The implementation of the zero-trust security paradigm within Zero Trust Cloud-Edge IoT Networks poses significant challenges due to the massive scale and heterogeneity of connected devices. This difficulty can be attributed to an inherent conflict between the Zero Trust model’s requirement for granular, policy-driven controls and the inherently short-sighted nature of traditional resource orchestration strategies when managing volatile IoT workloads. Consequently, existing solutions frequently remain confined to static security postures or passive mitigation mechanisms, failing to meet the core demand for proactive adaptability essential for securing the expanding IoT system. To bridge this gap, we propose GraphSSC, an autonomous orchestration framework that leverages Knowledge Graph representation learning and Deep Reinforcement Learning to coordinate Virtual Network Functions (VNFs) as dynamic Policy Enforcement Points. Specifically, we first construct a security-aware knowledge graph that unifies semantic representations of network topology, heterogeneous resources, and critical zero-trust context. Building upon this semantic foundation, we develop a context-aware graph attention network to facilitate precise learning of service request embeddings and real-time network security posture. Subsequently, a deep reinforcement learning agent is trained to derive proactive orchestration policies. These strategies enhance security posture, reduce performance overhead, and improve resource utilization efficiency while enabling granular traffic access control through dynamically deployed VNFs. Extensive simulation results demonstrate that, in comparison to existing state-of-the-art benchmark solutions, GraphSSC significantly increases acceptance rates to over 97% and achieves a long-term benefit-cost ratio exceeding 0.6. This research offers a scalable intelligent solution for next-generation zero-trust IoT networks, thereby enabling autonomous proactive security orchestration capabilities.

In addressing the cold-start problem in individual location prediction, we introduce a novel bilateral-branch network to enhance prediction accuracy specifically for cold-start users, without sacrificing general performance. This network integrates a main-branch that analyzes mobility behavior across all users and a sampling-branch dedicated to cold-start users, both employing a shared encoder to ensure consistent learning of behavioral patterns. The shared encoder weights play a crucial role, facilitating the robust transfer of insights from active to cold-start users, thus bridging the information gap effectively. Enhanced by an adapter mechanism, this design ensures that cold-start users benefit directly from the established behavioral patterns of active users. Evaluated on two real-world datasets, our model not only exceeded the performance of eight advanced baselines but also achieved a notable 6.5% increase in Acc@5 for cold-start users, demonstrating its ability to ad eptly handle the challenges associated with cold-start user predictions.

Pipeline and void recognition are two key tasks in the underground monitoring of urban roads. Ground penetrating radar (GPR), as an effective geophysical method, plays an important role in this area. With the increasing amount of GPR data, automatic recognition has become a research hotspot. However, existing automated recognition methods still suffer from low accuracy or high dependence on datasets. In this paper, a non-learning method for both pipeline and void recognition is proposed. In this method, the B-scan is preprocessed by removing the direct coupled wave and multiple echoes.Then, the binarized image is converted to sparse image using non-zero interval sparse coding (NISE). Next, the slope distribution of sparse images is extracted using column offset coding (COE). And clustering is carried out according to the corresponding relationship between the image slope and its original position. Finally, the decision is made according to the slope distribution characteristics of each cluster. The proposed method was tested on both simulated and field data. Experimental results show that the method not only has the advantage of being training-free but also exhibits excellent recognition accuracy.

Even though some studies have found encouraging results, the sparsity of data and the complexity of mobility patterns remain significant challenges in predicting individual mobility. In order to effectively address the two challenges, we propose a novel framework called Geo-aware Graph-Augmented Self-Attention Network (GaGASAN). In GaGASAN, we construct a heterogeneous location graph consisting of a geospatial subgraph and a location transition subgraph to simultaneously model the impacts of geospatial distance and location transitions on all users. With the heterogeneous location graph, the impacts of geospatial distances and global location transitions of all users can be effectively merged, thereby mitigating the sparsity of individual mobility data. For the complex and variable mobility patterns of individuals, we employ a multi-scale time encoding technique and a self-attention mechanism to model different temporal patterns and capture long- and short-range contexts of sequence transitions. Extensive experiments shows that GaGASAN significantly outperforms eight baseline methods on all metrics. Our implementation code is available at https://github.com/mrc-wyh/GaGASAN .

