In a paper published in Cluster Computing, Jasmine Kaur, Inderveer Chana and Anju Bala introduce an enhanced version of a serverless simulation framework that adds a virtual machine layer between physical servers and the containers that actually run user code. On top of that more realistic architecture, they bolt on a multi-agent reinforcement learning technique known as proximal policy optimization, or PPO, to decide where workloads should go. The results are striking: cold start latency drops by up to 29 percent, the number of active physical machines falls by as much as 66 percent, and energy consumption shrinks by up to 23 percent. For an industry under mounting pressure to curb the enormous electricity appetite of data centers, those numbers carry real weight.

To understand why the virtual machine layer matters, it helps to look at how serverless platforms are actually built. In principle, containers, lightweight packages of software that share the host operating system’s kernel, could run directly on physical machines. That is precisely how ServlessSimPro, the earlier simulation platform on which the new work builds, modeled the world. But in production deployments at major cloud providers and in popular open-source platforms such as Knative and OpenFaaS, containers are almost always nested inside virtual machines. The VM adds an extra boundary of isolation and security, but it also introduces an additional layer of resource management, with its own scheduling decisions, consolidation opportunities and performance overheads.

By ignoring that layer, earlier simulators produced results that diverged from what operators actually observe. A scheduling algorithm that looks brilliant in a flat, container-on-metal simulation may behave very differently when it must first choose a virtual machine, and only then a container within it. The enhanced framework bridges this architectural gap, giving researchers a testbed whose resource abstractions mirror the deployment models used in the real world. That matters because simulation is where most scheduling research lives: few academic groups can run experiments on hyperscale infrastructure, so the fidelity of the simulator effectively determines how transferable their ideas are.

The second half of the contribution is the scheduling brain itself. Rather than a single centralized controller making every placement decision, the researchers deploy multiple reinforcement learning agents, each powered by proximal policy optimization, working in parallel across the simulated cluster. PPO is a policy-gradient method that has become a favorite of the reinforcement learning community because it makes steady, clipped updates to its decision policy, avoiding the catastrophic performance collapses that can plague more aggressive learning algorithms. Each agent is responsible for a slice of the scheduling problem: deciding where containers should be placed, when virtual machines should be consolidated onto fewer physical hosts, and how incoming workloads should be distributed across the fleet.

Decentralization is not just an aesthetic choice. In a large data center, a single scheduler becomes a bottleneck and a single point of failure, and the state of the system grows so large that no one agent can see everything at once. Multi-agent architectures let decisions happen closer to the resources they affect, and the multi-agent formulation of PPO, often abbreviated MAPPO, allows the agents to learn coordinated behavior despite their partial views. The approach builds on the authors’ earlier work on multi-agent deep Q-learning for serverless job scheduling, but PPO’s more stable training dynamics make it better suited to the high-dimensional, continuous decisions involved in juggling containers, VMs and workloads simultaneously.

The headline metric, cold start latency, deserves particular attention because it is the Achilles’ heel of serverless computing. When a function is invoked and no warm instance exists, the platform must provision a container from scratch, an operation that can add hundreds of milliseconds or more to response time. For latency-sensitive applications, from interactive web services to real-time data pipelines, those milliseconds are the difference between a seamless experience and a visibly sluggish one. By learning placement and consolidation policies that keep likely-to-be-needed functions warm and co-located with available capacity, the MAPPO-driven scheduler cuts cold starts by nearly a third in the reported experiments.

The efficiency gains are equally significant. Consolidating workloads so that up to 66 percent fewer physical machines need to stay active is a dramatic reduction, and it cascades directly into the 23 percent cut in energy consumption. Data centers are among the fastest-growing consumers of electricity worldwide, and idle servers draw substantial power even when they process nothing. Any technique that lets operators switch off more of the fleet, without degrading the responsiveness users feel, translates into both lower costs and lower carbon emissions. The fact that the framework achieves these savings while simultaneously improving latency suggests the agents are finding genuinely smarter trade-offs, not merely shifting costs from one column to another.

