Multivariate time series forecasting is critical for decision-making, and real-world stochasticity makes probabilistic forecasting a robust alternative to deterministic predictions. However, prevailing methods suffer from a trilemma: poor scalability on large networks, neglected cross-series correlations, and slow inference. Recently, LLMs have become a promising solution, as their long-range dependency modeling tackles scalability and parallel processing captures cross-series correlations. Building on this potential, we propose STLLM, a novel framework for probabilistic forecasting that leverages LLMs as feature enhancers instead of direct predictors. STLLM devises a parallel spatio-temporal encoder to disentangle inter-series spatial dependencies and intra-series temporal dynamics, whose representations are aligned with the LLM’s semantic space via a spatio-temporal reprogramming mechanism for context-aware feature enhancement. Probabilistic forecasts are then generated through a quantile-based decoder. Experiments on real-world datasets demonstrate that STLLM has established a new state-of-the-art, outperforming baselines with average improvements of 2.46% in the probabilistic metric and 3.65% in the deterministic metric. Our code is available at https://github.com/xuyifeiiie/STLLM.

Multivariate time series (MTS) forecasting is a critical task, yet existing models often struggle to capture the complex, hierarchical nature of real-world data. Many existing methods operate at a single temporal resolution, failing to model cross-level dependencies, and face a trade-off between capturing long-range patterns and maintaining computational efficiency. To address these limitations, we propose FSTDiff (Fourier Spatio-Temporal Diffusion Model), a probabilistic forecasting framework that excels in multi-scale and global dependency modeling. The core of our approach is a novel noise network, the Multi-scale Fourier Network, which synergistically combines a U-Net architecture with the Fourier Neural Operator. The U-Net provides a hierarchical framework to capture temporal patterns at multiple scales, while FNO serves as the efficient backbone for modeling global correlations within each scale. This noise network is guided by a powerful encoder that utilizes automatic series decomposition to provide a clean, high-quality historical context. Extensive experiments on seven public datasets demonstrate that FSTDiff establishes a new state-of-the-art in probabilistic forecasting, achieving an average CRPS improvement of 6.4%. We provide our source code at https://github.com/xuyifeiiie/FSTDiff to facilitate reproducibility. Index Terms—Multivariate times series forecasting, Spatiotemporal data, Probabilistic forecasting, Conditional diffusion model

Accurate crowd counting is critical for numerous real-world applications. However, domain shift poses a significant barrier to deploying crowd counting models in practical scenarios due to the discrepancy between training and target domains. This paper proposes SinCount, a novel crowd counting framework designed for the Single-source Domain Generalization (SDG) setting, capable of generalizing to unseen domains. SinCount introduces a task-frequency alignment mechanism, directing high-frequency cues toward fine-grained density regression while allocating low-frequency cues to region-level classification to mitigate domain shift. Specifically, we develop a frequency-specific feature extraction module to extract high-frequency and low-frequency features. Subsequently, a dual-attention strategy is devised to embed high-frequency features via spatial attention for the regression branch, while modulating low-frequency features via channel attention for the classification branch. Moreover, an instance normalization mask and an attention consistency loss are incorporated to suppress domain-specific noise and stabilize feature learning. Evaluations across multiple benchmark datasets demonstrate that our method achieves competitive performance compared to state-of-the-art SDG approaches. The code is publicly available at https://github.com/Twiwq/SinCount.

Microservice systems generate fragmented and misaligned multi-modal data, including metrics, logs, and traces, posing a major challenge for AIOps, which requires coherent system-state representations for downstream analytics. Existing approaches typically model spatio-temporal relations at a coarse granularity or are tailored to specific tasks, limiting their generalizability across different O&M scenarios. To address these limitations, we propose M3RL, a unified pre-training and fine-tuning framework for learning robust and transferable system-state representations. At its core, the spatio-temporal network (STNet) performs fine-grained semantic fusion of multi-modal data along both temporal and spatial dimensions and models evolving communication-driven dependencies among services. We further pre-train STNet with three complementary objectives: denoising reconstruction for robustness, future prediction for temporal evolution modeling, and causal contrastive learning for node-level discriminability. Extensive experiments on two public benchmark datasets demonstrate that M3RL consistently outperforms recent state-of-the-art baselines across key downstream tasks, reducing state prediction MAE by 1.9%, increasing anomaly detection F1 by 4.7%, and improving root cause localization HR@1 by 4.8% on average. These results show that M3RL provides a robust and transferable representation backbone for multiple AIOps tasks.

