IEEE Transactions on Network and Service Management最新文献

NAGA: A Deterministic Programmable Network With Update Timing Guarantees NAGA：具有更新定时保证的确定性可编程网络

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-03-20 DOI: 10.1109/TNSM.2025.3553401

Nemanja Ðerić;Amir Varasteh;Andreas Blenk;Wolfgang Kellerer

{"title":"NAGA: A Deterministic Programmable Network With Update Timing Guarantees","authors":"Nemanja Ðerić;Amir Varasteh;Andreas Blenk;Wolfgang Kellerer","doi":"10.1109/TNSM.2025.3553401","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3553401","url":null,"abstract":"There is no system yet that provides predictable data plane and control plane operations in programmable networks. However, both predictable data plane and control plane operations are needed, e.g., in industrial networks. Particularly there, the operation of the network needs to be planned and, hence, relies on network operations that are deterministic and executed in a timely manner. To fill this gap, this paper proposes our system named <monospace>NAGA</monospace>, which provides data plane deterministic guarantees along with consistent and timely network updates in programmable networks. In order to not rely on specialized hardware, <monospace>NAGA</monospace> uses widely-available hardware capabilities such as priority queuing and label-based forwarding. Whereas the real implementation of <monospace>NAGA</monospace> in a P4-based testbed demonstrates that applications receive guaranteed performance in terms of latency and data rate, simulation studies show the ability of <monospace>NAGA</monospace> to be even deployed in large scale scenarios beyond industrial networks, such as wide area and data center networks.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1874-1888"},"PeriodicalIF":4.7,"publicationDate":"2025-03-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860976","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

P4-Secure: In-Band DDoS Detection in Software Defined Networks P4-Secure：软件定义网络带内DDoS检测

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-03-19 DOI: 10.1109/TNSM.2025.3552844

Liam Daly Manocchio;Yaying Chen;Siamak Layeghy;David Gwynne;Marius Portmann

{"title":"P4-Secure: In-Band DDoS Detection in Software Defined Networks","authors":"Liam Daly Manocchio;Yaying Chen;Siamak Layeghy;David Gwynne;Marius Portmann","doi":"10.1109/TNSM.2025.3552844","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3552844","url":null,"abstract":"Efficient detection of Distributed Denial of Service (DDoS) attacks in datacentres and corporate networks is an active research domain. This paper introduces, P4-Secure, an efficient approach for in-band detection of DDoS attacks, without using the controller resources and channel. The pure in-band implementation of DDoS detection, makes it a practical and viable solution for real-world network security applications, including large-scale backbone networks. The proposed DDoS detection uses an axis-aligned classifier based on the packet asymmetry metric, trained through the negative selection approach. The trained axis-aligned classifier was then implemented in the data plane using P4 programming and managed to classify network flows with a configurable false-positive ratio. Through experiments on two independent real-world network datasets (UQ and ISP) and the CAIDA DDoS attack dataset, the robustness of the proposed approach was evaluated across varying network characteristics. The approach demonstrated a notably superior performance in minimising false positives compared to alternative methods, with a rate of only 0.5%. This achievement was coupled with a 90% F1 score, highlighting its effectiveness in addressing DDoS attacks while avoiding unnecessary false alarms. The evaluation on real-world hardware demonstrates that P4-Secure incurs minimal overhead even at high packet rates, such as 8 Mpps, making it highly suitable for datacentres and backbone network security applications.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"2120-2137"},"PeriodicalIF":4.7,"publicationDate":"2025-03-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860793","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Adapting to the Evolution: Enhancing Intrusion Detection Through Machine Learning in the QUIC Protocol Era 适应演变：在 QUIC 协议时代通过机器学习加强入侵检测

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-21 DOI: 10.1109/TNSM.2025.3540753

