Communication among mobile devices in the Inter-net of Things (IoT) typically relies on fixed security boundaries and centralized trust models, resulting in weak trust mechanisms, unauthorized access, and limited adaptability to dynamic environments. To address this, this paper proposes a zero-trust-based secure communication access control method that follows the principles of zero trust and least privilege, establishing a dynamic trusted framework encompassing identity authentication, real-time trust evaluation, multi-layer access control, continuous behavior analysis, and trajectory visualization. A dynamic trust evaluation model combining static attributes and historical interaction data is designed to ensure that only users who pass trust assessments are granted access. An interaction trust computation method incorporating direct trust, indirect trust, and a time-decay factor is introduced, along with a sliding window algorithm for dynamic threshold updates, enhancing responsiveness to changes in device behavior. A machine-learning-based continuous behavior monitoring mechanism is implemented to perform real-time modeling and detection of performance, traffic, and access patterns, improving anomaly identification and rapid response. The prototype system was validated through multi-device collaborative interaction simulations, demonstrating significant advantages in traffic anomaly detection and communication security over existing approaches.

Cyber-Physical Systems (CPS) are closely connected with human social production and daily life, and ensuring their security is of vital importance. Anomaly detection in CPS has therefore become an important research area for safeguarding their security. However, existing approaches struggle to effectively capture nonlinear spatio-temporal interactions, dynamically model spatio-temporal relationships among variables, and enforce temporal causality, which ultimately result in inaccurate anomaly detection, reduced robustness, and limited applicability in real-world CPS scenarios. To overcome these limitations, we propose FST-AD, a Frequency-Spatio-Temporal Graph Neural Network framework for anomaly detection. FST-AD employs multiscale convolutions with an alternating padding strategy and Fast Fourier Transform (FFT) to jointly extract time-frequency features. The resulting time-frequency features are modeled through an adaptive graph structure learning module to capture evolving spatio-temporal dependencies and complex variable interactions. A message passing neural network (MPNN) combining multi-order graph convolutions and attention mechanisms further enables deep fusion of spatio-temporal features, and leveraging Principal Component Analysis (PCA) driven dimensionality reduction and reconstruction enhances noise suppression and stability in anomaly recognition. Experiments on real-world industrial datasets show that FST-AD achieves significant gains in accuracy, robustness, and generalization; on the SWaT dataset, it surpasses the best baseline by 8.57 and 6.3 percentage points in ROC and PRC, respectively, offering a reliable and scalable solution for CPS anomaly detection.

In load redistribution (LR) attacks, attackers compromise measurement devices at the cyber layer to inject false data, resulting in misoperations in the physical power system. However, most existing methods trace the source of attacks in cy-ber or physical layers separately, where the effective coordination between cyber and physical layers is neither modeled nor utilized. To address this issue, this paper proposes a cross-layer attribution method. Specifically, at the physical layer, a comprehensive evaluation metric is proposed to accurately locate high-risk branches. At the cyber layer, a labeled subgraph isomorphism matching algorithm based on a traceability graph is developed to reconstruct attack paths from log data. To enable cross-layer attribution, a time-topology coupling mechanism is introduced, which can significantly enhance cyber-physical correlation and attribution efficiency. Simulations using a publicly available real-world dataset on the IEEE 39-bus system verify the effectiveness of the proposed method in cross-layer attack attribution.

Foxmail client is one of the most popular tools to send and receive e-mail, and the mail data files preserved in it become an important target of computer investigation and forensics, from which the useful clues can be mined out and analyzed. In this paper, a visual Foxmail forensics system is designed to extract the information from the mail evidence file and display the association between the contacts by graphic and search the mail body and the attachment by full-text retrieval. The system can assist the investigating and forensic officers to analyze the correlation between the sender and the receiver, and find some useful clues to provide the necessary reference for handling the cases.