The increasing volume of time series signals and the scarcity of labels make time series anomaly detection (TSAD) a natural fit for self-supervised deep learning. However, existing normality-based approaches face two key limitations: relying on a single assumption often fails to capture the whole normality, leading to biased representations; and they typically presume clean training data, which is unrealistic in practice and undermines model robustness. In this article, we propose RoCA, a unified and robust anomaly detection (AD) framework that simultaneously addresses assumption incompleteness and data contamination. The key insight is that normal samples tend to satisfy multiple normality assumptions, whereas anomalous or contaminated samples should violate at least one. RoCA employs a composite loss function consisting of a multinormality alignment term, a dynamic anomaly-aware term, and a variance term to maintain training stability. This design enables RoCA to dynamically discover and push away latent anomalies during training to refine the boundary, eliminating the dependence on precisely labeled, high-purity training data. Extensive experiments on both univariate and multivariate time series datasets demonstrate that RoCA consistently outperforms state-of-the-art methods, achieving up to 7.3% improvement under real-world contamination. Our theoretical analysis further reveals the intrinsic synergy between contrastive learning (CL) and one-class classification (OC) under the RoCA framework. The source code is available at the anonymous repository https://github.com/ruiking04/RoCA

The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models (LLMs) offer strong semantic understanding and zero-shot reasoning, but current LLM-based detectors typically depend on code-centric or single-dimensional evidence, making them susceptible to obfuscation and limiting comprehensive behavior analysis. We present , a multimodal agent collaborative framework for dynamic Android malware detection. dynamically collects multimodal runtime evidence and employs ReAct-based specialized agents to analyze complementary behavioral views. The detection process begins by identifying visual deception cues, modeling UI state transitions, and integrating runtime API behaviors to fuse multi-dimensional evidence across user-visible interfaces and hidden backend operations. Experiments on temporally and distributionally unseen datasets show that achieves an accuracy of 90.06% without fine-tuning, outperforming state-of-the-art baselines and demonstrating strong zero-shot generalization against Android malware concept drift.

With the rapid evolution of Android applications, traditional machine learning-based detection models suffer from concept drift. Additionally, they are constrained by shallow features, lacking deep semantic understanding and interpretability of decisions. Although Large Language Models (LLMs) demonstrate remarkable semantic reasoning capabilities, directly processing massive raw code incurs prohibitive token overhead. Moreover, this approach fails to fully unleash the deep logical reasoning potential of LLMs within complex contexts. To address these limitations, we propose MARD, a multi-agent framework for robust Android malware detection. This framework effectively bridges the gap between the semantic understanding of LLMs and traditional static analysis. It treats underlying deterministic analysis engines as on-demand execution tools, while utilizing the LLM to orchestrate the entire decision-making process. By designing an autonomous multi-agent interaction mechanism based on the ReAct paradigm, MARD constructs a highly interpretable evidentiary chain for conviction. Furthermore, we radically reduce the total cost of conducting a deep analysis of a single complex APK to under $0.10. Evaluations demonstrate that, without any domain-specific fine-tuning, MARD achieves an F1 score of 93.46%. It not only outperforms continual learning baselines but also exhibits robustness against concept drift and strong cross-domain generalization capabilities in evaluations spanning up to five years.

Graph Neural Networks (GNNs) have found widespread application in malware detection tasks in recent years, aiming to uncover the malicious nature of target processes by aggregating neighborhood information via different relations. However, current GNN-based malware detection models are primarily designed for static graphs or fixed-window dynamic graphs; they often overlook the correlation between distinct continuous behaviors and specific attacks (e.g., code injection), leading to a disruption in the attack's continuity and incurring substantial computing overhead. This paper introduces a novel model dubbed DynMD, designed to enhance the efficiency of malware detection on streaming behavioral data via energy-based dynamic graph representation learning. Concretely, DynMD investigates an energy function to adaptively partition windows, facilitating the construction of a lossless malware dynamic heterogeneous graph. More importantly, DynMD proposes a unique time-aware dynamic graph learning method to capture energy-concordant dynamic neighborhoods. This approach involves both intra-graph and inter-graph message propagation, promoting dynamic graph learning while avoiding time-consuming and repetitive computations. Experimental results on three real-world malware datasets show that DynMD improves detection accuracy by up to 3.99% and achieves detection 3.81x to 5.33x faster than the MG-DVD framework, identifying malware within an average of 40 seconds of execution.

