Domain-Prior-Regularized Graph Modeling for Anomaly Detection in Cyber-Physical Systems

• URL: http://arxiv.org/abs/2607.23197v1
• Date: Sat, 25 Jul 2026 13:21:56 GMT
• Title: Domain-Prior-Regularized Graph Modeling for Anomaly Detection in Cyber-Physical Systems
• Abstract summary: Anomaly detection is critical for industrial monitoring of cyber-physical systems.<n>Recent graph-based approaches have made significant progress, but they often struggle in small-scale physical systems.<n>We propose DPR-GM, a forecasting-based framework that incorporates system design knowledge into graph construction.
• Score: 4.42333974179549
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Anomaly detection on multivariate sensor time series is critical for industrial monitoring of cyber-physical systems (CPS), where even subtle deviations from normal behavior can indicate process disruption. Recent graph-based approaches have made significant progress, but they often struggle in small-scale physical systems with scarce labeled anomalies and limited normal data. In such settings, graph-based models tend to capture spurious correlations and produce unstable sensor topologies. We propose DPR-GM (Domain-Prior-Regularized Graph Modeling), a forecasting-based framework that incorporates system design knowledge into graph construction. DPR-GM leverages a large language model (LLM) to extract directed physical couplings between sensor pairs from system documentation, which are encoded as a binary domain adjacency matrix serving as a structural gate over sensor relations. This gate is then modulated by Pearson correlations estimated from normal training data. The anomaly score is further weighted by sensor-level reliability derived from the coefficient of variation. All graph and weighting components are fixed prior to training and add no learnable parameters. On the SKAB benchmark, DPR-GM outperforms graph-based, statistical, and deep learning baselines across F1, AUROC, and AUPRC, showing that domain-structured graph priors are a practical alternative to fully learned topologies in data-scarce CPS.

Related papers

• Rethinking Feature Alignment in Generalist Graph Anomaly Detection: A Relational Fingerprint-based Approach [60.199985286210904]
  Generalist graph anomaly detection (GAD) aims to detect anomalies on unseen graphs without graph-specific retraining.<n>Existing approaches primarily focus on aligning heterogeneous data across domains, which ignores different feature semantics.<n>We propose Fingerprint-based generalist GAD approach (ReFi-GAD)<n>We show that ReFi-GAD significantly outperforms state-of-the-art methods in experiments on 14 datasets.
  arXiv  Detail & Related papers  (2026-05-25T05:12:26Z)
• Causal Graph Profiling via Structural Divergence for Robust Anomaly Detection in Cyber-Physical Systems [25.567981742631005]
  Causal Graph-based Anomaly Detection framework designed for reliable cyberattack detection in public infrastructure systems.<n>CGAD follows a two-phase supervised framework -- causal profiling and anomaly scoring.<n>By leveraging causal structures, CGAD achieves superior adaptability and accuracy in non-stationary and imbalanced time series environments.
  arXiv  Detail & Related papers  (2025-08-13T05:26:43Z)
• Graph Attention Neural Network for Botnet Detection: Evaluating Autoencoder, VAE and PCA-Based Dimension Reduction [0.0]
  Graph Neural Networks (GNNs) address this limitation by learning an embedding space via iterative message passing.<n>This paper proposes a framework that first reduces dimensionality of the NetFlow-based IoT attack dataset before transforming it into a graph dataset.<n>We evaluate three dimension reduction techniques--Variational Autoencoder (VAE-encoder), classical autoencoder (AE-encoder), and Principal Component Analysis (PCA)
  arXiv  Detail & Related papers  (2025-05-23T00:22:14Z)
• Beyond Message Passing: Neural Graph Pattern Machine [50.78679002846741]
  We introduce the Neural Graph Pattern Machine (GPM), a novel framework that bypasses message passing by learning directly from graph substructures.<n>GPM efficiently extracts, encodes, and prioritizes task-relevant graph patterns, offering greater expressivity and improved ability to capture long-range dependencies.
  arXiv  Detail & Related papers  (2025-01-30T20:37:47Z)
• A Causal Graph-Enhanced Gaussian Process Regression for Modeling Engine-out NOx [0.0]
  We develop and validate a probabilistic model to predict engine-out NOx emissions using Gaussian process regression.<n>We conclude that our model provides an improvement in predictive performance when using an input window and a deep kernel structure.
  arXiv  Detail & Related papers  (2024-10-24T04:23:57Z)
• Detecting Anomalies in Dynamic Graphs via Memory enhanced Normality [39.476378833827184]
  Anomaly detection in dynamic graphs presents a significant challenge due to the temporal evolution of graph structures and attributes. We introduce a novel spatial- temporal memories-enhanced graph autoencoder (STRIPE) STRIPE significantly outperforms existing methods with 5.8% improvement in AUC scores and 4.62X faster in training time.
  arXiv  Detail & Related papers  (2024-03-14T02:26:10Z)
• Deep Graph Stream SVDD: Anomaly Detection in Cyber-Physical Systems [17.373668215331737]
  We propose a new approach called deep graph vector data description (SVDD) for anomaly detection. We first use a transformer to preserve both short and long temporal patterns monitoring data in temporal embeddings. We cluster these embeddings according to sensor type and utilize them to estimate the change in connectivity between various sensors to construct a new weighted graph.
  arXiv  Detail & Related papers  (2023-02-24T22:14:39Z)
• Energy-based Out-of-Distribution Detection for Graph Neural Networks [76.0242218180483]
  We propose a simple, powerful and efficient OOD detection model for GNN-based learning on graphs, which we call GNNSafe. GNNSafe achieves up to $17.0%$ AUROC improvement over state-of-the-arts and it could serve as simple yet strong baselines in such an under-developed area.
  arXiv  Detail & Related papers  (2023-02-06T16:38:43Z)
• Graph Neural Networks with Trainable Adjacency Matrices for Fault Diagnosis on Multivariate Sensor Data [69.25738064847175]
  It is necessary to consider the behavior of the signals in each sensor separately, to take into account their correlation and hidden relationships with each other. The graph nodes can be represented as data from the different sensors, and the edges can display the influence of these data on each other. It was proposed to construct a graph during the training of graph neural network. This allows to train models on data where the dependencies between the sensors are not known in advance.
  arXiv  Detail & Related papers  (2022-10-20T11:03:21Z)
• MentorGNN: Deriving Curriculum for Pre-Training GNNs [61.97574489259085]
  We propose an end-to-end model named MentorGNN that aims to supervise the pre-training process of GNNs across graphs. We shed new light on the problem of domain adaption on relational data (i.e., graphs) by deriving a natural and interpretable upper bound on the generalization error of the pre-trained GNNs.
  arXiv  Detail & Related papers  (2022-08-21T15:12:08Z)
• Online Graph Topology Learning from Matrix-valued Time Series [0.0]
  The focus is on the statistical analysis of matrix-valued time series, where data is collected over a network of sensors. The goal is to identify the dependency structure among these sensors and represent it with a graph. Online algorithms are adapted to these augmented data models, allowing for simultaneous learning of the graph and trend from streaming samples.
  arXiv  Detail & Related papers  (2021-07-16T17:21:14Z)
• TELESTO: A Graph Neural Network Model for Anomaly Classification in Cloud Services [77.454688257702]
  Machine learning (ML) and artificial intelligence (AI) are applied on IT system operation and maintenance. One direction aims at the recognition of re-occurring anomaly types to enable remediation automation. We propose a method that is invariant to dimensionality changes of given data.
  arXiv  Detail & Related papers  (2021-02-25T14:24:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.