{"title":"Calling the Shots: Constraint-Aware Honeypoint Orchestration for Cloud-Native Anomaly Response","authors":"Weiyong Zhang;Wenjun Yao;Yuan Liu;Hui Lu;Zhihong Tian","doi":"10.1109/TSC.2026.3712455","DOIUrl":"10.1109/TSC.2026.3712455","url":null,"abstract":"Cloud-native anomaly response increasingly requires joint reasoning over evidence from both the attack side and the system side. Existing analysis pipelines can identify anomalous services, likely causes, and propagation paths, but they do not directly determine which response action should be taken, where deceptive resources should be placed, or how the response should adapt when new interaction evidence appears. To address this gap, we propose H4Cloud, a constraint-aware honeypoint orchestration framework for cloud-native anomaly response. H4Cloud unifies attack-side evidence, diagnosis outputs, operational constraints, and runtime feedback into a response framework for control and orchestration, models runtime risk states, performs constraint-aware utility maximization under explicit resource and business-impact constraints, translates selected strategies into cloud-native orchestration actions, and updates the defense topology through runtime feedback. Experiments on six joint datasets and a controlled Kubernetes runtime validation show that H4Cloud improves response effectiveness while preserving an interpretable benefit–cost tradeoff and executable orchestration behavior.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 5","pages":"3402-3415"},"PeriodicalIF":6.2,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148432175","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Chenxuan Hou, Chao Qiu, Tiantian Cao, Xiaoxu Ren, Hongyang Du, Xiaofei Wang, Haipeng Yao
{"title":"Sustainable Resource Management Based on Fluid Model for Crowdsourced Edge-Cloud System","authors":"Chenxuan Hou, Chao Qiu, Tiantian Cao, Xiaoxu Ren, Hongyang Du, Xiaofei Wang, Haipeng Yao","doi":"10.1109/tsc.2026.3728537","DOIUrl":"https://doi.org/10.1109/tsc.2026.3728537","url":null,"abstract":"","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"35 1","pages":""},"PeriodicalIF":8.1,"publicationDate":"2026-08-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148852375","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Toward Reliable and Secure Cloud Services With Fault-Tolerant Searchable Encryption","authors":"Cong Zuo;Bingjing Wang;Jianghua Liu;Shujie Cui;Jun Shao;Huaxiong Wang;Liehuang Zhu;Giovanni Russello","doi":"10.1109/TSC.2026.3698022","DOIUrl":"10.1109/TSC.2026.3698022","url":null,"abstract":"Dynamic Searchable Symmetric Encryption (DSSE) plays a crucial role in secure cloud-based database systems, as it enables efficient keyword search and dynamic updates over encrypted data. However, practical deployment of DSSE schemes faces two significant challenges. First, clients may inadvertently perform faulty updates—such as re-adding an existing keyword-identifier pair or attempting to delete a non-existent one—which can compromise the correctness of subsequent search results. Second, even with correctly issued updates, malicious servers may return incorrect or incomplete search results, undermining data integrity. To address these challenges, we propose <monospace>FVDSSE</monospace>, the first fault-tolerant DSSE scheme that tolerates client-side operational faults and provides result verifiability against malicious servers. Moreover, it simultaneously ensures strong privacy by guaranteeing forward and backward privacy—two essential properties for any practical DSSE. To further optimize performance, we present <monospace>FVDSSE-C</monospace>, an enhanced variant that leverages caching techniques. Experimental evaluations on a real-world dataset show that <monospace>FVDSSE-C</monospace> achieves up to <inline-formula><tex-math>$130times$</tex-math></inline-formula> improvement in search efficiency and <inline-formula><tex-math>$3times$</tex-math></inline-formula> reduction in communication overhead compared to the state-of-the-art scheme (<monospace>YCR22-C</monospace>).","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"3126-3139"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288579","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Shaohu Li;Yubo Wang;Jin Zhou;Xinxin Li;Weizhi Meng;Bei Gong;Yong Wang