We establish a rigorous framework that identifies imaginarity as a fundamental resource inherent in quantum coherence. By means of a geometric decomposition, we partition coherence into distinct imaginarity and residual components, thereby revealing a universal hierarchical relationship among these resources. For bipartite systems, this decomposition provides explicit bounds on the extent to which nonlocal correlations and imaginarity limit local coherence generation. Furthermore, we devise an explicit operational protocol that converts imaginarity into usable coherence, demonstrating the direct interconvertibility of these resources under physically admissible operations. The dynamical evolution under diagonal Hamiltonians is fully characterized, showing that while total coherence is conserved, imaginarity and residual coherence exhibit complementary oscillations. Our results provide a rigorous geometric and operational characterization of imaginarity as a fundamental constituent of quantum coherence, offering concrete insights for resource management in distributed quantum technologies. The geometric framework and theoretical bounds established herein are fully general, while the explicit conversion protocol and dynamical analysis serve as a compelling proof-of-principle demonstration in qubit systems.

Multimodal dialogue intent recognition fuses complementary signals from diverse modalities to infer users’ underlying intentions, serving as a cornerstone of intelligent conversational systems. However, existing methods often assume equal reliability across modalities and fail to account for whether each modality causally contributes to the predicted intent, making them sensitive to noise and distribution shift. To address this, we propose CaMoD, a causal-aware modality denoising framework that introduces a fine-grained, dynamic causal routing mechanism to explicitly model the causal impact of each modality. Furthermore, to effectively train this mechanism, we design a multi-objective training framework that combines a causal consistency loss and a diversity regularizer to strengthen causal reasoning while preventing routing collapse, alongside a counterfactual sample generation strategy constructing samples with explicit modality-reliability patterns to enhance causal learning. Extensive experiments show that CaMoD significantly outperforms strong baselines, and the ablation studies further demonstrate the effectiveness of our proposed designs.

This article proposes a hybrid machine learning model for detecting abnormal events in the power dispatch automation system. The model extracts features from both temporal and spatial dimensions to enhance algorithm performance and accurately locate anomalies. An unsupervised anomaly scoring mechanism is introduced to improve the detection of hidden anomalies. The study is divided into four parts: first, a time-space feature fusion model is developed for more accurate abnormal point localization; second, the model’s real-world effectiveness is validated through deployment in grid fault detection; third, dynamic fusion of time-series and high-dimensional spatial features demonstrates strong adaptability, with potential for applications in federated learning and data privacy protection; finally, it discusses the need for improvement in the model’s generalization ability when handling extreme cases.

In vehicle lateral stability control, accurately estimating the vehicle's lateral state is crucial. Vehicle state estimation is influenced by model accuracy, filter algorithms, and sensor accuracy, which are typically assumed to be affected by Gaussian noise. However, non-Gaussian noise often interferes with sensors in actual driving conditions, leading to decreased estimation accuracy and affecting subsequent stability analysis and control research. Traditional Kalman filters exhibit low accuracy and robustness under non-Gaussian noise conditions. This paper proposes the Maximum Correntropy Criterion Square Root Cubature Kalman Filter algorithm (MCCSCKF). By fusing signals from multiple vehicle sensors, the MCCSCKF processes non-Gaussian noise using the Maximum Correntropy Criterion and integrates it with the Square Root Cubature Kalman Filter to estimate the sideslip angle and yaw rate. The accuracy and robustness of the MCCSCKF algorithm are verified through comparisons with traditional Kalman filter variants under double-shift conditions at high-speed, low-adhesion, and fishhook conditions at medium-speed, low-adhesion in the MATLAB/Simulink co-simulation platform. Under high-speed conditions, the maximum estimation error of the sideslip angle using MCCSCKF is 0.003 rad, with a root mean square error (RMSE) reduction of 38.8%, significantly better than the UKF's 90.5%. Under medium-speed conditions, the maximum sideslip angle error is 0.002 rad, with an RMSE of 12.2%. Finally, in real-vehicle tests using the VBOX-3iSL, the maximum sideslip angle error of the MCCSCKF is 0.0025 rad, with an RMSE of 9.7%, representing a 20.5% reduction compared to the SCKF, validating its superiority and robustness.

