With the growing adoption of time-series anomaly detection (TAD) technology, numerous studies have employed deep learning-based detectors to analyze time-series data in the fields of Internet services, industrial systems, and sensors. The selection and optimization of anomaly detectors strongly rely on the availability of an effective evaluation for TAD performance. Since anomalies in time-series data often manifest as a sequence of points, conventional metrics that solely consider the detection of individual points are inadequate. Existing TAD evaluators typically employ point-based or event-based metrics to capture the temporal context. However, point-based evaluators tend to overestimate detectors that excel only in detecting long anomalies, while event-based evaluators are susceptible to being misled by fragmented detection results. To address these limitations, we propose OIPR1, a novel TAD evaluator with area-based metrics. It models the process of operators receiving detector alarms and handling anomalies, utilizing area under the operator interest curve to evaluate TAD performance. Furthermore, we build a special scenario dataset to compare the characteristics of different evaluators. Through experiments conducted on the special scenario dataset and five real-world datasets, we demon-strate the remarkable performance of OIPR in extreme and complex scenarios. It achieves a balance between point and event perspectives, overcoming their primary limitations and offering applicability to broader situations.

Data plane verification (DPV) can be critical in ensuring the network operates correctly. To be useful in practice, they need to be: (1) fast so as to prevent significant packet loss or security violations; (2) scalable so as to accommodate today's large-scale network architecture. Current DPV tools struggle to meet these requirements due to their centralized architecture. To be concrete, there is a bottleneck for a single-point server to perform real-time DPV tasks. Furthermore, a single-point server makes it hard to collect real-time data plane updates from every device in large-scale networks.

Event time series appear in many software scenarios and are a necessary data type in data analytics systems. Transformers are the preferred type of sequential neural network for advanced analytics on event time series, particularly due to their significant contributions to the recent surge of large language models (LLMs). Event series analytics heavily depends on the quality of input data, which may contain natural measurement errors or adversarial noises. Since the input data deviates from the true state, the opaque nature of neural networks presents a challenge in ensuring the reliability of output, which might be deemed untrustworthy. In this paper, we introduce an innovative formal verification framework for Transformer-based event series systems, leveraging sampling, linear programming, and the extreme value theorem. This framework can support the verification of the dependability of Transformers in managing inputs characterized by unpredictability and uncertainty. To exemplify its utility, we apply our verification approach to verify natural requirements from a real-world event series environments: network traffic classification. It outperforms the current state-of-the-art verifier in terms of effectiveness, providing more stringent verified bounds. Our experimental findings provide valuable benchmarks for guaranteeing reliable deployment of systems in scenarios where the credibility of event data is compromised, and for exposing specific cases in which the expected requirements are not satisfied.

Training large models in parallel by GPU clusters significantly accelerates the computation in each iteration. However, the frequent collective communication for synchronizing the huge number of gradients poses a scalability challenge, whose performance gradually becomes the bottleneck as the number of workers increases. Ring-reduce is a favorable architecture since it can balance the communication and computation load among workers. In this paper, we discover that the communication resources are underutilized when using the ring-reduce synchronization method in clusters. Accordingly, Shuffle-Exchange Synchronization (SES), a novel method is proposed to improve the communication efficiency for distributed large model training. SES organizes all the worker nodes into several groups, within which they perform small-scale ring-reduce synchronizations during each iteration. To achieve better convergence performance, a gradient correction operation is integrated into SES. Experiments in 16 workers on a real-world industrial computing platform, show that SES can accelerate the large model training to 1.97× without losing model performance.

Recent progress in video anomaly detection assumes that anomalies cannot be effectively reconstructed because they remain unseen during training. However, we observe that most existing methods excessively rely on appearance features, resulting in the accurate reconstruction of anomalies with subtle short-term appearance variations, which we refer to as appearance confusion. Meanwhile, many approaches fail to exploit sufficient semantic distinction, resulting in motion confusion for anomalies with motion patterns similar to normal ones. In this paper, we propose a masked self-supervised learning-based framework, which effectively addresses the two confusions by exploring context-aware motion patterns and discriminative semantic normality representations. First, we introduce reconstructing multi-pattern masked spatiotemporal information to motivate the model to capture motion patterns that focus on long-term context. Then, we design a semantic noise separation network to address motion confusion, facilitating the construction of semantic normality boundaries through semantic-aware separation. Extensive experiments on the Avenue and ShanghaiTech datasets validate the effectiveness of our proposed method.

