Abstract:Cyber–physical systems (CPSs) serve as the pivotal core of Internet of Things (IoT) infrastructures, such as smart grids and intelligent transportation, deploying interconnected sensing devices to monitor operating status. With increasing decentralization, the surge in sensor devices expands the potential vulnerability to cyber attacks. It is imperative to conduct anomaly detection research on the multivariate time series data that these sensors produce to bolster the security of distributed CPSs. However, the high dimensionality, absence of anomaly labels in real-world datasets, and intricate non-linear relationships among sensors present considerable challenges in formulating effective anomaly detection algorithms. Recent deep-learning methods have achieved progress in the field of anomaly detection. Yet, many methods either rely on statistical models that struggle to capture non-linear relationships or use conventional deep learning models like CNN and LSTM, which do not explicitly learn inter-variable correlations. In this study, we propose a novel unsupervised anomaly detection method that integrates Sparse Autoencoder with Graph Transformer network (SGTrans). SGTrans leverages Sparse Autoencoder for the dimensionality reduction and reconstruction of high-dimensional time series, thus extracting meaningful hidden representations. Then, the multivariate time series are mapped into a graph structure. We introduce a multi-head attention mechanism from Transformer into graph structure learning, constructing a Graph Transformer network forecasting module. This module performs attentive information propagation between long-distance sensor nodes and explicitly models the complex temporal dependencies among them to enhance the prediction of future behaviors. Extensive experiments and evaluations on three publicly available real-world datasets demonstrate the effectiveness of our approach.

Practical Cyber Attack Detection With Continuous Temporal Graph in Dynamic Network System

Detecting Unknown Threat Based on Continuous-Time Dynamic Heterogeneous Graph Network

Dynamic Deep Graph Convolution with Enhanced Transformer Networks for Time Series Anomaly Detection in IoT

Detection of Cyber-Attacks in a Discrete Event System Based on Deep Learning

Subtle Anomaly Detection in Dynamic Networks Using Graph Spectra

Application of a Dynamic Line Graph Neural Network for Intrusion Detection With Semisupervised Learning

Advanced Persistent Threat Detection in Smart Grid Clouds Using Spatiotemporal Context-Aware Graph Embedding

Graph Transformer Network Incorporating Sparse Representation for Multivariate Time Series Anomaly Detection

Spatio-Temporal Graph Convolutional Networks for DDoS Attack Detecting.

Local Augmentation with Functionality-Preservation for Semi-Supervised Graph Intrusion Detection

A Temporal Graph Neural Network for Cyber Attack Detection and Localization in Smart Grids

Deep Learning-Based Anomaly Detection in Network Traffic for Cyber Threat Identification

Attack Graph Model for Cyber-Physical Power Systems using Hybrid Deep Learning

HiSec: Towards Cyber Threat Correlation and Discovery Based on Hierarchical Graph Neural Networks

A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection

N-STGAT: Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-Earth Remote Sensing

Network Anomaly Early Warning through Generalized Network Temperature and Deep Learning

Advancing Cyber-Attack Detection in Power Systems: A Comparative Study of Machine Learning and Graph Neural Network Approaches

CTLMD: Continuous-Temporal Lateral Movement Detection Using Graph Embedding

Learning Graph Structures with Transformer for Multivariate Time Series Anomaly Detection in IoT

Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs