The emergence of Satellite-Terrestrial Integrated Networks (STIN) has significantly expanded terrestrial network coverage but introduced new security threats. Current Intrusion Detection Systems (IDSs) for STIN mostly consider the distributed nature of satellites, overlooking the computational limits of single satellites and the effect of satellite mobility on IDS generalization, where accuracy and adaptability may drop in dynamic environments. To address this, we propose an unsupervised IDS for STIN based on Federated Learning (FL) named STIN-IDS. We deploy IDS in a cross-layer distributed manner, distributing data processing tasks across multiple Low Earth Orbit (LEO) satellites, while Geostationary Earth Orbit (GEO) satellites act as FL clients responsible for anomaly detection, thereby alleviating the computational load on single satellites. Furthermore, to address changes in user regions and traffic patterns due to satellite mobility, FL clients use dynamic data from different LEO regions for collaborative training, improving adaptability to dynamic environments. Experiments across four datasets with varying network conditions show that STIN-IDS achieves strong generalization and outperforms similar methods.

Recently, Deep Learning (DL) models have been increasingly deployed on end-user devices as On-Device AI, offering improved efficiency and privacy. However, this deployment trend poses more serious Intellectual Property (IP) risks, as models are distributed on numerous local devices, making them vulnerable to theft and redistribution. Most existing ownership protection solutions (e.g., backdoor-based watermarking) are designed for cloud-based AI-as-a-Service (AIaaS) and are not directly applicable to large-scale distribution scenarios, where each user-specific model instance must carry a unique watermark. These methods typically embed a fixed watermark, and modifying the embedded watermark requires retraining the model. To address these challenges, we propose Hot-Swap MarkBoard, an efficient watermarking method. It encodes user-specific n-bit binary signatures by independently embedding multiple watermarks into a multi-branch Low-Rank Adaptation (LoRA) module, enabling efficient watermark customization without retraining through branch swapping. A parameter obfuscation mechanism further entangles the watermark weights with those of the base model, preventing removal without degrading model performance. The method supports black-box verification and is compatible with various model architectures and DL tasks, including classification, image generation, and text generation. Extensive experiments across three types of tasks and six backbone models demonstrate our method's superior efficiency and adaptability compared to existing approaches, achieving 100% verification accuracy.

Supervised quantum learning methods face notable limitations in dynamic, real-world environments due to their reliance on static labels and limited adaptability. To address these challenges, we propose a novel online learning framework — Quantum Contextual Bandit (QCB) — that integrates quantum neural networks (QNNs) with contextual bandit (CB) algorithms. The QCB framework enables adaptive decision-making by incorporating bandit-based exploration into QNN training, making it particularly suitable for applications such as recommender systems. To mitigate the adverse effects of quantum noise—including depolarizing, Pauli, and shot noise, the framework leverages a gradient-free optimization approach, enhancing robustness and convergence stability. Experimental results on various datasets demonstrate that QCB consistently outperforms traditional QNN training methods with identical circuit architectures. Notably, the model achieves over 99% accuracy under ideal conditions and sustains high performance under noisy quantum environments. These results underscore the potential of QCB as a scalable, noise-resilient solution for adaptive learning in quantum machine learning systems.

The signaling collected in mobile communication networks can intuitively display the operational status of the system, which can use to locate faults. This paper proposes a novel signaling-based end-to-end fine-grained troubleshooting (simFGT) method for 6G NTN networks. First, the signaling collected from the core network is analyzed to extract multidimensional KPIs and attribute information. Second, a root cause localization algorithm is employed for fine-grained fault localization. Third, a lightweight data-driven ensemble learning method is adopted, with the abnormal KPI of the localized root cause node as inputs, and precise fault classification is achieved through data-driven weight optimization. Experiments results show that the proposed lightweight SimFGT method achieves best balance between precision and recall, resulting in highest F1 score, outperforming current state-of-the-art solutions.

The ever-increasing complexity and scale of 5G communication networks pose huge challenges to network operations. Root cause analysis is considered as a promising method for fault detection. However, it still suffers challenges of severely uneven distribution of fault data, low accuracy in root cause detection, and long time consumption due to a large search space in 5G cellular networks. To address the above challenges, we introduce SimRCA to effectively analyze the faults’ root causes in 5G networks using signalling messages. By designing a novel confidence threshold value and pruning technique, SimRCA can significantly reduce the search space of signalling messages while maintaining the accuracy of root cause analysis. Moreover, SimRCA is proven to be able to handle unbalanced data distribution in 5G networks. We collected over 10GB of signalling data from Huawei 5G commercial network and conducted extensive experiments on this dataset. Experimental results demonstrate that SimRCA can complete root cause localization and fault classification within 11 seconds with an average F1-score over 0.93 which outperforms the current state-of-the-art solutions.

