Graph Neural Networks (GNNs) are promising for Encrypted Malicious Traffic Detection (EMTD), yet practical deployments often face weak information: broken graph structures, incomplete node features, and scarce training data. Prior methods partially mitigate these issues but still suffer from (i) restricted information propagation range in graph structures, (ii) imprecise graph structure reconstruction resulting in erroneous or missing connections, and (iii) absence of a unified framework to address multiple facets of information sparsity jointly. In response, we propose TrustWI, an uncertainty-aware multi-view framework. It builds three complementary views to recover and enrich signal under weak information: (i) long-range propagation to expand information flow, (ii) post-propagation structural augmentation to repair broken connections, and (iii) view interaction modeling to capture cross-view synergy. We further develop an evidential, uncertainty-aware fusion that quantifies prediction uncertainty at both the view level and the global level, yielding robust decisions. Extensive evaluations across three benchmarks validate the effectiveness of TrustWI, demonstrating substantial improvements in accuracy and trustworthiness under weak information conditions. Notably, our approach advances the state-of-the-art AUC from 85.45% to 89.57% in extreme information-constrained scenarios.

Unsupervised graph anomaly detection aims to identify irregular patterns in graph-structured data without relying on labeled anomalies. Graph neural networks (GNNs) have advanced GAD by learning effective graph representations through neighborhood aggregation. However, challenges such as anomalous information diffusion impede GNNs to accurately distinguish anomalies from normal ones. To bridge this gap, we propose a novel framework named Selective Anomalous information Filtering for Enhance unsupervised graph anomaly detection (SAFE). SAFE allows nodes to selectively filter anomalous information, preventing the spread of anomalous noise to normal nodes while allowing anomalies to assimilate features from their neighbors. This strategy enhances the reconstruction error disparity between normal and anomalous nodes, thereby improving the accuracy of anomaly detection. Extensive experiments on both synthetic and real-world datasets demonstrate the significant performance gains of SAFE over existing methods.

Network intrusion detection systems (NIDS) play a crucial role in maintaining network security . However, current NIDS techniques tend to neglect the topological structures of network traffic to varying degrees. This fundamental oversight leads to challenges in handling class-imbalanced and highly dynamic network traffic. In this paper, we propose a novel dynamic multi-scale topological representation (DMTR) method for improving network intrusion detection performance. Our DMTR method achieves the perception of multi-scale topology and exhibits strong robustness. It provides accurate and stable representations even in the presence of data distribution shifts and class imbalance problems . The multi-scale topology is obtained through multiple topology lenses, which reveal topological structures from different dimensional aspects. Furthermore, to address the limitations of existing detection models based on static network traffic, the DMTR method also achieves dynamic topological representation through our proposed group shuffle operation (GSO) strategy. When new traffic data arrives, the topological representation is updated by preserving a portion of the original information without reprocessing all data. Experiments on four publicly available network traffic datasets demonstrate the feasibility and effectiveness of the proposed DMTR method in handling class imbalanced and highly dynamic network traffic.