The deployment of large-scale LoRaWAN networks requires jointly optimizing conflicting metrics like Packet Delivery Ratio (PDR) and Energy Efficiency (EE) by dynamically allocating transmission parameters, including Carrier Frequency, Spreading Factor, and Transmission Power. Existing algorithms often ignore the complexity of multi-objective dynamic adaptation to oversimplify this challenge, focusing on a single metric or lacking the adaptability needed for dynamic channel environments, leading to suboptimal performance. To address this, we propose two online learning-based resource allocation frameworks that intelligently navigate the PDR-EE trade-off. Our foundational proposal, D-LoRa, is a fully distributed framework that models the problem as a Combinatorial Multi-Armed Bandit. By decomposing the joint parameter selection and employing specialized, disaggregated reward functions, D-LoRa dramatically reduces learning complexity and enables nodes to autonomously adapt to network dynamics. To further enhance performance in LoRaWAN networks, we introduce CD-LoRa, a hybrid framework that integrates a lightweight, centralized initialization phase to perform a one-time, quasi-optimal channel assignment and action space pruning, thereby accelerating subsequent distributed learning. Extensive simulations and real-world field experiments demonstrate the superiority of our frameworks, showing that D-LoRa excels in nonstationary environments while CD-LoRa achieves the fastest convergence. In physical deployments, our algorithms outperform state-of-the-art baselines, improving PDR by up to 10.8% and EE by 26.1%, demonstrating their practical effectiveness. Moreover, extensive simulations with up to 250 nodes confirm the scalability and efficiency of the proposed frameworks in large-scale LoRaWAN networks.

Guided by the principle of “Never Trust, Always Verify”, Zero Trust Architecture (ZTA) mandates continuous monitoring and analysis of users and entities, highlighting the critical role of behavior analytics. However, the growing volume of audit data and its complex contextual information render many existing behavior analytics methods insufficient. Moreover, most approaches rely on high-quality labeled data for supervised training, limiting their effectiveness against previously unseen malicious behaviors. To address these challenges, we propose the Large Language Model for Behavior Analytics (LLMBA) framework. LLMBA leverages a Large Language Model (LLM) to analyze behavioral patterns of internal users and entities, capitalizing on the LLM’s strong ability to model sequential data. We introduce a multi-level behavior encoding scheme to capture both contextual and temporal information from behavior records, producing rich input representations for the LLM-enhanced model. The LLM is fine-tuned using self-supervised learning, enabling the detection of unknown malicious behaviors. To reduce the computational and storage overhead inherent in LLMs, we apply knowledge distillation to compress the model while maintaining high detection performance. Extensive experiments on the CERT Insider Threat dataset demonstrate that LLMBA outperforms state-of-the-art baselines in detection accuracy. Furthermore, the compressed student model achieves superior performance compared with existing methods under comparable runtime constraints, making LLMBA highly suitable for real-world deployment.

The deployment of LoRa networks necessitates joint performance optimization, including packet delivery rate, energy efficiency, and throughput, by dynamically configuring multiple LoRa parameters for packet transmission across varying channel environments. Due to the complexity of modeling channel features and the coupling relationship between LoRa parameters and metrics, existing works have sacrificed adaptability by focusing on specific aspects rather than the whole. Therefore, we propose D-LoRa, a distributed parameter adaptation scheme, based on reinforcement learning towards network performance. We first build a comprehensive analytical model for the LoRa network that considers complex channel features, including path loss, quasiorthogonality of spreading factor, and packet collision. Then, we formulate the joint optimization problem as a combinatorial Multi-Armed Bandit (CMAB) problem and devise metric factors to handle the trade-off among different performance metrics. Experimental results show that our scheme can increase the packet delivery rate by up to 18.5% and demonstrate superior adaptability across different performance metrics.

Accurate per-flow measurement is essential for effective network management in programmable networks. However, achieving this accuracy remains challenging due to limited switch resources and the massive scale of network flows. Existing sketch-based methods often encounter significant measurement errors, particularly when dealing with the large number of extremely small flows, known as "ant flows". To address this issue, this paper introduces Mix Sketch, a novel measurement framework designed for differentiated and precise per-flow measurement. Mix Sketch uniquely categorizes traffic into elephant, mouse, and ant flows, and employs a tailored three-level structure to measure each flow category appropriately. This approach significantly enhances measurement accuracy, especially for ant flows. Furthermore, we propose Co-Mix Sketch, a lightweight collaborative measurement scheme that leverages network topology to distribute Mix Sketch components across different node tiers, thereby optimizing resource utilization and improving accuracy without requiring complex coordination. Evaluations conducted on real-world traffic traces demonstrate that Mix Sketch substantially outperforms baseline single-node methods, while Co-Mix Sketch achieves notable accuracy improvements with minimal overhead compared to existing collaborative approaches.

Due to sophisticated deployments of all kinds of wireless networks (e.g., 5G, Wi-Fi, Bluetooth, LEO satellite, etc.), multiband signals distribute in a large bandwidth (e.g., from 70 MHz to 8 GHz). Consequently, for network monitoring and spectrum sharing applications, a sniffer for extracting physical layer information, such as structure of packet, with low sampling rate (especially, sub-Nyquist sampling) can significantly improve their cost- and energy-efficiency. However, to achieve a multiband signals sniffer is really a challenge. To this end, we propose Sums, a system that can sniff and analyze multiband signals in a blind manner. Our Sums takes advantage of hardware and algorithm co-design, multi-coset sub-Nyquist sampling hardware, and a multi-task deep learning framework. The hardware component breaks the Nyquist rule to sample GHz bandwidth, but only pays for a 50 MSPS sampling rate. Our multi-task learning framework directly tackles the sampling data to perform spectrum sensing, physical layer protocol recognition, and demodulation for deep inspection from multiband signals. Extensive experiments demonstrate that Sums achieves higher accuracy than the state-of-the-art baselines in spectrum sensing, modulation classification, and demodulation. As a result, our Sums can help researchers and end-users to diagnose or troubleshoot their problems of wireless infrastructures deployments in practice.

The asymmetric workload attack is an application layer attack that aims to exhaust the Central Processing Unit (CPU) resources of a server. Some attackers exploit new features of the Hypertext Transfer Protocol version 2 (HTTP/2) to launch Multiplexed Asymmetric Workload DDoS (MAWD) attacks using a small number of bots, which can cause denial of service on HTTP/2 servers. Data centers in high-speed networks host a large number of web applications. However, most of the detection methods for asymmetric workload attacks rely on request semantic analysis, which cannot be applied to encrypted MAWD attack traffic in high-speed networks. Besides, traditional rate-based DDoS detection methods are ineffective in detecting MAWD because the MAWD attacks use legitimate HTTP requests, and HTTP/2 traffic is bursty in nature. This paper proposes a practical scheme to detect MAWD attacks in high-speed networks. We construct an effective feature set based on the characteristics of MAWD attacks in high-speed networks and design MAWD-HashTable (MAWD-HT) to extract features quickly. Experimental results on real traffic traces with speeds reaching Gbps demonstrate that our scheme can detect MAWD attacks within 3 seconds, with a recall rate of more than 99%, a FPR of less than 0.1%, and an acceptable resource consumption.

Traffic measurement is essential for network management. Sliding window models can provide network management tasks with flow statistics within the most recent window at any moment. However, most existing solutions over sliding windows are not designed for traffic measurement scenarios, therefore they have higher complexity and cannot be implemented on programmable hardware switches. To address the issues, we designed Ring Sketch, which is a generic, low-complexity, and hardware-friendly traffic measurement framework over sliding windows. Ring Sketch can not only be easily implemented on programmable hardware switches but can also accurately answer typical flow statistics queries by using different sketches. Then we propose the estimation strategies for Ring Sketch and theoretically analyze its error bounds. At last, we implement Ring Sketch on OVS-DPDK and a programmable hardware switch with a Tofino chip, and all the source codes are released on GitHub. The experimental results show that Ring Sketch has a throughput over 3x higher than the state-of-the-art Sliding Sketch, and in typical measurement tasks, Ring Sketch can achieve high measurement accuracy.