The increasing complexity and openness of 5G networks naturally enlarge the attack surface and introduce new vulnerabilities, thereby posing challenges to the performance of existing intrusion detection systems (IDSs). Current IDSs solely rely on statistical features, which may suffer from low accuracy due to the complex traffic patterns in 5G networks. Additionally, recent IDSs apply contrastive learning to improve detection capabilities, but the reliance on costly manual labeling hinders the adaptability to complex attacks in 5G networks.In this paper, we present Manticore, an unsupervised intrusion detection system based on contrastive learning for 5G networks. Specifically, Manticore leverages both statistical features and original features of packets to capture the holistic information of traffic in 5G networks. Moreover, it automatically establishes positive and negative pairs without manual labeling. We further explore the combination patterns between reconstruction loss and contrastive loss to attain a more precise model. Our experimental evaluation of two datasets demonstrates the proposed Manticore outperforms the relevant state-of-the-art methods.

Recently, Self-Supervised Learning (SSL) has achieved great success in various famous applications e.g., BERT and ChatGPT. However, when applying SSL to safety-critical downstream tasks, such as self-driving cars, potential adversarial attacks can completely change the final decisions and thus lead to serious security issues. To overcome this issue, existing methods combine adversarial training with pre-training to improve the adversarial robustness of SSL. However, combining these two computationally complex processes may largely amplify the computation cost. Moreover, whether performing adversarial training in pre-training or fine-tuning, current methods may degrade the accuracy due to the famous catastrophic forgetting problem. The computation cost of current adversarial training methods based on full parameter updating is still high even in the fine-tuning stage.To address the above challenges, we propose an effective robust fine-tuning framework for SSL based on Low-Rank Adaptation (LoRA), named LoFT. First, LoFT performs adversarial training in the fine-tuning stage rather than in the pre-training stage. Second, LoFT innovatively and elaborately integrates LoRA into adversarial training to avoid the catastrophic forgetting problem. Third, LoFT exploits a low-rank matrix in LoRA which enables efficient fine-tuning by updating only a small set of parameters, which contains only 1%-5% of the parameters of the pre-trained model. The whole pre-training and fine-tuning stages take only 9.44 hours, which reduces training time by 3× over the current SOTA method. Furthermore, compared with existing SOTA robust pre-training methods for SSL, LoFT improves accuracy by 5.97% (77.41%⇒83.38%) and robustness by 13% (45.04%⇒58.44%) on the CIFAR-10 dataset.

With the advancements in Machine Learning (ML) and edge computing, increasing efforts have been devoted toedge video analytics. However, most of the existing works fail to consider the cooperation of edge nodes for ML model caching and video frame scheduling, thus less efficient in practical scenarios with diverse requirements. In this article, we propose a novel approach named ESMO (joint framEScheduling andMOdel caching) to jointly optimize Frame Scheduling and Model Caching (FSMC), aiming at enhancing the performance of edge video analytics. In detail, we decompose the FSMC as three sub-problems, where the first two sub-problems (i.e., user's transmit power and edge computing resources allocation problems) are proven to be quasi-convex and strictly convex, respectively; while the third main sub-problem (i.e., trade-off among the video analytics (VA) accuracy, service delay and energy consumption) is NP-hard. Therefore, an efficient Two-layers Genetic Algorithm based algorithm (i.e., TGA-FSMC) is designed to find the close-to-optimal frame scheduling and the model caching decisions in an iterative manner. Finally, we deploy a target recognition prototype to comprehensively evaluate the practical performance in diverse edge nodes and CNN models. Extensive experiments demonstrate the empirical superiority of the ESMO over alternatives on real-world edge video analytics platforms, and it achieves 37.5%$\sim$87.2% performance improvement.

One key challenge to maintain a large-scale Content Delivery Network (CDN) is to minimize the service downtime when severe system problems happen (e.g., hardware failures). In this case, a critical step is to quickly and accurately identify the range of users with performance degradation, termed impact identification. Successful impact identification not only helps identify impacted users but also provides meaningful information for troubleshooting. However, current practice of impact identification usually takes network engineers several hours to manually identify impacted users, which may lead to a huge business loss. The main challenges for automatic impact identification in large CDNs include the inaccuracy of underlying anomaly detection, huge search space of impact identification and severe long-tail distribution of user traffic. In this paper we propose iSwift, a system that is specifically designed for impact identification in large-scale CDNs in order to address aforementioned challenges. We evaluate the performance of iSwift on semi-synthetic datasets and the results show that iSwift can achieve a F1-score greater than 0.85 within ten seconds, which significantly outperforms state-of-the-art solutions. Furthermore, iSwift has been deployed in a production CDN around one year as a pilot project and demonstrated its online performance confirmed by the network operators.