Multivariate time-series (MTS) classification tasks play a key role in data-driven applications spanning healthcare, finance, and mobile communication. As MTS data are typically collected from multiple interdependent sensors, the resulting temporal patterns inherently reflect the characteristics of the underlying sensing systems. Despite this connection, conventional MTS classification models predominantly focus on raw time-series data while disregarding valuable sensor-specific prior knowledge, which fundamentally constrains their classification accuracy. The emergence of large language models (LLMs) has encoded extensive sensor-related knowledge within their parameter spaces. However, effectively harnessing such knowledge to enhance MTS classification networks remains an open challenge. To address this, we propose Foresail, a status-guided neural framework that bridges this gap through systematic integration of LLM-derived sensor knowledge via the status relationship matrix and fine-grained status labels. Foresail can be seamlessly integrated with existing MTS networks to optimize performance and generate interpretable intermediate results. Experiments on irregularly and regularly sampled MTS data demonstrate that Foresail outperforms state-of-the-art approaches, achieving a notable improvement in F1-score of up to 10.9% compared to the basic MTS network.

With the rapid development of next-generation networks, the highly heterogeneous and dynamic nature of networks poses significant challenges for automated network management. Autonomous Network (AN), as a new network paradigm, aims to provide customers with a zero-wait, zero-touch, and zero-fault experience. AN facilitates network management through intent-driven interactions and provides on-demand resource orchestration and service scheduling. However, accurately translating user intents into commands and allocating resources on demand for services remain significant challenges for AN. Therefore, this paper proposes IAN, an intent-based AN framework guided by the Large Language Model (LLM). In the intent translation phase, IAN introduces RAG to enhance command generation quality by retrieving from manuals. In the resource allocation phase, the method utilizes LLM to analyze service characteristics, thereby guiding the training and inference of the resource allocation model to effectively distribute resources uniformly across emerging services. Experimental results demonstrate that IAN improves performance by 52.66% in intent translation tasks and increases overall gain by 33.57% in resource allocation tasks compared to other models.

Within the Internet of Things (IoT) for traffic monitoring, the employment of autonomous aerial vehicles (AAVs) as relays for collecting and transmitting real-time data from traffic sensors to base stations has proven a promising approach. In UAV-assisted Data Time-Sensitive IoT (DTIoT), the Age of Information is a crucial metric assessing data freshness, measuring the elapsed time from traffic sensors to the base station. Optimizing flight trajectories of multiple UAVs to minimize AoI while adhering to energy constraints poses a significant challenge. Current research often employs deep reinforcement learning for UAV trajectory control. Nevertheless, managing multi-agent continuous trajectories in intricate DTIoT network environments faces obstacles due to sparse rewards, thus impeding the training of deep neural network-based control policies using traditional DRL techniques. In this paper, we propose a network-oriented hierarchical reinforcement learning (NO-HRL) to control the UAVs’ flight trajectory in DTIoT networks for minimizing the AoI. We devise a control policy leveraging a two-tier hierarchical DRL framework, with the upper tier determining the target and the lower tier executing it. We also introduce a decoupled sequential training approach to efficiently train the mutually dependent two-tier DRL network of NO-HRL. Experimental results demonstrate that our method excels in optimizing AoI for DTIoT compared to other baselines.

Logs record crucial information about runtime status of software system, which can be utilized for anomaly detection and fault diagnosis. However, techniques struggle to perform effectively when dealing with interleaved logs and entities that influence each other. Although manually specifying a grouping field for each dataset can handle the single grouping scenario, the problems of multiple and heterogeneous grouping still remain unsolved. To break through these limitations, we first design a log semantic association mining approach to convert log sequences into Log-Entity Graph, and then propose a novel log anomaly detection model named Lograph. The semantic association can be utilized to implicitly group the logs and sort out complex dependencies between entities, which have been overlooked in existing literature. Also, a Heterogeneous Graph Attention Network is utilized to effectively capture anomalous patterns of both logs and entities, where Log-Entity Graph serves as a data management and feature engineering module. We evaluate our model on real-world log datasets, comparing with nine baseline models. The experimental results demonstrate that Lograph can improve the accuracy of anomaly detection, especially on the datasets where entity relationships are intricate and grouping strategies are not applicable.