The study also situates itself within a rapidly maturing ecosystem of simulation tools. Open-source options such as FaasSim, FaaS-Sim and SimFaaS have given researchers starting points for modeling function-as-a-service platforms, and commercial offerings from AWS, Microsoft Azure, Google Cloud and IBM have defined the de facto behavior the simulators try to capture. What has been scarce, the authors argue, is a comprehensive platform that combines realistic multi-layer resource modeling with the ability to train and evaluate learning-based schedulers. By pairing the VM-aware architecture with MAPPO, the framework becomes both a measurement instrument and a training ground, letting researchers prototype scheduling policies that can be benchmarked consistently before any real-world trial.

The broader significance of the work lies in the convergence of two trends: the industrial consolidation around serverless architectures and the rapid advance of multi-agent reinforcement learning as a practical tool for systems management. As edge computing, Kubernetes-based orchestration and energy-aware provisioning continue to reshape how cloud infrastructure is organized, the ability to simulate those systems faithfully, and to let learning agents discover scheduling policies that human engineers might never hand-design, could define the next generation of cloud efficiency. The Thapar Institute team’s framework offers the research community a way to explore that future at scale, on a laptop rather than a data center, and with an architectural honesty that earlier tools lacked. If the reported gains hold when such policies migrate from simulation to production clusters, the invisible machinery of the cloud may soon be run by algorithms that learned their craft in a simulator, one carefully modeled virtual machine at a time.

Subject of Research: VM-aware serverless simulation and multi-agent reinforcement learning for cloud job scheduling

Article Title: VM-aware serverless simulation framework with multi-agent proximal policy optimization for scalable and efficient job scheduling

Article References: Kaur, J., Chana, I., & Bala, A. (2026). VM-aware serverless simulation framework with multi-agent proximal policy optimization for scalable and efficient job scheduling. Cluster Computing, 29(13), Article 758. https://doi.org/10.1007/s10586-026-06585-w

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06585-w

Keywords: serverless computing, simulation framework, virtual machines, multi-agent reinforcement learning, proximal policy optimization, job scheduling, cold start latency, energy efficiency, cloud computing, resource utilization, container orchestration, data centers

The study, published open access in the journal Cybersecurity by José Manuel Ortega Candel, Francisco José Mora Gimeno and Higinio Mora Mora, makes a sharp distinction between two attack classes that are often conflated. Distributed Denial of Service attacks aim to exhaust computational resources and render a system unavailable to legitimate users. Denial of Wallet attacks, by contrast, exploit the pay-per-use billing model itself. An attacker floods a serverless application with invocation requests, forcing the platform to auto-scale and execute thousands of billable function instances. The service may remain perfectly accessible throughout the assault; the damage appears instead on the monthly invoice, in the form of invocation charges and compute time measured in gigabyte-seconds. The authors argue that treating this as an availability problem, as conventional DDoS detection does, misses the point: the harm is economic, and every undetected attack invocation carries a direct, quantifiable monetary cost.

Because the monetary loss is only the visible consequence of a technical exploitation, the team’s primary objective is not to measure financial damage after the fact but to intercept the abnormal invocation behavior that triggers it. Their threat model assumes an attacker with black-box knowledge of publicly accessible HTTP trigger endpoints, no access to internal monitoring or billing systems, and full control over invocation rates and payloads. Crucially, the detection system operates only on execution metadata that platforms such as AWS CloudWatch and Azure Monitor already expose in real time: function name, trigger type, invocation timestamp and execution duration. No request content inspection or deep packet analysis is required, which keeps the approach lightweight and privacy-preserving.

The heart of the proposed architecture is a two-stage pipeline. The first stage computes Shannon entropy, a classical information-theoretic measure of randomness, over serverless execution features within sliding time windows. Rather than measuring entropy over network-layer features like IP addresses or ports, as DDoS detectors do, the model calculates it over the distribution of function invocation types, meaning pairs of function names and trigger categories, together with execution-duration buckets. This choice is deliberate: each invocation type carries a distinct cost profile, and an attacker seeking to maximize billing will inevitably alter this distribution, either by flooding a single expensive function or by spreading calls across many functions to exploit auto-scaling. A deviation in the entropy of this distribution therefore directly signals a change in billing-relevant behavior, even when the underlying traffic looks entirely legitimate at the network layer.

