Knowledge-Assisted Multi-Graph Dependency Learning for Multivariate Time Series Anomaly Detection in Multi-Stage Industrial Processes

# Knowledge-Assisted Multi-Graph Dependency Learning for Multivariate Time Series Anomaly Detection in Multi-Stage Industrial Processes
Source: [https://arxiv.org/html/2607.15799](https://arxiv.org/html/2607.15799)
Jaeyeong Lee, Taeseong Yoon, Wonmo Koo, and Heeyoung KimThis work was supported by the National Research Foundation of Korea \(NRF\) grant funded by the Korea government \(MSIT\) \(2023R1A2C2005453, RS\-2023\-00218913\)\. \(Corresponding author: Heeyoung Kim\.\)Jaeyeong Lee, Taeseong Yoon, Wonmo Koo, and Heeyoung Kim are with the Department of Industrial and Systems Engineering, Korea Advanced Institute of Science and Technology \(KAIST\), Daejeon, Republic of Korea\. \(e\-mail: dlwodud116@kaist\.ac\.kr; bigstar0423@kaist\.ac\.kr; joseph92@kaist\.ac\.kr; heeyoungkim@kaist\.ac\.kr\)\.Jaeyeong Lee and Taeseong Yoon contributed equally to this work\.

###### Abstract

Industrial processes often generate complex, interdependent time\-series data from multiple sensors across multiple stages, forming complex dependencies among variables and process stages\. Effective monitoring and timely anomaly detection of these time series through multivariate time series anomaly detection \(MTAD\) is crucial for preventing failures and ensuring the reliability of automated systems\. Graph neural networks \(GNNs\) have advanced MTAD by leveraging data\-driven graphs to model complex dependencies among variables, effectively capturing relational structures within multivariate time series to enhance anomaly detection performance\. However, existing GNN\-based approaches often overlook critical process knowledge, and even when this knowledge is considered, seamlessly incorporating it into existing models remains inherently challenging, leading to suboptimal performance\. To address this limitation, we propose a knowledge\-assisted multi\-graph framework for modeling sensor dependencies in multi\-stage industrial processes for MTAD, which explicitly incorporates process knowledge into graph learning to enhance dependency modeling and improve anomaly detection performance\. Our method constructs three complementary graphs: one purely data\-driven and two refined by integrating structural constraints derived from process knowledge\. To effectively leverage these graphs for anomaly detection, we employ a multi\-graph attention network, enabling a more accurate and robust representation of complex dependencies\. Comprehensive experiments on two real\-world, multi\-stage industrial datasets demonstrate that incorporating process knowledge substantially enhances anomaly detection performance\.

Note to Practitioners—This work tackles anomaly detection in multi\-stage industrial processes, where many sensors exhibit dependencies both within and across stages\. Methods that learn sensor relations purely from data often overlook critical dependencies or infer spurious ones\. To address this limitation, the proposed approach incorporates two forms of commonly available process knowledge—sensor group knowledge \(sensors associated with each sub\-process\) and process flow knowledge \(adjacent sub\-process relationships\)—derived from process diagrams\. The method builds three complementary graphs \(uninformed, sensor group knowledge\-informed, and process flow knowledge\-informed\) and uses a multi\-graph attention network combined with a temporal convolutional network for forecasting\-based anomaly detection\. Experiments on water treatment and water distribution systems show substantial F1 improvements over data\-driven baselines, ablation studies confirming the contributions of both knowledge sources\. For deployment, practitioners only need to specify sensor groupings and stage adjacencies from existing diagrams; no manual relationship modeling or specialized domain expertise is required\. The model is trained on normal\-operation data and detects anomalies via prediction errors\. The approach is most effective when sub\-process boundaries and flows are well documented and should be updated if the plant configuration changes\. Beyond water systems, this method can be applied to chemical processing, power generation, and automated manufacturing facilities with similar multi\-stage structures\.

## IIntroduction

Industrial control systems \(ICS\) are cyber\-physical systems designed to enable a small number of operators to efficiently manage industrial processes\. These systems rely on numerous sensors and actuators distributed across multiple stages \(or sub\-processes\) to monitor and control operations\[[2](https://arxiv.org/html/2607.15799#bib.bib2),[4](https://arxiv.org/html/2607.15799#bib.bib4),[3](https://arxiv.org/html/2607.15799#bib.bib3),[1](https://arxiv.org/html/2607.15799#bib.bib1),[5](https://arxiv.org/html/2607.15799#bib.bib5)\]\. Effective monitoring and timely anomaly detection of the multivariate time series generated by ICS are important for preventing failures and ensuring system reliability, which can be achieved through multivariate time series anomaly detection \(MTAD\)\.

Recently, methods employing graph neural networks \(GNNs\)\[[6](https://arxiv.org/html/2607.15799#bib.bib6),[7](https://arxiv.org/html/2607.15799#bib.bib7),[9](https://arxiv.org/html/2607.15799#bib.bib9),[10](https://arxiv.org/html/2607.15799#bib.bib10),[11](https://arxiv.org/html/2607.15799#bib.bib11),[12](https://arxiv.org/html/2607.15799#bib.bib12),[13](https://arxiv.org/html/2607.15799#bib.bib13),[14](https://arxiv.org/html/2607.15799#bib.bib14),[15](https://arxiv.org/html/2607.15799#bib.bib15),[16](https://arxiv.org/html/2607.15799#bib.bib16),[17](https://arxiv.org/html/2607.15799#bib.bib17)\]have shown remarkable performance in MTAD, primarily due to their ability to capture complex inter\-sensor dependencies through graphs, where nodes represent sensors and edges represent their relationships\. Since the structure of the graph is often unknown in many real\-world MTAD scenarios\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\], GNN\-based MTAD methods typically learn the graph structure from the data\.

However, accurately learning the graph structure can be challenging for processes with multiple stages or sub\-processes, which exhibit complex dependencies both among variables and across process stages\. In particular, strong correlations can arise not only among variables within the same stage but also between different stages, especially when they are closely linked\[[8](https://arxiv.org/html/2607.15799#bib.bib8)\]\. To illustrate this challenge, Fig\.[1](https://arxiv.org/html/2607.15799#S1.F1)\(a\) presents the process flow diagram of a water treatment process comprising six sub\-processes \(P1–6\), each monitored by multiple sensors, while Fig\.[1](https://arxiv.org/html/2607.15799#S1.F1)\(b\) highlights the strong correlations among the measurements from two sensors in P3 \(MV301 and DPIT301\) and two sensors in P6 \(P602 and FIT601\)\. These correlations naturally arise from the underlying process dynamics\. Specifically, in P3, MV301 regulates the backwashing valve for the ultra\-filtration \(UF\) unit, while DPIT301 measures the resulting pressure difference\. Similarly, in P6, P602 indicates the pump’s state, directly influencing the water flow measured by FIT601\. Additionally, P3 and P6 are intrinsically linked through the backwashing process, as treated water from P6 is pumped to P3 to clean the UF unit\.111Although P3 and P6 are sequentially connected in process flow, their sensor responses may appear nearly simultaneous in Fig\.[1](https://arxiv.org/html/2607.15799#S1.F1)\(b\) because the physical response delay is short relative to sampling resolution\. Thus, the figure illustrates coupled responses from sequentially connected sub\-processes, rather than simultaneous operation of unrelated sub\-processes\.