In the AIOps realm, precise system state forecasting is essential, particularly within microservices architectures, where may have dynamic deployments, varied call paths, and cascading effects complicate spatio-temporal relationships. Existing time series forecasting methods, which emphasize temporal patterns, fall short in capturing the critical spatial dimensions. Spatio-temporal graph methods, while useful, often overlook temporal trends and the length of forecast horizons. Furthermore, existing research about microservices tends to undervalue the role of network metrics and topological structures in reflecting system dynamics. This paper presents STMformer, a novel model designed for microservices state forecasting, adept at managing multi-node and multivariate time series based on diverse spatio-temporal relationships. It harnesses dynamic network connections and topological insights to model complex spatio-temporal interactions and incorporates a PatchCrossAttention module for global cascading effect analysis. Based on a microservices-based dataset we collect with our developed tool, we demonstrated that STMformer outperformed existing methods, reducing MAE by 8.6% and MSE by 2.2% in forecasting tasks. The source code is available at https://github.com/xuyifeiiie/STMformer.

Automating penetration testing is crucial for enhancing cybersecurity, yet current Large Language Models (LLMs) face significant limitations in this domain, including poor error handling, inefficient reasoning, and an inability to perform complex end-to-end tasks autonomously. To address these challenges, we introduce Pentest-R1, a novel framework designed to optimize LLM reasoning capabilities for this task through a two-stage reinforcement learning pipeline. We first construct a dataset of over 500 real-world, multi-step walkthroughs, which Pentest-R1 leverages for offline reinforcement learning (RL) to instill foundational attack logic. Subsequently, the LLM is fine-tuned via online RL in an interactive Capture The Flag (CTF) environment, where it learns directly from environmental feedback to develop robust error self-correction and adaptive strategies. Our extensive experiments on the Cybench and AutoPenBench benchmarks demonstrate the framework's effectiveness. On AutoPenBench, Pentest-R1 achieves a 24.2% success rate, surpassing most state-of-the-art models and ranking second only to Gemini 2.5 Flash. On Cybench, it attains a 15.0% success rate in unguided tasks, establishing a new state-of-the-art for open-source LLMs and matching the performance of top proprietary models. Ablation studies confirm that the synergy of both training stages is critical to its success.

Currently, time series prediction in microservice systems suffers from inaccurate forecasts due to the complex interdependencies and highly dynamic workload characteristics. Traditional small-scale models struggle to understand the temporal patterns embedded within multi-dimensional metrics, leading to suboptimal performance. The advent of large language models (LLMs) offers a promising solution, as their powerful representation learning capabilities can effectively capture these complex temporal patterns. In this study, we propose a novel approach tailored for multi-dimensional time series forecasting in microservice environments. Our method leverages specialized embedding techniques that combine dynamic receptive field convolution and adaptive attention masks to capture temporal dependencies and feature relationships across multiple nodes. Additionally, we fine-tune a pre-trained LLaMA model to enhance its applicability for time series forecasting within microservice contexts. Experimental results demonstrate that our approach achieves higher prediction accuracy compared to baseline methods in different datasets. This research's achievements in time series forecasting provide new insights for downstream tasks such as resource allocation and fault prediction.

Accurate traffic forecasting in base station networks is crucial for efficient network management, resource allocation, and ensuring quality of service. This paper introduces BetaStack, a novel network-specific Large Language Model (LLM) designed to enhance base station traffic prediction. Unlike existing approaches, BetaStack incorporates physical constraints and a specialized network protocol embedding layer that captures the hierarchical structure of network traffic data. Through fine-tuning with these network-specific adaptations and a self-regressive prediction mechanism, BetaStack effectively leverages the powerful sequence modeling capabilities of LLMs to address the intricacies of network traffic. Extensive experiments on realworld data from base station cells in Guangdong, China demonstrate that BetaStack achieves significant performance improvements over both state-of-the-art time-series forecasting models and specialized network traffic prediction models. These results underscore the potential of BetaStack to improve the accuracy of network traffic prediction, enabling more efficient network management. The code can be found in https: //github.com/lqf0624/BetaStack.git.

