As the maritime industry evolves, applications such as real-time navigation, ocean monitoring, and emergency rescue increasingly require reliable communication. They also demand efficient computation offloading to support AI-driven services. However, terrestrial networks offer sparse coverage and unstable links in open-sea environments, severely constraining both connectivity and the execution of computation-intensive tasks. Although low Earth orbit (LEO) satellites extend coverage over oceans, their frequent handovers and high operating costs hinder stable, low-latency communication and efficient computation offloading. Unmanned aerial vehicle-based relays can enhance connectivity, but their limited endurance and environmental vulnerability hinder large-scale deployment. In contrast, high-altitude platform stations (HAPS) offer quasi-stationary positioning, broad coverage, and long operational duration, making them promising intermediaries between LEO satellites and maritime users. Building on this motivation, we design a space–air–ground–sea integrated network architecture in which HAPS function as relay nodes. We model the multi-layer task offloading and resource allocation as a partially observable Markov decision process to capture the uncertainty and dynamics of maritime environments. To solve it, we adopt multi-agent proximal policy optimization, which enables centralized training with decentralized execution. Furthermore, we incorporate an exact potential game mechanism into the reward design to enhance agent coordination and ensure alignment with system-wide objectives. Simulation results show that our method outperforms three representative baselines; under maximum task load, it reduces average latency, energy consumption, and overall cost by 8.7%, 2.0%, and 18.6%, respectively, verifying its effectiveness for computation-intensive maritime services.

The growing adoption of AI-Generated Content (AIGC) has made large-scale processing of multiple Generative AI (GAI) training jobs a key strategy for improving cost-efficiency in computing clusters. However, the distributed nature of GAI models, together with inherent network bottlenecks, imposes significant challenges on system performance. Moreover, differences in training purposes, variations in model sizes, and asynchronous lifecycles create a dynamic environment. As a result, the coexistence of multiple GAI training jobs in a computing cluster exacerbates problems such as resource misallocation, fragmentation, and network contention, leading to low resource utilization and inefficient training performance. These motivate us to explore an efficient resource scheduling approach for completing multiple GAI training jobs. Accordingly, we introduce an intrinsic topology-aware scheduling framework designed to ensure flexible scheduling and efficient distributed training of GAI models. To address the trade-off between the number of concurrent jobs and the communication contention they generate, we formulate a multi-objective optimization problem with two objectives: maximizing the utility of GAI jobs and minimizing communication bandwidth. We then propose the Diffusion Model-based AI-Generated Resources Scheduling (DARS) algorithm, designed to capture dynamic, high-dimensional environments and generate optimal resource scheduling decisions. DARS employs a denoising diffusion process to iteratively refine noisy resource allocations into optimized scheduling decisions. Subsequently, we replace the policy network of Deep Reinforcement Learning (DRL) with DARS to address environmental uncertainty and enhance efficiency. Finally, the simulation results confirm that the proposed algorithm outperforms existing approaches.

With the rise of AI-Generated Content (AIGC), multi-tenant training in large computing clusters has become a prominent trend. However, when multiple tasks from different tenants of varying scales coexist in a cluster, they pose significant co-resident eavesdropping risks. Unfortunately, distributed training tasks are particularly prone to leaks of model parameters and data when they receive uniform security protection. Research on co-resident eavesdropping and hierarchical security defenses for distributed training remains sparse. To address this, we propose a novel Grouping Task Migration Mechanism (GTMM) that integrates server grouping with task migration. First, servers are clustered according to their security levels, enabling tailored protection. We then cast task migration as a multi-objective optimization problem to mitigate co-resident threats. Next, a DDQN-based task-migration algorithm derives optimal migration decisions. Lastly, our experiments demonstrate that GTMM consistently outperforms baseline methods.