Adam Kadi;Lyes Khoukhi;Jouni Viinikka;Pierre-Edouard Fabre

{"title":"Adapting to the Evolution: Enhancing Intrusion Detection Through Machine Learning in the QUIC Protocol Era","authors":"Adam Kadi;Lyes Khoukhi;Jouni Viinikka;Pierre-Edouard Fabre","doi":"10.1109/TNSM.2025.3540753","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3540753","url":null,"abstract":"The advent of the QUIC protocol may herald a significant shift in the composition of online traffic in the years to come. The transport layer encryption of the QUIC protocol is one of its main evolutions, especially for metadata that was previously transmitted over TCP traffic without encryption. This new protocol has the potential to require significant alterations in future Internet traffic analysis methods and impact network intrusion detection. On the other side, Machine learning has been used in several research projects to identify network intrusions, with positive outcomes. However, we must take into account new evolution of network traffic. In this paper, we propose a new approach that employs supervised machine learning algorithms to identify flows generated by bots interacting with a Web server during a DDoS attack, focusing on the challenges posed by the QUIC protocol and its implications for effective intrusion detection and cybersecurity. Our contribution in this work is divided into three main parts: 1) A guided process with model architecture for emulating and collecting traffic that depict a range of situations our system may encounter; 2) an analysis module that consists on the creation of two labeled datasets, where observations represent the traffic flows detected in PCAP files. We studied the relevance of different features for these datasets, contributing to a thorough understanding of the quality of the data used; 3) a real world experimention for evaluating the effectiveness of several supervised machine learning algorithms on our datasets. This experimentation allows us to determine which algorithm provides the best prediction results.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1929-1944"},"PeriodicalIF":4.7,"publicationDate":"2025-02-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860982","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Class Incremental Website Fingerprinting Attack Based on Dynamic Expansion Architecture 基于动态扩展架构的类增量式网站指纹攻击

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-20 DOI: 10.1109/TNSM.2025.3538895

Yali Yuan;Yangyang Du;Guang Cheng

{"title":"Class Incremental Website Fingerprinting Attack Based on Dynamic Expansion Architecture","authors":"Yali Yuan;Yangyang Du;Guang Cheng","doi":"10.1109/TNSM.2025.3538895","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3538895","url":null,"abstract":"Encrypted traffic on anonymizing networks is still at risk of being exposed to the Website Fingerprinting (WF) attack. This attack can seriously threaten the online privacy of users of anonymity networks such as Tor. While deep-learning-based WF attacks achieve high accuracy in controlled experimental settings, they cannot continuously learn after deployment. In real-world environments, new websites are constantly emerging, requiring attackers to expand their monitoring scope continuously. This necessitates attack models capable of continuous learning and expanding classification capabilities. In this paper, we explore how attackers can leverage incremental class learning techniques to continuously learn new classes while retaining the ability to distinguish old ones. This approach mitigates the catastrophic forgetting problem in dynamic, open-world scenarios. We introduce a new WF attack, Class Incremental Fingerprinting (CIF), which employs a scalable architecture enabling Class Incremental Learning (CIL) with limited resources. We evaluate this attack in various scenarios, such as learning 100, 200, and 500 monitored website classes across 5 and 10 incremental tasks, achieving an average accuracy of 97.8% and above. Additionally, we assess the CIF attack’s effectiveness in open-world multi-classification scenarios and test it in few-shot settings using the proposed data augmentation method, Mixtam, achieving an average task accuracy of 87.6% and above with only 30 samples per class.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1955-1971"},"PeriodicalIF":4.7,"publicationDate":"2025-02-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860833","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

VPN-Encrypted Network Traffic Classification Using a Time-Series Approach 使用时间序列方法进行 VPN 加密网络流量分类

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-20 DOI: 10.1109/TNSM.2025.3543903

Jaidip Kotak;Idan Yankelev;Idan Bibi;Yuval Elovici;Asaf Shabtai

{"title":"VPN-Encrypted Network Traffic Classification Using a Time-Series Approach","authors":"Jaidip Kotak;Idan Yankelev;Idan Bibi;Yuval Elovici;Asaf Shabtai","doi":"10.1109/TNSM.2025.3543903","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3543903","url":null,"abstract":"Network traffic classification provides value to organizations and Internet service providers (ISPs). The identification of applications or services from network traffic enables organizations to better manage their business, and ISPs to offer services to their users. Given the vast quantity of traffic flowing in and out of organizations, it is impractical to write manual signatures for traffic identification. The effectiveness of machine learning (ML) in the identification of applications or services from network traffic has been demonstrated. Even when network traffic is encrypted, ML algorithms achieve high accuracy in the task of traffic identification based on statistical information and the packets’ headers and payloads. However, existing approaches were shown to be ineffective for VPN-encrypted network traffic. In this study, we propose a novel time-series based approach for the identification of traffic/source applications on VPN-encrypted traffic. We also demonstrate the broad applicability of our proposed approach by evaluating its effectiveness on non-VPN traffic that is encrypted, and on IoT traffic.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"2225-2242"},"PeriodicalIF":4.7,"publicationDate":"2025-02-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860753","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Deterministic and Dynamic Joint Placement and Scheduling of VNF-FGs for Remote Robotic Surgery 远程机器人手术中vnf - fg的确定性和动态关节放置与调度

