Temporal graph attention networks for real-time anomaly detection in industrial IOT: a multi-scale hierarchical approach (TGA-Net)

Abstract

In the Industrial Internet of Things (IIoT) networks, anomaly detection is a safety-critical task that is challenging due to dynamic, non-stationary and graph-structured sensor data. Current methods do not consider the sensor topology, either adopting a fixed one or treating time-series independently, ignoring spatial correlations among sensors. In this paper, the novel multi-scale hierarchical architecture of TGA-Net is proposed to capture temporal dependencies within a sensor as well as spatial correlation between different sensors by two novel modules, Gated Dilated Causal Convolutional Layer (GDCC) and Dynamic Multi-Head Graph Attention (DMHGA) layer, respectively. TGA-Net proposes a learnable Cross-Scale Hierarchical Fusion (CSHF) module to fuse the anomaly evidence collected from three temporal resolutions (1 s, 10 s, 60 s) in a learnable gating mechanism, and an adaptive graph structure that is updated at each inference step, according to the similarity of node features. Evaluation on four public benchmarks for IIoT (SWAT, WADI, MSL and SMD) shows state-of-the-art performance. On SWAT, TGA-Net obtains an F1 score of 95.7% while the best-reported baseline is 91.3% with an inference latency of 8.3ms/window, where it outperforms the baseline by 4.4%. TGA-Net is well suited for real-time deployment. Ablation tests have verified that each architectural element is a valuable one with regard to overall performance. Interpretability analysis by visualisation of attention weights shows patterns of anomaly localisation consistent with expert labelling of ground truth anomalies, thereby giving actionable diagnostic information beyond just identifying whether an anomaly occurred or not, and explaining its occurrence physically. Future research will include variants of online continual learning to deal with the problem of distribution shift without periodic retraining, and extension of the framework for heterogeneous, federated IIoT environments.