To address the issue of inaccurate synchronization between physical devices and their corresponding digital twins (DT) in Industrial Internet of Things (IIoT), which is caused by sensing errors, unreliable wireless transmission, and outdated information, we propose a DT information synchronization strategy for IIoT based on dual time scale network slicing (NS) orchestration. Firstly, a DT-driven IIoT slicing architecture is proposed to provide isolation for heterogeneous Quality of Service (QoS) requirements. On this basis, to quantify synchronization performance, a DT fidelity model is established, incorporating sensing accuracy, data transmission reliability, and the Age of Information (AoI). To fully utilize the network resources and improve the accuracy of DT synchronization information, a dual time-scale model is constructed, where the large time scale handles DT association and inter-slice resource allocation according to the users’ demand, while the small time scale is responsible for intra-slice scheduling of power, bandwidth, and observation frequency. To solve the formulated optimization problem, we design a hierarchical deep reinforcement learning framework that adopts Deep Recurrent Q-Network (DRQN) and Counterfactual Multi-Agent Prioritized Experience Replay Compound-Action Actor-Critic (COMA-PER-CA2C) algorithms. Simulation results demonstrate that the proposed method significantly improves DT fidelity and resource utilization in various IIoT scenarios.

The identification of the root causes of failures in complex Internet of Things (IoT) systems has always presented a significant challenge. Despite the extensive range of algorithms and technologies already available for Root Cause Analysis (RCA) in various fields, there remains a lack of RCA methods specifically designed for IoT systems. The present paper proposes an IoT system root cause analysis framework based on dynamic causal graphs, assisted by Large Language Models (LLMs), called LLMs-DCGRCA. Firstly, in response to the issues with traditional causal hypothesis methods, which rely on human experience and suffer from key variable omission and incorrect causal direction assumptions, this paper proposes a method for generating causal hypotheses for IoT systems by using knowledge graphs to enhance the performance of LLMs. Secondly, in response to the challenge that traditional causal learning methods in IoT scenarios struggle to capture causal relationships across the temporal dimension, this paper proposes a dynamic causal graph learning method that incorporates causal constraints. Finally, in response to the limitations of traditional root cause analysis methods in IoT scenarios in accurately capturing the dynamic characteristics of anomaly propagation, this paper proposes a cumulative root cause localization method based on dynamic causal graphs. The evaluation of LLMs-DCGRCA is conducted using IoT trace data collected from simulation environments and GAIA, a widely-used public dataset in the field of intelligent operations and maintenance. The evaluation results demonstrate that LLMs-DCGRCA achieves average HR@7 improvements of 14.04% and 9.35% compared to baseline methods on the two datasets, respectively.

As industrial IoT networks evolve, they become increasingly vulnerable to cyberattacks, such as Denial of Service and backdoor attacks, which lead to anomalies in data streams (e.g., unusual spikes or drops in traffic, sudden changes in device behavior, or irregular communication patterns). To address the challenge of detecting these anomalies amidst dynamic data distributions and diverse abnormal patterns, this article proposes a supervised contrastive learning-based spatiotemporal variational autoencoder (SC-STVAE) for anomaly detection in online data streams. A multihead graph attention network (MD-GAT) is utilized to capture feature correlations, while a temporal convolution network serves as the hidden layer in the variational autoencoder. This enables SC-STVAE to learn both feature correlations and temporal dependencies. To resolve the issue of ambiguous positive and negative boundaries, supervised contrastive learning is introduced within the STVAE, improving boundary distinction and detection accuracy. To mitigate performance degradation due to data drift, an event-triggered elastic weight consolidation algorithm is introduced, which updates model parameters based on reliability thresholds. Additionally, a fuzzy entropy-weighted anomaly score, which measures the error between reconstructed data and original inputs by computing the weighted sum of the mean squared error across each dimension, is introduced. Experimental results demonstrate superior performance in terms of accuracy, recall, and F1 score compared to benchmark algorithms.