![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/SWaT_diag_revised.png)\(a\)
![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/P3-P6_correlation2.png)\(b\)

Figure 1:\(a\) The process flow diagram of the Secure Water Treatment \(SWaT\) process and \(b\) a one\-hour\-long multivariate time series from four sensors in P3 and P6\.![Refer to caption](https://arxiv.org/html/2607.15799v1/x1.png)

Figure 2:Relationships among four sensors captured through graph structure learning in \(a\) the GDN\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]and \(b\) the proposed model\. Edges are weighted by learned similarities, with dashed lines representing missing relationships\.Thus, accurately modeling these complex interdependencies is crucial for effective MTAD\. However, existing GNN\-based MTAD methods, which infer inter\-sensor relationships solely from data, often struggle to accurately capture these complex dependencies\. As a result, they may learn spurious connections or fail to identify key relationships in multi\-stage processes\. This limitation is illustrated in Fig\.[2](https://arxiv.org/html/2607.15799#S1.F2)\(a\), which displays the relationships among the four sensors in Fig\.[1](https://arxiv.org/html/2607.15799#S1.F1)\(b\) \(MV301, DPIT 301, P602, FIT601\) learned by the graph deviation network \(GDN\)\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\], a representative GNN\-based MTAD method\. Solid lines indicate detected relationships, while the dashed lines represent missing connections\. The numerical values along the edges denote similarity scores, with darker shades indicating stronger inferred connections\. Ideally, the model should capture all relationships among four sensors, given their high correlations, as shown in Fig\.[1](https://arxiv.org/html/2607.15799#S1.F1)\(b\)\. However, GDN misrepresents sensor interactions, leading to an incomplete depiction of dependencies and ultimately suboptimal anomaly detection\. In contrast, our proposed method, shown in Fig\.[2](https://arxiv.org/html/2607.15799#S1.F2)\(b\), effectively captures the true sensor dependencies, leading to more reliable anomaly detection\.

To address these challenges, sensor group knowledge—which specifies the sub\-process associated with each sensor—has been incorporated into a GNN\-based MTAD framework\[[11](https://arxiv.org/html/2607.15799#bib.bib11)\]\. While this approach improved dependency modeling by leveraging sensor group knowledge, it did not account forprocess flow knowledge, which captures relationships between closely related sub\-processes\. Without explicitly modeling relationships between interconnected sub\-processes, the learned graph structure may still overlook critical dependencies, ultimately limiting the effectiveness of anomaly detection\. Thus, a more comprehensive approach that integrates both sensor group knowledge and process flow knowledge is essential for accurately modeling multi\-stage industrial processes and enhancing MTAD performance\.

In this paper, we propose a knowledge\-assisted multi\-graph framework for modeling sensor dependencies in multi\-stage industrial processes for forecasting\-based MTAD\. The framework extends GNN\-based MTAD approaches to structurally incorporate sensor group knowledge and process flow knowledge into graph construction, and exploits the resulting complementary relational representations through multi\-graph attention for forecasting\. This structured integration helps the model to more effectively capture inter\-sensor dependencies, improving over conventional data\-driven approaches that often overlook the underlying process dynamics\. By coupling this knowledge\-guided graph structure construction with temporal modeling via a temporal convolutional network \(TCN\)\[[19](https://arxiv.org/html/2607.15799#bib.bib19)\], the proposed method delivers more robust forecasting and improved anomaly detection performance on real\-world industrial datasets\.

Our method consists of three stages: \(1\) graph structure learning, \(2\) graph attention\-based forecasting, and \(3\) anomaly scoring\. Our primary contribution lies in the first stage—graph structure learning—where we introduce a principled method to embed process knowledge into the graph\. This is nontrivial due to architectural constraints and the difficulty of embedding structured relationships into graph representations\.

To address this, we introduce a simple yet effective structural design that integrates process knowledge seamlessly into the GNN framework\. Specifically, we represent sensor similarities using two learnable embeddings per sensor, capturing bidirectional relationships between sensor pairs\. Based on these similarities, we construct three graphs: \(1\) a purely data\-driven graph, \(2\) a graph that selectively masks similarities using sensor group knowledge, and \(3\) a graph that masks similarities based on process flow knowledge\. Instead of merely treating prior knowledge as auxiliary node attributes, our framework translates it directly into the graph construction mechanism\. This introduces structured inductive bias into graph learning itself, guiding the robust discovery of inter\-sensor dependencies\.

Building upon these graphs, we forecast future sensor readings and conduct anomaly detection based on forecast errors\. A key challenge here is to integrate the learned inter\-sensor dependencies from graphs with intra\-sensor temporal dynamics to enable accurate forecasting and robust anomaly detection\. Since each graph encodes distinct inter\-sensor relationships, we employ three separate graph attention networks \(GATs\)\[[18](https://arxiv.org/html/2607.15799#bib.bib18)\], one for each graph constructed in the previous stage, each learning an attention mechanism tailored to the corresponding graph and enabling the model to capture complementary relational information for forecasting\. These GATs allow for flexible and adaptive relationship modeling by dynamically assigning varying levels of importance to neighboring sensors\. In parallel, to model intra\-sensor dependencies over time, we use a TCN, leveraging its ability to effectively capture temporal patterns with relatively low computational cost compared to typical recurrent models\.

The outputs of the GATs and TCN are combined to form rich spatiotemporal representations, which are used to forecast future sensor readings\. Anomaly scores are then derived from the resulting prediction errors\. We validate our method on two real\-world multi\-stage industrial datasets and show that incorporating process knowledge significantly improves anomaly detection performance\.

The main contributions of this paper are threefold\. \(1\) a knowledge\-assisted multi\-graph dependency learning framework for MTAD in multistage industrial processes; \(2\) a principled mechanism for modeling both intra\-sub\-process and inter\-sub\-process dependencies using sensor group knowledge and process flow knowledge; and \(3\) comprehensive empirical validation, including ablation and qualitative analyses, demonstrating the effectiveness and interpretability of the proposed knowledge\-guided graph design\.

The remainder of the paper is organized as follows\. Section[II](https://arxiv.org/html/2607.15799#S2)reviews related work\. Section[III](https://arxiv.org/html/2607.15799#S3)provides an overview of the GAT and TCN\. Section[IV](https://arxiv.org/html/2607.15799#S4)describes the proposed method\. In Section[V](https://arxiv.org/html/2607.15799#S5), we validate the proposed method using real\-world sensor datasets\. Finally, we conclude this paper in Section[VI](https://arxiv.org/html/2607.15799#S6)\.

## IIRelated Work

### II\-AUnsupervised Multivariate Time Series Anomaly Detection

Following the standard taxonomy of anomaly detection, the present work focuses on point anomaly detection rather than contextual or collective anomaly detection\[[20](https://arxiv.org/html/2607.15799#bib.bib20),[21](https://arxiv.org/html/2607.15799#bib.bib21),[23](https://arxiv.org/html/2607.15799#bib.bib23),[24](https://arxiv.org/html/2607.15799#bib.bib24)\]\.

For MTAD, various deep neural network \(DNN\)\-based methods have been proposed\[[21](https://arxiv.org/html/2607.15799#bib.bib21),[22](https://arxiv.org/html/2607.15799#bib.bib22),[26](https://arxiv.org/html/2607.15799#bib.bib26),[25](https://arxiv.org/html/2607.15799#bib.bib25)\], owing to their effectiveness in handling complex, high\-dimensional time series data\. Due to the unlabeled nature of the data and the rarity of anomalies, MTAD has mainly been treated as an unsupervised learning problem\[[10](https://arxiv.org/html/2607.15799#bib.bib10)\]\. Unsupervised DNN\-based MTAD methods are typically categorized into two classes: forecasting\-based approaches\[[27](https://arxiv.org/html/2607.15799#bib.bib27),[28](https://arxiv.org/html/2607.15799#bib.bib28),[9](https://arxiv.org/html/2607.15799#bib.bib9),[29](https://arxiv.org/html/2607.15799#bib.bib29),[30](https://arxiv.org/html/2607.15799#bib.bib30)\]and reconstruction\-based approaches\[[32](https://arxiv.org/html/2607.15799#bib.bib32),[33](https://arxiv.org/html/2607.15799#bib.bib33),[35](https://arxiv.org/html/2607.15799#bib.bib35),[36](https://arxiv.org/html/2607.15799#bib.bib36),[37](https://arxiv.org/html/2607.15799#bib.bib37),[34](https://arxiv.org/html/2607.15799#bib.bib34)\]\.

