mlsanityData to 7 Oct 2026

IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems

arXiv 2606.01691 ↗First posted 1 Jun 2026cs.CR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Industrial Internet systems face increasing threats from sophisticated industrial control system (ICS) attacks, resulting in critical safety incidents. However, existing tools exhibit limited effectiveness in real-time anomaly detection due to the complex dependencies among sensors and actuators. To tackle this, we present IstGPT, the first industrial anomaly detection tool based on LLMs and graph learning to provide real-time protection against a wide range of ICS attacks. IstGPT achieves fine-grained and precise modeling on spatial-temporal dependencies in industrial cyber-physical systems. It first leverages industrial multi-modal knowledge, including operational data, technical documents, and system diagrams, to extract sensor-actuator dependency graphs via multi-stage prompt engineering. Then, LLM-Optimation iteratively refines the graph based on node accuracy, edge consistency, and logical coherence. Finally, IstGPT integrated improved graph neural networks with an encoder-decoder architecture to detect anomalies via reconstruction errors. We evaluate IstGPT against 12 state-of-the-art baselines on 9 datasets, including 2 public, 6 simulated, and a real-world robotic arm dataset. IstGPT achieves the best F1-scores and eTaF1 (a newer time-aware metric) across nine datasets. We further discuss the feasibility of deploying IstGPT in real-world industrial scenarios.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 22 of its 72 references that are in the map. First posted on arXiv 1 Jun 2026.

Builds on

22 of 72 references.

References · 22

  1. 2017Graph Attention Networkscited by 8,854
  2. 2024GPT-4o System Cardcited by 4,467
  3. 2023Large Language Models Are Zero-Shot Time Series Forecasterscited by 491
  4. 2018Fundamentals of Recurrent Neural Network (RNN) and Long Short-Term Memory (LSTM) Networkcited by 415
  5. 2021Graph Neural Network-Based Anomaly Detection in Multivariate Time Seriescited by 300
  6. 2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
  7. 2018A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Datacited by 181
  8. 2020Multivariate Time-series Anomaly Detection via Graph Attention Networkcited by 165
  9. 2021Learning Graph Structures with Transformer for Multivariate Time Series Anomaly Detection in IoTcited by 104
  10. 2020Normalization Techniques in Training DNNs: Methodology, Analysis and Applicationcited by 90
  11. 2022A Comprehensive Survey of Regression Based Loss Functions for Time Series Forecastingcited by 33
  12. 2024Graph Transformers: A Surveycited by 32
10 more
  1. 2024Large language models can be zero-shot anomaly detectors for time series?cited by 30
  2. 2023Prompting Frameworks for Large Language Models: A Surveycited by 29
  3. 2020Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunitiescited by 27
  4. 2024Large Language Models can Deliver Accurate and Interpretable Time Series Anomaly Detectioncited by 26
  5. 2023SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detectioncited by 13
  6. 2021A Survey on Industrial Control System Testbeds and Datasets for Security Researchcited by 10
  7. 2023Industrial Internet of Things Intelligence Empowering Smart Manufacturing: A Literature Reviewcited by 8
  8. 2022SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsicalcited by 2
  9. 2020Industrial Control via Application Containers:Maintaining determinism in IAAScited by 1
  10. 2023SoK: Evaluations in Industrial Intrusion Detection Researchcited by 1

Built on by

Not cited yet.