The widespread use of encryption protocols and increasing privacy demands have significantly increased encrypted traffic, creating new challenges for network monitoring and threat detection. Current methods struggle with diverse scenarios and distinguish between subtle traffic patterns within webpages of the same application. To address these challenges, we introduce ANT-ET, an end-to-end multimodal framework designed for fine-grained encrypted webpage traffic fingerprinting. ANT-ET leverages a transformer to model payload semantics and constructs a traffic interaction graph to capture both temporal and spatial characteristics of packet interactions. Additionally, ANT-ET incorporates a gradient reversal layer to improve generalization by facilitating domain-invariant feature learning across related webpages. Experimental results demonstrate ANT-ET’s superior performance compared to various baseline models, which were evaluated using a proprietary encrypted webpage traffic dataset and three public datasets. Ablation studies confirm the effectiveness of different framework components, while sensitivity and complexity analyses further validate ANT-ET’s robustness and flexibility.

Large Language Models (LLMs) have demonstrated remarkable performance across various domains, showcasing significant potential for long-term time series forecasting (LTSF), and consequently attracting substantial research interest. In LTSF, temporal decomposition has been widely adopted in existing models, including both Transformer-based and linear models, to enhance predictive capabilities. However, our experiments indicate that a simplistic integration of these decomposition methods into LLMs can lead to overfitting, even though they are effective in traditional models. In this paper, we propose PaSTS, a novel framework designed to integrate decomposition methods into LLMs through a specialized temporal synthesis layer, thereby improving predictive accuracy and mitigating overfitting of LLMs in LTSF tasks. Empirical evaluation of our framework provides evidence supporting the effective integration of LLMs with temporal decomposition techniques. Furthermore, applying our synthesis method to the decomposed series in several traditional models that employ seasonal-trend decomposition demonstrates its adaptability.

Penetration testing is a vital practice for identifying and mitigating vulnerabilities in cybersecurity systems, but its manual execution is labor-intensive and time-consuming. Existing large language model (LLM)-assisted or automated penetration testing approaches often suffer from inefficiencies, such as a lack of contextual understanding and excessive, unstructured data generation. This paper presents VulnBot, an automated penetration testing framework that leverages LLMs to simulate the collaborative workflow of human penetration testing teams through a multi-agent system. To address the inefficiencies and reliance on manual intervention in traditional penetration testing methods, VulnBot decomposes complex tasks into three specialized phases: reconnaissance, scanning, and exploitation. These phases are guided by a penetration task graph (PTG) to ensure logical task execution. Key design features include role specialization, penetration path planning, inter-agent communication, and generative penetration behavior. Experimental results demonstrate that VulnBot outperforms baseline models such as GPT-4 and Llama3 in automated penetration testing tasks, particularly showcasing its potential in fully autonomous testing on real-world machines.

Microservice architecture is gradually replacing traditional monolithic applications, but its modular design introduces new security challenges in service interactions. To ensure the security of the entire microservices system, it is crucial to implement strict network policies that prevent a compromised service from maliciously exploiting or affecting other properly functioning microservices. However, the dynamic and large-scale nature of microservices makes traditional manual policy configuration impractical. This paper presents a network policy generation method based on service topology. Our approach comprises two fundamental techniques: (1) a real-time service topology generation method that leverages configuration files and network plugins to dynamically capture service interactions, and (2) an automatic network policy generation method based on the derived service topology. The effectiveness of the proposed method is validated through experiments on three popular microservice applications. The results demonstrate that our method can generate fine-grained and efficient network policies, reducing the time overhead by an average of 38