Forecasting\-based MTAD methods typically predict the value at each time stamp by using previously observed values and use forecasting errors to detect anomalies\. These methods operate under the assumption that forecasting errors of anomalous data points are higher than those of normal data points\. To capture complex intra\-sensor dependencies, recurrent neural networks \(RNNs\) have been used\[[27](https://arxiv.org/html/2607.15799#bib.bib27),[28](https://arxiv.org/html/2607.15799#bib.bib28)\]\. Furthermore, TCNs and Transformers\[[45](https://arxiv.org/html/2607.15799#bib.bib45)\]have also been employed due to their effectiveness in capturing long\-range intra\-sensor dependencies\[[9](https://arxiv.org/html/2607.15799#bib.bib9),[29](https://arxiv.org/html/2607.15799#bib.bib29),[30](https://arxiv.org/html/2607.15799#bib.bib30)\]\.

Reconstruction\-based MTAD methods typically reconstruct observed time series, identifying anomalies when reconstruction errors are significant\. Similar to forecasting\-based MTAD methods, they employ various DNNs specially designed to capture complex intra\-sensor dependencies, such as RNNs\[[31](https://arxiv.org/html/2607.15799#bib.bib31),[32](https://arxiv.org/html/2607.15799#bib.bib32),[33](https://arxiv.org/html/2607.15799#bib.bib33),[34](https://arxiv.org/html/2607.15799#bib.bib34)\], TCNs\[[36](https://arxiv.org/html/2607.15799#bib.bib36)\], and Transformers\[[38](https://arxiv.org/html/2607.15799#bib.bib38),[37](https://arxiv.org/html/2607.15799#bib.bib37)\]\. Beyond such intra\-sensor modeling,\[[39](https://arxiv.org/html/2607.15799#bib.bib39)\]applied a Transformer to capture inter\-sensor spatial associations\.\[[40](https://arxiv.org/html/2607.15799#bib.bib40)\]performed reconstruction in the frequency domain by patchifying the spectrum into bands, and adaptively discovered channel correlations between channel\-independent and channel\-dependent strategies\. More recently, diffusion\-based generative models such as\[[41](https://arxiv.org/html/2607.15799#bib.bib41)\]have also been explored for reconstruction\-based anomaly detection\.

Hybrid MTAD methods\[[6](https://arxiv.org/html/2607.15799#bib.bib6),[10](https://arxiv.org/html/2607.15799#bib.bib10),[11](https://arxiv.org/html/2607.15799#bib.bib11),[42](https://arxiv.org/html/2607.15799#bib.bib42),[14](https://arxiv.org/html/2607.15799#bib.bib14)\]combine forecasting and reconstruction models\. These methods commonly use both forecasting and reconstruction errors to detect anomalies\. More recently, contrastive learning has been explored as an alternative paradigm, learning discriminative representations through synthetic anomaly injection or causality\-aware augmentation\[[44](https://arxiv.org/html/2607.15799#bib.bib44),[43](https://arxiv.org/html/2607.15799#bib.bib43)\]\.

### II\-BGraph Neural Network\-Based MTAD

In recent years, several GNN\-based MTAD methods\[[6](https://arxiv.org/html/2607.15799#bib.bib6),[7](https://arxiv.org/html/2607.15799#bib.bib7),[9](https://arxiv.org/html/2607.15799#bib.bib9),[10](https://arxiv.org/html/2607.15799#bib.bib10),[11](https://arxiv.org/html/2607.15799#bib.bib11),[12](https://arxiv.org/html/2607.15799#bib.bib12),[13](https://arxiv.org/html/2607.15799#bib.bib13),[14](https://arxiv.org/html/2607.15799#bib.bib14),[15](https://arxiv.org/html/2607.15799#bib.bib15),[16](https://arxiv.org/html/2607.15799#bib.bib16),[17](https://arxiv.org/html/2607.15799#bib.bib17)\]have been introduced, achieving remarkable performance by effectively capturing complex inter\-sensor dependencies as well as intra\-sensor dependencies\. In an initial effort,\[[6](https://arxiv.org/html/2607.15799#bib.bib6)\]used a GAT\[[18](https://arxiv.org/html/2607.15799#bib.bib18)\], assuming that sensor relationships could be represented by a complete graph\. However, in many real\-world cases, the assumption of a complete graph is unrealistic, and the underlying \(sparse\) graph is typically unknown\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]\. To address this challenge,\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]proposed a GNN\-based MTAD method capable of learning the latent graph from the data\. They introduced a randomly initialized learnable embedding for each sensor to represent its characteristics, deriving the graph from the similarities across the sensor embeddings\. This graph structure learning technique has been employed in various GNN\-based MTAD methods in a similar manner\[[10](https://arxiv.org/html/2607.15799#bib.bib10),[11](https://arxiv.org/html/2607.15799#bib.bib11),[14](https://arxiv.org/html/2607.15799#bib.bib14),[15](https://arxiv.org/html/2607.15799#bib.bib15),[16](https://arxiv.org/html/2607.15799#bib.bib16)\]\. In addition to sensor embedding\-based techniques, various graph structure learning techniques have been employed in GNN\-based MTAD methods\. For example,\[[9](https://arxiv.org/html/2607.15799#bib.bib9)\]learned a graph by edge sampling, employing the Gumbel\-softmax sampling trick\[[46](https://arxiv.org/html/2607.15799#bib.bib46)\]to make the sampling procedure differentiable\. Furthermore,\[[12](https://arxiv.org/html/2607.15799#bib.bib12)\]learned a directed acyclic graph \(DAG\) through gradient\-based optimization with a differentiable constraint\[[47](https://arxiv.org/html/2607.15799#bib.bib47)\]\. Beyond learning the graph in an end\-to\-end manner,\[[48](https://arxiv.org/html/2607.15799#bib.bib48)\]constructed the sensor graph from transfer entropy to explicitly capture causal relationships among sensors\. However, most GNN\-based MTAD methods may exhibit limitations in performance when applied to multi\-stage industrial processes, as they overlook the distinctive characteristics of such processes, which can be encoded as sensor group knowledge and process flow knowledge\. Recently,\[[11](https://arxiv.org/html/2607.15799#bib.bib11)\]extended the method by\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]to better suit multi\-stage industrial processes\. They incorporated sensor group knowledge into the process of learning sensor embeddings\. However, they did not consider process flow knowledge\. In contrast, our work incorporates process flow knowledge in addition to sensor\-group knowledge within a unified multi\-graph construction framework, enabling explicit modeling of both intra\-sub\-process and inter\-sub\-process dependencies\.

## IIIBackground

### III\-ATemporal Convolutional Network

TCNs\[[19](https://arxiv.org/html/2607.15799#bib.bib19)\]are a class of one\-dimensional convolutional neural networks designed to capture long\-range temporal dependencies in multivariate time series data\. TCNs are built from stackeddilated causal convolutionallayers\. Thecausalityconstraint ensures that the output at timettdepends only on input at timettor earlier, whiledilationintroduces fixed gaps between filter taps, allowing the receptive field to grow without increasing filter size\.

Formally, for a one\-dimensional input sequences∈ℝw\\textbf\{s\}\\in\\mathbb\{R\}^\{w\}and a convolutional filterf:\{0,…,J−1\}→ℝf:\\\{0,\\dots,J\-1\\\}\\to\\mathbb\{R\}, whereJJis the filter size, the output sequencez∈ℝw\\textbf\{z\}\\in\\mathbb\{R\}^\{w\}is computed as:

zt=∑j=0J−1f​\(j\)⋅st−d⋅j,\\textbf\{z\}\_\{t\}=\\sum\_\{j=0\}^\{J\-1\}f\(j\)\\cdot\\textbf\{s\}\_\{t\-d\\cdot j\},wherezt∈ℝ\\textbf\{z\}\_\{t\}\\in\\mathbb\{R\}andst∈ℝ\\textbf\{s\}\_\{t\}\\in\\mathbb\{R\}are the value ofzandsat timett, andddis the dilation factor\. By stacking multiple such layers with exponentially increasing dilation rate \(e\.g\.,d=2i−1d=2^\{i\-1\}for theii\-th layer\), TCNs effectively expand their receptive field and capture long\-range dependencies\. Fig\.[3](https://arxiv.org/html/2607.15799#S3.F3)illustrates a TCN with three dilated causal convolutional layers, usingd=1,2,4d=1,2,4andJ=3J=3\.