Using multiple unmanned aerial vehicles (UAVs) with backscatter communication to collect data from Internet of Things (IoT) devices has emerged as a promising solution. However, many existing UAVs path planning schemes for data collection suffer from performance degradation due to their limited consideration of the full collaboration of UAVs and dynamic stochastic environments. Therefore, we propose a path planning scheme for the data collection task in multi-UAV IoT based on multi-agent reinforcement learning (MARL) to minimize the task completion time. Due to the inherent asynchronous decision making among the agents, we model the path planning problem as a macro-action decentralized partially observable Markov decision process. Furthermore, we design an action mask mechanism to enhance data efficiency, which accelerates the training speed. Simulation results show that our scheme reduces the average task completion time by 15 %.

It is crucial to automatically detect anomalous patterns in system logs to protect computer systems from cyber attacks and malfunctions. However, as log data is becoming increasingly complex and labeled logs are difficult to obtain, it poses serious challenges to existing methods. To this end, this paper introduces the pre-training and fine-tuning paradigm to the log analysis domain and proposes a novel log anomaly detection framework. We propose the masked log reconstruction approach to pre-train a Transformer-based foundation model and fine-tune it for the event prediction task to obtain the anomaly detector. Our training methods exploit the sequential information within unlabeled logs with self-supervised learning. Experimental results on two public datasets demonstrate the performance superiority of our framework compared with existing state-of-the-art methods. More importantly, it is suitable for real-world scenarios where labeled logs are difficult to acquire.

Traffic measurement is critical for network manage-ment. The programmable networking paradigm paves the way for implementing fine-grained and accurate traffic measurement. However, in programmable networking, the programmable re-sources on hardware switches are highly limited. Most existing solutions have not considered the deployment of multiple traffic measurement tasks under resource constraints in programmable networks. To address the issue, we construct the network model and problem formulation, and we refer to this problem as the traffic measurement task deployment problem and prove it is NP-hard. To solve it, we proposed an approximate algorithm called Ant Colony Optimization with Dynamic Pruning (ACO-DP). We conducted simulations on the Fat-Tree topologies to evaluate the performance of ACO-DP. The evaluation results show that ACO-DP can achieve much higher overall measurement utility and faster convergence compared to other benchmark algorithms, and the solutions returned by ACO-DP are very close to the optimal solutions.

Wireless sensor networks (WSNs) enable intelligent collaborative perceptions in the Internet of Things. However, devices in WSNs are battery-powered with limited energy resources. During transmission, routing policies significantly affect the energy efficiency in terms of both energy consumption and energy balance among nodes, and further impact the network lifetime. Previous works mostly used heuristic fixed strategies to make routing decisions based on incomplete information in a distributed manner for lower control costs and faster calculation when facing numerous devices in WSNs, which easily lead to performance limitations and routing loops. To this end, we model the network lifetime maximization problem as a decentralized partially observable Markov decision process and propose a new scheme MeFi based on Mean Field Reinforcement Learning to perform real-time energy-efficient routing policies for WSNs. The utilization of Mean Field Theory effectively simplifies the intractable interactions among numerous agents and guides the policy training. Additionally, a prioritized-sampling loop-free algorithm is developed to eliminate routing loops and avoid routing policies with significant energy consumption. Experimental results show that our scheme outperforms several algorithms by up to 50%, significantly enhancing energy efficiency and extending WSN lifetime under different circumstances.

The fast anomaly detection and localization is essential for network management, however, it is also very challenging for the current networks due to the lack of flexible control and telemetry capabilities. Fortunately, the maturity of Deep Reinforcement Learning (DRL) and programmable networking technologies could shed a light on realizing fast and intelligent anomaly detection and localization. In the paper, we design a fast anomaly detection and localization system for programmable networks by leveraging the in-band network telemetry and flexible control capabilities of programmable networks. Based on the system, we propose a DRL-based abnormal link detection and localization algorithm. It can iteratively infer abnormal links based on the ingress-to-egress performance metrics of flows and the one-hop performance metrics of the flows on the already identified abnormal links. The simulation results show that our proposals can detect and localize link anomalies in a matter of seconds to tens of seconds with low network telemetry overhead.