Network availability and service continuity are major concerns for network operators to provide reliable communication services for Internet of Things (IoT), which are particularly challenging to achieve in virtualized network slicing environment where network services are exposed to the failure risks of both software (virtual network function (VNF) instances) and hardware (physical nodes). In general, the redundancy-based VNF backup solutions are used to improve the reliability of virtualized network slices. However, backup VNFs require the same amount of resources as the primary VNFs, which will result in high-resource cost. In this article, we propose a joint VNF partition and hybrid backup scheme for VNF orchestration, backup and mapping, whose aim is to construct the reliability-enhanced and delay-guaranteed network slices at minimum cost. Specifically, the VNF partition method divides a single VNF into multiple thinner VNFs with lower processing capacity and is expected to enhance the reliability of network slices with less additional resources. The hybrid backup scheme includes both onsite and offsite backup forms. Then, considering the time-varying network environment and IoT service requirements, we formulate the VNF orchestration, backup and mapping as a dynamic mixed integer linear programming (DMILP) problem, and model the dynamic problem as a Markov decision process (MDP). In view of the large action space of the formulated MDP, we propose a multiagent deep reinforcement learning (DRL) approach with an action space reduction strategy to achieve the dynamic VNF orchestration, backup and mapping solution. Simulation results demonstrate that the proposed joint VNF partition and hybrid backup scheme can obtain superior delay and reliability performance with low-network cost.

An efficient Intrusion Detection System (IDS) model is essential for the protection of Unmanned Aerial Vehicles (UAVs) networks against network intrusion. However, when designing IDS models using distributed data collected by UAVs, it is crucial to ensure the security and privacy of the data. Moreover, most IDS models only focus on one-time learning and lack continuous learning capabilities. To address this, we present a Federated Continuous Learning framework with a Stacked Broad Learning System (FCL-SBLS) that utilizes Digital Twin Network (DTN) to enable quick and continuous learning on new data. To enhance the efficiency and quality of the IDS model during training and aggregation, we adopt an asynchronous federated learning architecture. Additionally, we introduce a Deep Deterministic Policy Gradient (DDPG)-based UAV selection scheme assisted by DTN to aid in global IDS model aggregation. This approach ensures that the IDS model can effectively and efficiently learn from distributed data while preserving the privacy and security of the data. The presented algorithm is validated using the CIC-IDS2017 dataset, and the simulation results reveal that our algorithm achieves higher efficiency and accuracy than the existing FL scheme.

Numerous resource-constrained Internet of Things (IoT) devices make the edge IoT consisting of unmanned aerial vehicles (UAVs) vulnerable to network intrusion. Therefore, it is critical to design an effective intrusion detection system (IDS). However, the differences in local data sets among UAVs show small samples and uneven distribution, further reducing the detection accuracy of network intrusion. This article proposes a conditional generative adversarial net (CGAN)-based collaborative intrusion detection algorithm with blockchain-empowered distributed federated learning to solve the above problems. This study introduces long short-term memory (LSTM) into the CGAN training to improve the effect of generative networks. Based on the feature extraction ability of LSTM networks, the generated data with CGAN are used as augmented data and applied in the detection and classification of intrusion data. Distributed federated learning with differential privacy ensures data security and privacy and allows collaborative training of CGAN models using multiple distributed data sets. Blockchain stores and shares the training models to ensure security when the global model’s aggregation and updating. The proposed method has good generalization ability, which can greatly improve the detection of intrusion data.

The edge of the Internet of Things (IoT), which consists of unmanned aerial vehicles (UAVs), is vulnerable to network intrusion because software and wireless connections are used extensively in the IoT. Designing an efficient intrusion detection system (IDS) model is imperative. However, when creating IDS models with distributed data collected by UAVs, it is necessary to take precautions to protect the data’s security and privacy. Furthermore, most of the IDS models are focused on one-time learning but not on continuous learning. To this end, we propose a federated continuous learning framework with a stacked broad learning system (FCL-SBLS) based on the digital twin network (DTN), which can learn and train the IDS model on new data quickly and continuously. In order to improve the efficiency and quality of the IDS model when training and aggregation, we employ an asynchronous federated learning (FL) architecture, and a deep deterministic policy gradient (DDPG)-based UAV selection scheme assisted by DTN is proposed to help the global IDS model aggregation. The presented algorithm is validated using the CIC-IDS2017 data set, and the simulation results reveal that our algorithm achieves higher efficiency and accuracy than the existing FL scheme.