Along with the rapid evolution of mobile communication technologies, such as 5G, there has been a significant increase in telecom fraud, which severely dissipates individual fortune and social wealth. In recent years, graph mining techniques are gradually becoming a mainstream solution for detecting telecom fraud. However, the graph imbalance problem, caused by the Pareto principle, brings severe challenges to graph data mining. This emerging and complex issue has received limited attention in prior research. In this paper, we propose aGraphATtention network withCOst-sensitiveBOosting (GAT-COBO) for the graph imbalance problem. First, we design a GAT-based base classifier to learn the embeddings of all nodes in the graph. Then, we feed the embeddings into a well-designed cost-sensitive learner for imbalanced learning. Next, we update the weights according to the misclassification cost to make the model focus more on the minority class. Finally, we sum the node embeddings obtained by multiple cost-sensitive learners to obtain a comprehensive node representation, which is used for the downstream anomaly detection task. Extensive experiments on two real-world telecom fraud detection datasets demonstrate that our proposed method is effective for the graph imbalance problem, outperforming the state-of-the-art GNNs and GNN-based fraud detectors. In addition, our model is also helpful for solving the widespread over-smoothing problem in GNNs. The GAT-COBO code and datasets are available athttps://github.com/xxhu94/GAT-COBO.

In recent years, the increasing prevalence of mobile social network fraud has led to significant distress and depletion of personal and social wealth, resulting in considerable economic harm. Graph neural networks (GNNs) have emerged as a popular approach to tackle this issue. However, the challenge of graph imbalance, which can greatly impede the effectiveness of GNN-based fraud detection methods, has received little attention in prior research. Thus, we are going to present a novel cost-sensitive graph neural network (CSGNN) in this article. Initially, reinforcement learning is utilized to train a suitable sampling threshold, followed by neighbor sampling based on node similarity, which helps to alleviate the graph imbalance issue preliminarily. Subsequently, message aggregation is executed on the sampled graph using GNN to obtain node embeddings. Concurrently, the optimization objective for the cost matrix is formulated using the sample histogram matrix, scatter matrix, and confusion matrix. The cost matrix and GNN are collaboratively optimized through the backpropagation algorithm. Ultimately, the derived cost-sensitive node embedding is employed for fraudulent node detection. Furthermore, this study provides a theoretical demonstration of the effectiveness of adaptive cost-sensitive learning in GNN. Extensive experiments are carried out on two publicly accessible real-world mobile network fraud datasets, revealing that the proposed CSGNN effectively addresses the graph imbalance issue while outperforming state-of-the-art algorithms in detection performance. The CSGNN code and datasets can be accessed at https://github.com/xxhu94/CSGNN.

The recognition of underground pipelines is an important in urban areas. As an efficient and non-destructive recognition method, ground penetrating radar (GPR) has been increasingly applied in the recognition of underground pipelines. With the growing volume of GPR data, there is an urgent need for automatic recognition. However, due to the complexity of the subsurface environment, existing automatic recognition methods still have drawbacks such as low accuracy, poor robustness, and the requirement for large training datasets. An underground pipeline recognition model for GPR that combines scale-invariant feature transform (SIFT) and support vector machine (SVM) is proposed in this article. The model is based on the fact that there are scale-invariant keypoints at the tops of hyperbolas. First, SIFT is used to identify scale-invariant keypoints in the image. These keypoints undergo symmetry assessment and feature enhancement. Subsequently, SVM is employed to filter out the keypoints located at the tops of the hyperbolas. Finally, keypoints located on the same hyperbola are clustered to obtain the recognition results. The model improves the original SIFT method by modifying the calculation of the blur coefficients in the Gaussian pyramid layers. It also employs manually designed feature enhancement methods when constructing the feature descriptors. Additionally, we have introduced methods such as symmetry judgment to further enhance the model’s accuracy. The results indicate that the proposed method exhibits superior recognition performance for the field data even with very limited training samples.

Dynamic link prediction is an important component of the dynamic network analysis with many real-world applications. Currently, most advancements focus on analyzing link-defined neighborhoods with graph convolutional networks (GCN), while ignoring the influence of higher-order structural and temporal interacting features on link formation. Therefore, based on recent progress in modeling temporal graphs, we propose a novel temporal motif-based attentional graph convolutional network model (TMAGCN) for dynamic link prediction. As dynamic graphs usually contain periodical patterns, we first propose a temporal motif matrix construction method to capture higher-order structural and temporal features, then introduce a spatial convolution operation following a temporal motif-attention mechanism to encode these features into node embeddings. Furthermore, we design two methods to combine multiple temporal motif-based attentions, a dynamic attention-based method and a reinforcement learning-based method, to allow each individual node to make the most of the relevant motif-based neighborhood to propagate and aggregate information in the graph convolutional layers. Experimental results on various real-world datasets demonstrate that the proposed model is superior to state-of-the-art baselines on the dynamic link prediction task. It also reveals that temporal motif can manifest the essential dynamic mechanism of the network.