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-20 DOI: 10.1109/TNSM.2025.3539183

Amina Hentati;Amin Ebrahimzadeh;Roch H. Glitho;Fatna Belqasmi;Rabeb Mizouni

{"title":"Deterministic and Dynamic Joint Placement and Scheduling of VNF-FGs for Remote Robotic Surgery","authors":"Amina Hentati;Amin Ebrahimzadeh;Roch H. Glitho;Fatna Belqasmi;Rabeb Mizouni","doi":"10.1109/TNSM.2025.3539183","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3539183","url":null,"abstract":"During a Remote Robotic Surgery (RRS) session, multimodal data traffic with different requirements is initiated. In order to achieve a cost-effective deployment of such a system, it is crucial to tailor resource allocation policies based on the different quality of service (QoS) requirements of each data traffic. In this paper, we focus on resource allocation in a 5G-enabled tactile Internet RRS system using network function virtualization (NFV). In particular, we investigate the joint placement and scheduling of Virtualized Network Functions (VNFs) in a RRS system under both deterministic and dynamic settings. An integer linear program (ILP) is used to formulate the problem. Due to its high computational complexity, we first propose an efficient greedy algorithm to solve the ILP under deterministic settings. Simulation results show that our proposed algorithm achieves near-optimal performance and outperforms the benchmark solutions in terms of cost and admission rate. It can reduce cost by up to 37% and improve admission rate by up to 34% while satisfying both latency and reliability constraints. Furthermore, our results show that modeling the multimodal data traffic by multiple VNF Forwarding Graphs (VNF-FGs) with different QoS requirements achieves a significant gain in terms of cost and acceptance rate compared to modeling it by a single VNF-FG with the most stringent requirements. We then considered a dynamic environment where latency variations and traffic arrivals may occur over time. Using the principles of optimal stopping theory, we propose an adaptive dynamic scheduler that is capable of triggering recalculations of the existing optimal solution based on the observed cumulative number of traffic arrivals and latency violations without the need for predictions. Our proposed optimal scheduler minimizes the migration cost compared to other schedulers.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1841-1858"},"PeriodicalIF":4.7,"publicationDate":"2025-02-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860845","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

JLOS: A Cooperative UAV-Based Optical Wireless Communication With Multi-Agent Reinforcement Learning 基于多智能体强化学习的协同无人机光无线通信

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-18 DOI: 10.1109/TNSM.2025.3543160

Jiangang Liu;Hanjiang Luo;Hang Tao;Jiahong Liu;Jiehan Zhou

{"title":"JLOS: A Cooperative UAV-Based Optical Wireless Communication With Multi-Agent Reinforcement Learning","authors":"Jiangang Liu;Hanjiang Luo;Hang Tao;Jiahong Liu;Jiehan Zhou","doi":"10.1109/TNSM.2025.3543160","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3543160","url":null,"abstract":"In maritime Internet of Things (IoT) systems, leveraging a swarm of Uncrewed Aerial Vehicles (UAVs) and optical communication can achieve a variety of potential maritime missions. However, due to the high directionality of the optical beam and interference from the marine environment, the optical link via UAVs as relays is prone to interruption. To address this challenge, we propose a Joint Link Optimization Scheme (JLOS) that includes Wind Disturbance Resistance (WDR) and Adaptive Beamwidth Adjustment (ABA). In WDR, we first model the problem as a Partially Observed Markov Decision Process (POMDP), and then design a collaborative Multi-Agent Reinforcement Learning (MARL) approach to control a swarm of UAVs in windy conditions, to maintain mechanical stability and prevent link interruption. Furthermore, in ABA, to reduce uncertainties from control activities and environmental factors like sunlight and fog, we design an adaptive algorithm using distributed MARL. It adjusts beamwidth based on historical UAV locations and link Bit Error Ratio (BER) to improve communication reliability. Numerical simulations confirm its effectiveness in enhancing robust data transmission.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1345-1356"},"PeriodicalIF":4.7,"publicationDate":"2025-02-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143871088","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