With the prosperity of AI-Generated Content (AIGC), efficiently scheduling multiple Generative AI (GAI) distributed training jobs in a computing cluster has become crucial for pursuing higher cost-effectiveness. However, the resource-intensive nature and frequent communication demands of distributed training exacerbate resource fragmentation and network contention, resulting in low utilization and high latency. To this end, we propose an intelligent and dynamic resource scheduling method. Firstly, we propose an innovative scheduling analytical model that describes heterogeneous computing resources, communication contention, and the parameter synchronization architecture. We then formulate it as a multi-objective optimization problem. Next, we propose a Diffusion Model-based AI-generated Resource Scheduling (DARS) algorithm, to capture dynamic and high-dimensional environment and generate the optimal scheduling decisions. Finally, the policy network of deep reinforcement learning (DRL) is replaced with the proposed DARS to address the environmental uncertainty and enhance efficiency. Simulation results demonstrate that our proposed algorithm outperforms associated algorithms.

Advances in communication technology, coupled with the growing global demand for network connectivity, have established low Earth orbit (LEO) satellite networks as a critical complement to terrestrial networks. However, the inherent high latency, dynamic topology, and bandwidth limitations of LEO satellite networks, along with the inefficiencies of centralized routing strategies, pose significant challenges to the effectiveness of conventional terrestrial routing protocols. Traditional routing methods, which rely on static, rule-based approaches, lack the flexibility required to adapt to dynamic network conditions, underscoring the necessity for more adaptive packet routing strategies within satellite network protocols. To address these challenges, we propose a packet routing optimization algorithm that integrates cooperative multi-agent proximal policy optimization (MAPPO) with the M/M/1/K queuing theory model. Specifically, we develop a multi-attribute graph model for dynamic satellite networks that incorporates both communication delay and energy consumption metrics. For each satellite node, we establish an M/M/1/K queuing model that accounts for the queuing waiting time at each node. We formulate the packet routing optimization problem, aiming to minimize delay and energy consumption, as a partially observable Markov decision process and apply the multi-agent proximal policy optimization algorithm to refine the routing policy. Extensive simulations on real satellite network topologies demonstrate that the proposed algorithm significantly outperforms existing methods, achieving higher cumulative rewards while reducing both latency and energy consumption.

Low Earth orbit (LEO) satellite networks enhance terrestrial connectivity by providing global coverage and low-latency communication. However, their highly dynamic topology, time-varying propagation delays, and constrained bandwidth severely limit the efficiency of conventional centralized routing, underscoring the necessity for adaptive and distributed strategies that can operate effectively under partial observability. Multi-agent reinforcement learning (MARL) offers a promising foundation for such strategies by enabling decentralized, context-aware decision-making based on local information. Nevertheless, existing MARL-based routing approaches often struggle to maintain accurate congestion awareness, reconcile conflicting objectives, and ensure stable convergence in large-scale LEO constellations. To address these challenges, we present POMAP, a packet routing framework that integrates Pareto optimization with multi-agent proximal policy optimization (MAPPO) to achieve efficient and stable trade-offs across multiple key performance metrics. Specifically, we propose a dynamic multi-attribute graph model for LEO satellite networks that simultaneously captures communication delay and energy consumption. Within this framework, each satellite node is represented as a G/G/1/K queue equipped with active queue management and scheduled using weighted priority queueing, thereby enabling precise characterization and control of packet queueing behavior. We formulate the packet routing problem as a partially observable Markov decision process that jointly minimizes delay, energy consumption, and packet loss rate, and apply MAPPO to optimize the resulting policy. Extensive simulations on realistic satellite network topologies demonstrate that the proposed method achieves better convergence stability, improved Pareto front coverage, and enhanced overall network performance compared with state-of-the-art baselines.

