# Clustering-Based Collective Anomaly Detection in IoT Systems: A Graph Neural Network Approach

arXiv: https://arxiv.org/abs/2609.22166 · HTML: https://mlsanity.com/paper/2609.22166/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 43 references that are in the map.
- First posted on arXiv 26 Aug 2026.

## Builds on (most cited first, 8 of 8)

- [From Louvain to Leiden: guaranteeing well-connected communities](https://mlsanity.com/paper/1810.08473/) (2018)
- [The Faiss library](https://mlsanity.com/paper/2401.08281/) (2024)
- [Collective Anomaly Detection based on Long Short Term Memory Recurrent Neural Network](https://mlsanity.com/paper/1703.09752/) (2017)
- [GLAD: Group Anomaly Detection in Social Media Analysis- Extended Abstract](https://mlsanity.com/paper/1410.1940/) (2014)
- [Group Anomaly Detection using Deep Generative Models](https://mlsanity.com/paper/1804.04876/) (2018)
- [Graph Anomaly Detection at Group Level: A Topology Pattern Enhanced Unsupervised Approach](https://mlsanity.com/paper/2308.01063/) (2023)
- [Blockchain-Envisioned UAV-Aided Disaster Relief Networks: Challenges and Solutions](https://mlsanity.com/paper/2310.05180/) (2023)
- [Hybrid Graph Embeddings and Louvain Algorithm for Unsupervised Community Detection](https://mlsanity.com/paper/2509.23411/) (2025)

## Abstract (arXiv)

The rapid advancement of Internet of Things (IoT) technology has led to the widespread deployment of smart, interconnected devices across a range of domains. However, this expansion has also resulted in a substantial increase in network traffic, creating more opportunities for malicious actors to launch cyberattacks and compromise sensitive information, thereby increasing the need for effective anomaly detection. The state-of-the-art in anomaly detection has predominantly focused on point anomalies. In contrast, the detection of collective anomalies remains relatively under-explored in the literature. In this paper, we introduce Unsupervised Graph Collective Anomaly Detection (UGCAD), a novel frame- work designed to identify collective anomalies in IoT network traffic. Unlike many existing methods, UGCAD operates on graph-structured data without any prior knowledge of group labels or membership. It leverages a variational graph autoencoder (VGAE) to learn the graph representation, which is subsequently used to enhance a clustering algorithm for effective grouping of nodes. To detect collective anomalies, clusters identified as normal are first aggregated and refined, after which anomaly scores are applied to detect collective anomalies. Extensive experiments conducted on the CICIoT2023 and ToN-IoT network datasets demonstrate the effectiveness of UGCAD in both clustering and collective anomaly detection (CAD). Furthermore, comparative evaluations against several traditional and state-of-the-art clustering-based CAD approaches confirm the superiority of UGCAD in accurately detecting collective anomalies.