The entropy stage acts as a rapid triage filter with three tiers. Traffic whose entropy falls below a lower threshold is classified as clearly benign and never reaches the computationally expensive AI models. Values above an upper threshold are flagged immediately as suspicious with near-zero false negatives. Ambiguous transactions in the intermediate range are forwarded to the second stage, where supervised machine learning and deep learning classifiers perform precise analysis. Because a missed attack costs money while a false alarm does not, the threshold calibration is explicitly optimized to minimize the false negative rate, an inversion of the availability-focused logic of conventional DDoS systems. Dynamic thresholds computed from the mean and standard deviation of a rolling baseline of the five most recent windows allow the system to track gradual workload shifts such as daily traffic cycles without mislabeling them as attacks. A sensitivity factor of 2.5 was selected empirically, covering roughly 98.76 percent of normal traffic under a Gaussian assumption, and a persistence counter requires anomalies to survive across multiple consecutive windows before a formal alert is raised.

To train and evaluate the second-stage classifiers, the researchers had to overcome a fundamental obstacle: no publicly available labeled datasets for serverless Denial of Wallet attacks existed. They built one by combining a purpose-built DoW traffic simulator with fourteen days of real telemetry from the Microsoft Azure Functions dataset, incorporating call time series, execution durations and memory usage, and then augmenting the result with synthetic transactions generated by Generative Adversarial Networks. The final dataset contains 187,087 transactions. All experiments used Python on Google Colab with GPU and TPU acceleration, and the code and models have been released for independent verification.

The evaluation reveals a nuanced picture of when the hybrid architecture pays off. Under the optimal first-stage configuration, a 480-minute window with a low threshold, the entropy filter captured 83.08 percent of transactions as suspicious with a false negative rate of just 0.44 percent. Among the second-stage models, the bidirectional long short-term memory network, or BiLSTM, emerged as the recommended classifier, achieving a precision of 0.9810 and test accuracy of 0.9890, thanks to its ability to model invocation sequences in both forward and backward directions and capture temporal dependencies that static classifiers miss. For resource-constrained deployments, the simpler GRU architecture offers a more efficient alternative.

The most striking results concern computational efficiency under realistic attack densities. Because the original dataset contained an unrealistically high proportion of malicious traffic, roughly 70 percent, the entropy stage could filter out at most the legitimate minority. So the researchers expanded the dataset to 200,000 transactions and progressively reduced the attack density from 60 percent down to 1 percent, mirroring production conditions where attacks are rare. As the attack ratio fell, the efficiency gain of the entropy pre-filter soared. At a 1 percent attack transaction rate, the LSTM network achieved a processing gain of 91.95 percent, BiLSTM reached 91.11 percent, and the K-Neighbors classifier led traditional machine learning methods at 80.05 percent, all while maintaining F1-scores above 0.97 and ROC-AUC above 0.98 for the deep learning models. In other words, the hybrid design delivers its greatest savings precisely in the low-attack-density conditions that real serverless deployments actually experience, cutting the compute burden of security monitoring by more than nine tenths without degrading detection quality.

The authors are candid about the limits of their work. The evaluation was conducted offline on batch data, and the synthetic dataset, however carefully constructed, cannot fully replicate cold-start latency distributions, provider-specific concurrency throttling, billing rounding granularities and the workload heterogeneity of live production environments. They also note that under their specific test configuration, where attack traffic dominated, the two-stage pipeline actually imposed more total overhead than running the AI classifier alone; the entropy stage functioned primarily as an early-warning triage rather than a bulk traffic reducer in that regime. Future work will focus on large-scale deployment on OpenFaaS, an open-source platform that avoids commercial billing costs during attack experiments, and integration with cloud cost management APIs such as AWS Cost Explorer and Azure Cost Management, enabling alerts the moment projected spending exceeds user-defined thresholds.

For an industry betting its economics on serverless computing, the study arrives at an opportune moment. Major cloud providers handle ever-growing transaction volumes, and the same auto-scaling that makes functions resilient to downtime makes them exquisitely vulnerable to financial exhaustion. By re-deriving a decades-old information-theoretic concept for the peculiar anatomy of function invocations, and pairing it with deep learning classifiers that remember how workloads unfold over time, the Alicante team has produced the first hybrid methodology built specifically around the economics of Denial of Wallet attacks rather than adapted from DDoS playbooks. The message for cloud architects is clear: in the serverless era, the firewall that matters most may be the one guarding your budget.

