🤖 machine learning

Knowledge-Assisted Multi-Graph Dependency Learning for Multivariate Time Series Anomaly Detection in Multi-Stage Industrial Processes

This paper proposes a knowledge-assisted multi-graph framework that integrates process knowledge with data-driven learning to construct complementary graphs for enhanced multivariate time series anomaly detection in complex multi-stage industrial processes.

Original authors: Jaeyeong Lee, Taeseong Yoon, Wonmo Koo, Heeyoung Kim

Published 2026-07-20

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Jaeyeong Lee, Taeseong Yoon, Wonmo Koo, Heeyoung Kim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the conductor of a massive, high-tech orchestra, but instead of violins and drums, your instruments are thousands of sensors spread across a giant factory. These sensors are constantly playing a symphony of numbers, measuring everything from water pressure to chemical levels. In the world of industrial automation, this is called Multivariate Time Series Anomaly Detection (MTAD). It's basically the art of listening to this digital orchestra to spot a single instrument playing a wrong note before the whole song turns into a disaster.

For a long time, computers have tried to learn this music purely by listening. They use a type of artificial intelligence called Graph Neural Networks (GNNs). Think of a GNN as a detective who tries to figure out which sensors are "friends" just by watching how their numbers move together. If Sensor A goes up and Sensor B goes up right after, the detective assumes they are connected. But here's the catch: in complex factories with many stages, sensors can look like they are friends just by coincidence, or they might be secretly connected in ways the detective can't see just by listening. This is where process knowledge comes in. It's like giving the detective a map of the factory floor so they know exactly which sensors are supposed to be talking to each other based on how the machines are actually built, not just how the numbers look.

This paper, titled "Knowledge-Assisted Multi-Graph Dependency Learning for Multivariate Time Series Anomaly Detection in Multi-Stage Industrial Processes," tackles the problem of how to mix that "listening" skill with the "factory map" to catch mistakes faster and more accurately. The authors, Jaeyeong Lee and his team from KAIST, argue that relying only on data is like trying to navigate a city without a map—you might get there, but you'll likely take wrong turns. They propose a new system that builds three different "friendship maps" (graphs) for the sensors: one based purely on what the data says, one based on which sensors belong to the same machine stage, and a third based on how the stages are connected to each other. By using a special attention network that looks at all three maps at once, their system learns to predict what the sensors should be doing. When the actual numbers don't match the prediction, the system sounds the alarm.

The researchers tested this idea on real-world data from two water treatment plants (the SWaT and WADI datasets). They found that by using the factory maps, their system was significantly better at spotting cyber-attacks and glitches than systems that only listened to the data. For example, in one test, their method achieved an F1 score (a measure of accuracy) of 0.8233 on the SWaT dataset, beating all the other top methods they compared it against. The paper suggests that this approach works because it helps the AI understand the "rules" of the factory, preventing it from being fooled by strange but harmless data patterns. However, the authors also note a limitation: their current model doesn't fully account for the natural randomness or "noise" in industrial data, which might make it sometimes too confident in its predictions. They suggest that future versions could add a layer of probability to handle this uncertainty, but for now, the results show that giving AI a little bit of human knowledge about how a factory works makes it a much sharper detective.

Technical Summary: Knowledge-Assisted Multi-Graph Dependency Learning for Multivariate Time Series Anomaly Detection in Multi-Stage Industrial Processes

Problem Statement
Industrial control systems (ICS) generate complex multivariate time series data from sensors distributed across multiple stages or sub-processes. Effective anomaly detection in these environments (Multivariate Time Series Anomaly Detection, or MTAD) is critical for preventing failures. While Graph Neural Networks (GNNs) have advanced MTAD by learning data-driven graphs to model inter-sensor dependencies, existing approaches often struggle in multi-stage processes. Purely data-driven methods frequently fail to capture critical dependencies that arise from physical process dynamics, such as strong correlations between sensors in different but connected sub-processes. Consequently, these models may infer spurious connections or miss key relationships, leading to suboptimal detection performance. Furthermore, while some methods incorporate sensor group knowledge (grouping sensors by sub-process), they often neglect process flow knowledge (relationships between adjacent sub-processes), limiting their ability to model the full complexity of industrial systems.

