Smart grids, as critical national infrastructure, require robust cybersecurity. However, traditional anomaly detection methods face inherent challenges: the scarcity of labeled attack samples due to power grid traffic characteristics, which results in highly imbalanced datasets. To overcome these limitations, this paper introduces ProfilE, a novel self-supervised anomaly detection model. The framework consists of three core modules: an encoder module is responsible for fusing historical, topological, and statistical features to generate multi-dimensional feature embeddings; a self-supervised module generates corrupted samples to mitigate the reliance on labeled data; and a Profile Module utilizes these embeddings to learn and construct a communication relationship profile that characterizes normal network behavior. By using the reconstruction error from the profile module for anomaly detection, ProfilE fundamentally eliminates reliance on labeled data. Experimental evaluations on the CICModbus2023 and CICIDS2017 datasets demonstrate that ProfilE performs better than existing baseline methods in imbalanced smart grid environments. Notably, in scenarios with scarce attack samples, its Macro F1 outperforms baselines, fully validating its effectiveness and robustness in real-world power grid settings.

The continuous advancement of digital processes has significantly increased the risk to users’ data privacy. To protect private data, it is crucial to provide anonymous, anti-tracking secure communication services. However, Existing anti-tracking data transmission technologies has problems such as centralized node, unstable links, low transmission efficiency, and vulnerable static transmission, which fail to meet users’ privacy and security requirements. This paper proposes a dynamic asymmetric hierarchical architecture path generation method(DAHP) for anti-tracking network. The method adopts a hierarchical architecture design, comprising a Secure Access Layer responsible for link construction and a Secret Transmission Layer handling the actual transmission. A node hybrid selection strategy, combined with a dynamic asymmetric path generation strategy, minimizes the risk of node exposure and enables dynamic variation in path generation. The efficacy of the DAHP method is validated through extensive testing on representative network and existing path generation methods. Experimental results demonstrate that the proposed method exhibits superior scalability and anti-tracking performance.

With the increasing threats of network tracking and information leakage, privacy protection has become a widely concern in the field of network security. As an important means of protecting the privacy of network users, anti-tracking networks have gradually become one of the important research directions. However, the existing topology structures of anti-tracking networks still have problems such as intra-domain aggregation and key nodes, which are vulnerable to attack, tracking and destruction, and can not meet the privacy requirements. Therefore, this paper proposes a topology construction method based on cross-domain decentralized gravity model (CDTC). Firstly, the model comprehensively considers the local neighbor information, the location information of nodes, and the path information between nodes to calculate the node attraction. Secondly, each node determines its link status with other nodes through the model by ranking its local nodes, achieving optimization of the network topology. Finally, experiments on typical network structures and open network datasets, the experimental results show that the proposed model has better decentralization, cross-domain, and anti-tracking performance.

Recent work has shown that the properties of network traffic may reveal some patterns (such as, payload size, packet interval, etc.) that can expose users' identities and their private information. The existing defense approaches, such as traffic morphing, protocol tunneling, still suffer from revealing the special traffic pattern. To address this problem, we propose a feature-flux traffic camouflage method (FFTC). FFTC forecasts the pattern of normal traffic via twin Gaussian process(TGP), and dynamically change the on-going traffic feature based on the learned traffic pattern to conceal the camouflaged traffic in the normal traffic. TGP-based traffic forecasting makes FFTC more sensitive to the feature dynamics of normal traffic. Then, the camouflaged traffic can always synchronize with the normal traffic pattern in real time. Furthermore, FFTC can learn multiple traffic patterns from different kinds of normal traffic, and dynamically change the camouflaged traffic pattern to achieve the feature-flux ability. From the experimental results, FFTC improves the indistinguishability of the camouflaged traffic and the normal traffic, and the feature-flux of the camouflaged traffic mitigates the traffic analysis attack effectively.

The increasingly rampant network monitoring and tracing bring the huge challenge on the protection of netizens' privacy. The anonymous networks mitigate the threat of network monitoring and tracing to a certain degree, but the static communication path has become the weakness. To address the problem, we propose a tracking-resistant communication mechanism with dynamic paths(TresMep). Different with the stepping stone chain like Tor, TresMep provides a chain of node groups which include at least one honest node. The message is transferred between groups. Each group uses asynchronous DC-net to hide the exit node which deliver the message to the honest node of the next group, and each group randomly chooses the exit node in each round of transmission through lagrange interpolation. Then, the transmission path would be changed dynamically and randomly to provide stronger tracking-resistance. The experimental results show that TresMep has a stronger performance of trackingresistance than the stepping stones based anti-tracking network with static communication path. The communication efficiency of TresMep is also satisfactory. But when message load is big, the communication efficiency of TresMep becomes worse. TresMep takes a tradeoff between tracking- resistance and communication efficiency.