Subject of Research: Hybrid entropy and AI-based detection of Denial of Wallet attacks in serverless computing

Article Title: Hybrid model for detecting Denial of Wallet attacks in serverless architectures

Article References: Candel, J. M. O., Gimeno, F. J. M., & Mora Mora, H. (2026). Hybrid model for detecting Denial of Wallet attacks in serverless architectures. Cybersecurity, 9(1), Article 221. https://doi.org/10.1186/s42400-026-00663-7

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00663-7

Keywords: serverless computing, Denial of Wallet, cybersecurity, Shannon entropy, deep learning, BiLSTM, FaaS, cloud billing, anomaly detection, machine learning, Azure Functions, GAN data augmentation

The headline numbers tell a story of explosive growth. Metric mentions across the reviewed studies surged from just three in 2020 to fifty-three in 2024, a roughly seventeen-fold expansion that mirrors the maturation of Function-as-a-Service platforms such as AWS Lambda, Azure Functions, and Google Cloud Run. Latency emerged as the dominant research focus, accounting for approximately 31 percent of all 149 metric mentions, followed by cost at 24 percent of the 80-study dataset. This emphasis is hardly surprising: in serverless environments, where functions spin up in ephemeral containers only when triggered by events, every millisecond of delay translates directly into degraded user experience and, thanks to pay-per-use billing, real money. The review’s authors found that roughly 30 percent of the analyzed studies addressed two or more metrics simultaneously, with latency-cost and latency-cold start pairs being the most common combinations—a clear signal that researchers increasingly treat performance optimization as a multi-objective problem rather than a single-variable puzzle.

At the heart of the serverless performance challenge sits the notorious cold start problem. When a function is invoked after a period of inactivity, the platform must provision a new container, allocate CPU and memory, load the function’s code and dependencies, and perform initialization tasks—all before a single line of business logic executes. The review quantifies this cumulative burden as the sum of container preparation time and dependency installation time across a set of functions, and notes that delays can range from milliseconds to several seconds depending on memory allocation, package size, runtime choice, and workload burstiness. Because scale-to-zero policies deliberately terminate idle containers to save money, cold starts are not an accidental flaw but an inherent feature of the serverless economic model, which is precisely why mitigating them without inflating costs has become such an active battleground.

The mitigation arsenal documented in the review is remarkably diverse. Pre-warming strategies keep pools of initialized containers ready for immediate use, while prebaking techniques initialize functions ahead of anticipated demand peaks—effective during predictable load surges but wasteful during quiet periods. Container reuse and sharing approaches hold initialized environments for subsequent invocations, and hybrid models combining these tactics have shown greater cold start reductions than any single method alone. Architectural innovations such as the Function Delivery Network maintain functions in a warm state and orchestrate execution windows, reporting 97 percent less resource use and 45 percent faster responses in serverless video and scientific applications. Application-level solutions also play their part: the FaaSLight framework loads only indispensable code segments on demand, cutting runtime memory usage by up to 57.84 percent without introducing observable latency during warm starts.

Where traditional heuristics reach their limits, machine learning has stepped in with impressive results. The review identifies deep reinforcement learning as the leading ML paradigm in the field, appearing in 10 percent of the studies and excelling at sequence-dependent decision-making where temporal dependencies matter. Concrete numbers underscore the appeal: multi-agent DRL systems have reduced latency by 23 percent and request failures by 34 percent on Azure traces spanning 1,800 functions, while a Proximal Policy Optimization-based model cut cold starts by 38.75 percent, improved memory utilization by 46.73 percent, and decreased overhead by 48.53 percent. Context-aware probabilistic caching achieved a 62.1 percent reduction in system cost and a 69.1 percent drop in cold-start frequency on 14 days of Azure serverless traces. These are not marginal tweaks—they represent order-of-magnitude improvements in how serverless platforms manage the tension between readiness and resource waste.

Yet the review is refreshingly honest about the constraints of learning-based approaches. Gradient-boosted ensemble models such as XGBoost, LightGBM, and CatBoost dominate short-term invocation forecasting because they are accurate and lightweight, but their performance degrades sharply when historical data is sparse or when workloads exhibit concept drift. DRL controllers, for their part, carry substantial training overhead and exploration costs, and their benefits diminish in stable, low-variance environments where simple heuristics deliver comparable performance at a fraction of the complexity. Most models also remain tightly tuned to specific providers or testbeds such as OpenWhisk or AWS traces, making transfer to heterogeneous cloud-edge environments far from trivial. The authors recommend online learning, continual retraining, and multi-objective formulations as the most sustainable paths forward, particularly for deployments where latency, cost, energy, and service-level objectives must be balanced simultaneously.

