ABSTRACT Human Cyber Physical Systems (HCPS) encompass humans, networks, and physical devices, characterized by intricate interactions and interdependencies. The complexity of HCPS networks makes them vulnerable to network issues and cyberattacks, potentially resulting in network paralysis and significantly impacting the reliable operation of HCPS. Therefore, precise anomaly detection is imperative for HCPS. To tackle this issue, we integrate HCPS with the Software Defined Networking (SDN) infrastructure layer and propose an anomaly detection strategy based on Graph Neural Networks (GNN). Our approach utilizes Graph Sample and Aggregates (GraphSAGE) to capture adjacent feature information of nodes, revealing hidden relationships within the graph. These embeddings are then combined with Graph Attention Networks (GAT), which calculate attention coefficients between a node and its neighboring nodes, representing the importance of neighboring nodes to the central node. Finally, a fully connected layer is employed to obtain anomaly node labels. To assess the performance of our method, we conduct experiments using real datasets and compare them with other advanced anomaly detection methods in terms of accuracy, precision, recall, F1 score, and area under the ROC curve (AUC). Our method accurately detects anomalous nodes, offering a viable solution for practical applications.