Finding top-k flows in data streams is a fundamental task in network management. As the line rates continue to increase in a network, it becomes increasingly challenging to find the top-k flows precisely and quickly in real time. Existing algorithms that can achieve high precision suffer from a slow speed. In this paper, we propose a novel sketch, LUSketch, which is much faster than existing algorithms. LUSketch adopts a new strategy called limited-and-imperative-update to significantly improve the insertion speed. The key idea is to significantly reduce the number of update operations by establishing a connection between the sketch and heap part when tracking the top-k flows. Our experiment results show that, while maintaining a high precision, LUSketch achieves an insertion speed approximately 2 to 5 times higher than that of the state-of-the-art.

The cover image is based on the Research Article Filter-Sketch: A two-layer sketch for entropy estimation in the data plane by Jie Lu et al., https://doi.org/10.1049/cmu2.12494.

Abstract Entropy‐based approaches have been shown to aid various network measurement applications such as load balancing, anomaly detection, and traffic classification. Existing methods that assume out‐of‐band detection and/or use switches merely as accelerators require frequency communication between data and control plane, which increase the burden on the network and are no longer sufficient. To track these challenges, the authors design and implement a switch‐native approach for entropy estimation that can run detection function entirely inline on data plane. The authors first present Filter‐Sketch, a two‐layer sketch that supports frequency estimation with small and static memory allocation by separating elephant flow and mice flow. Then, the authors propose a mechanism based on memory‐optimized longest‐prefix match (LPM) to attain entropy at a line rate that completely executes in the programmable data plane. The trace‐driven evaluation shows that Filter‐Sketch achieves higher accuracy than the existing data plane algorithm in entropy estimation, where the relative error decreases by 0.65 on average.

Abstract Deploying microservices in container‐based cloud environments increases the agility of resource scaling. However, the delay in autoscaling for microservices caused by container cold start results in response time service‐level objectives (SLO) violations under burst workloads. This paper proposes Cushion , a proactive resource provisioning method for containerized microservices to mitigate SLO violations caused by burst workloads, which promptly schedules workloads to reserved container instances when workloads suddenly increase and meanwhile steadily scales the container instances according to the SLOs of the microservices. Cushion was evaluated through prototype‐based experiments in a containerized testbed using a benchmark microservice and four web workload traces by comparing it against existing methods. The experimental results show 9.12x times lower SLO violations, 23.75% higher throughput with 24.35% more CPU usage, and 4.85% more memory usage compared to the baseline methods.

Graph convolutional networks (GCN) have recently emerged as powerful node embedding methods in network analysis tasks. Particularly, GCNs have been successfully leveraged to tackle the challenging link prediction problem, aiming at predicting missing links that exist yet were not found. However, most of these models are oriented to undirected graphs, which are limited to certain real-life applications. Therefore, based on the social ranking theory, we extend the GCN to address the directed link prediction problem. Firstly, motivated by the reciprocated and unreciprocated nature of social ties, we separate nodes in the neighbor subgraph of the missing link into the same, a higher-ranked and a lower-ranked set. Then, based on the three kinds of node sets, we propose a method to correctly aggregate and propagate the directional information across layers of a GCN model. Empirical study on 8 real-world datasets shows that our proposed method is capable of reserving rich information related to directed link direction and consistently performs well on graphs from numerous domains.

Software-defined networking (SDN) decouples the control plane from the data plane, which increases network flexibility and programmability. However, the “three-layer two-interface” architecture of SDN introduces new security issues. Attackers can collect fingerprint information (such as network types, controller types, and critical flow rules) by analyzing round-trip time (RTT) distribution of test packets. In order to defend against the fingerprint attack with limited attack time, we first design a probabilistic scrambling strategy. This strategy not only interferes with the delay distribution of probe packets in attack flow but also reduces the negative impact on the performance of legal packets in normal flow. However, if fingerprint attackers have unlimited attack time, it is not enough to defend against the attack only by this strategy. Therefore, we further propose a controller dynamic scheduling strategy to change SDN fingerprint information actively. Because scheduling different types of controllers to work in different periods will generate costs, the scheduling strategy is also responsible for determining the optimal switching time point to balance security benefits and costs. At last, we implement the defense mechanism on different types of controllers and verify its effectiveness in experimental scenarios. The experimental results show that the mechanism can effectively hide the SDN fingerprint information while reducing the negative impact on network performance.

Traditional network routing protocol exhibits high statics and singleness, which provide significant advantages for the attacker. There are two kinds of attacks on the network: active attacks and passive attacks. Existing solutions for those attacks are based on replication or detection, which can deal with active attacks; but are helpless to passive attacks. In this paper, we adopt the theory of network coding to fragment the data in the Software-Defined Networks and propose a network coding-based resilient multipath routing scheme. First, we present a new metric named expected eavesdropping ratio to measure the resilience in the presence of passive attacks. Then, we formulate the network coding-based resilient multipath routing problem as an integer-programming optimization problem by using expected eavesdropping ratio. Since the problem is NP-hard, we design a Simulated Annealing-based algorithm to efficiently solve the problem. The simulation results demonstrate that the proposed algorithms improve the defense performance against passive attacks by about 20% when compared with baseline algorithms.