Video streams continue to dominate network traffic. Regulating video traffic is crucial because some videos may contain malicious content that harms society. The key foundation of regulation is identifying encrypted video traffic, primarily based on fingerprinting techniques. However, QUIC is becoming a mainstream video transport protocol similar to TCP, and its end-to-end encryption renders traditional packet-based fingerprint extraction methods ineffective. Besides, unstable network environments can lead to video data loss or retransmissions, disrupting fingerprint continuity and, thus, the effectiveness of identification. Furthermore, with ongoing booming video numbers, deep learning-based algorithms display poor real-time identification capability because they require extensive training resources and time to learn new video patterns every time. To address these challenges, we propose a two-stage encrypted video traffic identification method, TSIV. We designed a fingerprint extraction method for QUIC encrypted traffic relying on the flow feature. Additionally, we developed Hit Model based on Term Frequency-Inverse Document Frequency (TF-IDF) and Corrective Dynamic Time Wrapping (C-DTW) to perform the two-stage fingerprint matching, considering both the distribution and temporal sequence characteristics of video data, to handle potential issues caused by fingerprint discontinuity. The experimental results demonstrate that TSIV significantly improves accuracy and speed under ideal and poor conditions, outperforming existing methods.

In the domain of cloud computing and distributed systems, microservices architecture has become preeminent due to its scalability and flexibility. However, the distributed nature of microservices systems introduces significant challenges in maintaining operational reliability, especially in fault localization. Traditional methods for fault localization are insufficient due to time-intensive and prone to error. Addressing this gap, we present SpanGraph, a novel framework employing graph convolutional networks (GCN) to achieve efficient span-level fault localization. SpanGraph constructs a directed graph from system traces to capture invocation relationships and execution times. It then utilizes GCN for edge representation learning to detect anomalies. Experimental results demonstrate that SpanGraph outperforms all baseline approaches on both the Sockshop and TrainTicket datasets. We also conduct incremental experiments on SpanGraph using unseen traces to validate its generalizability and scalability. Furthermore, we perform an ablation study, sensitivity analysis, and complexity analysis for SpanGraph to further verify its robustness, effectiveness, and flexibility. Finally, we validate SpanGraph’s effectiveness in anomaly detection and fault location using real-world datasets.

The fast development of artificial intelligence and Internet of Things (IoT) technologies has enabled various applications of smart cities, e.g., smart monitoring and surveillance. However, vulnerabilities of IoT devices bring new threats to the security of smart cities. To identify ubiquitous IoT botnet attacks, a distributed and collaborative lightweight edge federated learning model for IoT zombie devices detection is proposed, named FIOT. To reduce computational complexity and enhance the adaptability to new attack environment at the network edge, FIOT is designed in a lightweight manner based on feature dimensionality reduction and transfer learning. Three IoT botnet datasets are used to validate the effectiveness of the proposed FIOT. Experimental results show that FIOT has an accuracy loss of less than 3% in terms of F1 value compared to the centralized learning, but the training time of FIOT is only 14.3% of that of centralized learning. While ensuring high detection accuracy, the number of parameters of FIOT is compressed to 37.58% of the comparison method.

Microservice has become the mainstream paradigm for developing cloud-native applications, but the intricate interdependencies between microservices and the vast amount of heterogeneous observable data (i.e. metrics, logs and traces) pose challenges for rapid troubleshooting. Several anomaly detection and root cause localization approaches that integrate multi-source data have been proposed. However, they are plagued with issues such as scarcity of high-quality data and insufficient model generalization. This is particularly evident when domain-specific models are trained from scratch for specific tasks. Recently, Large Language Models (LLMs) have shown outstanding capabilities in time series analysis, due to multi-source data generated by distributed microservices exhibit intrinsic spatio-temporal characteristics. In view of this, we propose LLM4MST, an LLM-empowered microservice troubleshooting model. We first unify and represent multi-source data by extracting service invocation graphs, and model dependencies between microservices by using a message-passing based graph neural network to generate graph-level sequences. The graph-level representation is then aligned with the LLM, and the LLM is fine-tuned to capture complex spatio-temporal patterns, generating a global vector that represents the state of microservice system within a timeslot. LLM4MST achieves accurate anomaly detection and root cause localization by jointly training the end-to-end model. Experiments on real datasets show that LLM4MST exhibits excellent performance in both full-sample and few-shot scenarios, demonstrating the powerful ability of LLMs in cross-domain knowledge transfer and few-shot learning.

