed at enabling cooperative intrusion detection. Initially, FL is leveraged to aggregate all learned information from edge servers, thereby disseminating extracted attack characteristics to all participants through gradient sharing. Subsequently, a blockchain-based parameter verification scheme is introduced to safeguard against tampered local parameters affecting the global model. Clients record model parameters in smart contracts deployed on a private chain, and parameter servers verify parameter confidentiality before aggregation, ensuring only valid parameters are considered. Finally, extensive experiments are conducted using an edge IIoT cybersecurity data set comprising 61 features spanning ten protocol layers and five attacks targeting IIoT connectivity protocols. Simulation results demonstrate that the proposed scheme significantly enhances intrusion detection accuracy, achieving a threefold improvement when two-thirds of federated nodes are subjected to MITM attacks.

Energy efficiency plays an important role in intelligent networking for 5G networks, which concerns environmental, financial, and performance aspects of intelligent networking for 5G networks. To this end, network designers propose energy-efficient approaches to reduce energy consumption of networks and to raise network performance by switching off the links/nodes with low loads or at idle status. The existing energy-efficient approaches can be formulated as a max-min optimal problem, namely maximizing network/node/port throughput via minimum energy consumption. The max-min planning investigates energy efficiency only from the links/nodes perspective. The max-min planning for energy-efficient networking, if not carefully designed from the network-wide standpoint, can lead to lower energy efficiency for the whole network due to lack of global planning, which in turn results in the degraded performance due to network un-connectivity after closing the nodes/links. In this paper we rethink the max-min planning framework on energy-efficient software-defined networking for intelligent networking of 5G networks, which takes in account combining network connectivity and maximum network flow with minimum energy consumption. Our framework aims at how to deliver dynamic end-to-end traffic demands with the appropriate network topology by building data forwarding plane with maximum network flow and control plane with network connectivity. We discuss the associated challenges and implementation issues. A dynamic max-min planning framework depending on dynamic end-to-end traffic demands is presented to achieve network-wide energy efficiency. Numerical results show the improved energy efficiency performance for the whole network.

The rapid expansion of interconnected infrastructures has dramatically increased the volume of network devices and traffic, introducing significant security vulnerabilities in Software-Defined Networking (SDN) environments. Distributed Denial-of-Service (DDoS) attacks exploit the centralized control plane characteristic of SDN, underscoring the need for adaptive, efficient detection mechanisms. In response, we present a novel hybrid framework that leverages Principal Component Analysis (PCA) for dimensionality reduction and a supervised Deep Convolutional Neural Network (DCNN) for high-precision classification of normal and malicious events. Rigorous evaluation on a real-world SDN dataset, comprising both categorical and numerical features, demonstrates that the proposed model achieves an exceptional detection accuracy of 99.97% and a swift detection time of only 3 seconds-making it well-suited for real-time applications in SDN. These results affirm the efficacy of our model in enhancing both security and scalability, contributing a robust solution for mitigating DDoS threats in dynamic SDN environments.

The Digital Twin Network creates a real-time virtual reflection of the physical network, providing a valuable experimentation and verification platform. To achieve high-fidelity reconstruction of the physical network, adopting a comprehensive, efficient, and high-precision data collection method is necessary. This paper presents a network-wide data collection scheme based on In-band Network Telemetry (INT). However, covering the entire network with a single probing path can result in unnecessarily lengthy paths, while using paths with too large deviation reduces collecting efficiency. Based on graph Community Detection (CD), we propose Graph Partition-based INT (GP-INT) to address these issues to create balanced sub-graphs of network topology. To avoid packet fragmentation due to excessively long paths, a path planning algorithm based on Deep Limited Search (DLS) is further introduced to generate probing paths in separated subgraphs. The proposed scheme is then implemented in P4-defined switches. Simulation results indicate the scheme produces a more balanced and less redundant set of multiple probing paths for network-wide data collection across various network structures.

Developing non-terrestrial networks (NTN) in future wireless networks has been widely recognized to bring advanced communication services to remote and unserved areas. The Low-Earth-Orbit (LEO) constellation has emerged as a promising component for NTN to provide seamless and fast global connectivity. However, since natural dynamic features, the mobility management, in particular the handover (HO) between satellites, plays an important role in ensuring a stable and continuous data service for NTN. Motivated by this fact, this paper proposes a HO optimization strategy based on conditional handover (CHO) mechanism to enhance service continuity in LEO-based NTN. A reward function, related to link service time and service capability, is firstly designed to modify the monitoring conditions of target satellite candidates. The optimal target selection algorithm is proposed to obtain the maximum reward for each CHO. Then, a service continuity performance graph (SCG) model is constructed to predict different potential CHO combinations in service duration. On the basis of SCG, the HO sequence supporting a high-quality and stable data service is predictively calculated for each accessing user. Simulation results demonstrate that the proposed HO optimization scheme can obviously reduce handover rate under different NTN conditions and can better enhance NTN service continuity.

Low-Earth-Orbit (LEO) satellite networks (LSN) are envisioned as complement and enhancement of terrestrial networks. The LEO constellation enables low-latency and high-speed data transmission for global users, especially in remote areas. However, due to the nature of mobility, LSN networking pattern must be pre-configured. Compared with a fixed mode, dynamic networking for LSN will bring more benefits, but simultaneously confront more challenges. The two main issues in dynamic LSN networking are how to increase network transmission capacities (NTC) and how to maintain an excellent NTC performance during service duration. Motivated by these two issues, we firstly build a time-varying connected graph to formulate the changes of LSN features over time. Then a Support-Vector-Machine (SVM) based LSN networking scheme is proposed to improve the NTC performance. Each link type is predicted by SVM model at each time slot to prioritize transmission for the type matching tasks. Next, a network performance graph (NPG) is constructed to show potential NTC performances with different time slot divisions. The dynamic programming is utilized to find the time slot sequence with optimal LSN service continuity. Simulation results show that the proposed SVM-based transmission contact planning with dynamic programming (NSDP) scheme can achieve superior NTC performance and service continuity, compared with existing LSN networking schemes.

The satellite-terrestrial networks (STNs) enable global data delivery with low latency and high transmission rate utilizing the Low-Earth-Orbit (LEO) satellite constellation, especially for users in remote regions. However, the dynamic nature of STN presents two challenges to the quality of experience (QoE): 1) the dynamic topology in different time slots; 2) the dynamic path planning for each user. These raise unique problems for the optimization of data delivery paths in STN with service continuity guarantee. In this article, we first model the STN by a time-varying graph to describe the data delivery in a certain service duration. An indicator called user satisfaction is constructed to measure delivery performance. Aiming at maximizing total user satisfaction, we reformulate the STN path planning problem by utilizing the spatial-temporal decomposition. Considering the path planning in each time slot, we modify the heuristic algorithm to optimize the allocation of transmission resources for different users. In the temporal dimension, we show that the path allocation results in previous time slots directly affect subsequent path calculation then propose an active time slot division algorithm to improve the STN service continuity. Excellent STN transmission performance is matched to the best fit time slot duration to obtain efficient and continuous data delivery. Experimental results show that the proposed STN data delivery optimization scheme achieves superior transmission performance with better service continuity.