As an advanced form of IoT technology, integrated sensing and communication (ISAC) deeply integrates communication and perception, enhancing the performance and application range of IoT. At the same time, the space-air-ground integrated network (SAGIN) provides a wider and more efficient connection and information processing support for both. However, the highly dynamic and time-varying characteristics of SAGIN lead to more frequent vertical handovers among heterogeneous wireless networks, which seriously affects the continuity and reliability of services. This motivates us to explore an effective vertical handover method in SAGIN to guarantee the quality of network service. The issue is a typical complex and high-dimensional problem with its online and dynamic characteristics, which provides a particularly favorable scenario for the adaptability of the diffusion model (DM). Accordingly, we propose a novel vertical handover decision algorithm with the aid of DM. First, we innovate a novel vertical handover analytical model that describes handover jitter, load difference, and handover robustness. Then we formulate it as a multiobjective optimization problem. Next, inspired by Generative AI (GAI), we propose a DM-based GAI-empowered handover decision (DGHD) algorithm to capture the time-varying and high-dimensional environments and generate optimal vertical handover decisions. Subsequently, the policy network of multiagent proximal policy optimization (MAPPO) is replaced with the proposed DGHD for addressing environmental uncertainty and enhancing efficiency. Finally, the simulations exhibit that our proposed algorithm outperforms existing algorithms.

With the prosperity of AI-generated content (AIGC), multitenant training in AI task clusters has become prevalent. To improve resource utilization, multiple tenants will coexist on the same server, while malicious tenants may exploit side-channel to pose significant co-resident eavesdropping risks. Due to the extensive attack surface, distributed training tasks are particularly vulnerable to model parameters and data leakage when subjected to the same level of security protection as inference tasks. Moreover, traditional security mechanisms, reliant on static encryption or isolation, suffer from high overhead, passive defense and poor scalability, failing to address the dynamic resilience requirements of AI clusters. However, the research on proactive resilience enhancement in AI clusters is almost blank. To fill this gap, we devise a grouping task migration mechanism (GTMM), which jointly considers adaptive server grouping and proactive task migration. Specifically, we first employ an adaptive server grouping algorithm to classify servers, offering customized protection based on tenants’ security requirements. Then, we formulate the task scheduling process as a multiobjective optimization problem for making a tradeoff between security, power consumption, and load balance. Next, we propose a deep reinforcement learning-based task migration algorithm to separate tenants that have completed co-residency for mitigating co-resident threats. Lastly, the simulation experiments demonstrate that GTMM’s security outperforms the baselines with only an affordable performance degradation.

This paper proposes a weight-aware deep reinforcement learning (WADRL) approach designed to address the multiobjective vehicle routing problem with time windows (MOVRPTW), aiming to use a single deep reinforcement learning (DRL) model to solve the entire multiobjective optimization problem. The Non-dominated sorting genetic algorithm-II (NSGA-II) method is then employed to optimize the outcomes produced by the WADRL, thereby mitigating the limitations of both approaches. Firstly, we design an MOVRPTW model to balance the minimization of travel cost and the maximization of customer satisfaction. Subsequently, we present a novel DRL framework that incorporates a transformer-based policy network. This network is composed of an encoder module, a weight embedding module where the weights of the objective functions are incorporated, and a decoder module. NSGA-II is then utilized to optimize the solutions generated by WADRL. Finally, extensive experimental results demonstrate that our method outperforms the existing and traditional methods. Due to the numerous constraints in VRPTW, generating initial solutions of the NSGA-II algorithm can be time-consuming. However, using solutions generated by the WADRL as initial solutions for NSGA-II significantly reduces the time required for generating initial solutions. Meanwhile, the NSGA-II algorithm can enhance the quality of solutions generated by WADRL, resulting in solutions with better scalability. Notably, the weight-aware strategy significantly reduces the training time of DRL while achieving better results, enabling a single DRL model to solve the entire multiobjective optimization problem.

With the rapid development of emerging services such as cellular vehicle-to-everything and immersive video service, network connections have further evolved from tangible physical connections to intangible virtual connections such as content, services, and computing resources, and the application scenarios have become more abundant. The mobile ultra-service, which is characterized by ultra-low latency, ultra-high reliability, and ubiquitous mobility, is becoming one of the most representative traffic types. However, the existing mobile network architecture has not evolved sufficiently to meet the specific requirements of these mobile ultra-services, the mobility anchors introduce unnecessary node and link latency, leaving space for further optimization. A compact network architecture (ComArch) is proposed in this paper for ultralow-latency services with ubiquitous mobility. ComArch is designed with a mapping control plane and a generalized forwarding plane to collaboratively implement packet forwarding in mobile scenarios. The generalized forwarding plane handles packet forwarding, while the mapping control plane manages terminals’ identifier and locator mapping entries. The node latency introduced by mobility anchors is eliminated, and an efficient routing scheme is proposed to find the optimal mandatory nodes in the forwarding path, thereby reducing unnecessary link latency. Experimental results show that ComArch can effectively reduce end-to-end delay while saving resources.

