FluxGraph: Synergizing Dynamic Graph Attention and Flux Memory for Unsupervised Time Series Anomaly Detection

Technical Summary: FluxGraph

Problem Statement
Time series anomaly detection is critical for cyber-physical systems (CPS) and automotive Controller Area Network (CAN) bus networks. However, existing unsupervised methods face significant challenges in real-world, non-stationary environments. Traditional reconstruction-based methods often fail to detect subtle masquerade anomalies or gradual baseline drifts because they rely on single optimization objectives and tend to smooth over transient patterns. Similarly, forecasting-based methods respect sequential continuity but frequently miss changes in cross-variable dependencies or slow drifts that remain consistent with short-term history. Furthermore, many critical anomalies manifest not as large statistical deviations but as small shifts in temporal dynamics, gradual changes in inter-sensor relationships, or transitions between operating regimes. Current approaches often lack the ability to jointly reason about pointwise values, sequential dependencies, relational structures, and global state evolution.

Methodology
The authors propose FluxGraph, an unsupervised framework that synergizes dynamic graph attention with flux memory and state-aware adaptive regulation. The architecture processes fixed-length windows of normalized multivariate observations through the following components:

1. Cross-Window KL-Constrained Reversible Normalization: To address continuous distribution drift between adjacent windows, the model employs a Window-based Reversible Instance Normalization (WindowRevIN) enhanced with a cross-window Kullback-Leibler (KL) divergence regularizer. This suppresses distribution shifts without introducing lookahead bias, ensuring stable input for subsequent modules.
2. Dynamic Sensor Graph with Feature Reflux: Unlike fixed-topology graphs, FluxGraph constructs a soft adjacency matrix conditioned on the current window content. Crucially, it introduces a feature reflux mechanism where high-level features extracted by deeper layers are fed back to iteratively update the adjacency matrix. This allows the graph topology to adapt in real-time to changing inter-channel structures and subtle relational anomalies.
3. Multi-Scale Temporal Stem: The model extracts features at different receptive fields using parallel depthwise convolutions, combining the original normalized signal, graph-conditioned signals, and first-order differences.
4. Flux Attention Blocks: These blocks integrate three complementary pathways:
   • Standard temporal self-attention with relative positional bias.
   • Attention over persistent memory vectors that accumulate long-range patterns.
   • Lightweight depthwise convolution for local refinement.
     A state-entropy-driven adaptive gating mechanism dynamically balances the contribution of these pathways based on the uncertainty of the system's operational state.
5. Process State Memory: This module maintains latent operational prototypes to explicitly track regime changes and state transitions, which are difficult to capture via local reconstruction alone. It estimates assignment confidence based on entropy and models expected transitions between consecutive states.
6. Multi-Evidence Fusion: The architecture generates four parallel outputs (reconstruction, one-step forecast, state-transition prediction, and channel-wise state expectations). Seven complementary residual signals (including pointwise deviations, relational discrepancies, and state-transition inconsistencies) are fused using a logarithmic aggregation function. This approach eliminates magnitude discrepancies between heterogeneous residuals, preventing large-amplitude outliers from masking subtle structural anomalies.

Key Contributions

• Synergistic Framework: The integration of bidirectional feature flow (via the feature reflux loop) with state-aware adaptive regulation within a unified unsupervised framework.
• Dynamic Topology Optimization: The proposal of an iterative mechanism where deep features refine the dynamic sensor graph, enabling the detection of relational drifts that fixed-topology models miss.
• State-Entropy Gating: The introduction of a gating mechanism driven by state entropy, allowing the model to adaptively shift focus between global patterns and local variations based on real-time system uncertainty.
• Log-Space Multi-Evidence Fusion: A novel aggregation strategy that fuses seven distinct residual signals in log-space to ensure balanced detection of both abrupt point faults and slow systemic drifts.

Results
FluxGraph was evaluated on industrial sensor (SMD, HAI), automotive CAN bus (Car-Hacking), and traffic network (ROAD) benchmarks.

• Industrial Sensors (SMD): FluxGraph achieved optimal Range-based F1 (RF1) of 0.62, VROC of 0.93, and VPR of 0.67, outperforming baselines like Mamba, LSTM-AE, and ALoRa by a significant margin. This demonstrates superior capability in detecting gradual drift and structural anomalies.
• Industrial Sensors (HAI): While slightly lower in RF1 (0.59) compared to some reconstruction-heavy baselines (due to HAI's prevalence of point anomalies), FluxGraph achieved the highest VROC (0.96) and VPR (0.72), indicating superior ranking ability in unsupervised settings.
• Cross-Domain Generalization:
  • CAN Bus (Car-Hacking): Achieved 99.98% accuracy and a perfect Macro AUROC of 1.00000, surpassing specialized models like LiPar and MobileNetV3.
  • Traffic Graph (ROAD): Demonstrated strong performance in detecting masquerade attacks, significantly improving Precision and F1-scores for stealth attacks (e.g., Reverse Light Off) where other baselines failed.
• Ablation Studies: Confirmed that removing any core component (forecasting, reconstruction, dynamic graph, flux memory, or state memory) leads to performance degradation. The study also validated that logarithmic aggregation is superior to linear summation or max pooling for fusing heterogeneous residuals.
• Efficiency: Despite its complexity, FluxGraph maintains an inference time of 2.45 ms per batch on an NVIDIA RTX4090, comparable to ALoRa and nearly twice as fast as Mamba, making it suitable for near-real-time industrial monitoring.

Significance and Claims
The paper claims that FluxGraph addresses the fundamental blind spots of single-objective anomaly detection methods. By explicitly modeling the interplay between dynamic sensor correlations, global state evolution, and local temporal dynamics, the framework can detect fine-grained anomalies that are systematically missed by existing approaches. The authors emphasize that the iterative feature reflux and log-space multi-evidence fusion are critical innovations that allow the model to distinguish between normal operational drifts and subtle, stealthy anomalies (such as masquerade attacks) without requiring labeled data. The results suggest that this unified spatiotemporal framework offers robust cross-domain generalization, making it a viable solution for diverse CPS applications ranging from industrial plants to vehicle networks.