Network intrusion detection is a crucial line of defense for protecting network security. Despite the significant advancements made by deep learning in this field, existing methods are primarily based on closed-set classification and are ineffective in detecting unknown attacks. To address this research gap, we propose an open-set recognition-based network intrusion detection method. We first provide a network traffic classification model based on open-set recognition, OpenPN , to classify known classes of network traffic and recognize unknown network traffic. Then we introduce a novel attack detection algorithm involving expert intervention, which reduces manual costs through expert verification and utilizes a density-based k-reciprocal nearest neighbor clustering algorithm for optimization. Finally, we perform continuous learning for the classes that have been verified as novel attacks. Extensive experiments conducted on three public datasets demonstrate that the proposed method outperforms existing methods in both closed-set classification and open-set recognition. In addition, the impact of each critical parameter on the performance of the relevant algorithms is comprehensively analyzed.

Emerging low-latency video (LLV) services, such as cloud gaming, video conferencing, and virtual reality, demand ultra-low latency for smooth interaction. However, existing methods often overlook the misalignment between frame-level perception and packet-level scheduling in ubiquitous Wi-Fi networks, causing high tail latency and degraded user experience. To this end, we propose Flick, a frame-perceptive packet scheduling framework at Wi-Fi access points (APs). It leverages the periodic per-frame transmission behavior and the LLV traffic distribution characteristics to infer the end-to-end frame latency at APs. Flick consists of three components: a Frame Boundary Identifier that detects video frame boundaries using only packet size, an End-to-End Frame Latency Estimator that estimates the end-to-end latency without sender or receiver timestamps, and a Fast-Send, Slow-Recovery Scheduler that dynamically adjusts scheduling priority based on inferred latency. We implement Flick on a commercial Wi-Fi AP. Testbed results show that Flick reduces P99 latency and stall rate by 57% and 81%, respectively, while preserving 95% throughput and maintaining high fairness.

Deploying artificial intelligence (AI) models on the programmable data plane is a key direction toward realizing intelligent data planes. However, this vision faces significant challenges: existing approaches often incur excessive consumption of scarce switch hardware resources or introduce packet recirculation, leading to performance bottlenecks. To address these issues, we propose SwitchLGN, a novel Deep Differentiable Logic Gate Network (DDLGN) architecture deployable on programmable switches. The core of SwitchLGN lies in its hardware-aligned design, which decomposes the model into multiple independent sub-layers and maps each to distinct pipeline processing units. This design enables the entire inference process to be executed solely with the switch's native bit-level logic operations, thereby eliminating the challenges of cross-cluster computation and complex arithmetic in the data plane. In addition, we develop a compilation toolchain to support the automated mapping of SwitchLGN models to P4 code. Experimental evaluations show that SwitchLGN achieves accuracies of 99.42% for network anomaly detection and 95.59% for flow size classification, while reducing SRAM usage to below 3% and making TCAM consumption negligible. Notably, it delivers line-rate inference without packet recirculation, achieving a per-packet latency of only 283 ns.

The LLM serving systems are increasingly growing in popularity, as they provide various capabilities ranging from realtime translation to AI-driven chatbots. Recently, significant effort has been made to optimize server-side metrics such as token generation throughput, while the optimization of token streaming is simply overlooked, resulting in excessive network traffic and poor network utilization. In this paper, we introduce user regions to relieve the network issues, since users from the same region (e.g., universities and business zones) are likely to share similar behaviors to access LLM serving systems (e.g., they are active in a period of time). In this context, we propose Libra, a proxy-cloud collaborative serving system, where the cloud generates and bundles the tokens in terms of user regions and region-based proxy extracts and repacks the received token bundle to their corresponding users. At its core, we design an online region-based task scheduling algorithm with a provable performance to optimize user QoE and system overhead over time. Our evaluations show that Libra outperforms the state-of-the-art LLM serving systems (without user regions), such as vLLM, VTC and Andes, by up to$2.1 \times$in the Time-Between-Tokens (TBT) metric and$78.4 \times$in the number of packets. In addition, it achieves a 32.6 % reduction in TBT compared to other alternative algorithms (with user regions).

Latency is one of the most significant issues in cloud gaming, among which tail latency, mainly attributed to dynamic network environments (i.e., transmission) and limited device computing capacity (e.g., decoding), has attracted increasing attention. To mitigate the tail latency, different from existing researches considering resource adaptation such as bitrate adaptation, we propose TailClip, whose novel idea is to enable video frame generation at the client if the tail latency is about to happen. TailClip consists of two innovative components: a Deep Reinforcement Learning (DRL) driven tail latency trigger that jointly decides a series of subsequent frame generation regarding multidimensional features of historical tail latency; a lightweight frame generation model derived by adaptive pruning in terms of device computing capacity at runtime. Extensive evaluations indicate the superior performance of TailClip. For example, it can remove the high-latency frames (i.e., over 100 ms) by 77% with an acceptable video quality (i.e., 0.45 dB reduction on average).