Low Earth orbit satellite networks (LSNs) are envisioned as key enablers of 6 G by offering ubiquitous, low-latency connectivity. Their mesh topology enables multipath differential routing, which improves bandwidth utilization and reduces transmission delay. However, the growing demand for data and the dynamic, self-organizing nature of LSNs pose significant challenges for joint multipath routing and traffic scheduling under strict latency and energy constraints. To address these challenges, this paper proposes a multipath routing optimization (MRO) and traffic scheduling method tailored for multipath differential routing. Specifically, a dynamic multi-attribute graph model is developed to precisely capture the dynamic properties of LSNs. Building on this model, a MRO algorithm, integrated with a Stackelberg game framework, is introduced. The MRO algorithm employs a decomposition-based approach to identify multiple optimal paths that minimize delay and energy consumption, while the Stackelberg game framework ensures efficient traffic distribution across these paths. Numerical results demonstrate that the proposed approach significantly outperforms existing baseline methods, achieving cumulative reward improvements of 26.77% to 43.8% across four real-world network topologies and exhibiting better Pareto front coverage. Furthermore, by leveraging the rapid convergence properties of the Stackelberg game model, the proposed method enhances network throughput by 12% to 43% and reduces transmission time by 14% to 49%.

The Service Function Chain (SFC) leverages Network Function Virtualization (NFV) and Software-Defined Networking (SDN) for flexible deployment, creating customized service chains tailored to specific applications. As NFV and SDN technologies play crucial roles in the SFC implementation, any security risk that arises in an NFV/SDN network can potentially pose a threat to SFC. Thus, SFC becomes vulnerable to network security attacks. To address this, intrinsic security technologies, including moving target defense and mimic defense, offer proactive protection against both known and unknown threats. It is expected to break through traditional security protection mechanisms such as “enhanced”, “plug-in” and “passive” defense. This paper proposes an intrinsic dynamic defense architecture to equip SFC with active defense capabilities, shifting from passive reactive mechanism based on prior knowledge to an active defense against various attacks. The architecture comprises two models and five modules, including a sub-pool partitioning algorithm that enhances heterogeneity across sub-pools by splitting the heterogeneous replica pool into several sub-pools among replica VNFs. To meet Quality of Service (QoS) requirements like latency, cost, and security, we formulate a multi-objective optimization problem with three objectives: latency, cost, and defense success rate. Following that, we propose a dynamic Deep Reinforcement Learning (DRL)-based deployment algorithm. This algorithm selects appropriate VNFs based on heterogeneity and historical information, improving SFC and VNF security against external attacks. Extensive experiments validate that our architecture significantly enhances network security, provided that this improvement comes at the expense of limited cost and latency.