Port scanning is an extensively used technique by attackers to probe for vulnerabilities in network systems. Since fast port scans can be effectively detected by many existing methods, some advanced attackers perform slow port scans in order not to be suspected. A highly stealthy slow scan can last for dozens of days, which brings significant challenges to current intrusion detection approaches. Besides, the existing port scan detection methods are all based on full traffic. They are not suitable for high-speed networks because of huge computational and storage resource consumption. According to the protocol characteristics and the connection patterns of port scans, we construct a traffic feature set that can not only distinguish the specific scan types, but also remain effective for the sampled traffic. Furthermore, we customize a data structure Scan Detection Sketch (SDS) for feature extraction. Experimental results using public datasets show that our method can detect slow port scans in a 10Gbps high-speed network with high accuracy and acceptable memory consumption. And the proposed method works well even for slow port scans lasting more than 60 days.

With the development of Mobile Edge Computing (MEC) and Internet of Things (IoT) technology, various real-time monitoring and control applications are deployed to benefit people’s daily life. The performance of these applications relies heavily on the timeliness of collected environmental information, which can be effectively quantified by the recently introduced metric named age of information (AoI). Although extensive researches have been conducted to optimize AoI under various circumstances, these works commonly require a priori information about the system dynamics that is usually unknown in realistic situations. To design a more practical scheduling algorithm, in this paper, we formulate the AoI minimization problem as a Constrained Markov Decision Process (CMDP) which can be solved by Reinforcement Learning (RL) algorithms without prior knowledge. To improve the running efficiency, we (1) introduce post-decision states (PDSs) to exploit the partial knowledge of the system’s dynamics, (2) perform a batch update in every learning step, (3) decompose the system-level value function into multiple device-level value functions, and (4) propose a heuristic algorithm to find the greedy action. Numerical results demonstrate that our algorithm is highly efficient and outperforms the benchmarks under various scenarios.

The integration of Mobile Edge Computing (MEC) and Wireless Power Transfer (WPT), which is usually referred to as Wireless Powered Mobile Edge Computing (WP-MEC), has been recognized as a promising technique to enhance the lifetime and computation capacity of wireless devices (WDs). Compared to the conventional battery-powered MEC networks, WP-MEC brings new challenges to the computation scheduling problem because we have to jointly optimize the resource allocation in WPT and computation offloading. In this paper, we consider the energy minimization problem for WP-MEC networks with multiple WDs and multiple access points. We design an online algorithm by transforming the original problem into a series of deterministic optimization problems based on the Lyapunov optimization theory. To reduce the time complexity of our algorithm, the optimization problem is relaxed and decomposed into several independent subproblems. After solving each subproblem, we adjust the computed values of variables to obtain a feasible solution. Extensive simulations are conducted to validate the performance of the proposed algorithm.

With an ambitious increase in the number of Internet of Things (IoT) terminals, IoT networks face a huge challenge which is providing diverse and complex network services with different requirements on a common infrastructure. To solve this challenge, Software Defined Network (SDN) and Network Function Virtualization (NFV) are adopted to build next-generation IoT networks which are softwarized and virtualized. This way, network functions are virtualized as Virtualized Network Functions (VNFs) and a network service consists of a set of VNFs. One of the main challenges for realizing this paradigm is the optimal resource allocation for VNFs. Most existing works assumed that services are represented as Service Function Chains (SFCs) which are chains. However, network services in IoT networks are more complex and diverse, therefore, more appropriate representations are Virtualized Network Function Forwarding Graphs (VNF-FGs) which are Directed Acyclic Graphs (DAGs). Previous works failed to exploit this special graph structure, which makes them sub-optimal or non-applicable for IoT networks. In this paper, we investigate the VNF-FG placing problem in dynamic IoT networks where DAG-represented services arrive and depart. To fully exploit the graph structures of services and handle the complexity of dynamic IoT networks, we combine a novel neural network structure Graph Neural Network (GNN) with Deep Reinforcement Learning (DRL) and propose an efficient algorithm for VNF-FG placing, which is called Kolin. Extensive simulation results suggest that Kolin outperforms the state-of-the-art solutions in terms of system cost, acceptance ratio, and computation complexity.

In recent years, with the rapid proliferation of smart devices, Mobile Edge Computing (MEC) has been regarded as a promising technique that provides computing services in proximity to end-users. To improve the performance of MEC systems, Collaborative Edge Computing (CEC) is proposed to balance the load among cooperative edge servers. In practice, however, edge servers belong to different MEC service providers (SPs) and they have no incentive to help others. To encourage the cooperation between self-interested SPs, in this paper, we propose a profit-sharing incentive mechanism based on the Shapley value. In addition to the desirable properties such as efficiency and fairness, we also proved that our mechanism induces optimal offloading strategies and provides every SP an incentive to join the coalition. To protect the private information of SPs, we defined an aggregate profit function for each SP and showed that revealing this function is sufficient to calculate the profit allocation. Simulation results demonstrate that the system performance and SPs' revenue are substantially improved under cooperation.

