# Deep Graph Stream SVDD: Anomaly Detection in Cyber-Physical Systems

arXiv: https://arxiv.org/abs/2302.12918 · HTML: https://mlsanity.com/paper/2302.12918/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 22 references that are in the map.
- First posted on arXiv 24 Feb 2023.

## Builds on (most cited first, 7 of 7)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Variational Graph Auto-Encoders](https://mlsanity.com/paper/1611.07308/) (2016)
- [GANomaly: Semi-Supervised Anomaly Detection via Adversarial Training](https://mlsanity.com/paper/1805.06725/) (2018)
- [MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks](https://mlsanity.com/paper/1901.04997/) (2019)
- [Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks](https://mlsanity.com/paper/1806.08110/) (2018)
- [Hierarchical Graph Neural Networks for Causal Discovery and Root Cause Localization](https://mlsanity.com/paper/2302.01987/) (2023)
- [Defending Water Treatment Networks: Exploiting Spatio-temporal Effects for Cyber Attack Detection](https://mlsanity.com/paper/2008.12618/) (2020)

## Built on by (most cited first, 1 of 1)

- [Non-contact Sensing for Anomaly Detection in Wind Turbine Blades: A focus-SVDD with Complex-Valued Auto-Encoder Approach](https://mlsanity.com/paper/2306.10808/) (2023)

## Abstract (arXiv)

Our work focuses on anomaly detection in cyber-physical systems. Prior literature has three limitations: (1) Failing to capture long-delayed patterns in system anomalies; (2) Ignoring dynamic changes in sensor connections; (3) The curse of high-dimensional data samples. These limit the detection performance and usefulness of existing works. To address them, we propose a new approach called deep graph stream support vector data description (SVDD) for anomaly detection. Specifically, we first use a transformer to preserve both short and long temporal patterns of monitoring data in temporal embeddings. Then we cluster these embeddings according to sensor type and utilize them to estimate the change in connectivity between various sensors to construct a new weighted graph. The temporal embeddings are mapped to the new graph as node attributes to form weighted attributed graph. We input the graph into a variational graph auto-encoder model to learn final spatio-temporal representation. Finally, we learn a hypersphere that encompasses normal embeddings and predict the system status by calculating the distances between the hypersphere and data samples. Extensive experiments validate the superiority of our model, which improves F1-score by 35.87%, AUC by 19.32%, while being 32 times faster than the best baseline at training and inference.