Software Defined Networking (SDN) centrally manages the network data layer to improve the programmability and flexibility of networks by the controller. Because of centralized control, SDN is vulnerable to Distributed Denial of Service (DDoS) attacks. In order to protect the security of SDN, a method based on K-means++ and Fast K-Nearest Neighbors (K-FKNN) is proposed for DDoS detection in SDN, and the modular detection system is presented in the controller. The detailed experiments are conducted to evaluate the system performance. The results of the experiments show that K-FKNN improves the detection accuracy and efficiency of K-Nearest Neighbors (KNN), and has high precision and stability of DDoS detection in SDN.

Software-defined networking (SDN) emerges as an innovative network paradigm, which separates the control plane from the data plane to improve the network programmability and flexibility. It is widely applied in the Internet of Things (IoT). However, SDN is vulnerable to DDoS attacks, which can cause network disasters. In order to protect SDN security, a DDoS detection method using cloud-edge collaboration based on Entropy-Measuring Self-organizing Maps and KD-tree (EMSOM-KD) is designed for SDN. Entropy measurement is utilized to select the ideal SOM map and classify SOM neurons considering the limitation of dead and suspicious neurons. EMSOM can detect most flows directly and filter out a few doubtable flows. Then these flows are fine-grained, identified by KD-tree. Due to the limited and precious resources of the controller, parameter computation is performed in the cloud. The edge controller implements DDoS detection by EMSOM-KD. The experiments are conducted to evaluate the performance of the proposed method. The results show that EMSOM-KD has better detection accuracy; moreover, it improves the KD-tree detection efficiency.

Aiming at the problem that the search efficiency of key vulnerable nodes in large-scale networks is not high and the consideration factors are not comprehensive enough, in order to improve the time and space efficiency of search and the accuracy of results, a key vulnerable node discovery method based on Bayesian attack subgraphs and improved fuzzy C-means clustering is proposed. Firstly, the attack graph is divided into Bayesian attack subgraphs, and the analysis results of the complete attack graph are quickly obtained by aggregating the information of the attack path analysis in the subgraph to improve the time and space efficiency. Then, the actual threat features of the vulnerability nodes are extracted from the analysis results, and the threat features of the vulnerability itself in the common vulnerability scoring standard are considered to form the clustering features together. Next, the optimal number of clusters is adaptively adjusted according to the variance idea, and fuzzy clustering is performed based on the extracted clustering features. Finally, the key vulnerable nodes are determined by setting the feature priority. Experiments show that the proposed method can optimize the time and space efficiency of analysis, and the fuzzy clustering considering multiple features can improve the accuracy of analysis results.

A central obstacle to the practical deployment of Reinforcement Learning (RL) is the prevalence of sparse rewards, which often necessitates task-specific dense signals crafted through costly trial-and-error. Automated reward decomposition and return–redistribution methods can reduce this burden, but they are largely semantically agnostic and may fail to capture the multifaceted nature of task performance, leading to reward hacking or stalled exploration. Recent work uses Large Language Models (LLMs) to generate reward functions from high-level task descriptions, but these specifications are typically static and may encode biases or inaccuracies from the pretrained model, resulting in a priori reward misspecification. To address this, we propose the Metacognitive Introspective Reward Architecture (MIRA), a closed-loop architecture that treats LLM-generated reward code as a dynamic object refined through empirical feedback. An LLM first produces a set of computable reward factors. A dual-loop design then decouples policy learning from reward revision: an inner loop jointly trains the agent’s policy and a reward-synthesis network to align with sparse ground-truth outcomes, while an outer loop monitors learning dynamics via diagnostic metrics and, upon detecting pathological signatures, invokes the LLM to perform targeted structural edits. Experiments on MuJoCo benchmarks show that MIRA corrects flawed initial specifications and improves asymptotic performance and sample efficiency over strong reward-design baselines.

As supply chains expand in scale and the number of participating nodes increases, existing consensus algorithms are increasingly showing limitations in scalability, communication complexity, and handling complex network environments. To address the shortcomings of blockchain consensus mechanisms in master node selection, scalability, and communication complexity in supply chain traceability scenarios, this paper proposes a blockchain hybrid consensus optimization algorithm named Node Rating-Based and Grouping Raft cluster Practical Byzantine Fault Tolerance (NG-RPBFT) for supply chain traceability. This algorithm builds a multi-index comprehensive rating model for nodes to comprehensively evaluate consensus nodes, reasonably groups consensus nodes, adopts an inter-group and intra-group dual consensus mechanism to achieve efficient data synchronization, and introduces Brotli data compression technology to optimize message load, effectively enhancing system performance. Experimental results confirm that this algorithm significantly improves the scalability of the consensus mechanism and performs exceptionally well in consensus efficiency, making it suitable for complex application scenarios such as supply chain traceability under CPS scenarios.