As one of the key concepts in the 5G network, MEC can support the latency-sensitive and compute-intensive services by widely deploying computing and storage capacity to the base stations at the network edge. Because these services are sensitive to latency, the joint optimization problem of task offloading and resource allocation needs to be solved in a short time. In this paper, we propose a Fast AI-assistant Solution for Task Offloading and Resource Allocation in MEC (FAST-RAM), which can directly solve the joint optimization problem leveraging a deep neural network. FAST-RAM can produce the offloading policy and resource allocation scheme in milliseconds. Meantime, our solution has near-optimal performance and sufficient feasibility under different network environments.

Software-Defined Networking (SDN) provides programmable, flexible and fine-grained traffic control capability, which paves the way for realizing dynamic and high-performance traffic measurement and traffic engineering. In the SDN paradigm, the traffic forwarding and measurement strategies are realized through flow tables stored in the Tenantry Content Addressable Memories (TCAM) of SDN switches. However, the number of TCAM entries in SDN switches is limited. In this paper, we aim to jointly optimize the Traffic Matrix Measurement (TMM) and Traffic Engineering (TE) process under the TCAM capacity and flow aggregation constraints in software-defined networks. We first formulate the joint optimization problem as a Mixed Integer Linear Programming (MILP) model. Then to get an initial traffic matrix for the joint optimization problem, we propose a simple flow rule generation strategy named Maximum Load Rule First (MLRF) to efficiently generate feasible flow rules, which are used to provide direct measurements for the traffic matrix measurement problem. At last, to solve the joint optimization efficiently, we propose two efficient heuristic algorithms named Traffic Matrix Measurement First (TMMF) and Traffic Engineering First (TEF), respectively. TMMF and TEF can generate feasible flow rules for realizing TMM and TE strategies. Our evaluations on real network topologies and traffic traces verify that by jointly optimizing the TMM and TE strategies, both TMMF and TEF can significantly improve TMM accuracy and TE objective (i.e., load balancing) with limited TCAM resource.

Video streaming service has been consuming a massive amount of Internet traffic during recent years. Even though Dynamic Adaptive Streaming over HTTP (DASH) has become the mainstream technology for improving users' Quality of Experience (QoE), the competing of multiple independent DASH streams could degrade the QoE and make unfair resource allocation. With the support of Software Defined Networking (SDN), it is possible to jointly optimizing resource allocation and bitrate adaptation in this competing scenario. In this paper, we propose FAIR-AREA, a fast Artificial Intelligence based joint optimization of rate adaptation and resource allocation of DASH service. With FAIR-AREA, we can solve this complex optimization problem only in milliseconds and achieve near optimal performance at the same time.

Mobile edge computing (MEC) is an emerging paradigm which has drawn much attention from the academy and industry. Leveraging 5G technique, MEC provisions the ability to support the latency-sensitive and compute-intensive services by deploying computing and storage capacity at the network edge. As one of the critical problems in MEC, resource allocation problem needs to be solved within a very short time to satisfy the low latency requirement of services. In this paper, we propose an Accelerator for Resource allocation in MEC (ARM), which can directly solve the resource allocation problem based on deep neural network. With the aid of our scale-free representation scheme and feasible guarantee algorithm, ARM can solve the problem in milliseconds. Meanwhile, our algorithm achieves near 2-factor approximation to the optimal solution.

Due to the hard constraint of measurement resources in switches, accurately and timely measuring a huge number of fine-grained flows is very challenging. To handle this challenge, we design FlowMap, which is a Bloom filter and hash-based approach to keep track of fine-grained flows with small bandwidth as well as computation and memory overheads. In each switch, FlowMap stores flow IDentifiers (IDs) in the FlowID table and encodes flow counters in the counting table with small memory space and constant operation time. To get the per-flow counters, FlowMap leverages the computing power of the remote controller to decode the encoded flow statistics collected from switches periodically. In addition, to achieve scalable flow counter decoding, FlowMap divides the cells of the counting table into several groups, and then uses a two-level flow mapping scheme to map flows to different groups, each of which can be decoded independently and concurrently at the remote controller. The simulation results show that FlowMap can provide per-flow counters with high accuracy for all the flows in short time scales with low overheads, and comparing with the existing approach, FlowMap is more scalable and robust.

