Spatial Temporal Graph Neural Networks based Model for Anomaly Detection

Tang, Zhiqin

Spatial Temporal Graph Neural Networks based Model for Anomaly Detection

Tang, Zhiqin

Permalink

Publication Type:: Thesis
Issue Date:: 2025

Open Access

Copyright Clearance Process

Recently Added
In Progress
Open Access

This item is open access.

Adobe PDF

Download thesisAdobe PDF (1.33 MB)

View statistics

Full metadata record

Field	Value	Language
dc.contributor.author	Tang, Zhiqin
dc.date.accessioned	2026-09-23T06:06:03Z
dc.date.available	2026-09-23T06:06:03Z
dc.date.issued	2025
dc.identifier.uri	http://hdl.handle.net/10453/196201
dc.description	University of Technology Sydney. Faculty of Engineering and Information Technology.	en_US.UTF-8
dc.description.abstract	The rapid development of the cyber-physical systems has led to the deployment of massive sensor networks that continuously generate large volumes of multivariate time-series data. In industrial environments, where reliability and operational safety are paramount, effective anomaly detection is essential for ensuring system stability and early fault prevention. However, conventional statistical and deep learning approaches often fail to capture the complex spatial and temporal dependencies that exist among heterogeneous sensors, particularly in industrial control systems (ICS) where operating conditions are dynamic and anomalies are rare. The diversity of sensor behaviours, high dimensionality, and the lack of labelled data further exacerbate the difficulty of building accurate and generalisable detection frameworks. To address these challenges, this research proposes MLAD (Multi-task Learning-based Anomaly Detection), a novel spatial-temporal graph neural network (STGNN) framework that unifies unsupervised sensor clustering, graph structure learning, and multi-task forecasting. The framework begins by learning low-dimensional temporal embeddings of sensor behaviour using UMAP-based dimensionality reduction, followed by DBSCAN clustering to group sensors exhibiting similar temporal dynamics. These clusters are then used to form a cluster-constrained adjacency matrix, ensuring that graph learning is both physically meaningful and computationally efficient. The core architecture integrates Graph Convolutional Networks (GCN) for modelling spatial dependencies among sensors and Temporal Convolutional Networks (TCN) for capturing sequential temporal patterns. Furthermore, MLAD introduces a multi-task learning mechanism that simultaneously performs forecasting and reconstruction tasks. This design allow the model to capture both short-term, abrupt deviations and long-term, gradual drifts, thereby enhancing its robustness and interpretability in detecting diverse anomaly types. Extensive experiments were conducted on two benchmark ICS datasets, SWaT and WADI, to evaluate the proposed framework. The results demonstrate that MLAD consistently outperforms state-of-the-art baselines in both ROC-AUC and PRC-AUC metrics. The ablation study confirms the importance of clustering-guided graph learning and the contribution of the multi-task design, while the case studies visually reveal the complementary strengths of the forecasting and reconstruction heads: the forecasting component excels at identifying sudden anomalies, whereas the reconstruction component effectively captures persistent, low-amplitude drifts. In summary, this research presents a unified, interpretable, and generalisable approach to anomaly detection in multivariate time-series data. By integrating spatial-temporal graph learning with multi-task representation learning, MLAD advances the state of the art in intelligent fault diagnosis and resilient monitoring for large-scale industrial systems, offering new insights into reliable, data-driven industrial analytics.	en_US.UTF-8
dc.format	MSc(CompSc)
dc.language.iso	en	en_US.UTF-8
dc.relation	https://opus.lib.uts.edu.au/bitstream/10453/196201/1/thesis.pdf
dc.rights	info:eu-repo/semantics/openAccess
dc.rights	The author owns the copyright in this thesis including all reproduction and reuse rights for the work. The work may not be altered without the permission of the copyright owner. Attribution is essential when quoting or paraphrasing from this thesis.
dc.rights	©2025 Zhiqin Tang
dc.rights	au.edu.uts.lib/cph
dc.title	Spatial Temporal Graph Neural Networks based Model for Anomaly Detection	en_US.UTF-8
dc.type	Thesis
utslib.copyright.status	open_access	*

Abstract:

The rapid development of the cyber-physical systems has led to the deployment of massive sensor networks that continuously generate large volumes of multivariate time-series data. In industrial environments, where reliability and operational safety are paramount, effective anomaly detection is essential for ensuring system stability and early fault prevention. However, conventional statistical and deep learning approaches often fail to capture the complex spatial and temporal dependencies that exist among heterogeneous sensors, particularly in industrial control systems (ICS) where operating conditions are dynamic and anomalies are rare. The diversity of sensor behaviours, high dimensionality, and the lack of labelled data further exacerbate the difficulty of building accurate and generalisable detection frameworks. To address these challenges, this research proposes MLAD (Multi-task Learning-based Anomaly Detection), a novel spatial-temporal graph neural network (STGNN) framework that unifies unsupervised sensor clustering, graph structure learning, and multi-task forecasting. The framework begins by learning low-dimensional temporal embeddings of sensor behaviour using UMAP-based dimensionality reduction, followed by DBSCAN clustering to group sensors exhibiting similar temporal dynamics. These clusters are then used to form a cluster-constrained adjacency matrix, ensuring that graph learning is both physically meaningful and computationally efficient. The core architecture integrates Graph Convolutional Networks (GCN) for modelling spatial dependencies among sensors and Temporal Convolutional Networks (TCN) for capturing sequential temporal patterns. Furthermore, MLAD introduces a multi-task learning mechanism that simultaneously performs forecasting and reconstruction tasks. This design allow the model to capture both short-term, abrupt deviations and long-term, gradual drifts, thereby enhancing its robustness and interpretability in detecting diverse anomaly types. Extensive experiments were conducted on two benchmark ICS datasets, SWaT and WADI, to evaluate the proposed framework. The results demonstrate that MLAD consistently outperforms state-of-the-art baselines in both ROC-AUC and PRC-AUC metrics. The ablation study confirms the importance of clustering-guided graph learning and the contribution of the multi-task design, while the case studies visually reveal the complementary strengths of the forecasting and reconstruction heads: the forecasting component excels at identifying sudden anomalies, whereas the reconstruction component effectively captures persistent, low-amplitude drifts. In summary, this research presents a unified, interpretable, and generalisable approach to anomaly detection in multivariate time-series data. By integrating spatial-temporal graph learning with multi-task representation learning, MLAD advances the state of the art in intelligent fault diagnosis and resilient monitoring for large-scale industrial systems, offering new insights into reliable, data-driven industrial analytics.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/196201