The accumulation of time-series signals and the absence of labels make time-series Anomaly Detection (AD) a self-supervised task of deep learning. Methods based on normality assumptions face the following three limitations: (1) A single assumption could hardly characterize the whole normality or lead to some deviation. (2) Some assumptions may go against the principle of AD. (3) Their basic assumption is that the training data is uncontaminated (free of anomalies), which is unrealistic in practice, leading to a decline in robustness. This paper proposes a novel robust approach, RoCA, which is the first to address all of the above three challenges, as far as we are aware. It fuses the separated assumptions of one-class classification and contrastive learning in a single training process to characterize a more complete so-called normality. Additionally, it monitors the training data and computes a carefully designed anomaly score throughout the training process. This score helps identify latent anomalies, which are then used to define the classification boundary, inspired by the concept of outlier exposure. The performance on AIOps datasets improved by 6 (COCA). On two large and high-dimensional multivariate datasets, the performance increased by 5 performance on both univariate and multivariate datasets. The source code is available at https://github.com/ruiking04/RoCA.

Due to the complexity of network scenarios and inaccurate state observations, zero-trust defense (ZTD) architecture, which fundamentally operates as a defense mechanism based on user trustworthiness, is commonly modeled as partially observable markov decision process (POMDP). Existing control methods on zero-trust defense processes primarily evaluate trustworthiness in a model-based Bayesian manner, losing their generality. To overcome the difficulty of obtaining model knowledge in practical applications, this paper proposes a model-free reinforcement learning (RL) approach based on recurrent actorcritic (RAC) framework as the zero-trust policy engine. This method does not rely on observation matrix or state transition information. Instead, it uses a recurrent neural network (RNN) to assess trustworthiness from records of past observations, which is more aligned with real-world scenarios characterized by limited information and unknown attack types. To validate the effectiveness of the proposed method, we simulate a zerotrust attack-defense scenario by combining security datasets with real-world data. The proposed methods achieve excellent control performance in the simulated environment.

Knowledge graphs (KGs) have emerged as a powerful paradigm for structuring and leveraging diverse real-world knowledge, which serve as a fundamental technology for enabling cognitive intelligence systems with advanced understanding and reasoning capabilities. Knowledge graph reasoning (KGR) aims to infer new knowledge based on existing facts in KGs, playing a crucial role in applications such as public security intelligence, intelligent healthcare, and financial risk assessment. From a task-centric perspective, existing KGR approaches can be broadly classified into static single-step KGR, static multi-step KGR, dynamic KGR, multi-modal KGR, few-shot KGR, and inductive KGR. While existing surveys have covered these six types of KGR tasks, a comprehensive review that systematically summarizes all KGR tasks particularly including downstream applications and more challenging reasoning paradigms remains lacking. In contrast to previous works, this survey provides a more comprehensive perspective on the research of KGR by categorizing approaches based on primary reasoning tasks, downstream application tasks, and potential challenging reasoning tasks. Besides, we explore advanced techniques, such as large language models (LLMs), and their impact on KGR. This work aims to highlight key research trends and outline promising future directions in the field of KGR.

Accurately identifying network attacks is crucial for maintaining network security. However, these attacks are often hide within massive volumes of network traffic, posing significant challenges for traditional detection methods. Supervised learning approaches require substantial labeled data and struggle to adapt to unknown attack types, while unsupervised methods face difficulties in accurately pinpointing specific attack categories. To address these limitations, we propose a novel fewshot learning model for network flow attack classification based on graph contrastive learning. Our model leverages contrastive learning to enhance feature representation and generalization capabilities, enabling high-accuracy attack detection even with limited training data. Specifically, we first construct a multi- graph representation of network traffic and segment the data into snapshots. Then, we perform graph data augmentation within each snapshot to generate augmented sample pairs, which are used to pre-train the model via contrastive learning. Finally, we fine-tune the model parameters to achieve multi-class attack classification, leveraging the learned feature representations to identify various attack types, even those unseen during training. Experimental results demonstrate that our model exhibits excellent generalization ability and achieves high attack detection performance, even with limited training data.

