In graph theory, Katz centrality is a widely used measure to quantify the influence of a vertex within a network. Unlike simple degree centrality, it considers not only immediate neighbors but also multi-hop directed paths, weighting them by length and inter-hop time delays to reflect indirect influence. Traditional computation assumes a non-temporal graph, where edges lack timestamps, and computes using recursive multiplication of the graph’s adjacency matrix. However, this approach becomes impractical for graphs with billions of vertices due to high time/memory demands, and it overlooks the temporal information available on edges. By contrast, we focus on the problem of processing a streaming temporal graph , where edges are timestamped and arrive sequentially at a central analyzer. We want to online estimate the temporal Katz centrality of each vertex, and identify the top- K influential vertices with the largest Katz centralities. To solve this problem, we propose two solutions: TAS-TKC and ATAS-TKC. Both algorithms are designed to operate with a small constant-memory footprint, but ATAS-TKC builds on TAS-TKC to further improve performance. TAS-TKC avoids memory growth with the number of vertices by using a time-adaptive Count-Min sketch that allows all vertices to share memory for centrality estimation. It also maintains the top- K influential vertices using a min-heap-based tracker updated on each edge arrival. Additionally, ATAS-TKC enhances this design in two key ways: First, it achieves O ( 1 ) lookup time for the top- K vertex tracker by augmenting the min-heap with an auxiliary hash table. Second, it improves estimation accuracy by placing the top- K tracker as a prefilter before the sketch. In the prefilter, the top- K influential vertices are allocated dedicated memory and bypass the sketch entirely, avoiding estimation errors caused by memory sharing. For these two proposed solutions, we have conducted extensive evaluation based on real-world graph datasets. The results show that the average estimation error for all vertices is smaller than 4 % and the identification precision for the top- K vertices can be larger than 97 % when given only 400 KB memory to process a million-vertex graph dataset.

In large-scale Internet of Things (IoT) environments, the reliability and security of complex cloud-edge ecosystems critically depend on accurate anomaly detection from system logs. However, most existing methods rely primarily on log templates, often ignoring the diagnostic signals embedded in heterogeneous fields (e.g., timestamps, components, and severity levels). Furthermore, they struggle to learn discriminative representations for rare anomalies due to severe class imbalance, causing models to become biased toward normal patterns. Finally, these approaches often fail to capture the latent structure of unlabeled data, limiting their ability to generalize to unseen anomalies. These limitations render them unreliable in practice. To address the above challenges, we propose LogRMC, a semi-supervised framework for robust log anomaly detection through multi-field log feature fusion, contrastive representation learning, and pseudo-label refinement. First, LogRMC extracts features from diverse log fields and fuses them into unified contextual embeddings that encode inter-field dependencies. Next, it applies contrastive learning on normal samples to learn discriminative and stable representations, thereby improving the separation of normal and anomalous sequence embeddings. To exploit unlabeled data, LogRMC further introduces a cluster-refined pseudo-labeling strategy: it performs density-based clustering on contrastively learned embeddings and applies density ratio estimation within each cluster to generate confidence-aware pseudo-labels. Finally, an attention-based GRU network is trained jointly on labeled and pseudo-labeled log sequences. Extensive experiments on public log datasets demonstrate that LogRMC outperforms state-of-the-art unsupervised and semi-supervised methods, and achieves performance comparable to fully supervised approaches.

Abstract Tor traffic tracking is valuable for combating cybercrime as it provides insights into the traffic active on the Tor network. Tor‐based application traffic classification is one of the tracking methods, which can effectively classify Tor application services. However, it is not effective in classifying specific applications due to more complicated traffic patterns in the spatial and temporal dimensions. As a solution, the authors propose FlowMFD, a novel Tor‐based application traffic classification approach using amount‐frequency‐direction (MFD) chromatographic features and spatial‐temporal modelling. Expressly, FlowMFD mines the interaction pattern between Tor applications and servers by analysing the time series features (TSFs) of different size packets. Then MFD chromatographic features (MFDCF) are designed to represent the pattern. Those features integrate multiple low‐dimensional TSFs into a single plane and retain most pattern information. In addition, FlowMFD utilises a cascaded model with a two‐dimensional convolutional neural network (2D‐CNN) and a bidirectional gated recurrent unit to capture spatial‐temporal dependencies between MFDCF. The authors evaluate FlowMFD under the public ISCXTor2016 dataset and the self‐collected dataset, where we achieve an accuracy of 92.1% (4.2%↑) and 88.3% (4.5%↑), respectively, outperforming state‐of‐the‐art comparison methods.