In image analysis scenarios such as the Internet of Things and the metaverse, the introduction of federated learning (FL) is an effective solution to safeguard user data security and meet low‐latency requirements during the machine learning process. However, due to the constrained computational power and memory of devices, facilitating the local training of complex models becomes challenging, thereby posing a significant obstacle to the application of FL. Consequently, a lightweight dynamic hierarchical neural network model and its learning paradigm are proposed in this study. Specifically, a lightweight compression method is designed based on enlarged receptive fields and separable convolutions to reduce redundancy in convolutional layer feature maps. A dynamic model partitioning method is devised, grounded in the Q‐Learning reinforcement learning algorithm, to enable collaborative model training across multiple devices and enhance the utilization efficiency of device computing and storage resources. Furthermore, a hierarchical federated partition learning (HFSL) paradigm based on complete weight sharing is introduced to facilitate the compatibility of partitioned models with FL. Experimental results show that our lightweight model outperforms existing models in terms of accuracy, lightweight degree, and efficiency on image analysis tasks. Moreover, the proposed HFSL paradigm achieves performance comparable to centralized training.

System log anomaly detection is important for ensuring stable system operation and achieving rapid fault diagnosis. System log sequences include data on the execution paths and time stamps of system tasks in addition to a large amount of semantic information, which enhances the reliability and effectiveness of anomaly detection. At the same time, considering the correlation between system log sequences can effectively improve fault diagnosis efficiency. However, the existing system log anomaly detection methods mostly consider only the sequence patterns or semantic information on the logs, so their anomaly detection results show a high rate of missed and false alarms. To solve these problems, this paper proposed an unsupervised log anomaly detection model (LogBASA) based on the system behavior analysis and global semantic awareness, aiming to decrease the leakage rate and increase the log sequence anomaly detection accuracy. First, a system log knowledge graph was constructed based on massive, unstructured, and multilevel system log data to represent log sequence patterns, which facilitates subsequent anomaly detection and localization. Then, a self‐attention encoder‐decoder transformer model was developed for log spatiotemporal association analysis. This model combines semantic mapping and spatiotemporal features of log sequences to analyze system behavior and log semantics in multiple dimensions. Furthermore, a system log anomaly detection method that combines adaptive spatial boundary delineation and sequence reconstruction objective functions was proposed. This method uses special words to characterize the log sequence states, delineates anomaly boundaries automatically, and reconstructs log sequences through unsupervised training for anomaly detection. Finally, the proposed method was verified by numerous experiments on three real datasets. The results indicate that the proposed method can achieve an accuracy rate of 99.3%, 95.1%, and 97.2% on HDFS, BGL, and Thunderbird datasets, which proves the effectiveness and superiority of the LogBASA model.

Summary The information propagation mechanism in graph‐structured networks such as social networks is the foundation of network security. The graph convolutional network (GCN) is a powerful approach for semisupervised node classification on graph‐structure data. The vertex features which pass through the graph network are affected by the k‐hop neighborhood vertices. However, current high‐order GCN approaches merged the k‐hop neighborhood using coarse pooling and complicated weight parameters. To reduce the computational complexity and preserve topological of the graph data, with weight sharing mechanism we propose a novel GCN based on a novel higher‐order pooling layer for semisupervised classification. The proposed model and its variants are experimental studied on several large‐scale citation network datasets using semisupervised learning. The experimental results show that the proposed model and its variants have lower computational complexity and achieve the state‐of‐the‐art in the node classification accuracy.

Summary The Internet of Things is becoming widely popular in the past decade, which comes with huge amount of data. These magnanimous data, stored in data centers, put forward the new demand for the efficient management of the network. In this article, we propose Software‐Defined Congestion Control Plane (SDCCP), a hybrid network control architecture that aims to fully utilize the network while avoiding congestion. SDCCP is based on Software‐Defined Networking and CCP, in which the controller collects the network statistics and specifies the behavior of the end‐to‐end hosts by sending feedback or modifying their transport layer parameters directly. It can also be used to mitigate Distributed Denial of Service attacks and other security problems. In addition, we propose FCA, a Feedback‐based Congestion Avoidance algorithm running on SDCCP, which adapts the congestion window based on the feedback from the remote controller. We evaluate SDCCP and FCA in Mininet and the result shows that FCA can achieve high network utilization while keeping the queue length of the routers in a low level. Also, FCA is robust to noncongestion loss, and outperforms other algorithms at high loss rate.

Efficient anomaly detection methods are urgently needed to prevent attacks in the application layer of the Industrial Internet of Things (IIoT). The existing intrusion detection systems have certain limitations in detecting abnormal packets exploited by the application-layer attacks. In this article, a content-agnostic-payload-based anomaly detector named the CapBad is proposed to detect malicious packets in the application layer of the IIoT system. Specifically, a phase-aware hidden semi-Markov model (pHSMM) is used to model the industrial control protocol packets and automatically learn the packets’ payload characteristics. The packet types are then inferred based on the packet likelihoods obtained by the pHSMM. In addition, the probabilistic suffix tree is employed to analyze the packets’ contextual similarity to the historical packets. The abnormal packets are finally detected by comparing their contextual similarity with that of the historical normal packets. The proposed algorithm is verified by simulations, and the results show that the CapBad has an excellent performance in detecting abnormal packets in the application layer.

With device-to-device (D2D) communication, user equipment can share data with each other without the involvement of network infrastructures. In order to maintain the Quality of Service (QoS) and Quality of Experience (QoE) for user applications in D2D communications, most existing schemes use proactive content caching that needs to predict content popularity before making caching decisions which may result in privacy leakage, since the information of users is collected to train a deep learning-based model to predict content popularity. Therefore, it is crucial to guarantee secure data collection in machine learning-based framework. In this paper, we propose a privacy-preserving D2D caching scheme with a passive content caching strategy based on node importance, which can deliver more efficient caching and prevent the potential leakage of user privacy. The scheme is based on softwaredefined networking (SDN), in which the controller is responsible for calculating node importance of devices according to the information of requests and encounters collected by SDN switches. Base station will decide which device can establish reliable and secure communication with content requester based on historical information. The simulation results show that the proposed strategy can outperform other D2D caching strategies in terms of cache hit rate and data rate.

By replacing traditional hardware-based middleboxes with software-based Virtual Network Functions (VNFs) running on general-purpose servers, network function virtualization represents a promising technique to reduce the cost of service creation and increase the agility of network operations. Typically, Service Function Chains (SFCs) are adopted to orchestrate dynamical network services and facilitate management of network applications. Recently, SFC parallelism that implements parallel processing of VNFs has been investigated to further improve SFC service quality. However, the unreasonable service graph of parallel processing in existing parallelized SFCs (PSFCs) might cause excessive resource consumption; incoordination between PSFC deployment and scheduling also increases the queuing delay of VNFs and degrades PSFC performance. In this article, an adaptive parallel processing optimization mechanism (APPM) is proposed to self-adaptively adjust the service graph of PSFCs and intelligently solve the joint problem of PSFC deployment and scheduling. Specifically, APPM uses a parallelism optimization algorithm (POA) based on the bin packing problem with soft bin capacity to optimize the structure of the PSFC service graph. Afterward, APPM employs a joint optimization algorithm based on reinforcement learning (JORL) to jointly deploy and schedule the PSFCs optimized by POA via the online perception of environment status. Simulation results showed that POA reduces the SFC parallelism degree and resource consumption by about 35%; JORL lowers SFC delay by reducing the queuing delay and has better overall performance than the state of the art algorithms even with limited resources.