Abstract The Onion Router (Tor), a cornerstone of online privacy, is increasingly exploited for malicious purposes, creating an urgent need to distinguish its traffic from benign web streams. In response to detection efforts, Tor deploys pluggable transports like Obfs4, which obfuscates traffic using randomized padding and artificial timing delays to evade traditional analysis. Although these transformations obscure surface-level patterns, Obfs4 traffic retains subtle yet exploitable statistical divergences from standard web behavior. Critically, existing detection approaches often fail to achieve the throughput necessary for practical, real-time deployment in high-speed network environments, presenting a significant performance gap. To bridge this performance gap, we introduce CTS-OD : A C ascad-ed T wo- S tage framework for high-throughput O bfs4 D etection, engineered for both speed and precision. Our methodology is founded on a compact yet potent set of expressive features selected from early-flow packet data. The first stage implements a label-guided clustering strategy to generate class centroids; these centroids are then indexed using Facebook AI Similarity Search for exceptionally rapid similarity matching, allowing for the immediate classification of the majority of samples. The second stage employs a highly optimized tree-based fallback classifier, which is specifically trained to resolve complex instances that remain ambiguous after the initial assessment. This synergistic architecture achieves an F1-score surpassing 99% and an inference throughput exceeding million samples per second, satisfying the demanding requirements of high-precision, ultra-high-speed inference and making it eminently suitable for real-world deployment.

Web page tampering detection is crucial in web threat perception. Current methods rely on monitoring historical changes of web pages to identify anomalies. These approaches often struggle to effectively distinguish between tampering and benign changes, especially in the presence of numerous dynamic pages. Furthermore, the increasing complexity of website structures places more resource demands on tampering monitoring and makes some malicious alterations more covert and challenging to detect. We propose a web page tampering detection based on pretraining with dynamic temporal graphs. The core of the method involves constructing a website temporal graph model based on evolutionary information, and enhances the graph feature perturbations to expose concealed tampering behaviors. Specifically, the framework's autoencoder is composed of enhanced DySAT, enabling it to handle dynamic data. We introduce DySAT, bolstered with GATv2, to capture dynamic attention. Additionally, we design a temporal masking mechanism and prediction error to improve the effectiveness of generative self-supervised learning in temporal graph pretraining. Experimental results on Webpage Tampering Dataset (WPT-Dataset) demonstrate that our method outperforms other comparative approaches in terms of both detection efficacy and stability. Furthermore, the research findings on the anomaly detector and model performance provide direction for the practical application of our method.

Graph Neural Networks (GNNs) have achieved remarkable success in modeling structured data. Recent studies, however, reveal that they are highly vulnerable to backdoor attacks, which can implant triggers into training data to mislead predictions on nodes injected with triggers while maintaining accuracy on clean inputs. Despite recent advances, existing graph backdoor attacks often rely on explicit training interventions and substantial trigger injection while focusing solely on single-node misclassification, which limits their practicality in real-world deployments. To address these limitations, we propose a clean-label graph backdoor attack that induces one-hop neighborhood misclassification under a minimal trigger injection budget. Without altering target nodes’ features or labels, our method attaches a single trigger node to a target node, thereby misclassifying both the target and its immediate neighbors as the target class. To maximize effectiveness while preserving stealthiness, we propose a poisoned node selection strategy guided by semantic consistency and structural activeness, and design a conditional diffusion-based trigger generator optimized with multiple auxiliary objectives. Extensive experiments on multiple real-world benchmarks and mainstream GNN architectures show that our approach achieves over 95% attack success rate on both target nodes and their neighbors in most settings, including under state-of-the-art defenses. These findings underscore the urgent need for more robust graph learning systems and reveal novel attack surfaces in graph security.