![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/tcn_illustration_final.png)

Figure 3:Illustration of a TCN with three dilated causal convolutional layers\.
### III\-BGraph Attention Network

GATs\[[18](https://arxiv.org/html/2607.15799#bib.bib18)\]are a class of GNNs that utilize self\-attention to assign varying importance to neighboring nodes during feature aggregation, improving upon uniform averaging in graph convolutional networks \(GCNs\)\[[49](https://arxiv.org/html/2607.15799#bib.bib49)\]and effectively capturing complex dependencies between different nodes\.

Given a graph𝒢\\mathcal\{G\}withNNnodes and input featuresz∈ℝN×w\\textbf\{z\}\\in\\mathbb\{R\}^\{N\\times w\}, GAT computes an updated featureai∈ℝd\\textbf\{a\}\_\{i\}\\in\\mathbb\{R\}^\{d\}for nodeiias follows\. First, each node feature𝐳i∈ℝw\\mathbf\{z\}\_\{i\}\\in\\mathbb\{R\}^\{w\}is linearly transformed using a shared weight matrixW∈ℝd×w\\textbf\{W\}\\in\\mathbb\{R\}^\{d\\times w\}, and attention coefficientsπi​j∈ℝ\\pi\_\{ij\}\\in\\mathbb\{R\}are computed via a functionf:ℝd×ℝd→ℝf:\\mathbb\{R\}^\{d\}\\times\\mathbb\{R\}^\{d\}\\to\\mathbb\{R\}:

πi​j=f​\(𝐖𝐳i,𝐖𝐳j\),j∈\{𝒩​\(i\)∪\{i\},if self\-loop at​i,𝒩​\(i\),otherwise,\\pi\_\{ij\}=f\(\\mathbf\{W\}\\mathbf\{z\}\_\{i\},\\mathbf\{W\}\\mathbf\{z\}\_\{j\}\),\\quad j\\in\\begin\{cases\}\\mathcal\{N\}\(i\)\\cup\\\{i\\\},&\\text\{if self\-loop at \}i,\\\\ \\mathcal\{N\}\(i\),&\\text\{otherwise\},\\end\{cases\}where𝒩​\(i\)\\mathcal\{N\}\(i\)is the set of neighbors of nodeiiin𝒢\\mathcal\{G\}\. Then, if there is a self\-loop at nodeii, the output node featureai\\textbf\{a\}\_\{i\}is calculated as follows:

𝐚i=σ​\(αi​i​𝐖𝐳i\+∑j∈𝒩​\(i\)αi​j​𝐖𝐳j\),\\mathbf\{a\}\_\{i\}=\\sigma\(\\alpha\_\{ii\}\\mathbf\{W\}\\mathbf\{z\}\_\{i\}\+\\sum\\limits\_\{j\\in\\mathcal\{N\}\(i\)\}\\alpha\_\{ij\}\\mathbf\{W\}\\mathbf\{z\}\_\{j\}\),αi​j=exp⁡\(πi​j\)∑r∈𝒩​\(i\)∪\{i\}exp​\(πi​r\),\\alpha\_\{ij\}=\\frac\{\\exp\(\\pi\_\{ij\}\)\}\{\\sum\_\{r\\in\\mathcal\{N\}\(i\)\\cup\{\\\{i\\\}\}\}\\text\{exp\}\(\\pi\_\{ir\}\)\},whereσ​\(⋅\)\\sigma\(\\cdot\)is a nonlinear activation function\.

## IVMethodology

In this section, we present a proposed method in detail\. Our approach comprises three main components: \(1\) graph structure learning, \(2\) graph attention\-based forecasting, and \(3\) anomaly scoring\. An overview is provided in Fig\.[4](https://arxiv.org/html/2607.15799#S4.F4)\. Our key contribution lies in enhancing graph structure learning by integratingprocess knowledgeto improve dependency modeling\.

The remainder of this section is structured as follows\. First, we define the problem setting of MTAD and formally define process knowledge in Section[IV\-A](https://arxiv.org/html/2607.15799#S4.SS1)\. Next, we present a multi\-graph structure learning framework, focusing on our core contributions: the innovative strategy for incorporating process knowledge \(Section[IV\-B](https://arxiv.org/html/2607.15799#S4.SS2)\)\. Then, we describe the graph attention\-based forecasting framework, which effectively leverages the three constructed graphs \(Section[IV\-C](https://arxiv.org/html/2607.15799#S4.SS3)\)\. Finally, we introduce the anomaly scoring scheme, designed to detect anomalies accurately using the proposed framework \(Section[IV\-D](https://arxiv.org/html/2607.15799#S4.SS4)\)\. The codes for the proposed method are available athttps://anonymous\.4open\.science/r/Knowledge\-Assisted\-Multi\-Graph\-Structure\-Learning\-60AE\.

![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/overview2.png)

Figure 4:Overview of the proposed method### IV\-AProblem Statement

We consider multivariate time series data generated from a multi\-stage industrial process consisting ofNpN\_\{p\}sub\-processes\. We denote the collection of sensor index sets for the entire process as\{Ps\}s=1Np\\\{P\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}, wherePsP\_\{s\}is the set of sensor indices associated with thess\-th sub\-process\. The total number of sensors is given byN=∑s=1Np\|Ps\|N=\\sum\\limits\_\{s=1\}^\{N\_\{p\}\}\|P\_\{s\}\|\. These sub\-processes form a process flow graph, and we denote their adjacency as a symmetric binary relationS⊆\{Ps\}s=1Np×\{Ps\}s=1NpS\\subseteq\\\{P\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}\\times\\\{P\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}, where\(Ps1,Ps2\)∈S\(P\_\{s\_\{1\}\},P\_\{s\_\{2\}\}\)\\in Sindicates that thes1s\_\{1\}\-th ands2s\_\{2\}\-th sub\-processes are directly connected\. To formally express the sensor\-to\-sub\-process relationship, we define the mapping

ϕ:\{1,…​N\}→\{1,…​Np\},\\phi:\\\{1,\\ldots N\\\}\\rightarrow\\\{1,\\ldots N\_\{p\}\\\},\(1\)where,i∈\{1,…,N\}i\\in\\\{1,\\ldots,N\\\}denotes a sensor index, andϕ​\(i\)\\phi\(i\)gives the index of the sub\-process to which sensoriibelongs\.

Each sensor observation𝐱t∈ℝN\\mathbf\{x\}\_\{t\}\\in\\mathbb\{R\}^\{N\}at timettis composed ofNpN\_\{p\}sub\-vectors𝐱t=\[𝐱t\(1\);𝐱t\(2\);…;𝐱t\(Np\)\]\\mathbf\{x\}\_\{t\}=\\left\[\\mathbf\{x\}\_\{t\}^\{\(1\)\};\\mathbf\{x\}\_\{t\}^\{\(2\)\};\\dots;\\mathbf\{x\}\_\{t\}^\{\(N\_\{p\}\)\}\\right\], where𝐱t\(s\)∈ℝ\|Ps\|\\mathbf\{x\}\_\{t\}^\{\(s\)\}\\in\\mathbb\{R\}^\{\|P\_\{s\}\|\}denotes the sensor values of thess\-th sub\-process at timettassociated with the sensor indices inPsP\_\{s\}\. Our training dataset consists ofTtrT\_\{\\text\{tr\}\}sensor observations collected under normal operating conditions, without any anomalies\. In contrast, the test dataset containsTteT\_\{\\text\{te\}\}sensor observations, which may include both normal and anomalous data\.