GSA-DT: A Malicious Traffic Detection Model Based on Graph Self-Attention Network and Decision Tree 基于图自关注网络和决策树的恶意流量检测模型GSA-DT

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-12 DOI: 10.1109/TNSM.2025.3531885

Saihua Cai;Han Tang;Jinfu Chen;Tianxiang Lv;Wenjun Zhao;Chunlei Huang

{"title":"GSA-DT: A Malicious Traffic Detection Model Based on Graph Self-Attention Network and Decision Tree","authors":"Saihua Cai;Han Tang;Jinfu Chen;Tianxiang Lv;Wenjun Zhao;Chunlei Huang","doi":"10.1109/TNSM.2025.3531885","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3531885","url":null,"abstract":"Malicious attack has shown a rapid growth in recent years, it is very important to accurately detect malicious traffic to defend against malicious attacks. Compared with machine learning and deep learning technologies, <underline>graph <underline>convolutional neural <underline>network (GCN) achieves better detection results of malicious traffic due to additional consideration of the correlation between network traffic features. However, existing GCN-based detection models suffer from fixed weight assignment, only focusing on local features, lack the ability to model graph structure and relationships as well as having gradient disappearance. To solve these problems, this paper proposes the GSA-DT model based on <underline>graph <underline>self-<underline>attention network and <underline>decision <underline>tree. GSA-DT first preprocesses the original network traffic to obtain better traffic features and labels, and then uses GCN to extract the topological structure of network traffic as well as capture the correlation relationships among traffic features, where the ReLU activation function is replaced by LeakyReLU to overcome the problems of neuron “death” and gradient disappearance during the training process; It also introduces the self-attention mechanism into GCN to assign larger weights to the key features to reduce the interference of redundant features. Finally, GSA-DT uses decision tree to perform the detection of malicious traffic. Experimental results on four network traffic datasets show that GSA-DT model improves the detection accuracy over 1% on average than seven advanced malicious traffic detection models, and it also performs better in F1-measure, TPR, FPR as well as stability.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"2059-2073"},"PeriodicalIF":4.7,"publicationDate":"2025-02-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860843","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Decentralized Oracle Network Constructed From Weighted Schnorr Multisignature 利用加权施诺尔多重签名构建的去中心化甲骨文网络

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-10 DOI: 10.1109/TNSM.2025.3539615

Zhiwei Wang

引用次数: 0

Explainable and Energy-Efficient Selective Ensemble Learning in Mobile Edge Computing Systems 移动边缘计算系统中可解释和节能的选择性集成学习

IF 4.7 2区计算机科学

IEEE Transactions on Network and Service Management Pub Date : 2025-02-07 DOI: 10.1109/TNSM.2025.3539830

Lei Feng;Chaorui Liao;Yingji Shi;Fanqin Zhou

{"title":"Explainable and Energy-Efficient Selective Ensemble Learning in Mobile Edge Computing Systems","authors":"Lei Feng;Chaorui Liao;Yingji Shi;Fanqin Zhou","doi":"10.1109/TNSM.2025.3539830","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3539830","url":null,"abstract":"Explainable ensemble learning combines explainable artificial intelligence (XAI) and ensemble learning (EL) to solve the closed-box problem of EL and provide a clear and transparent explanation of the decision-making process in the model. As a distributed machine learning architecture, EL deploys base learners trained with local data at edge node and infers on target tasks, then combines the inference results of the participating base learners. However, selecting all base learners into EL may result in wasting more computing resources and not obtain better performance. To address this issue, we put forward the definition of confidence level (ConfLevel) on the basis of XAI and verify its effectiveness as the metric of selecting the base learner. Then, we take the joint optimization model of considering high ConfLevel and low computing power to determine the participating base learners for selective ensemble learning (SEL). Due to the non-convex and combinatorial nature of the problem, we propose a node selection and power control algorithm on the premise of Benders’ Decomposition (referred to BD-NSPC) to obtain the global optimal solution efficiently. In addition, simulation results show that BD-NSPC consumes about 30% less energy per EN on average and improves accuracy by 1-2% compared to other SEL algorithms. Besides, compared with federated learning (FL) framework, BD-NSPC reduces the energy consumption by about 25% and the latency by about 28%, achieving comparable accuracy in the edge computing system.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1744-1759"},"PeriodicalIF":4.7,"publicationDate":"2025-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860752","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0