The emergence of Internet connectivity has led to a significant increase in the volume and complexity of cyber attacks. Abnormal behavior detection systems are valuable tools for ensuring the security in computer networks. However, due to the huge amount and ever increasing diversity of the intrusions, the existing intrusion detection systems, which use machine learning techniques to learn a classifier based on a handcrafted feature vector, are not robust enough to detect sophisticated attacks which cause a high false alarm rate. Therefore, building a flexible in-depth defense system to detect abnormal behavior requires an ability to automatically learn powerful features and analyze large amounts of network traffic. To address these concerns, this paper proposes a novel distributed approach for the detection of abnormal behavior in largescale networks. The developed model discovers the abnormal behavior from large-scale network traffic data using a combination of a deep feature extraction and multi-layer ensemble support vector machines (SVMs) in a distributed way. First, we perform a non-linear dimensionality reduction, achieved through a distributed deep belief networks on large-scale network traffic data. Then, the obtained features are fed to the multi-layer ensemble SVM. The construction of the ensemble is accomplished through the iterative reduce paradigm based on Spark. Empirical results show a promising gain in performance compared with other existing models.

Deep learning (DL) greatly enhances binary anomaly detection capabilities through effective statistical network characterization; nevertheless, the intrusion class differentiation performance is still insufficient. Two related challenges have not been fully explored. 1) Statistical attack characteristics are overemphasized while ignoring inherent attack topologies; sequence features are extracted from whole traffic flows, but the interaction evolution of each IP pair over time is rarely considered, such as in long short-term memory (LSTM) and gated recurrent units (GRUs). 2) Meeting the need for many high-quality labeled data samples is an expensive and labor-intensive task in large-scale, complex, and heterogeneous networks. To address these issues, we propose a dynamic line graph neural network (DLGNN)-based intrusion detection method with semisupervised learning. Our model converts network traffic into a series of spatiotemporal graphs. A dynamic GNN (DGNN) is employed to extract spatial information from each discrete snapshot and capture the contextual evolution of communication between IP pairs through consecutive snapshots. Moreover, a line graph realizes edge embedding expressions corresponding to network communications and strengthens the message aggregation ability of graph convolution. Experiments on 6 novel datasets demonstrate that our approach achieves 98.15–99.8% accuracy in abnormality detection with fewer labeled samples. Meanwhile, state-of-the-art multiclass performance is achieved, e.g., the average detection accuracy for DDoS across the 6 datasets reaches 95.32%.

Deep learning (DL) greatly enhances cyber anomaly detection capabilities through effective statistical network characteristic. However, previous methods have not fully addressed two real-world scenario-driven challenges. 1) Frequent node access and disconnection sourced from free-bounded 5G/B5G cyberspace introduce unfamiliar communication behavior patterns, reducing the detection ability of the pre-trained DL model. 2) Low-frequency or sporadic communication behaviors lack stable patterns, posing a challenge for existing AI-driven models, including DL-based detection methods. To address these issues, we propose a cyber anomaly detection framework based on Continuous Temporal Graph (CTG) neural network from a new interaction-centered perspective. The proposed framework refines the concrete information interaction between network entities into the CTG evolution process, thereby naturally incorporating new node access behaviors into feature extraction on CTG neural network. We furthermore present a message aggregation scheme on CTG with fusion of spatio-temporal neighborhood, the actual time distribution and the historical state, thus transforming communication into a more stable pattern for the learning of low-frequency interactions. Extensive experiments on 4 novel datasets, including ToN-IoT, UNSWNB15, CIC-Dark2020, J.P. Morgan payment, demonstrate that our approach outperforms state-of-the-art methods, particularly in detecting new access and low-frequency behaviors.

Edge computing offloading in remote areas is a challenging problem in 5 G and 6 G studies, since edge cloud infrastructures are often unavailable in remote areas. In these areas, using drones instead of infrastructures to provide edge computing services can be an efficient solution. However, the limited coverage of drones makes it challenging to provide effective edge computing services. In this paper, we propose an edge computing architecture based on the cooperation among the drones with and without edge servers to provide edge computing services for the users, where the computing tasks are transmitted in multi-path and multi-hop in a Mobile Ad hoc Network (MANET). To extend the lifetime of a MANET while ensuring service quality, we formulate a joint optimization problem, which assigns a suitable computing drone, a transmission path and a task division scheme for each task. The problem is investigated using a Software Defined Network (SDN) controller, which can get a partial solution of the problem through a greedy algorithm. By adding a task arrival order constraint, we approximate the original problem as a multi-path multi-hop task transmission problem, which can be solved according to the movement state of a MANET. Specifically, when a MANET is stationary, we propose a traversal method to obtain the optimal solution of the approximate problem; when a MANET is dynamic, we propose a heuristic scheme to get a suboptimal solution of the problem based on average rate. Experimental results show that our scheme has a better performance compared to typical existing ones.

Multi-access edge computing (MEC) has been booming in recent years, as it promises to fulfill the growing low-latency requirements of applications on large amounts of Internet of things (IoT) devices. Nevertheless, as latency-sensitive applications tend to become more complicated, existing schemes are too sophisticated, which may result in exceeding the real-time requirements of IoT systems. In this paper, we investigate the task offloading problem for the multi-device multi-edge server IoT system integrated with MEC. Firstly, according to the performance gains obtained by offloading different subtasks, we formalize a system latency minimization problem with energy utilization consideration, which has been proven to be NP-hard. Then, to address it, we propose a heuristic computation offloading scheduling scheme, which offloads appropriate subtasks to edge servers such that the system latency is minimized. Additionally, we theoretically prove the upper and lower boundaries of the system latency. Extensive simulation results corroborate that the proposed algorithm is low-complexity yet effective in decreasing the system latency by 16.15% (and up to 51.18%), improving the energy efficiency of local devices by 8.97% (and up to 21.69%) and shortening the offloading strategy execution time by 96.33% (and up to 98.95%).

With the rapid development of mobile Internet and urban constructions, high-volume and dynamic indoor communications bring challenges to cellular systems. High penetration loss and deep shadowing channels of indoor users may substantially degrade the transmission efficiency and system throughput. To address this issue, this paper proposes a solution using Floating Relay (FR) given the mature technologies of unmanned aerial vehicle (UAV). We target the undesirable channel conditions of indoor users, introduce the FR into the cellular system to improve transmission efficiency and maximize system throughput. Considering the capacity limit of the FR's back-haul link and the maximum transmission power of each user, an optimization problem is formulated to maximize the system throughput. The optimal power allocation strategy is then obtained for each user, and two effective online 3-D placement algorithms are proposed for the FR to approach the optimal location in the unpredictable and predictable scenarios, respectively. Extensive simulations are conducted. The achieved maximum system throughput, convergence rate, and accumulated throughput are used to evaluate the proposed algorithms. According to the comparisons between the two proposed algorithms and with off-line schemes, they show superiorities in their targeted scenarios, respectively.