Cost optimization emerges as perhaps the most economically consequential thread in the analysis. Fine-grained billing models based on GB-seconds or vCPU-hours mean that memory allocation decisions directly shape expenditure: larger allocations execute faster but cost more per second, while leaner configurations prolong execution and can paradoxically increase total charges. The review highlights techniques such as Multi-Layer Container Reuse, which matches containers on base-image similarity rather than exact equality and significantly cuts cold start times, indirectly reducing the need for expensive pre-warming. Metrics like wasted memory time enable dual-objective optimization where providers can tune a parameter to prioritize either reduced startup delays or lower memory waste. Balanced provisioning strategies, meanwhile, consistently outperform greedy allocation under dynamic workloads, avoiding the trap of spending heavily early only to gain little for later requests.

Not everything in the serverless performance landscape is flourishing. Throughput stands out as the review’s most glaring gap, with only five mentions across six years of literature and zero studies recorded in 2025—a stagnation the authors classify as critically under-researched, especially for high-concurrency streaming and healthcare IoT workloads where request volume is the binding constraint. Resource allocation, by contrast, shows a steady upward trajectory from 2023 onward, driven largely by multi-tenant scheduling research and DRL-based approaches. The review also points to sustainability as an underexploited opportunity: serverless architectures can reduce energy consumption by up to 70 percent and operational costs by up to 60 percent compared to traditional always-on provisioning, yet energy-aware scheduling that incorporates power models into optimization objectives remains rare. The authors argue that energy consumption and carbon intensity deserve promotion to first-class metrics alongside latency and cost.

The practical guidance flowing from this synthesis is strikingly concrete. Platform developers are advised to prioritize warm-pool sizing and scaling-threshold tuning in multi-tenant settings, and to adopt learning-based schedulers only where workloads are genuinely non-stationary—because DRL’s gains of 23 to 38 percent in latency and cold-start reduction simply do not justify its training overhead for stable traffic. Application developers, meanwhile, should match the optimization paradigm to workload shape, right-size memory and package configurations deliberately, and benchmark latency-cost trade-offs before deployment to locate the inflection point beyond which added resources yield diminishing returns. For researchers, the message is equally clear: treat throughput as an independent optimization target, address cross-platform generalizability and drift head-on, and build unified multi-objective frameworks that integrate latency, cost, energy, and SLA compliance—ideally through DRL-based multi-agent systems.

What emerges from this landmark review is a field in transition, moving decisively from static, rule-based configurations toward autonomous, adaptive optimization powered by machine learning. The seventeen-fold growth in performance research between 2020 and 2024 confirms that serverless computing has graduated from experimental curiosity to production-grade infrastructure serving IoT deployments, AI inference pipelines, and big data analytics. But the transition is incomplete. Hybrid architectures combining serverless elasticity with serverful stability, stateful abstractions for long-running workloads, and cross-platform portable intelligence all remain open frontiers. If the trajectory documented here continues, the next generation of serverless platforms may well manage their own performance—predicting demand, pre-warming containers, and balancing budgets in real time—leaving developers free to do what the paradigm always promised: simply write code.

Subject of Research: AI-driven performance optimization strategies and key metrics in serverless cloud computing, analyzed through a systematic literature review of 80 studies published between 2020 and 2025.

Article Title: AI-driven performance optimization strategies and key metrics in serverless cloud computing: A systematic literature review

Article References: Jarallah, Z. F., Alhussian, H. S., Sumiea, E. H., Eltahir, M., Aziz, N., Abri, A. W. A., Almuniri, I. S., Saidu, Y., & Adamu, S. (2026). AI-driven performance optimization strategies and key metrics in serverless cloud computing: A systematic literature review. Machine Learning with Applications, 25, Article 100994. https://doi.org/10.1016/j.mlwa.2026.100994

Image Credits: AI Generated

DOI: 10.1016/j.mlwa.2026.100994

Keywords: serverless computing, Function-as-a-Service, cold start latency, deep reinforcement learning, machine learning, cloud optimization, auto-scaling, resource allocation, cost optimization, systematic literature review, edge computing, predictive scaling