Virtualized network slicing allows a multitude of logical networks to be created on a common substrate infrastructure to support diverse services. A virtualized network slice is a logical combination of multiple virtual network functions, which run on virtual machines (VMs) as software applications by virtualization techniques. As the performance of network slices hinges on the normal running of VMs, detecting and analyzing anomalies in VMs are critical. Based on the three-tier management framework of virtualized network slicing, we first develop a federated learning (FL) based three-tier distributed VM anomaly detection framework, which enables distributed network slice managers to collaboratively train a global VM anomaly detection model while keeping metrics data locally. The high-dimensional, imbalanced, and distributed data features in virtualized network slicing scenarios invalidate the existing anomaly detection models. Considering the powerful ability of generative adversarial network (GAN) in capturing the distribution from complex data, we design a new multi-discriminator Bidirectional Wasserstein GAN with Gradient Penalty (BiWGAN-GP) model to learn the normal data distribution from high-dimensional resource metrics datasets that are spread on multiple VM monitors. The multi-discriminator BiWGAN-GP model can be trained over distributed data sources, which avoids high communication and computation overhead caused by the centralized collection and processing of local data. We define an anomaly score as the discriminant criterion to quantify the deviation of new metrics data from the learned normal distribution to detect abnormal behaviors arising in VMs. The efficiency and effectiveness of the proposed collaborative anomaly detection algorithm are validated through extensive experimental evaluation on a real-world dataset.

Emerging digital twin (DT) and mobile-edge computing (MEC) are crucial for enabling the rapid development of 6G. However, the existing works ignore the edge collaboration, which can provide the system with additional performance gain. In this article, we study the problem of mobile users (MUs) intelligently offloading tasks to cooperative mobile-edge servers (MESs) with the assistance of DT. Specifically, a DT-assisted task offloading scheme (DTTOS) that consists of the selection of MESs and intelligent task offloading is proposed. Channel state information (CSI) and blockchain are employed to implement the selection of MESs. Then, we present a solution to enable MU’s task offloading that is modeled as a Markov decision process (MDP) in an intelligent way. After this, a mathematical optimization model aiming at decreasing power and time overhead is formulated. In view of the complexity, it is decomposed into two suboptimization models and solved by the decision tree algorithm (DTA) and double deep-$Q$-learning (DDQN), respectively. Simulations are conducted to prove the superiority of the proposed scheme in terms of data security assurance and network performance improvement.

Applications in the Internet of Vehicles (IoV) are usually accompanied by ultralow network response latency requirement. A promising approach to meet this demand is combining the IoV with mobile edge computing and enabling edge devices to share their communication, computation, and caching (3C) resources via edge intelligent cooperation. However, the allocation of 3C resources supported by artificial intelligence (AI) demands a huge number of training data and strong computing ability which is impossible to achieve on resource-limited on board unit (OBU) or road side unit (RSU). In this article, we propose a digital twin (DT) supported edge intelligent cooperation scheme, which empowers the optimal 3C resource allocation and edge intelligent cooperation possible. We focus on the response delay minimization in order to meet the requirement of latency-sensitive applications in the IoV. Specifically, mathematical expressions of the network response time are formulated according to modeling the workflow of the edge server as an M/M/1/N/FCFS queuing process. Especially, we conduct a detailed analysis of the deviations in 3C resource between the physical world and the DT space, based on which we further discuss the impact of these deviations in offloading decision. Furthermore, a mathematical optimization model aiming at minimizing the latency is formulated. In view of its complexity, we apply a deep deterministic policy gradient algorithm to solve it by modeling the cooperation process between edge nodes as a Markov decision process. Finally, we carry out simulations to demonstrate that our algorithm outperforms the existing schemes in terms of network response latency.