Methodology
The authors propose a Knowledge-Assisted Multi-Graph Framework designed to explicitly integrate process knowledge into the graph learning process for forecasting-based anomaly detection. The method operates in three primary stages:

Multi-Graph Structure Learning:
Instead of relying on a single learned graph, the framework constructs three complementary graphs to capture different types of dependencies:
- Uninformed Graph ( $G_U$ ): A purely data-driven graph learned from sensor embeddings without prior knowledge, serving as a baseline to capture latent patterns.
- Sensor Group Knowledge-Informed Graph ( $G_G$ ): This graph incorporates sensor group knowledge (which sensors belong to which sub-process). It masks similarities between sensors not in the same sub-process, focusing on intra-sub-process dependencies.
- Process Flow Knowledge-Informed Graph ( $G_F$ ): This graph incorporates process flow knowledge (adjacency between sub-processes). It masks similarities between sensors not in adjacent sub-processes, focusing on inter-sub-process dependencies.
To model directional relationships, each sensor is assigned two learnable embeddings (source and target roles). Similarities are computed using these embeddings, and adjacency matrices are formed by selecting the top- $k$ neighbors, with sparsity controlled by the specific knowledge constraints.
Graph Attention-Based Forecasting:
The framework employs a hybrid architecture combining temporal and spatial modeling:
- Temporal Encoder: A Temporal Convolutional Network (TCN) processes historical sensor data to capture intra-sensor temporal dynamics.
- Multi-Graph Attention Network: Three separate Graph Attention Networks (GATs) operate in parallel, one for each of the constructed graphs ( $G_U, G_G, G_F$ ). Each GAT learns an attention mechanism specific to its graph structure, allowing the model to weigh neighboring sensors differently based on the specific dependency type (data-driven, intra-process, or inter-process).
- Prediction: The aggregated features from the three GATs, combined with the temporal features and sensor embeddings, are fed into a Multi-Layer Perceptron (MLP) to forecast future sensor readings.
Anomaly Scoring:
Anomalies are detected based on forecasting errors. The method calculates the error between predicted and observed values for each sensor. These errors are normalized using the median and interquartile range (IQR) derived from training data (normal operations). The final anomaly score for a timestamp is the maximum normalized error across all sensors.

Key Contributions
The paper identifies three primary contributions:

A Knowledge-Assisted Multi-Graph Framework: A novel architecture for MTAD in multi-stage industrial processes that structurally integrates process knowledge into graph construction rather than treating it as auxiliary input.
Principled Dependency Modeling: A mechanism to simultaneously model intra-sub-process and inter-sub-process dependencies using two distinct forms of domain knowledge: sensor group knowledge and process flow knowledge.
Empirical Validation: Comprehensive experiments and ablation studies demonstrating that incorporating these knowledge sources significantly improves anomaly detection performance and interpretability compared to purely data-driven baselines.

Experimental Results
The proposed method was evaluated on two real-world multi-stage industrial datasets: SWaT (Secure Water Treatment) and WADI (Water Distribution).

Performance: The proposed method achieved the highest F1 scores on both datasets (0.8233 on SWaT and 0.6485 on WADI), outperforming a diverse set of baselines including MAD-GAN, USAD, TranAD, GDN, and FuSAGNet.
Ablation Studies: Removing either the sensor group knowledge graph ( $G_G$ ) or the process flow knowledge graph ( $G_F$ ) resulted in a consistent decline in performance. Removing both led to the most significant drop, confirming that both knowledge sources provide unique and synergistic value.
Qualitative Analysis: Case studies on specific attack scenarios demonstrated that:
- Sensor group knowledge is crucial for detecting anomalies that disrupt coordinated behavior within a single sub-process.
- Process flow knowledge is essential for detecting anomalies that create inconsistencies between physically connected sub-processes.
- Purely data-driven models often failed to capture these specific physical dependencies, leading to missed detections.

Significance and Claims
The paper claims that the primary significance of this work lies in addressing the limitation of existing GNN-based MTAD methods that overlook critical process dynamics. By explicitly embedding sensor group and process flow knowledge into the graph construction mechanism, the model achieves a more robust representation of complex inter-sensor dependencies. The authors emphasize that this approach does not require manual relationship modeling or specialized domain expertise beyond specifying sensor groupings and stage adjacencies from existing process diagrams.

The study concludes that while the method significantly improves detection performance, it currently relies on deterministic forecasting. The authors modestly note a limitation regarding the lack of explicit modeling of inherent stochasticity in industrial time series, suggesting that future work could extend this framework into a probabilistic forecasting model to further enhance reliability.

More like this