In order to address the problem of log anomaly detection in scenarios with limited labeled log datasets, this paper proposes Log-MatchNet, a novel few-shot log anomaly detection method. To tackle issues such as unstructured log data, diversity, and evolution over time, we employ structured processing and log parsing to convert log content information and template ID into vectors. Feature extraction is performed using the BERT model. Additionally, by integrating multiple datasets and conducting post-training on the BERT model for domain adaptation, we obtain BERT_Post, a module with universal feature extraction capabilities in the log domain. Compared to BERTbase and CyBERT, our method demonstrates superior performance in log anomaly detection, especially in situations with limited labeled datasets. With only 2 annotated normal logs and 2 annotated abnormal logs, BERT_Post achieves a remarkable 16.14% increase in F1-score. Addressing the challenge of imbalanced data, we introduce a matching network that learns the similarity scores between input and prototype vectors, showcasing strong generalization capabilities with an average accuracy of 99.6%. In few-shot scenarios, our method, Log-MatchNet outperforms traditional methods and Proto-Siamese network in terms of F1-score. In an unstable log evolution environment, our method exhibits robustness against noisy data, achieving an F1-score of 81.2% even with 20% injected noise. Compared to LogAnMeta, our approach yields a 31.71% increase in F1-score. Experimental results demonstrate the effectiveness of Log-MatchNet in detecting anomalies in the presence of limited labeled log data and its robust performance in log evolution scenarios.

In the AIOps (Artificial Intelligence for IT Operations) era, accurately forecasting system states is crucial. In microservices systems, this task encounters the challenge of dynamic and complex spatio-temporal relationships among microservice instances, primarily due to dynamic deployments, diverse call paths, and cascading effects among instances. Current time-series forecasting methods, which focus mainly on intrinsic patterns, are insufficient in environments where spatial relationships are critical. Similarly, spatio-temporal graph approaches often neglect the nature of temporal trend, concentrating mostly on message passing between nodes. Moreover, current research in microservices domain frequently underestimates the importance of network metrics and topological structures in capturing the evolving dynamics of systems. This paper introduces STMformer, a model tailored for forecasting system states in microservices environments, capable of handling multi-node and multivariate time series. Our method leverages dynamic network connection data and topological information to assist in modeling the intricate spatio-temporal relationships within the system. Additionally, we integrate the PatchCrossAttention module to compute the impact of cascading effects globally. We have developed a dataset based on a microservices system and conducted comprehensive experiments with STMformer against leading methods. In both short-term and long-term forecasting tasks, our model consistently achieved a 8.6 Squared Error). The source code is available at https://github.com/xuyifeiiie/STMformer.

Host Intrusion Detection System (HIDS) is an important research topic in the field of cyberspace security. With the explosion in the number of malicious attacks in recent years, machine learning-based detection method is now the most common and efficient approach. While traditional centralized machine learning needs to transmit data to the central server for training, which not only requires the central server to have large computing resources, but also causes problems such as sensitive data leakage and communication overhead. As a distributed machine learning paradigm, Federated Learning (FL) can achieve multi-party collaborative training and aggregate a unified global model without data sharing, which can well alleviate these problems. It is worth noting that existing studies on the use of FL in HIDS are all conducted in the scenario where the data is independent and identically distributed (IID). However, due to the different context of hosts, the data generated by hosts is usually non-independent and identically distributed (Non-IID) in reality. Therefore, We investigate the impact of Non-IID data with different skew levels on FL in HIDS. On this basis, we propose a data augmentation FL algorithm based on Synthetic Minority Over-Sampling Technique (SMOTE) to reduce the impact of Non-IID data. We also develop a data collection module using extended Berkeley Packet Filter (eBPF) technology to collect a dataset for experiments. Experimental results show that our proposed FL algorithm can effectively improve the performance of HIDS under Non-IID data.

Existing studies for rumor detection rely heavily on a large number of labeled data to operate in a fully-supervised manner. However, manual data annotation in realistic cases is very expensive and time-consuming. In this paper, we propose a novel self-supervised Relation-Event based Contrastive Learning (RECL) framework for rumor detection to address the above issue. Specifically, we present both the relation-level and event-level augmentation strategies to generate contrastive samples, which capture both the semantics revealed by repost relations and the structural features of rumor events. Moreover, contrastive learning tasks are devised to generate informative graph representations by utilizing self-supervision signals of unlabeled data. Extensive experimental results on real-world datasets demonstrate the effectiveness of our model, especially with limited labeled data.