Our goal is to detect anomalies in the test dataset\. The proposed method producesTteT\_\{\\text\{te\}\}binary labels, each indicating whether the sensor value at a given test timestamp is anomalous \(e\.g\., value 1\) or normal \(e\.g\., value 0\)\. We focus on point anomalies, where anomalies are defined at the individual timestamp level without explicitly modeling contextual or subsequence\-level anomaly patterns\. We define two types of prior knowledge commonly found in multi\-stage processes:

###### Definition 1\(Sensor group knowledge\)

Sensor group knowledgeKG=\{Ps\}s=1NpK\_\{G\}=\\\{P\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}is a collection of sensor index sets, wherePsP\_\{s\}represents the sensors involved in thess\-th sub\-process\.

###### Definition 2\(Process flow knowledge\)

Process flow knowledgeKF=\{Fs\}s=1NpK\_\{F\}=\\\{F\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}is a collection of sensor index sets, whereFs=∪r:\(Pr,Ps\)∈SPrF\_\{s\}=\\mathop\{\\cup\}\\limits\_\{r:\(P\_\{r\},P\_\{s\}\)\\in S\}P\_\{r\}represents the sensors involved in sub\-processes adjacent to thess\-th sub\-process\.

### IV\-BMulti\-Graph Structure Learning

By incorporating sensor group knowledge and process flow knowledge, we learn three graphs: 1\) uninformed graph𝒢U\\mathcal\{G\}^\{U\}, 2\) sensor group knowledge\-informed graph𝒢G\\mathcal\{G\}^\{G\}, and 3\) process flow knowledge\-informed graph𝒢F\\mathcal\{G\}^\{F\}\.

#### IV\-B1Uninformed Graph

The uninformed graph𝒢U\\mathcal\{G\}^\{U\}is learned without using any prior knowledge about sensor relationships\. We adopt the graph structure learning technique of\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\], which is a foundational similarity\-based method and a strong baseline\. To model directional relationships between sensors, we introduce two learnable embeddings for each sensor, representing the source and target roles, respectively\. The source and target embeddings for each sensor are randomly initialized and jointly learned during training by minimizing the forecasting loss\. The embedding dimensionddis treated as a hyperparameter\.

Specifically, for each sensori∈\{1,…,N\}i\\in\\\{1,\\ldots,N\\\}, we assign two learnable embeddingse1​\(i\),e2​\(i\)∈ℝde\_\{1\}\(i\),e\_\{2\}\(i\)\\in\\mathbb\{R\}^\{d\}, representing its latent characteristics when acting as a source and target, respectively\. For a directed relation from sensorjjto sensorii, sensorjjis regarded as the source node, i\.e\., the candidate influencing sensor, and sensoriias the target node, i\.e\., the sensor whose dependency is modeled\. This design enables the model to capture asymmetric relationships between sensors\. These embeddingse1​\(i\)e\_\{1\}\(i\)ande2​\(i\)e\_\{2\}\(i\)are initialized randomly and are learned automatically through backpropagation under the forecasting objective\. Thus, they are not externally specified or separately estimated, but are optimized jointly with the rest of the network in an end\-to\-end manner\. The similarity between thejj\-th sensor \(source\) and theii\-th sensor \(target\) is computed as follows:

Cj​i=ReLU​\(e1​\(j\)⊤​e2​\(i\)‖e1​\(j\)‖2⋅‖e2​\(i\)‖2\),C\_\{ji\}=\\text\{ReLU\}\\bigg\(\\frac\{e\_\{1\}\(j\)^\{\\top\}e\_\{2\}\(i\)\}\{\|\|e\_\{1\}\(j\)\|\|\_\{2\}\\cdot\|\|e\_\{2\}\(i\)\|\|\_\{2\}\}\\bigg\),where\|\|⋅\|\|2\|\|\\cdot\|\|\_\{2\}denotes theL2L\_\{2\}\-norm, and ReLU refers to a rectified linear unit\[[50](https://arxiv.org/html/2607.15799#bib.bib50)\]\. Then, we obtain the adjacency matrixAU=\(Aj​iU\)∈ℝN×NA^\{U\}=\(A^\{U\}\_\{ji\}\)\\in\\mathbb\{R\}^\{N\\times N\}, which represents the uninformed graph𝒢U\\mathcal\{G\}^\{U\}based on the similaritiesCj​iC\_\{ji\}, as follows:

Aj​iU=𝟙​\{j∈Topk​\(\{Cr​i\|r∈\{1,2,…,N\}​\\​\{i\}\}\)\},A^\{U\}\_\{ji\}=\\mathbbm\{1\}\\\{j\\in\\text\{Top\}\_\{k\}\(\\\{C\_\{ri\}\|r\\in\\\{1,2,\\dots,N\\\}\\text\{\\textbackslash\}\\\{i\\\}\\\}\)\\\},\(2\)whereTopk\\text\{Top\}\_\{k\}is an operator that selects the indices of thekk\-highest values among its input and𝟙​\{⋅\}\\mathbbm\{1\}\\\{\\cdot\\\}is the indicator function, returning11if the condition is true and0otherwise\. The parameterkkcontrols graph sparsity by determining the number of incoming edges per node\. The value ofkkis treated as a hyperparameter and is selected on the validation set together withα\\alphaandddthrough a joint grid search\.

#### IV\-B2Sensor Group Knowledge\-Informed Graph

To model intra\-sub\-process relationships, we use sensor group knowledgeKG=\{Ps\}s=1NpK\_\{G\}=\\\{P\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}\. The sensor group knowledge\-informed graph𝒢G\\mathcal\{G\}^\{G\}focuses on dependencies among sensors within the same sub\-process\. We define the masked similarity between thejj\-th sensor \(source\) and theii\-th sensor \(target\) as follows:

Cj​iG=\{Cj​i,if​j∈Pϕ​\(i\),−∞,otherwise,C\_\{ji\}^\{G\}=\\begin\{cases\}C\_\{ji\},&\\text\{if\}\\,j\\in P\_\{\\phi\(i\)\},\\\\ \-\\infty,&\\text\{otherwise,\}\\end\{cases\}whereϕ​\(⋅\)\\phi\(\\cdot\)is the sensor\-to\-sub\-process mapping defined in \([1](https://arxiv.org/html/2607.15799#S4.E1)\)\. This mapping is constructed based on the predefined sensor group knowledgeKG=\{Ps\}s=1NpK\_\{G\}=\\\{P\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}\. Then, we obtain the adjacency matrixAG=\(Aj​iG\)∈ℝN×NA^\{G\}=\(A\_\{ji\}^\{G\}\)\\in\\mathbb\{R\}^\{N\\times N\}, which represents the sensor group knowledge\-informed graph𝒢G\\mathcal\{G\}^\{G\}based on the masked similaritiesCj​iGC\_\{ji\}^\{G\}, as follows:

Aj​iG=𝟙​\{j∈TopkiG​\(\{Cr​iG\|r∈\{1,2,…,N\}​\\​\{i\}\}\)\},A^\{G\}\_\{ji\}=\\mathbbm\{1\}\\\{j\\in\\text\{Top\}\_\{k\_\{i\}^\{G\}\}\(\\\{C\_\{ri\}^\{G\}\|r\\in\\\{1,2,\\dots,N\\\}\\text\{\\textbackslash\}\\\{i\\\}\\\}\)\\\},\(3\)wherekiG=α⋅\|Pϕ​\(i\)\|k\_\{i\}^\{G\}=\\alpha\\cdot\|P\_\{\\phi\(i\)\}\|andα∈\(0,1\)\\alpha\\in\(0,1\)is a hyperparameter controlling the sparsity of𝒢G\\mathcal\{G\}^\{G\}\. This adaptive neighborhood size reflects the variations in the number of sensors across sub\-processes, ensuring that each sensor selects a proportionally consistent number of intra\-sub\-process neighbors\.