{"title":"ROMA: Enhancing Container OOM Resilience via Reinforced Isolation and Adaptive Shared Resource Reclamation","authors":"Shaohu Li;Yubo Wang;Jin Zhou;Xinxin Li;Weizhi Meng;Bei Gong;Yong Wang","doi":"10.1109/TSC.2026.3698682","DOIUrl":"10.1109/TSC.2026.3698682","url":null,"abstract":"Container-based virtualization is a cornerstone of modern cloud orchestration, but the shared-kernel architecture also introduces subtle risks to memory isolation. Our study shows that Linux cgroups and the default Out-of-Memory (OOM) mechanism lack sufficient container context when selecting victim processes. As a result, a malicious container may disrupt critical co-located services and leave behind unreclaimed shared resources, such as POSIX/SysV shared memory, message queues, semaphores, and tmpfs files. These residual resources can accumulate over time and eventually lead to denial-of-service conditions. To address this problem, we propose ROMA, an adaptive memory-governance framework for containerized environments. ROMA introduces container awareness into the OOM handling path while maintaining low runtime overhead. It combines eBPF-based monitoring with two lightweight LSM hooks to confine OOM victim selection to the offending container and to proactively reclaim shared resources left behind after OOM events. Extensive experiments show that ROMA incurs only a 6.94% throughput overhead across eight workloads. Under up to eight concurrent attackers, ROMA preserves isolation, avoids collateral kills, reclaims all leaked resources, and keeps recovery time within 6.9 seconds. In 24-hour runs with up to 64 containers, ROMA remains stable with low CPU and memory overhead, negligible event loss, and limited impact on benign services.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"3015-3028"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11540439","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288580","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Yang Zhang;Xi Zhang;Chunhao Dong;Chaoshuai Li;Grant Meredith
{"title":"Automated Refactoring for Conditional Branching","authors":"Yang Zhang;Xi Zhang;Chunhao Dong;Chaoshuai Li;Grant Meredith","doi":"10.1109/TSC.2026.3696354","DOIUrl":"10.1109/TSC.2026.3696354","url":null,"abstract":"Conditional branching provides a fundamental structure for executing a specific branch based on the value of a boolean expression at run-time. However, repeated or nested conditional branching can lead to increased complexity. Furthermore, fall-through semantics in conditional branching result in uncontrollable jumps. Refactoring conditional branching manually is error-prone, time-consuming, and tedious. There is a critical need to provide automated refactoring support for conditional branching. To this end, this paper presents <italic>ReBrancher</i>, an automated refactoring approach to eliminate repeated or nested conditional branching. Firstly, <italic>ReBrancher</i> parses source code into an abstract syntax tree and walks through conditional branching statements. Secondly, it removes redundant fall-through semantics by static program analysis and an automaton. The automaton is constructed from a control flow graph to match patterns of conditional branching. Finally, it converts a conditional branching into a <italic>switch</i> expression and removes the fall-through semantics. <italic>ReBrancher</i> was evaluated on nine real-world projects involving 25,137 conditional branchings. Experimental results show that a total of 1,790 conditional branching constructs are refactored within an average of 18.62 seconds per project. Furthermore, <italic>ReBrancher</i> reduced the average cyclomatic complexity by 4.41% and removed 1,249 code smells, demonstrating its effectiveness in improving code quality.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"2702-2715"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148290563","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Intelligent Cooperative Computation Offloading and Resource Allocation for Dual-Dependency Tasks in Edge Computing","authors":"Zhixiu Yao;Yun Li;Qilie Liu;Shichao Xia;Yi Jiang","doi":"10.1109/TSC.2026.3709905","DOIUrl":"10.1109/TSC.2026.3709905","url":null,"abstract":"Mobile edge computing (MEC) has accelerated the development of artificial intelligence and Internet of Things technologies, leading to the explosive growth of intelligent applications characterized by resource intensity and latency sensitivity, such as image processing and smart home. In practice, an application typically consists of multiple tasks with execution dependencies, where the output of some tasks serves as the input for specific others. Recently, the design of computation offloading methods for such execution-dependent tasks has received extensive research. However, computation offloading for execution-dependent tasks with service dependencies in resource-constrained multi-user, multi-edge-server cooperative MEC systems has not been thoroughly studied. In this paper, we formulate a