Accurate long-term viewport prediction in tile-based 360° video adaptive streaming helps pre-download tiles for a further future, thus establishing a longer buffer to cope with network fluctuations. Long-term viewport motion is mainly influenced by Historical viewpoint Trajectory (HT) and Video Content information (VC). However, HT and VC are difficult to align in space due to their different modalities, and their relative importance in viewport prediction varies across prediction time steps. In this paper, we propose STAR-VP, a model that fuses HT and VC in a Space-aligned and Time-vARying manner for Viewport Prediction. Specifically, we first propose a novel saliency representation salxyz and a Spatial Attention Module to solve the spatial alignment of HT and VC. Then, we propose a two-stage fusion approach based on Transformer and gating mechanisms to capture their time-varying importance. Visualization of attention scores intuitively demonstrates STAR-VP's capability in space-aligned and time-varying fusion. Evaluation on three public datasets shows that STAR-VP achieves state-of-the-art accuracy for long-term (2-5s) viewport prediction without sacrificing short-term (<1s) prediction performance.

The real-time control capability of IoT devices is contingent upon the transmission of packets. However, due to the influence of multiple devices accessing the network, the bandwidth available to IoT devices from access points may decline significantly, which causes a surge in the queuing latency and interrupts the transmission. This phenomenon is referred to as transient congestion. To achieve stable high-quality network service, this paper designs RushWay, a QUIC-enabled framework for alleviating transient congestion. RushWay employs stream multiplexing to compress the original packet into the stream frame, thereby reducing the bandwidth required for transmission. Furthermore, RushWay employs an adaptive decision-making algorithm to assess uplink queue conditions and packet latency requirements, thereby alleviating transient congestion. The simulation results demonstrate that RushWay can improve key performance by 13% to 94%.

In this paper, we investigate dense short packet forwarding for clustering-based massive Internet-of-Things (mIoT). The objective is to support the data forwarding with minimal communication overhead while satisfying the differentiated latency constraints from the transport layer perspective. To this end, we propose a dense packet assembling scheme, named ShuttleBus, for forwarding devices in mIoT to achieve effective data merging. The assembling scheme is designed based on the stream multiplexing mechanism of the Quick UDP Internet Connection (QUIC) protocol. With ShuttleBus, the payload data sent from IoT devices are extracted as independent frames belonging to different data streams. The ShuttleBus can bundle data frames from multiple streams into a single packet while ensuring data integrity of these streams. Furthermore, we develop a resilient packing mechanism in packet assembling to merge data received from IoT devices within a cluster. In addition, a latency-oriented scheduling mechanism for backlogged QUIC data is established to guarantee satisfactory delivery of diverse transmission tasks. To accommodate the dynamic network environment, we tailor a learning-based algorithm to determine the optimal packet assembling time adaptively. We evaluate the performance of ShuttleBus under various network load conditions. Both analytical and experimental results demonstrate that the proposed scheme significantly reduces communication overhead and enhances data delivery performance under stringent latency constraints.

Monitoring and anomaly detection of key performance indicators (KPIs) are crucial for large Internet companies to maintain the reliability of their Web services. Influenced by human behavior and schedules, the KPIs of Web services typically exhibit seasonal characteristics. These characteristics may be complex as different KPIs exhibit differences in trend, multiple periods, and noise behaviors. However, existing anomaly detection methods typically only model one fixed pattern of seasonal KPIs, which may lead to performance degradation when dealing with diverse seasonal KPIs. In this work, we propose a novel anomaly detection model for seasonal KPIs,Diner, which incorporates multiple interpretable components. It is able to capture the additive and multiplicative trends, multiple periods, and seasonal noise in intricate seasonal KPIs, making it easily adaptable to different types of seasonal KPIs. Additionally, we present a set of evaluation criteria for generic time series anomaly detection tasks, which prove more effective in handling ambiguous manual labels and various anomaly events. Experiments are conducted on three real-world datasets, and the performanceDinersurpassed both the statistical baseline and the state-of-the-art deep learning baselines.

Multi-access Edge Computing and ubiquitous smart devices help serve end-users efficiently by providing emerging edge-deployed services. On the other hand, more heavy and time-varying traffic loads are generated in mobile edge networks, so that an efficient traffic forwarding mechanism is highly required to handle the routing problem in complex and highly dynamic edge environments. Thus, Deep Reinforcement Learning (DRL) is introduced since it can work in a model-free approach. However, previous centralized DRL-based methods work in a turn-based way that mismatches the real-time property of routing. In this paper, we propose a real-time and distributed learning approach, RTHop, to adapt to the volatile environment and realize a hop-by-hop routing. The Multi-Agent Deep Reinforcement Learning (MADRL) and the Real-Time Markov Decision Process (RTMDP) are used to alleviate network congestion and maximize the utilization of network resources. By joining with the self-attention mechanism, RTHop obtains the semantics from elements of the network state to help agents learn the importance of each element on routing. Experiment results show that RTHop not only overcomes the weakness of conventional turn-based DRL methods but also achieves the increase of delivered packet ratios and effective throughput compared with other routing methods.

