# An unsupervised spatiotemporal graphical modeling approach to anomaly detection in distributed CPS

arXiv: https://arxiv.org/abs/1512.07876 · HTML: https://mlsanity.com/paper/1512.07876/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Dec 2015.

## Built on by (most cited first, 3 of 3)

- [RLAD: Time Series Anomaly Detection through Reinforcement Learning and Active Learning](https://mlsanity.com/paper/2104.00543/) (2021)
- [INVARLLM: LLM-assisted Physical Invariant Extraction for Cyber-Physical Systems Anomaly Detection](https://mlsanity.com/paper/2411.10918/) (2024)
- [Granger Causality Based Hierarchical Time Series Clustering for State Estimation](https://mlsanity.com/paper/2104.04206/) (2021)

## Abstract (arXiv)

Modern distributed cyber-physical systems (CPSs) encounter a large variety of physical faults and cyber anomalies and in many cases, they are vulnerable to catastrophic fault propagation scenarios due to strong connectivity among the sub-systems. This paper presents a new data-driven framework for system-wide anomaly detection for addressing such issues. The framework is based on a spatiotemporal feature extraction scheme built on the concept of symbolic dynamics for discovering and representing causal interactions among the subsystems of a CPS. The extracted spatiotemporal features are then used to learn system-wide patterns via a Restricted Boltzmann Machine (RBM). The results show that: (1) the RBM free energy in the off-nominal conditions is different from that in the nominal conditions and can be used for anomaly detection; (2) the framework can capture multiple nominal modes with one graphical model; (3) the case studies with simulated data and an integrated building system validate the proposed approach.