Dynamic Adaptive Streaming over HTTP (DASH) has been broadly applied within most of mainstream video delivery services. At the same time, the lack of Quality of Experience (QoE) and the competition among several DASH streams have attracted significant attention. Aiming to supply better QoE for DASH streams in terms of video quality as well as starvation-free playing back, and achieve fairness among clients, we try to formulate the joint optimization of resource allocation and rate adaptation (JRA2) problem in this paper based on the information of streams' playout buffers and available network bandwidth. We first analyze the buffer behavior of a DASH stream using a modified version of M/D/1 queue and formulate the JRA2problem based on the analysis. To solve this problem, we propose an algorithm based on Generalize Benders Decomposition (GBD) to get optimal solution (JRA2-G) and devise one heuristic algorithm (JRA2-A) for acceleration. Based on the sufficient demonstrating results, the proposed algorithms can supply high-quality and smooth playing back for clients.

Hybrid Software-Defined Networking (HSDN) is a transitional networking form of SDN where SDN elements are partially deployed in traditional networks. Previous researches show that redirecting every flow of source-destination pair through at least one SDN switch can obtain flow manageability, e.g., access control and traffic measurement. Intuitively, the selection of SDN switch as the waypoint for every flow has a significant effect on the Traffic Engineering (TE) performance, such as maximum link utilization and routing efficiency. And it is worth noting that SDN switch can split traffic to the outgoing links to exactly profit the TE performance. In this paper, from the perspective of TE performance, we propose a flow routing and splitting (FRS) algorithm whereby we jointly determine an appropriate SDN switch for every flow as the waypoint, as well as optimizing the traffic splitting fractions for every SDN switch among its outgoing links to minimize the maximum link utilization. We conduct simulations with different SDN deployment rate. The results indicate that, when 20% of the SDN switches are deployed, the proposed FRS algorithm can obtain a lower maximum link utilization compared with other state-of-art works. Not only that, FRS algorithm can also generate a little longer paths for every flow on the average, which has a limited influence on the routing efficiency.

In-network content caching is an inherent capability of Content Centric Networking (CCN) architecture. Undoubtedly, efficient caching strategies can help CCN networks to achieve high performance content dissemination. In general, there are two types of caching strategies: collaborative and non-collaborative caching strategies. Compared with non-collaborative caching strategies, collaborative caching strategies have much better caching performance. However, collaborative caching strategies incur extra overhead (e.g., computation and communication). To make a trade-off between the performance and overhead, we propose a distributed lightweight collaborative in-network caching strategy in this paper, called Popularity Publishing based caching strategy (PopPub for short). PopPub uses a lightweight protocol to publish the content popularity statistics counted by edge routers to other routers, and caches different contents at different routers along the content delivery paths based on the popularities of the contents. To evaluate the performance of PopPub, we conduct both theoretical analysis and extensive simulations on different topologies. The evaluation results confirm that PopPub yields the best performance compared with several state-of-art caching strategies, and the extra overhead incurred by PopPub is low.

The increasing demand for media-rich content has driven many efforts to redesign the Internet architecture. As one of the major candidates, information-centric network (ICN) has attracted significant attention, where in-network cache is a key component in different ICN architectures. In this paper, we propose a novel framework for optimal cache management in ICNs which jointly considers caching strategy and content routing. Specifically, we propose a cache management framework for ICNs based on software-defined networking (SDN) where a controller is responsible for determining the optimal caching strategy and content routing via linear network coding (LNC). Under the proposed cache management framework, we formally formulate the problem of minimizing the network bandwidth cost by jointly considering caching strategy and content routing with LNC. We develop an efficient network coding based cache management (NCCM) algorithm to obtain a near-optimal caching and routing solution for ICNs. We further develop a lower bound of the problem and conduct extensive experiments to compare the performance of the NCCM algorithm with the lower bound. Simulation results validate the effectiveness of the NCCM algorithm and framework.