Cloud of Things (CoT) is an integration of Internet of Things (IoT) and cloud computing, where Network Function Virtualization (NFV) can dynamically provide Virtualized Network Functions (VNFs) for IoT devices based on service-specific requirements. The provisioning of VNFs in CoT is formulated as an online decision-making problem, but widely used methods mostly focus on characterizing the environment using simple models to obtain the optimal solution. Valuable historical experience on provisioning for the best long-term benefits is ignored and Quality of Service (QoS) requirements for different types of CoT services are also not considered, which leads to inefficient and coarse-gained provisioning. In this article, an intelligent provisioning framework of VNFs is proposed for adaptive CoT resource scheduling according to traffic identification of heterogeneous network services. The framework leverages a Deep Reinforcement Learning (DRL)-based model to make decisions based on the complexity of network environments and traffic variances. In this model, a policy gradient DRL algorithm, namely, Policy Optimization using Kronecker-Factored Trust Region (POKTR) is adopted to obtain the stable performance by a novel surrogate objective function. Experimental results verify that our framework improves the QoS in CoT by real-time VNFs provisioning. The DRL-based model with POKTR algorithm reduces network congestion and achieves higher throughput than other DRL algorithms.

With the development of the Internet of Things (IoT) and 5G, there are ubiquitous smart devices and network functions providing emerging network services efficiently and optimally through building many network connections based on WiFi, LTE/5G, Ethernet, and etc. The Multipath TCP (MPTCP) protocol that enables these devices to establish multiple paths for simultaneous data transmission, has been a widely used extension of standard TCP in smart devices and network functions. On the other hand, more heavy and time-varying traffic loads are generated in an MPTCP network, so that an efficient congestion control mechanism that schedules the traffic between multiple subflows and avoids congestion is highly required. In this paper, we propose a decentralized learning approach, DeepCC, to adapt to the volatile environments and realize the efficient congestion control. The Multi-Agent Deep Reinforcement Learning (MADRL) is used to learn a policy of congestion control for each subflow according to the real-time network states. To deal with the problem of the fixed state space and slow convergence, we adopt two self-attention mechanisms to receive the states and train the policy, respectively. Due to the asynchronous design of DeepCC, the learning process will not introduce extra delay and overhead on the decision-making process. Experiment results show that DeepCC consistently outperforms the well-known heuristic method and DRL-based MPTCP congestion control method in terms of goodput and jitter. Besides, DeepCC with the attention mechanism reduces convergence time by about 50% and increase goodput by about 80% compared with the commonly used structures of neural networks.

Multi-access Edge Computing (MEC) and ubiquitous smart devices help serve end-users efficiently and optimally through providing emerging edge-deployed services. Meanwhile, heavy and time-varying traffic loads are produced in the edge network, so that an efficient traffic forwarding mechanism is required. In this paper, we propose a parallel and distributed learning approach, DeepHop, to adapt to the volatile environments and realize hop-by-hop routing. The Multi-Agent Deep Reinforcement Learning (MADRL) is used to alleviate the edge network congestion and maximize the utilization of network resources. DeepHop determines the routing among edge network nodes for heterogeneous types of traffic according to the current workload and capability. By joining with an attention mechanism, DeepHop obtains the semantics from the elements of the network state to help the agents learn the importance of each element on routing. Experiment results show that DeepHop achieves the increase of successfully transmitted packets by 15% compared with the state-of-the-art algorithms. Besides, DeepHop with an attention mechanism reduces convergence time by nearly half compared with the common-used structures of neural networks.

Application awareness is essential for traffic engineering and Quality of Service (QoS) guarantee, especially in Internet of Things (IoT). Software Defined Network (SDN) with centralized controlling of network resources provides opportunities for fine- grained resource allocation. However, the controller cannot autonomously identify applications effectively, because sampling and recognizing traffic data consumes a lot of IO and computing resources. In this demonstration, we provide an intelligent application-aware Virtualized Network Function (VNF) with deep learning technology to identify the network traffic. The traffic type information will be mapped to specific network requirements and utilized to search appropriate route paths for different applications. The intelligent VNF is deployed on a GPU-equipped standalone server and works on the data plane of SDN. It identifies the traffic and sends the type information to the controller through OpenFlow protocol. The experiments show that by introducing the type information, SDN controller can assign more appropriate route paths for different types of traffic and highly improve the network QoS.