#### IV\-B3Process Flow Knowledge\-Informed Graph

We further incorporate process flow knowledgeKF=\{Fs\}s=1NpK\_\{F\}=\\\{F\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}to model inter\-sub\-process relationships\. The process flow knowledge\-informed graph𝒢F\\mathcal\{G\}^\{F\}focuses on dependencies among sensors across adjacent sub\-processes\. Following a similar masking strategy used in constructing the sensor knowledge\-informed graph \(Section[IV\-B2](https://arxiv.org/html/2607.15799#S4.SS2.SSS2)\), we compute the masked similarities as follows:

Cj​iF=\{Cj​i,if​j∈Fϕ​\(i\),−∞,otherwise,C\_\{ji\}^\{F\}=\\begin\{cases\}C\_\{ji\},&\\text\{if\}\\,j\\in F\_\{\\phi\(i\)\},\\\\ \-\\infty,&\\text\{otherwise,\}\\end\{cases\}whereϕ​\(⋅\)\\phi\(\\cdot\)is the sensor\-to\-sub\-process mapping defined in \([1](https://arxiv.org/html/2607.15799#S4.E1)\)\. Here, the conditionj∈Fϕ​\(i\)j\\in F\_\{\\phi\(i\)\}indicates that thejj\-th sensor belongs to one of the sub\-processes that are adjacent to theii\-th sub\-process, as specified by the process flow knowledgeKF=\{Fs\}s=1NpK\_\{F\}=\\\{F\_\{s\}\\\}\_\{s=1\}^\{N\_\{p\}\}\. Then, the adjacency matrixAF=\(Aj​iF\)∈ℝN×NA^\{F\}=\(A\_\{ji\}^\{F\}\)\\in\\mathbb\{R\}^\{N\\times N\}, which represents the process flow knowledge\-informed graph𝒢F\\mathcal\{G\}^\{F\}, is obtained by

Aj​iF=𝟙​\{j∈TopkiF​\(\{Cr​iF\|r∈\{1,2,…,N\}​\\​\{i\}\}\)\},A^\{F\}\_\{ji\}=\\mathbbm\{1\}\\\{j\\in\\text\{Top\}\_\{k\_\{i\}^\{F\}\}\(\\\{C\_\{ri\}^\{F\}\|r\\in\\\{1,2,\\dots,N\\\}\\text\{\\textbackslash\}\\\{i\\\}\\\}\)\\\},\(4\)wherekiF=α⋅\|Fϕ​\(i\)\|k\_\{i\}^\{F\}=\\alpha\\cdot\|F\_\{\\phi\(i\)\}\|, using the same hyperparameterα\\alphaas in the construction of𝒢G\\mathcal\{G\}^\{G\}\.

This multi\-graph approach may offer several advantages\. First, maintaining three complementary graph structures can provide alternative pathways for dependency modeling when process knowledge is incomplete or noisy, thereby enhancing robustness against knowledge uncertainties\. Furthermore, the distinct contribution of each graph to anomaly detection can be examined, offering insights into the relative importance of different dependency types and thus improving interpretability\.

### IV\-CGraph Attention\-based Forecasting

We perform graph attention\-based forecasting by using the three graphs𝒢U\\mathcal\{G\}^\{U\},𝒢G\\mathcal\{G\}^\{G\}, and𝒢F\\mathcal\{G\}^\{F\}\. At each timett, we use a sliding window of sizewwover historical timestamps,𝐬t:=\[𝐱t−w,…,𝐱t−1\]∈ℝN×w\\mathbf\{s\}\_\{t\}:=\[\\mathbf\{x\}\_\{t\-w\},\\dots,\\mathbf\{x\}\_\{t\-1\}\]\\in\\mathbb\{R\}^\{N\\times w\}as an input to the proposed method\. Our goal is to predict the next observation𝐱t\\mathbf\{x\}\_\{t\}\.

#### IV\-C1Temporal Encoder

The input sequence𝐬t\\mathbf\{s\}\_\{t\}is first passed through a TCN to capture intra\-sensor dependencies\. The TCN consists of multiple dilated causal convolutional layers, each followed by weight normalization\[[51](https://arxiv.org/html/2607.15799#bib.bib51)\]and ReLU activation, following\[[19](https://arxiv.org/html/2607.15799#bib.bib19)\]\. The encoded feature𝐳t∈ℝN×w\\mathbf\{z\}\_\{t\}\\in\\mathbb\{R\}^\{N\\times w\}is computed via the TCN formulation presented in Section[III\-A](https://arxiv.org/html/2607.15799#S3.SS1):

𝐳t=TCN​\(𝐬t\)\.\\mathbf\{z\}\_\{t\}=\\text\{TCN\}\(\\mathbf\{s\}\_\{t\}\)\.

#### IV\-C2Multi\-Graph Attention Network

To capture inter\-sensor dependencies, we apply three separate GATs, each operating over one of the learned graphs𝒢U\\mathcal\{G\}^\{U\},𝒢G\\mathcal\{G\}^\{G\}, and𝒢F\\mathcal\{G\}^\{F\}, respectively\. For each graph, we follow the procedure described in Section[III\-B](https://arxiv.org/html/2607.15799#S3.SS2)to compute the corresponding aggregated feature vectors𝐚t,iU∈ℝd\\mathbf\{a\}\_\{t,i\}^\{U\}\\in\\mathbb\{R\}^\{d\},𝐚t,iG∈ℝd\\mathbf\{a\}\_\{t,i\}^\{G\}\\in\\mathbb\{R\}^\{d\}, and𝐚t,iF∈ℝd\\mathbf\{a\}\_\{t,i\}^\{F\}\\in\\mathbb\{R\}^\{d\}, respectively\. As an example, for the uninformed graph𝒢U\\mathcal\{G\}^\{U\}, the aggregated feature𝐚t,iU∈ℝd\\mathbf\{a\}\_\{t,i\}^\{U\}\\in\\mathbb\{R\}^\{d\}for theii\-th sensor is computed as follows:

𝐚t,iU=ReLU​\(βi​iU​𝐖U​𝐳t,i\+∑j∈𝒩U​\(i\)βi​jU​𝐖U​𝐳t,i\),\\mathbf\{a\}\_\{t,i\}^\{U\}=\\text\{ReLU\}\(\\beta\_\{ii\}^\{U\}\\mathbf\{W\}^\{U\}\\mathbf\{z\}\_\{t,i\}\+\\sum\\limits\_\{j\\in\\mathcal\{N\}^\{U\}\(i\)\}\\beta\_\{ij\}^\{U\}\\mathbf\{W\}^\{U\}\\mathbf\{z\}\_\{t,i\}\),βi​jU=exp​\(πi​jU\)∑r∈𝒩U​\(i\)∪\{i\}exp​\(πi​rU\),\{\\beta\}\_\{ij\}^\{U\}=\\frac\{\\text\{exp\}\(\\pi\_\{ij\}^\{U\}\)\}\{\\sum\_\{r\\in\\mathcal\{N\}^\{U\}\(i\)\\cup\{\\\{i\\\}\}\}\\text\{exp\}\(\\pi\_\{ir\}^\{U\}\)\},wherezt,i∈ℝw\\textbf\{z\}\_\{t,i\}\\in\\mathbb\{R\}^\{w\}is theii\-th row ofzt\\textbf\{z\}\_\{t\}, denoting the feature of theii\-th sensor from the temporal encoder,𝐖U∈ℝd×w\\mathbf\{W\}^\{U\}\\in\\mathbb\{R\}^\{d\\times w\}is a weight matrix, and𝒩U​\(i\)=\{j\|Aj​iU=1\}\\mathcal\{N\}^\{U\}\(i\)=\\\{j\|A^\{U\}\_\{ji\}=1\\\}, whereAj​iUA^\{U\}\_\{ji\}is defined in \([2](https://arxiv.org/html/2607.15799#S4.E2)\)\. Notably, attention\-based aggregation is explicitly dependent on the structure of𝒢U\\mathcal\{G\}^\{U\}, as both the neighbor set𝒩U​\(i\)\\mathcal\{N\}^\{U\}\(i\)and the attention weightsβi​jU\\beta\_\{ij\}^\{U\}are computed based solely on the edges defined in the adjacency matrixAUA^\{U\}\.