In the 6G era, user demand for low-latency, cost-effective extreme services such as extended reality (XR) and holographic communications has significantly increased. Multi-domain networks, known for their vast capacity and coverage, are essential in fulfilling the growing demand for high-performance services. Despite their potential, these networks face challenges with domain isolation, requiring a software defined network (SDN) controller for inter-domain communication. Network function virtualization (NFV) enhances flexibility of service delivery with customizable service function chain (SFC), yet prior research falls short in delivering low-latency, cost-efficient services in multi-domain NFV networks alongside an unreasonable assumption that software on physical nodes can support the execution of all virtualization network functions (VNFs). In this paper, we study the problem of SFC deployment with VNF-dependent software migration (SD-VDSM) in multi-domain networks. Particularly, we first formulate the problem by setting an objective to minimize the end-to-end communication delay and the associated costs of service provisioning, while simultaneously ensuring load balancing across multi-domain networks. However, complexity of the issue escalates to an intractable level due to the intertwined nature of SFC deployment strategies and VNF-dependent software migration tactics, which mutually influence each other intricately. To tackle this issue, we propose an innovative heuristic algorithm, designated as the Joint SFC Deployment with VNF-Dependent Software Migration Algorithm (JSD-VDSMA). Comprising three fundamental steps, this algorithm is crafted to adeptly resolve the complexities of service provisioning across multi-domain networks. A suite of rigorous experimental assessments is detailed, demonstrating the capability of our proposed JSD-VDSMA. Through these comparative analyses, we demonstrate its effectiveness not only to increase the service acceptance rate but also to diminish both the end-to-end communication delay and resource utilization costs in comparison to its counterparts.

The development of immersive video service and large-scale cluster computing technology further expand the potential application scope of time-sensitive networks (TSN). In the delivery network for these emerging services, the Ultra-Service Flow (USF), which is characterized by ultra-high bandwidth and deterministic latency has become the most representative traffic type. Therefore, the route scheduling for hybrid deployment of Regular Service Flow (RSF) and USF has become an unavoidable issue within a deterministic domain. To resolve this issue, a multi-objective optimization model for joint routing of hybrid service flows is studied in this paper. Subsequently, an effective algorithm is designed to discover feasible routing solutions using a deep reinforcement learning approach with a transformer framework, followed by optimization utilizing NSGA-II. The simulation results indicate that, our proposed algorithm exhibits superior overall performance and enhanced generalization capabilities. It effectively reduces the overall latency of RSF by 10.526% and the path blocking degree of USF by 14.10256%, while significantly increasing the available bandwidth rate by 14.286%.

The introduction of network function virtualization (NFV) leads to service function chain (SFC) deployment problems, promoting the idea of composing network services as virtualized network functions (VNFs). Meanwhile, the rapid development of edge computing, artificial intelligence and big data has led to a surge in data volume and explosive growth in computing and forwarding demands. As such, a traditional central processing unit (CPU)-based data forwarding mode in the NFV network appears to be a bottleneck, and a CPU-only computing framework can no longer meet the forwarding needs of diverse business scenarios and services. The data processing unit (DPU)-based architecture allows better forwarding performance to be achieved more cost-effectively, largely alleviating the computing pressure of the CPU and reducing the node forwarding delay. Therefore, in this paper, a heterogeneous CPU+DPU architecture is investigated to solve the SFC deployment problem. To handle diverse service needs, we establish a multi-objective SFC deployment scheme to optimize the service latency, deployment cost and service acceptance rate. Because extreme services require better real-time performance, DPUs are adopted for fast processing according to the requirement of service requests. To address the unacceptable delay in sequential mode, a parallel strategy is proposed to process SFCs. To solve the multi-objective SFC deployment problem, a deep reinforcement learning (DRL)-based heterogeneous algorithm that includes multiple subalgorithms is designed, named parallelizable, shared and horizontally scaled service function chain deployment (PSHD), which uses diverse processing algorithms to deploy SFCs and break the delay bottleneck in NFV-based networks.The performance of PSHD is evaluated through extensive experiments. PSHD is found to be time-efficient, and it achieves a higher request acceptance rate and 37.73% and 34.26% lower latencies than state-of-the-art methods.