The rapid development and increasing evolution of malware necessitate novel defensive techniques with high accuracy and minimal false positives to safeguard information systems against potential threats. Unfortunately, current malware detection methods, primarily relying on deep learning to identify malicious fingerprints from extensive training sets, prove ineffective against few-shot and evolving malware variants. To address these challenges, this paper introduces MalIRL, which designs a model-free inverse reinforcement learning (IRL) mechanism to automatically capture the evolving attack intent of malware. Specifically, MalIRL explores six representative categories of malware actions and employs sliding windows to organically divide the massive malware execution event stream into multiple attack stages, achieving a reduced action space and state space. To model dynamic malicious environments, MalIRL proposes an instant dynamic heterogeneous graph representation learning technique. This technique learns state representations of different malware attack stages, enhancing detection accuracy and efficiency by incrementally capturing the newly added contextual semantics of diverse malware entities and relations. In experiments with three real-world malware datasets, MalIRL surpasses existing state-of-the-art methods, particularly in few-shot malware detection scenarios, MalIRL exhibits performance benefits of up to 18.9%.

As smart grid development advances, anomaly detection and verification of distribution network topology have become crucial for ensuring reliable power supply. Existing methodologies face two primary challenges: they often overlook the contextual relationships among multiple device measurements, leading to increased false positive rates, and they rely heavily on numerous task-specific labels, limiting their applicability in real-world few-shot scenarios. To address these challenges, this paper presents DNT-GCL, a novel few-shot anomaly detection technique based on graph contrastive learning. DNT-GCL utilizes a heterogeneous graph to construct a comprehensive grid topology that integrates feeder topology data with multi-source measurement data, effectively capturing detailed attribute information of physical quantities within the network. Additionally, DNT-GCL implements two adversarial data augmentation strategies to generate diverse positive and negative instance pairs, thereby enhancing the model’s robustness against confusion and adversarial attacks. Finally, a Graph Convolutional Network (GCN) is employed as a contrastive learning discriminator to extract higher-order semantic information in a self-supervised manner. Experimental results indicate that DNT-GCL achieves an accuracy improvement of at least 8.75

Malware attacks, especially “few-shot” malware, have profoundly harmed the cyber ecosystem. Recently, malware detection models based on graph neural networks have achieved remarkable success. However, these efforts over-rely on sufficient labeled data for model training and thus may be brittle in few-shot malware detection because of the label scarcity. To this end, we propose a self-supervised malware detection framework based on graph contrastive learning and adversarial augmentation, termed A2-CLM, to address the challenge of few-shot malware detection. Particularly, A2-CLM first depicts the malware execution context with a sensitivity heterogeneous graph by assessing the security semantic of each behavior. Afterwards, A2-CLM designs multiple adversarial attacks to generate more practical contrastive pairs, including the PGD attack, attribute masking attack, meta-graph-guide sampling attack, direct system calls attack, and obfuscation attack, which is beneficial to strengthening the model’s effectiveness and robustness. To alleviate the training workload of contrastive learning, we introduce a momentum strategy to train the multiple graph encoders in A2-CLM. Especially on 1-shot detection tasks, A2-CLM achieves performance gains of up to 24.63% and 4.58% against supervised and self-supervised detection methods, respectively.

Network flow anomaly detection plays a critical role in the Industrial Control System (ICS). As industrial informatization advances, ICS encounters numerous cybersecurity challenges. Recent approaches based on machine learning and deep learning have proven successful; however, the complex relationships among ICS nodes and insufficient feature extraction capabilities hinder anomaly detection performance, presenting significant challenges to the process. In this paper, we propose a novel framework IMG (Inter-Intra MultiGraph Anomaly Detection), an unsupervised detection framework for anomalous network flow detection on multigraph. Specifically, IMG first builds a multigraph within each snapshot from network flows. Then, by employing embedding and Fourier transformation to the numerical, discrete, and temporal features of the same edge, IMG simplifies multigraph into a simple directed graph for each snapshot. Next, IMG leverages attention mechanisms combined with Graph Neural Networks (GNN) to learn node relationships within snapshots (intra-snapshot), and uses Gated Recurrent Units (GRU) combined with GNN for temporal learning between snapshots (inter-snapshot). Finally, a stacked autoencoder is employed to perform dimension reduction for anomaly detection. Experiments conducted on industrial protocol traffic datasets and traditional traffic datasets demonstrate that IMG exhibits superior anomaly detection performance compared to baseline methods.