The attention scoreπi​jU\\pi^\{U\}\_\{ij\}is adapted from the formulation in\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\], with a key modification; we explicitly distinguish the source and target roles of a sensor by using separate embeddingse1​\(⋅\)e\_\{1\}\(\\cdot\)ande2​\(⋅\)e\_\{2\}\(\\cdot\)\. Specifically,

πi​jU\\displaystyle\\pi\_\{ij\}^\{U\}=LeakyReLU​\(\(𝐮U\)⊤​\(rtarget,iU⊕rsource,jU\)\),\\displaystyle=\\text\{LeakyReLU\}\(\(\\mathbf\{u\}^\{U\}\)^\{\\top\}\(r\_\{\\text\{target\},i\}^\{U\}\\oplus r\_\{\\text\{source\},j\}^\{U\}\)\),rtarget,iU\\displaystyle r\_\{\\text\{target\},i\}^\{U\}=e2​\(i\)⊕𝐖U​𝐳t,i,rsource,jU=e1​\(j\)⊕𝐖U​𝐳t,j,\\displaystyle=e\_\{2\}\(i\)\\oplus\\mathbf\{W\}^\{U\}\\mathbf\{z\}\_\{t,i\},\\quad r\_\{\\text\{source\},j\}^\{U\}=e\_\{1\}\(j\)\\oplus\\mathbf\{W\}^\{U\}\\mathbf\{z\}\_\{t,j\},whereWUW^\{U\}anduUu^\{U\}are randomly initialized trainable parameters of the attention module and jointly optimized with the rest of the network during end\-to\-end training\. In addition,⊕\\oplusdenotes the concatenation operator, and LeakyReLU refers to the leaky rectified linear unit\[[52](https://arxiv.org/html/2607.15799#bib.bib52)\]\. Here,rtarget,iUr\_\{\\text\{target\},i\}^\{U\}is a contextualized representation of theii\-th sensor as a target node, whilersource,jUr\_\{\\text\{source\},j\}^\{U\}corresponds to the representation of thejj\-th sensor as a source node\. Each representation combines structural embeddings \(e2​\(i\)e\_\{2\}\(i\)ore1​\(j\)e\_\{1\}\(j\)\) with temporal features \(𝐳t,i\\mathbf\{z\}\_\{t,i\}\), enabling the model to capture direction\-aware dependencies between sensors\. This asymmetric formulation enhances the model’s capacity to represent complex and structured inter\-sensor interactions\.

Aggregated features𝐚t,iG∈ℝd\\mathbf\{a\}\_\{t,i\}^\{G\}\\in\\mathbb\{R\}^\{d\}and𝐚t,iF∈ℝd\\mathbf\{a\}\_\{t,i\}^\{F\}\\in\\mathbb\{R\}^\{d\}are computed analogously using𝒢G\\mathcal\{G\}^\{G\}and𝒢F\\mathcal\{G\}^\{F\}, respectively, where the edge structures are constructed based on sensor group knowledge and process flow knowledge\. In this way, each attention module selectively reflects a specific style of process knowledge through its corresponding graph structure\.

Using these aggregated feature vectors, we integrate all available information to predict the value of theii\-th sensor at timettas follows:

x^t,i=ℱ​\(at,iU⊕at,iG⊕at,iF⊕e1​\(i\)⊕e2​\(i\)\),\\hat\{\\textbf\{x\}\}\_\{t,i\}=\\mathcal\{F\}\\bigg\(\\textbf\{a\}\_\{t,i\}^\{U\}\\oplus\\textbf\{a\}\_\{t,i\}^\{G\}\\oplus\\textbf\{a\}\_\{t,i\}^\{F\}\\oplus e\_\{1\}\(i\)\\oplus e\_\{2\}\(i\)\\bigg\),wherex^t,i∈ℝ\\hat\{\\textbf\{x\}\}\_\{t,i\}\\in\\mathbb\{R\}is theii\-th element of the predicted vectorx^t∈ℝN\\hat\{\\textbf\{x\}\}\_\{t\}\\in\\mathbb\{R\}^\{N\}, andℱ\\mathcal\{F\}is a multi\-layer perceptron \(MLP\)\. During the training process, we minimize the mean squared error between𝐱t\\mathbf\{x\}\_\{t\}and𝐱^t\\hat\{\\mathbf\{x\}\}\_\{t\}, utilizing it as the loss function:

ℒ=1Ttr−w​∑t=w\+1Ttr‖𝐱^t−𝐱t‖22\.\\mathcal\{L\}=\\frac\{1\}\{T\_\{\\text\{tr\}\}\-w\}\\sum\\limits\_\{t=w\+1\}^\{T\_\{\\text\{tr\}\}\}\|\|\\hat\{\\mathbf\{x\}\}\_\{t\}\-\{\\mathbf\{x\}\}\_\{t\}\|\|\_\{2\}^\{2\}\.

### IV\-DAnomaly Scoring

After training, we evaluate anomaly scores on the test dataset using the graph deviation scoring method\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]\. This approach computes forecasting errors for each sensor, normalizes them, and defines the anomaly score as the maximum normalized error across sensors at each test timestamp\. Formally, at timett, the anomaly score𝒜​\(t\)\\mathcal\{A\}\(t\)is computed as:

𝒜​\(t\)=maxi⁡\(Erri​\(t\)−μ~iσ~i\),\\mathcal\{A\}\(t\)=\\max\_\{i\}\\bigg\(\\frac\{\\text\{Err\}\_\{i\}\(t\)\-\\tilde\{\\mu\}\_\{i\}\}\{\\tilde\{\\sigma\}\_\{i\}\}\\bigg\),wherei∈\{1,…,N\}i\\in\\\{1,\\ldots,N\\\}indexes theNNsensors, andErri​\(t\)=\|𝐱^t,i−𝐱t,i\|\\text\{Err\}\_\{i\}\(t\)=\\lvert\\hat\{\\mathbf\{x\}\}\_\{t,i\}\-\\mathbf\{x\}\_\{t,i\}\\rvertdenotes the forecasting error for theii\-th sensor at timett\. Here,𝐱t,i∈ℝ\\mathbf\{x\}\_\{t,i\}\\in\\mathbb\{R\}and𝐱^t,i∈ℝ\\hat\{\\mathbf\{x\}\}\_\{t,i\}\\in\\mathbb\{R\}represent the observed and predicted values, respectively\. To ensure robustness against outliers, we normalize the error for each sensor using the medianμ~i\\tilde\{\\mu\}\_\{i\}and interquartile range \(IQR\)σ~i\\tilde\{\\sigma\}\_\{i\}of its forecasting errors, following\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]\. The median and interquartile range are computed from the training dataset, which contains only normal operating conditions\. Specifically, for each sensorii,μ~i\\tilde\{\\mu\}\_\{i\}is computed as the second quartileQ2,iQ\_\{2,i\}of the training forecasting errors, andσ~i\\tilde\{\\sigma\}\_\{i\}is computed asQ3,i−Q1,iQ\_\{3,i\}\-Q\_\{1,i\}, whereQ1,iQ\_\{1,i\}andQ3,iQ\_\{3,i\}denote the first and third quartiles, respectively\.

A test timestampttis flagged as anomalous if𝒜​\(t\)\\mathcal\{A\}\(t\)exceeds a predefined threshold\.