Satellite-terrestrial integrated networks (STNs) are considered a promising architecture for 6G networks due to their ability to provide ubiquitous, high-capacity coverage on a global scale by combining satellite and terrestrial network infrastructures. However, the complex network architecture, time-varying topology, and frequent inter-satellite connection handovers present significant challenges for developing efficient routing and service continuity in STNs. To overcome these challenges, we propose Dyna-STN, a dynamic discrete topology-oriented wide-area routing mechanism in this paper. Dyna-STN utilizes a dynamic discrete topology model to characterize the time-varying topology of satellite networks. Furthermore, a hierarchical framework is established within the management plane to implement Dyna-STN, which comprises a dynamic discrete topology management plane and a routing management plane. A virtual overlay network composed of fixed virtual nodes shields the dynamics of satellite networks, while the open shortest path first protocol (OSPF) is deployed within the virtual overlay network to exchange routing reachability information among virtual nodes. Additionally, Dyna-STN performs dynamic binding and service migration between different satellite entities at specific time slots, thereby maintaining the continuity of virtual node services. Extensive numerical results demonstrate that Dyna-STN outperforms several baseline schemes in terms of routing protocol performance, packet forwarding performance, and service continuity. Furthermore, Dyna-STN maintains stable performance as the network scale increases and supports reliable data transmission among terminal devices in STNs.

In this paper, a novel two-timescale resource management framework for mobile edge computing (MEC) is constructed. Unlike existing studies, for providing seamless and cost-efficient MEC services, this work aims to strike the balance between service migration and task rerouting for mobile devices (MDs) whenever handovers occur (i.e., switching access from one edge server to another). Considering the network dynamics (e.g., randomness of MDs’ task generations and time-varying channel conditions) and the asynchronization of different management decisions with different triggers, we formulate an online optimization problem for jointly determining: 1) large-timescale decisions, including which edge server should be selected to access, and whether service migration or task rerouting should be chosen for each MD in each large time frame; and 2) small-time scale decisions, including how computing and communication resources should be allocated among MDs with task offloading requests in each small time slot. Then, we propose an online algorithm based on the improved Lyapunov method, together with an iterative algorithm integrating randomized rounding and Lagrange dual techniques, which solves the problem to asymptotic optimum in terms of the long-term average service delay. Theoretical analyses and simulations evaluate the performance of the proposed solution and show its superiority over counterparts.

With the development of mobile services such as autonomous driving and the industrial internet, ultralow latency and pervasive mobility have become key characteristics of the intelligent interconnections among people, machines, and things. As a prevailing mobile network architecture, the network function virtualization (NFV)-based edge-cloud architecture brings the computing and memory resources closer to the end user, significantly reducing service delays and supporting more efficient mobility management. However, the geographically distributed nature of the edge-cloud architecture and the quality of service (QoS) requirements of latency-sensitive services in extreme mobile scenarios make service function chain (SFC) deployment more challenging. In this paper, we investigate a mobility-aware SFC deployment scheme with service migration in an NFV-based edge-cloud system. To properly cope with the mobility pattern of mobile services, a multistage decision-making problem is formulated, aiming to jointly minimize the long-term deployment and migration costs and the average end-to-end service latency while simultaneously satisfying various QoS constraints for services and the physical resource constraints of the edge-cloud system. Then, to address the formulated problem, a deep reinforcement learning (DRL)-based online SFC deployment algorithm is proposed that can automatically detect variations in the widely distributed edge-cloud environment and generate online deployment solutions without human intervention to implement adaptive and fast service provision and also support mobile service migration. Extensive experimental results demonstrate our proposed scheme surpasses its competitors in terms of end-to-end latency and migration cost, with average reductions of 6.26% and 18.77%, respectively, while improving the average service acceptance rate by 19.19%.

In this paper, a long-term workload management problem for multi-server edge computing with server collaboration is studied. In the considered model, mobile users’ computation-intensive tasks are generated dynamically over the time and offloaded to associated edge servers according to pre-determined subscription agreements. Upon receiving the subscribed workload, each edge server can then decide to whether participate in server collaboration for enabling workload re-allocation (i.e., workload exchange) with other heterogeneously configured edge servers. Unlike most of the existing work, this paper takes into account both competitions and collaborations among strategic edge servers in sharing their computing capacities. To achieve the equilibrium for each edge server in minimizing its expected cost (including energy consumption, delay, transmission, configuration and pricing costs), a joint optimization is formulated for determining i) its amount of workload to undertake, ii) compensation price charged from peers, and iii) computing speed to adopt. To efficiently solve this problem, we propose a novel cooperative queueing game approach, which integrates a convex optimization, a core cost sharing scheme and a mapping rule. Theoretical analyses and extensive simulations are conducted to evaluate the performance of the proposed solution, and demonstrate its superiority over counterparts.