Ultra-High-Definition (UHD) videos have been getting increasing attention. However, existing video streaming solutions fail to deliver them due to the extremely high bandwidth requirement. The emerging cloud native 5G networks have opened up the possibility of enhancing UHD video quality by leveraging in-network video streaming. Unfortunately, the restricted storage and bandwidth of in-network servers could become the main bottleneck. To this end, we present${\sf EMS}$, a novel UHD video streaming framework, by integratingErasure-coded storage withMulti-sourceStreaming. We respectively introduce a deadline-aware and a latency-sensitive metric to indicate the service quality of video servers and advocate a federated learning paradigm for the adaptive service quality update, including a reinforcement learning based multi-server selection (i.e., user local training) and a global service quality aggregation. To facilitate user local training without sacrificing streaming Quality-of-Experience (QoE), we cast the multi-server selection associated with the restriction on the average number of selected servers per video chunk into two kinds of Multi-Armed Bandit (MAB) models in terms of the proposed service quality metrics. We design lightweight Upper Confidence Bound (UCB) based algorithms with a theoretical performance guarantee. We implement a prototype of${\sf EMS}$, and extensive experiments confirm the superiority of the proposed algorithms.

In this paper, we advocate${\sf NetDPI}$, a novel and efficient Deep Packet Inspection (DPI) solution built-in 5G Data Plane for multi-access edge computing, leveraging the unique forwarding while computing capability of emerging programmable switches. As the cornerstone, we propose${\sf FIVE}$, the firstFiltering-plus-Verification algorithm tailored to programmable switches to achieve efficient multiple pattern matching (i.e., the core of DPI). Briefly, the filtering phase introduces a multi-window parallel shift-or algorithm to rapidly screen out all the “suspicious” packet payloads. Meanwhile, the verification phase innovates a level-based state encoding scheme for the Aho–Corasick (AC) algorithm, which substantially increases the number of supported patterns and consequently figures out more “guilty” payloads. We implement the prototype of${\sf NetDPI}$in both software and hardware programmable switches (i.e., BMv2 and Barefoot Tofino2) and make them publicly available. Extensive evaluations indicate that${\sf NetDPI}$provides orders of magnitude improvement in throughput compared to the typical cloud-delivered DPI solutions, and besides${\sf FIVE}$greatly reduces the memory consumption compared to the alternative in-network exact match algorithms under a variety of system settings including different DPI pattern sets and malware-packet percentages.

In this paper, we advocate CPN-FedSL, a novel and flexible Federated Split Learning (FedSL) framework over Computing Power Network (CPN). We build a dedicated model to capture the basic settings and learning characteristics (e.g., training flow, latency and convergence). Based on this model, we introduce Resource Usage Effectiveness (RUE), a novel performance metric integrating training utility with system cost, and formulate a multivariate scheduling problem that maximizes RUE by comprehensively taking client admission, model partition, server selection, routing and bandwidth allocation into account (i.e., mixed-integer fractional programming). We design Refinery, an efficient approach that first linearizes the fractional objective and non-convex constraints, and then solves the transformed problem via a greedy based rounding algorithm in multiple iterations. Extensive evaluations corroborate that CPN-FedSL is superior to the standard and state-of-the-art learning frameworks (e.g., FedAvg and SplitFed), and besides Refinery is lightweight and significantly outperforms its variants and de facto heuristic methods under a variety of settings.

360° videos generally require a large amount of bandwidth between video servers and users, which puts much burden on the current CDN-based single-source video streaming solutions. The emerging cloud native 5G networks can bridge the distance between video servers and users by leveraging in-network single-source video streaming to enhance 360° video quality. Unfortunately, the restricted bandwidth of in-network servers becomes the main bottleneck. Although tile-based video streaming is promising to reduce video transmission size while keeping user QoE, it highly depends on the accuracy of user FoV prediction, which existing prediction methods cannot guarantee. Recently, some researchers advocate the idea of “super FoV” (i.e., an extended range of predicted FoV) to cope with the inaccurate FoV prediction, which however could lower the effect of tile-based video streaming. Alternatively, we present Muster, a multi-source streaming for tile-based 360° videos within cloud native 5G networks. We detail the system components, provide a comprehensive model, formulate joint server selection and tile requesting problems, and correspondingly propose efficient online algorithms with a performance guarantee. Small-scale testbed and large-scale simulation based evaluation confirm the superiority of the proposed algorithms.

