A hybrid dynamic graph neural network framework for real-time anomaly detection

Abstract

ABSTRACT The timely and robust detection of anomalies is essential for resilient and secure operations of critical water infrastructures against operational faults or malicious actions. However, real-world systems exhibit diverse and evolving spatiotemporal relationships among their components, posing an intricate challenge in anomaly detection task. This study proposes a hybrid dynamic graph neural network (GNN) that jointly maps long- and short-term spatiotemporal relationships in multivariate data streams. Those relationships are encoded via a hybrid graph, comprising an optimally learned static subgraph for persistent structural relationships and a complementary dynamic subgraph for dynamically shifting relationships. Additionally, an attention mechanism captures time-varying relational importances and shifts the model's focus towards significant relationships, while minimising contributions of less importance to the final outputs. The proposed architecture is showcased through a synthetic case study of a water distribution system with multivariate data streams from both on-site and soft sensors, and shows strong detection and localisation accuracy against all scenarios of operational faults and malicious actions explored. A comparative analysis with an equivalent static graph model indicates that the addition of the hybrid dynamic component enhances detection accuracy and reduces false alarm rates through more robust characterisation of behaviours, thus allowing actionable insights for more resilient and secure operations.