Foretelling ongoing malware attacks in real time is challenging due to the stealthy and polymorphic nature of their executive behavior patterns. In this paper, we present MalAF, a novel Mal ware A ttack F oretelling framework that utilizes run-time behavior (i.e., sequences of API events) of malware to foretell the attack that has not yet executed. MalAF first samples suspicious API events by assessing the sensitivity of the parameters of each API event and dividing them into multiple attack time slots by calculating the strong correlation. Following that, MalAF employs dynamic heterogeneous graph sequences to incrementally model contextual semantics for each attack time slot, generating malware state sequences in real time. Moreover, MalAF proposes a greedy adaptive dictionary (GAD)-optimized IRL preference learning method to automate the capture of families' intrinsic attack preferences, which achieves higher performance than the existing inverse reinforcement learning (IRL). Additionally, with the guidance of families' attack preferences, MalAF trains an LSTM to foretell the future path of the target malware. Finally, MalAF matches the identified APIs' paths with a malicious capability base and reports the comprehensible attacks to an analyst. The experiments on real-world datasets demonstrate that our proposed MalAF outperforms the state-of-the-art methods, which improves the baseline by 3.01% $\sim$ 4.73% of accuracy in terms of path foretell.

Federated learning is a computing paradigm that enhances privacy by enabling multiple parties to collaboratively train a machine learning model without revealing personal data. However, current research indicates that traditional federated learning platforms are unable to ensure privacy due to privacy leaks caused by the interchange of gradients. To achieve privacy-preserving federated learning, integrating secure aggregation mechanisms is essential. Unfortunately, existing solutions are vulnerable to recently demonstrated inference attacks such as the disaggregation attack. This paper proposes TAPFed , an approach for achieving privacy-preserving federated learning in the context of multiple decentralized aggregators with malicious actors. TAPFed uses a proposed threshold functional encryption scheme and allows for a certain number of malicious aggregators while maintaining security and privacy. We provide formal security and privacy analyses of TAPFed and compare it to various baselines through experimental evaluation. Our results show that TAPFed offers equivalent performance in terms of model quality compared to state-of-the-art approaches while reducing transmission overhead by 29%-45% across different model training scenarios. Most importantly, TAPFed can defend against recently demonstrated inference attacks caused by curious aggregators, which the majority of existing approaches are susceptible to.

Smart city situational awareness has recently emerged as a hot topic in research societies, industries, and governments because of its potential to integrate cutting-edge information technology and solve urgent challenges that modern cities face. For example, in the latest five-year plan, the Chinese government has highlighted the demand to empower smart city management with new technologies such as big data and Internet of Things, for which situational awareness is normally the crucial first step. While traditional static surveillance data on cities have been available for decades, this review reports a type of relatively new yet highly important urban data source, i.e., the big mobile data collected by devices with various levels of mobility representing the movement and distribution of public and private agents in the city. We especially focus on smart city situational awareness enabled by synthesizing the localization of hundreds of thousands of mobile software Apps using the Global Positioning System (GPS). This technique enjoys advantages such as a large penetration rate (~50% urban population covered), uniform spatiotemporal coverage, and high localization precision. We first discuss the pragmatic requirements for smart city situational awareness and the challenges faced. Then we introduce two suites of empowering technologies that help fulfill the requirements of (1) cybersecurity insurance for smart cities and (2) spatiotemporal modeling and visualization for situational awareness, both via big mobile data. The main contributions of this review lie in the description of a comprehensive technological framework for smart city situational awareness and the demonstration of its feasibility via real-world applications.

The rapid development of large language models has significantly reduced the cost of producing rumors, which brings a tremendous challenge to the authenticity of content on social media. Therefore, it has become crucially important to identify and detect rumors. Existing deep learning methods usually require a large amount of labeled data, which leads to poor robustness in dealing with different types of rumor events. In addition, they neglect to fully utilize the structural information of rumors, resulting in a need to improve their identification and detection performance. In this article, we propose a new rumor detection framework based on bi-directional multi-level graph contrastive learning, BiMGCL, which models each rumor propagation structure as bi-directional graphs and performs self-supervised contrastive learning based on node-level and graph-level instances. In particular, BiMGCL models the structure of each rumor event with fine-grained bidirectional graphs that effectively consider the bi-directional structural characteristics of rumor propagation and dispersion. Moreover, BiMGCL designs three types of interpretable bi-directional graph data augmentation strategies and adopts both node-level and graph-level contrastive learning to capture the propagation characteristics of rumor events. Experimental results on real datasets demonstrate that our proposed BiMGCL achieves superior detection performance compared against the state-of-the-art rumor detection methods.