In remote regions (e.g., mountain and desert), cellular networks are usually sparsely deployed or unavailable. With the appearance of new applications (e.g., industrial automation and environment monitoring) in remote regions, resource-constrained terminals become unable to meet the latency requirements. Meanwhile, offloading tasks to urban terrestrial cloud (TC) via satellite link will lead to high delay. To tackle above issues, Satellite Edge Computing architecture is proposed, i.e., users can offload computing tasks to visible satellites for executing. However, existing works are usually limited to offload tasks in pure satellite networks, and make offloading decisions based on the predefined models of users. Besides, the runtime consumption of existing algorithms is rather high. In this paper, we study the task offloading problem in satellite-terrestrial edge computing networks, where tasks can be executed by satellite or urban TC. The proposed Deep Reinforcement learning-based Task Offloading (DRTO) algorithm can accelerate learning process by adjusting the number of candidate locations. In addition, offloading location and bandwidth allocation only depend on the current channel states. Simulation results show that DRTO achieves near-optimal offloading cost performance with much less runtime consumption, which is more suitable for satellite-terrestrial network with fast fading channel.

Mobile edge computing (MEC) has been envisaged as one of the most promising technologies in the fifth generation (5G) mobile networks. It allows mobile devices to offload their computation‐demanding and latency‐critical tasks to the resource‐rich MEC servers. Accordingly, MEC can significantly improve the latency performance and reduce energy consumption for mobile devices. Nonetheless, privacy leakage may occur during the task offloading process. Most existing works ignored these issues or just investigated the system‐level solution for MEC. Privacy‐aware and user‐level task offloading optimization problems receive much less attention. In order to tackle these challenges, a privacy‐preserving and device‐managed task offloading scheme is proposed in this paper for MEC. This scheme can achieve near‐optimal latency and energy performance while protecting the location privacy and usage pattern privacy of users. Firstly, we formulate the joint optimization problem of task offloading and privacy preservation as a semiparametric contextual multi‐armed bandit (MAB) problem, which has a relaxed reward model. Then, we propose a privacy‐aware online task offloading (PAOTO) algorithm based on the transformed Thompson sampling (TS) architecture, through which we can (1) receive the best possible delay and energy consumption performance, (2) achieve the goal of preserving privacy, and (3) obtain an online device‐managed task offloading policy without requiring any system‐level information. Simulation results demonstrate that the proposed scheme outperforms the existing methods in terms of minimizing the system cost and preserving the privacy of users.

Advanced Persistent Threat (APT) is a stealthy, continuous and sophisticated method of network attacks, which can cause serious privacy leakage and millions of dollars losses. In this paper, we introduce a new game-theoretic framework of the interaction between a defender who uses limited Security Resources(SRs) to harden network and an attacker who adopts a multi-stage plan to attack the network. The game model is derived from Stackelberg games called a Multi-stage Maze Network Game (M2NG) in which the characteristics of APT are fully considered. The possible plans of the attacker are compactly represented using attack graphs(AGs), but the compact representation of the attacker’s strategies presents a computational challenge and reaching the Nash Equilibrium(NE) is NP-hard. We present a method that first translates AGs into Markov Decision Process(MDP) and then achieves the optimal SRs allocation using the policy hill-climbing(PHC) algorithm. Finally, we present an empirical evaluation of the model and analyze the scalability and sensitivity of the algorithm. Simulation results exhibit that our proposed reinforcement learning-based SRs allocation is feasible and efficient.

With the rapid growth of multimedia content in the social content-centric network (SocialCCN), in-network caching and caching strategy are becoming more and more important for efficient content delivery, but it also brings huge challenges to the cache space and computing capabilities in the network. In order to increase cache space and improve the computing capability in SocialCCN, in this paper, we integrate Mobile edge computing with SocialCCN (MeSoCCN) and design a novel caching strategy in MeSoCCN. Firstly, we proposed MeSoCCN, a novel architecture that integrates Mobile Edge Computing (MEC) in SocialCCN. Then, in MeSoCCN, a caching strategy based on popularity prediction is designed, which can increase the cache hit rate and reduce hop redundancy. We predict content popularity in the future and make cache placement and replacement decisions based on the prediction results. Finally, we conducted experiments and verified the effectiveness of the proposed caching strategy in MeSoCCN.

Content-Centric Networking (CCN) is one of the most important next-generation Internet architectures. The in-network caching mechanism in CCN can bring higher efficiency and lower traffic to the network in terms of content distribution, but it also poses a great privacy risks. In this paper, we propose a privacy-preserving scheme based on fragments storage and fragments recombination (FS&FR) to solve the user's privacy leakage problem caused by timing attack in CCN. Firstly, the content in the network can be divided into different privacy levels according to the content provider, content consumer and router. Secondly, the optimal number of content fragments can be obtained by binary linear regression model based on content popularity, node betweenness and content privacy levels. Finally, the FS&FR algorithm is proposed and applied to the private content for content distribution and achieving fine-grained privacy protection. The simulation results show that the proposed scheme is secure yet highly efficient again timing attack compared to random-K delay algorithm. More specifically, the FS&FR algorithm can make the round-trip delays obtained by the attacker requesting the same content change, and then protect users' behavior privacy without sacrificing distribution performance.