360° video streaming requires ultra-high bandwidth to provide an excellent immersive experience. Traditional viewport-aware streaming methods are theoretically effective but unreliable in practice due to the adverse effects of time-varying available bandwidth on the small playback buffer. To this end, we ponder the complementarity between the large buffer-based approach and the viewport-aware strategy for 360°video streaming. In this work, we present Sophon, a buffer-based and neural-enhanced streaming framework, which exploits the double buffer design, super-resolution technique, and viewport-aware strategy to improve user experience. Furthermore, we propose two well-suited ideas: visual saliency-aware prefetch and super-resolution model selection scheme to address the challenges of insufficient computing resources and dynamic user preferences. Correspondingly, we respectively introduce the prefetch and model selection metric, and develop a lightweight buffer occupancy-based prefetch algorithm and a deep reinforcement learning method to trade off bandwidth consumption, computing resource utilization, and content quality enhancement. We implement a prototype of Sophon and extensive evaluations corroborate its superior performance over state-of-the-art works.

To facilitate the emerging applications in 5G networks, mobile network operators will provide many network functions in terms of control and prediction. Recently, they have recognized the power of machine learning (ML) and started to explore its potential to facilitate those network functions. Nevertheless, the current ML models for network functions are often derived in an offline manner, which is inefficient due to the excessive overhead for transmitting a huge volume of dataset to remote ML training clouds and failing to provide the incremental learning capability for the continuous model updating. As an alternative solution, we proposeCocktail, an incremental learning framework within a reference 5G network architecture. To achieve cost efficiency while increasing trained model accuracy, an efficient online data scheduling policy is essential. To this end, we formulate an online data scheduling problem to optimize the framework cost while alleviating the data skew issue caused by the capacity heterogeneity of training workers from the long-term perspective. We exploit the stochastic gradient descent to devise an online asymptotically optimal algorithm, including two optimal policies based on novel graph constructions for skew-aware data collection and data training. Small-scale testbed and large-scale simulations validate the superior performance of our proposed framework.

The incoming 5G cellular network is stepping into a densification era, where various kinds of base stations are densely deployed to provide fruitful mobile services such as video streaming. In order to improve the performance of these mobile services, the way to optimally allocate cellular resources for the network-wide users is a crucial problem. In this paper, we consider the mobile Ultra-High-Definition (UHD) video streaming service, envision a 5G ultra dense network (UDN) consisting of a series of Video Base Stations (VBSs) dedicated to video streaming services for multiple users, and mainly explore the impact of cellular resource allocation on video streaming. We incorporate two important video streaming states into cellular resource allocation and formulate a streaming-aware and fairness-aware cellular resource allocation problem. To deal with the formulated problem, we provide a novel graph transformation and design an optimal matching algorithm which can be solved in polynomial time. Extensive trace-driven simulations validate the superior performance of the proposed algorithm under different user mobility patterns and network scales.

Ultra-High-Definition (UHD) videos have absorbed great attention in recent years. However, as they are of significant size, streaming them require an extremely high bandwidth to achieve a good quality of experience, which poses a great challenge on the current cellular networks. Realizing the great potentials of coordinated multi-point joint transmission (JT-CoMP) in 5G Ultra Dense Network, we propose a novel Tuner framework for the UHD video streaming service. In this framework, we strive to design an efficient algorithm for VBS sleeping and VBS grouping to maximize the data rates of overall video users while reducing the overhead of cellular networks. To this end, we provide a comprehensive framework model and formulate a single-timescale VBS sleeping & grouping problem. We design a novel master-slave based algorithm to solve the formulated mixed-integer programming problem optimally with low complexity. In addition, we extend it to facilitate the more practical setting, i.e., two-timescale VBS sleeping & grouping. Extensive simulations validate the superior performance of our framework in various system settings.

360° UHD videos have absorbed great attention in recent years. However, as they are of significant size and usually watched from a close range, they require extremely high bandwidth for a good immersive experience, which poses a great challenge on the current single-source adaptive streaming strategies. Realizing the great potentials of tile-based video streaming and pervasive edge services, we advocate a tile-based multi-source adaptive streaming strategy for 360° UHD videos over edge networks. In order to reap its benefits, we consider a comprehensive model which captures the key components of tile-based multi-source adaptive streaming. Then we formulate a joint bitrate selection and request scheduling problem, aiming at maximizing the system utility (i.e., user QoE minus service overhead) while satisfying the service integrity and latency constraints. To solve the formulated non-linear integer programming problem efficiently, we decouple the control variables and resort to matroid theory to design an optimal master-slave algorithm. In addition, we improve our proposed algorithm with a deep learning-based bitrate selection algorithm, which can achieve a rationalization result in a short running time. Extensive datadriven simulations validate the superior performance of our proposed algorithm.