Network Functions Virtualization (NFV) replaces the specialized hardware with the software-based forwarding to promise the flexibility, scalability and automation benefits. With an increasing range of applications, NFV must ultimately forward packets at rates that are comparable to the native and specialized hardware-based approaches. However, the transition packet forwarding from specialized hardware to software-based has turned out to be more challenging than expected. Thus, NFV acceleration is desperately needed to play a crucial role in the development of NFV. It is an interesting issue how to address the persistent performance tuning in a way that provides far greater flexibility to meet the demands of power. The existing developments are very inefficient, since that the uncontrollable and unanticipated performance regressions frequently occur. Besides, the environments for full system simulations are traditionally expensive and time consuming to evaluate the system performance. In this paper, we propose the methodology named as “NFV Acceleration via Lean Measurements (NALM)” to tune the performance for the NFV acceleration. NALM provides a holistic measurement approach through combining individual measures to quickly identify the bottlenecks, which can help developers with a better understanding of the design tradeoffs. Moreover, the environments for large scale performance simulation are replaced by a debugger. Thus, the waste is eliminated in terms of time consumption and infrastructure costs of the full system simulation. The systematic analysis of the multi-cores speedup ratio highlights the potential optimization space and rules. We further propose the improvement recommendations on efficient practices. The experiments evaluate the specific effects, and the relationship between the metrics and forwarding performance.

With the emergence of cloud native technology, the network slicing enables automatic service orchestration, flexible network scheduling and scalable network resource allocation, which profoundly affects the traditional security solution. Security is regarded as a technology independent of the cloud native architecture in the initial design, traditional passive defense such as “reinforced” and “stacked” is relied on to achieve system security protection. The lack of intrinsic security mechanisms makes the system capability insufficient when faces the uncertain threat brought by vulnerabilities and backdoors under the ecosystem of opening-up and sharing. The static nature of existing networks and computing systems makes them easy to be compromised and hard to defend, and thus it is urgent to provide intrinsic security and proactive protection against the unpredictable attacks. To this end, this paper proposes a novel paradigm named intrinsic cloud security (iCS) from the perspective of dynamic defense. The dynamic defense provides component-level security, and has complementary and consistency with the cloud native environment. In particular, iCS introduces mimic defense and moving target defense (MTD), and makes full use of the new features introduced by cloud native to implement an intrinsic and proactive defense mechanism with acceptable costs and efficiency. The iCS paradigm achieves seamless integration and symbiosis evolution between security and cloud native. We implement a trial of iCS based on 5GC commercial system and evaluate its performance on costs, efficiency and attack success. The result shows that the iCS enhanced mode always can provide a better and more stable defense effects.

With a traditional static model of telecommunications service, it is difficult to deal with the uncertain factors and differentiation of massive mobile Internet services. Cloud computing, software‐defined networking (SDN), and network function virtualisation (NFV) drive telecom networks to a new round of network reconstruction. The IaaS platform can partially solve the ‘production tool’ problem of operators; however, the ‘production relationship’ problem persists. After infrastructure reconstruction is completed, due to the 5G service vision of networks on demand and sliced networks, a PaaS environment is introduced to implement a new‐generation of virtual network functions (VNFs). Based on the analysis of the necessity and feasibility of an Information and Communications Technology PaaS (ICT‐PaaS) Platform, following the technical trend of 5G, the ICT‐PaaS platform is proposed to construct a future network featuring elasticity, automation, flexibility, and openness. The adoption of lightweight VNF design ideas based on componentisation, containerisation, and microservice can better satisfy the requirements of flexible ‘network slicing’ than the traditional heavy monolith VNF‐based on VMs. The measured results show that the optimisation implementations can significantly improve network forwarding performance. From the evaluation result of the cost benefits of it is possible to highlight potentials of the platform introduction.