Network Function Virtualization (NFV) is a promising paradigm that enables the employment of novel service types with lower deployment cost and faster time-to-value, but it introduces new fault management problems and challenges. In NFV environment, anomalies occurred in virtual machines (VMs) can be caused by faulty components of their hosting servers or anomaly propagation from other ones. If the performance of VMs degrades, we need to find out the root causes accurately, i.e., locate the exact faulty components, to recover the networks as soon as possible. In this paper, we first use digital twin to establish a virtual instance of the physical network to capture the real-time anomaly-fault dependency relationship. When the network environment changes, transfer learning is leveraged to utilize the learned knowledge of dependency relationship in historical periods to avoid huge time and computation cost of learning from scratch. Assisted by the learned dependency relationship, a dynamic set-covering (DSC) based root caused analysis problem is formulated and modeled with a set of parallel hidden Markov models to capture the dynamics of component states, which can best explain the sequence of anomalous VMs. We use alternating direction method of multipliers to decompose the DSC problem into a set of independent sub-problems and solve it in a distributed fashion. Since the state variables of each component in the DSC problem are coupled between any two successive time epochs, each sub-problem is solved by the Viterbi decoding and an incremental function is designed to construct the feasible solution that covers all anomalous VMs. Simulation results show the availability and superiority of the digital-twin assisted root cause analysis algorithm for NFV environment.

In this paper, we propose a Digital Twin (DT) Supported Resource Allocation Scheme (DTS-RAS), which empowers the intelligent edge cooperation in the Internet of Vehicles (IoV) environment possible. We focus on the latency minimization under the DT-IoV framework. Specifically, we formulate the mathematical expression for the response time of vehicle offloading tasks to cooperative edge nodes according to modeling the edge server as a M/M/1/N queen. Then, we construct the optimization model aiming at reducing the response time. In view of the complexity, we apply a Double Deep Q-learning Network (DDQN) to training the edge server to get an optimal allocation action by modeling the cooperation process as an MDP. Simulation results demonstrate that our proposed scheme outperforms the existing schemes in terms of execution latency.

As the network slicing is one of the critical enablers in communication networks, one anomalous physical node (PN) in substrate networks that carries multiple virtual network elements can cause significant performance degradation of multiple network slices. To recover the substrate networks from anomaly within a short time, rapid and accurate identification of whether or not the anomaly exists in PNs is vital. Online anomaly detection methods that can analyze system data in real-time are preferred. Besides, as virtual nodes mapped to PNs are scattered in multiple slices, the distributed detection modes are required to preserve the data privacy of different slices. According to those requirements, we propose a distributed online PN anomaly detection algorithm based on a decentralized one-class support vector machine (OCSVM), which is realized through analyzing real-time measurements of virtual nodes mapped to PNs in a distributed manner. Specifically, to decouple the OCSVM objective function, we transform the original problem to a group of decentralized quadratic programming problems by introducing the consensus constraints. The alternating direction method of multipliers is adopted to achieve the solution for the distributed online PN anomaly detection. The simulation results on the real-world network dataset show the effectiveness and superiority of the proposed distributed online anomaly detection algorithm.

Network Function Virtualization (NFV) enables the employment of novel service types with lower deployment cost and faster time-to-value, but it introduces new fault management problems and challenges. Anomalies of virtual machines (VMs) can be caused by faulty components of their located physical servers or anomaly propagation from other ones. If the data patterns of VMs are detected as anomalous, we need to locate the root causes precisely to recover the networks as soon as possible. In this paper, we first introduce digital twin to capture the real-time anomaly-fault dependency matrix for the networks. Assisted by the dependency matrix, a dynamic set-covering (DSC) problem is formulated and modeled with a set of parallel hidden Markov models to find a minimal set of faulty components at each observation epoch, which can cover all anomalous VMs. We introduce alternating direction method of multipliers to decompose the DSC problem into a set of independent sub-problems and solve it in a distributed fashion. Simulation results show the availability and superiority of the proposed digital-twin assisted root cause analysis algorithm for NFV environment.