cooperative computation offloading problem for dual-dependency tasks in multi-edge-server scenarios with limited service and computing resources, aiming to minimize the long-term average service delay for multiple users. To solve this problem, we propose a recurrent multi-agent reinforcement learning-based dual-dependency task offloading (RMA-DepO) algorithm, which enables users to communicate during training to explore and learn optimal joint task offloading and computing resource allocation strategies, and to make distributed offloading decisions at execution time. Simulation results demonstrate that the proposed RMA-DepO algorithm outperforms several baselines under different network settings, demonstrating its effectiveness in coordinating edge resources for cooperative computation of dual-dependency tasks.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"2843-2856"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148383986","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Wei Tang;Congfeng Jiang;Guangming Wang;Junming Liu
{"title":"Microservices Anomaly Detection Based on Adaptive Wavelet Convolutional Networks and Transformer","authors":"Wei Tang;Congfeng Jiang;Guangming Wang;Junming Liu","doi":"10.1109/TSC.2026.3701934","DOIUrl":"https://doi.org/10.1109/TSC.2026.3701934","url":null,"abstract":"Microservice architecture, characterized by loose coupling, elastic scalability, and independent deployment, has become the de facto standard for cloud-native services. However, in production systems, the complex interaction topologies among microservices can easily trigger cascading failures, which severely compromise system reliability and operational stability. This paper proposes an anomaly detection method for microservices that integrates adaptive wavelet convolutional networks and Transformer architecture. Specifically, the proposed method leverages a wavelet convolutional network to preprocess time-series data, while a weighted inverse transformer combined with a frequency-band attention mechanism is utilized to capture multi-scale time–frequency features of different microservices. Moreover, a dual-branch GRU-Transformer structure is then used to model both long- and short-term dependencies as well as cross-metric correlations among services. Therefore, anomaly scores can be derived through the joint optimization of prediction and reconstruction models. To overcome the challenge of threshold determination, this paper also proposes a two-stage gradient-based optimization algorithm that adaptively converges the threshold range using finite differential methods. Experimental results show that the proposed method is effective on datasets such as SMD (Server Machine Dataset), ASD (Application Server Dataset) and the NASA Anomaly Detection Dataset SMAP, where its average F1 score on SMD exceeds that of existing approaches by 11.0%, while on the SMAP dataset, an accuracy of 96.40% is achieved. These results confirm that the proposed approach can effectively detect anomalies in industrial level microservices, thereby enhancing the stability and reliability of industrial service systems.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"2929-2942"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11557239","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148694822","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Guozeng Xu;Xiuhua Li;Junhao Wen;Qiang He;Xiaofei Wang;Victor C. M. Leung
{"title":"Collaborative Knowledge Editing for Large Language Model Services in Edge-Cloud Computing","authors":"Guozeng Xu;Xiuhua Li;Junhao Wen;Qiang He;Xiaofei Wang;Victor C. M. Leung","doi":"10.1109/TSC.2026.3703848","DOIUrl":"10.1109/TSC.2026.3703848","url":null,"abstract":"With the rapid deployment of large language model (LLM) technology across various fields, numerous LLMs have been deployed on edge servers (ESs) to provide low-latency generative services for edge devices. However, as factual knowledge evolves, the massive number of parameters in LLMs poses significant challenges for updating LLMs on ESs. Existing studies employ federated fine-tuning to update LLMs, but these unconstrained updating approaches can lead to overfitting and knowledge forgetting, while also resulting in substantial overhead. Knowledge editing (KE), as a promising technology, ensures the injection of new knowledge while preserving existing knowledge by editing specific parameters. In this paper, we propose multi-ES collaborative KE for the first time and design the CoKE and pCoKE frameworks in edge-cloud scenarios. These frameworks enhance editing efficiency by extracting identical expressions of the same knowledge across different LLM parameters for collaborative editing across multiple ESs. Additionally, we incorporate a personalized selection module in pCoKE to provide domain-specific generative services on ESs. To further reduce editing latency, we design a binary search-based resource allocation algorithm to balance editing latency across ESs. Extensive experiments demonstrate that CoKE and pCoKE reduce editing latency by 73% while maintaining high editing quality. Moreover, pCoKE achieves an approximately 6% improvement in editing quality.