Software-Defined Networking (SDN) has quickly emerged as a promising technology for future networks and gained much attention. However, the centralized nature of SDN makes the system vulnerable to denial-of-services (DoS) attacks, especially for the currently widely deployed multicontroller system. Due to DoS attacks, SDN multicontroller model may additionally face the risk of the cascading failures of controllers. In this paper, we propose SDNManager, a lightweight and fast denial-of-service detection and mitigation system for SDN. It has five components: monitor, forecast engine, checker, updater, and storage service. It typically follows a control loop of reading flow statistics, forecasting flow bandwidth changes based on the statistics, and accordingly updating the network. It is worth noting that the forecast engine employs a novel dynamic time-series (DTS) model which greatly improves bandwidth prediction accuracy. What is more, to further optimize the defense effect, we also propose a controller dynamic scheduling strategy to ensure the global network state optimization and improve the defense efficiency. We evaluate SDNManager through a prototype implementation tested in a real SDN network environment. The results show that SDNManager is effective with adding only a minor overhead into the entire SDN/OpenFlow infrastructure.

Software-defined networking (SDN) has emerged as a new networking paradigm that can provide fine-grained network management service. Since the SDN controller makes control decision for the network, it becomes the main target of denial of service (DoS) attacks. In this paper, we propose BWManager to mitigateE which mainly consists mitigate the DoS attacks on the SDN controller with BWManager that mainly consists of four key components: 1) simplified DoS detection module; 2) forecasting engine; 3) priority manager; and 4) scheduler. The simplified DoS detection module calculates a comprehensive judgment score for each switch, which indicates the attacking severity of each switch and is used to decide time slice allocation of the controller. The forecasting engine is the basis of the controller scheduling method and forecasts the bandwidth consumption of users to determine the users' trust values. The trust values are used by the priority manager to manage multiple buffer queues with different priorities for the users. The scheduler protects the controller and the normal users under DoS attacks by running a weighted Round-Robin algorithm to process flow requests in different priority queues. We evaluate the performance and overhead of BWManager in both hardware and software OpenFlow environments. The results demonstrate that BWManager is effective with a limited overhead.

Security evaluation of diverse SDN frameworks is of significant importance to design resilient systems and deal with attacks. Focused on SDN scenarios, a game-theoretic model is proposed to analyze their security performance in existing SDN architectures. The model can describe specific traits in different structures, represent several types of information of players (attacker and defender) and quantitatively calculate systems' reliability. Simulation results illustrate dynamic SDN structures have distinct security improvement over static ones. Besides, effective dynamic scheduling mechanisms adopted in dynamic systems can enhance their security further.

Distributed control plane is a promising approach to a scalable software-defined networking (SDN). However, traffic changes could incur load imbalance among individual controllers. Live migration of switches from controllers that are overloaded to those that are underutilized may be a solution to handle peak switch traffic using available control resource. Such migration has to be performed with a well-defined mechanism to fully utilize the available resource of controllers. In this paper, we study a scalable control mechanism to decide which switch and where it should be migrated for a balanced control plane, and we define it as switch migration problem (SMP). The main contributions of this paper are as follows. First, we define a SDN model to describe the relation between the controllers and switches from the view of loads. Based on this model, we formulate SMP as a network utility maximization (NUM) problem with the objective of serving more requests under the available control resource. Second, we design a synthesizing distributed algorithm for SMP - distributed hopping algorithm (DHA), by approximating our optimal objective via Log-Sum-Exp function. In such DHA, individual controller performs algorithmic procedure independently. With the solution space F, we prove that the optimal gap caused by approximation is bounded by 1/β log|F|, and the DHA procedure is equal to an implementation of a time-reversible Markov chain process. Finally, the results are corroborated by several numerical simulations.

Network functional combination is a promising direction in enhancing Internet adaptability. It decomposes the current layered network into fine-grained building blocks and combines them on demand. However, what legacy functions should be decomposed and how to combine them in an optimal way are unclear. We propose a novel adaptive architecture called reconstructive network architecture (RECON) based on the principles of the Complex Adaptive System. This study has three main contributions. First, RECON decomposes functions of the protocol stack at layers 3 and 4 into fine-grained building blocks, called atomic capabilities to open the network core functions unlike existing solutions. Second, RECON can customize different service chains on demand by combining atomic capabilities in an optimal way. We formulate the atomic capability combination into a nonlinear integer optimization problem with the proposed algorithm to reach an appropriate tradeoff between the optimal solution and computation cost. Finally, we implement a proof-of-concept for RECON in the network node. Results are corroborated by several numerical simulations.