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"2730-2745"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288509","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Defense Against Membership Inference Attacks via Normalizing Flow-Based Adversarial Sample","authors":"Guangxu Xie;Yang Xiao;Qingqi Pei;Haibo Huang","doi":"10.1109/TSC.2026.3697251","DOIUrl":"10.1109/TSC.2026.3697251","url":null,"abstract":"An attacker can determine if a specific input belongs to a deep learning model’s training set by analyzing the complete confidence vector output, known as a membership inference attack. To counter this type of attack, a common defense strategy is to add adversarial noise to the confidence vector to enhance the model’s resilience. However, existing research indicates that defenses against adversarial examples may introduce new security risks to membership inference defenses via adversarial examples. Against this backdrop, this paper proposes a more robust adversarial example defense strategy. By generating adversarial examples with distributions similar to normal samples, we can reduce the impact of distributional differences on the defense model’s security. Leveraging normalizing flow, adding noise to the hidden layer of a flow model trained on normal samples generates adversarial examples that resemble normal ones, enhancing defense robustness. Additionally, limiting the information accessible to the attack model further strengthens robustness. To accelerate convergence, a bidirectional mean update method is employed. The proposed strategy demonstrates effectiveness not only in defending against membership inference attacks but also in mitigating attribute inference attacks. Finally, experiments on real-world datasets validate the effectiveness of the proposed strategy.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"2776-2787"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288552","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Efficient Microservice Autoscaling Through $mu$Opt","authors":"Emilio Incerto;Roberto Pizziol;Mirco Tribastone","doi":"10.1109/TSC.2026.3696863","DOIUrl":"10.1109/TSC.2026.3696863","url":null,"abstract":"Microservices have become the architecture of choice for cloud applications requiring high performance and scalability. Autoscaling, which dynamically adjusts resource allocation based on workload fluctuations, is key to optimizing performance and controlling costs. This paper presents <inline-formula><tex-math>$mu$</tex-math></inline-formula>Opt, a computationally efficient, model-based autoscaler specifically designed for microservices. <inline-formula><tex-math>$mu$</tex-math></inline-formula>Opt leverages a nonlinear optimization problem tied to a fluid approximation of a layered queuing network (LQN) model to determine optimal configurations that maximize key performance metrics—such as throughput, CPU usage, and response time—while minimizing operational costs. On a well-known benchmark application, our numerical experiments show that <inline-formula><tex-math>$mu$</tex-math></inline-formula>Opt achieves fast solution times, enabling responsiveness to dynamic workloads. Compared to a state-of-the-art LQN-based autoscaler employing genetic algorithms, <inline-formula><tex-math>$mu$</tex-math></inline-formula>Opt delivers improved application performance using fewer resources. To demonstrate the robustness and generalizability of our underlying model, we validate its prediction accuracy across ten randomly generated applications with diverse architectures, showing that its performance is a reliable foundation for autoscaling. Finally, it also outperforms Horizontal Pod Autoscaler, a production-ready solution for Kubernetes deployments in Google Cloud Platform, consistently reducing resource usage while more accurately tracking CPU utilization targets across both synthetic and real-world workloads.","PeriodicalId":13255,"journal":{"name":"IEEE Transactions on Services Computing","volume":"19 4","pages":"2801-2814"},"PeriodicalIF":6.2,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148290565","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}