## VExperiments

### V\-ADatasets

We used the Secure Water Treatment \(SWaT\)\[[2](https://arxiv.org/html/2607.15799#bib.bib2)\]and Water Distribution \(WADI\)\[[53](https://arxiv.org/html/2607.15799#bib.bib53)\]datasets\. The former was obtained from a multi\-stage water treatment process, while the latter was obtained from a multi\-stage water distribution process\. Both datasets were collected by iTrust, a cybersecurity research center at the Singapore University of Technology and Design\.

The SWAT dataset was collected from a six\-stage water treatment process, as described in Section[I](https://arxiv.org/html/2607.15799#S1)and shown in Fig\.[1](https://arxiv.org/html/2607.15799#S1.F1)\. It includes measurements from 51 sensors over 11 consecutive days, including 7 days of normal operation and 4 days during which cyber\-attacks of varying time intervals were executed\.

The WADI dataset was collected from a three\-stage water distribution process \(P1–P3\)\[[53](https://arxiv.org/html/2607.15799#bib.bib53)\]\. In P1, the raw water is stored in two tanks, and its quality is controlled by a chemical dosing system\. In P2, the water initially flows to elevated reservoir tanks and is subsequently distributed to consumer tanks based on a pre\-set demand pattern\. If the consumer tanks meet their demands, the water is reserved in another tank and sent back to P1, which is referred to as P3\. The WADI dataset comprises measurements of 127 sensors over 14 consecutive days of normal operations and 2 subsequent days of operations with several cyber attacks\.

We provide the statistics for the SWaT and WADI datasets in Table I\. We followed the data preprocessing procedures outlined in\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]\. For both datasets, we used the data from normal operations for training and the data corresponding to cyber attack periods for testing\. We used 10% of the training data as a validation set for both datasets to tune hyperparameters and perform early stopping\.

TABLE I:Statistics for the SWaT and WADI datasets: number of sub\-processes, number of sensors, number of training data points, number of testing data points, and the ratio of anomalies in the test data\.TABLE II:Comparison of anomaly detection performance between the proposed method and various baselines in terms ofPr,Re, andF1\. The values in bold indicate the highest scores\.†\\daggerdenotes reproduced results using officially provided codes, while the remaining results of the baselines are sourced from\[[15](https://arxiv.org/html/2607.15799#bib.bib15)\]\.TABLE III:Comparison of anomaly detection performance between the proposed method and its variants in terms ofPr,Re, andF1\. The values in bold indicate the highest scores\.
### V\-BBaselines

We evaluate the proposed method against a diverse set of baselines, including recent state\-of\-the\-art approaches, to ensure a fair and comprehensive comparison\. These baselines were carefully selected to cover various model architectures \(e\.g\., LSTM, Transformer, GNN\), anomaly scoring strategies \(e\.g\., reconstruction\-based, forecasting\-based, hybrid\), reproducibility under a common evaluation protocol, and the extent to which domain knowledge is incorporated\. The selected baselines are briefly described below:

- •MAD\-GAN\[[32](https://arxiv.org/html/2607.15799#bib.bib32)\]: MAD\-GAN is adversarially trained with a generator and a discriminator, both based on a long short\-term memory \(LSTM\) network\. The generator reconstructs input data, while the discriminator distinguishes between the input and reconstructed data\. This method utilizes both reconstruction errors and discrimination scores to detect anomalies\.
- •USAD\[[35](https://arxiv.org/html/2607.15799#bib.bib35)\]: USAD consists of two autoencoders that share a common encoder\. It is trained within a two\-phase adversarial framework and detects anomalies based on reconstruction errors\.
- •TranAD\[[37](https://arxiv.org/html/2607.15799#bib.bib37)\]: TranAD comprises two Transformer\-based encoder\-decoder networks\. It is adversarially trained and utilizes reconstruction errors as anomaly scores, similar to USAD\. However, unlike USAD, one of the encoder\-decoder networks reconstructs the entire training time series to capture long\-term temporal trends\.
- •MTAD\-GAT\[[6](https://arxiv.org/html/2607.15799#bib.bib6)\]: MTAD\-GAT employs two parallel GATs to capture inter\-sensor and intra\-sensor dependencies separately\. The outputs of these GATs are then used as inputs for jointly optimized reconstruction and forecasting models\. Both reconstruction errors and forecasting errors are utilized as anomaly scores\.
- •GTA\[[9](https://arxiv.org/html/2607.15799#bib.bib9)\]: GTA is a Transformer model designed to capture inter\-sensor dependencies through graph convolution\. It learns a graph structure by using the Gumbel\-softmax sampling technique and uses forecasting errors as anomaly scores\.
- •GDN\[[7](https://arxiv.org/html/2607.15799#bib.bib7)\]: GDN learns a graph to represent relationships between sensors by evaluating their similarities through sensor embeddings\. It employs graph attention\-based forecasting, using forecasting errors for anomaly detection\.
- •ECNU\-GNN\[[15](https://arxiv.org/html/2607.15799#bib.bib15)\]: ECNU\-GNN employs an embedding for each sensor and learns a graph of sensors, similar to GDN\. During graph convolution, for each sensor, the features of its neighboring sensors are transformed into new features based on the embedding of the central sensor\. These transformed features are then aggregated to update the feature of the central sensor\. To detect anomalies, forecasting errors are used as anomaly scores\.
- •FuSAGNet\[[11](https://arxiv.org/html/2607.15799#bib.bib11)\]: FuSAGNet enhances GDN’s robustness against noise by integrating a sparse autoencoder capable of extracting sparse latent representations of input data\. These representations are used to reconstruct the input data and also serve as input for graph attention\-based forecasting\. It considers sensor group knowledge during sensor graph learning and uses both reconstruction errors and forecasting errors for anomaly detection\.
- •CAROTS\[[43](https://arxiv.org/html/2607.15799#bib.bib43)\]: CAROTS integrates inter\-sensor causality into contrastive learning for anomaly detection\. It first extracts a causality matrix via a causal discovery model, and then employs two augmentors to generate causality\-preserving and causality\-disturbing samples, which serve as positives and negatives, respectively\. An encoder is trained with a similarity\-filtered one\-class contrastive loss so that its latent space separates normal and abnormal samples based on causality\. Anomaly scores are computed in the learned representation space\.
- •CGAD\[[48](https://arxiv.org/html/2607.15799#bib.bib48)\]: CGAD constructs a weighted causal graph among sensors using transfer entropy\. It models the causal graph and temporal patterns with weighted graph convolutions and causal convolutions, and uses forecasting errors as anomaly scores\.
- •TopoGDN\[[16](https://arxiv.org/html/2607.15799#bib.bib16)\]: TopoGDN extends GDN by incorporating a multi\-scale temporal convolution module to capture fine\-grained temporal features and augmenting the graph attention mechanism with topological features derived from persistent homology\. It learns a sensor graph via sensor embeddings and uses forecasting errors as anomaly scores\.

### V\-CEvaluation Metrics

We used precision \(Pr\), recall \(Re\), and F1 score \(F1\) to evaluate the anomaly detection performances of the proposed method and baselines, withF1serving as the primary evaluation metric\. Precision measures the proportion of detected anomalies that are truly anomalous; thus, higher precision indicates fewer false alarms\. Recall measures the proportion of true anomalies that are correctly detected; thus, higher recall indicates fewer missed anomalies\. The F1 score is the harmonic mean of precision and recall and serves as a balanced summary when both false positives and false negatives are important\. For all three metrics, higher values indicate better anomaly detection performance\.

The metrics are defined as follows:

Pr=TPTP\+FP,Re=TPTP\+FN,\\displaystyle=\\frac\{\\text\{TP\}\}\{\\text\{TP\}\+\\text\{FP\}\},\\quad\\textbf\{Re\}=\\frac\{\\text\{TP\}\}\{\\text\{TP\}\+\\text\{FN\}\},F1=2×Pr×RePr\+Re,\\displaystyle=2\\times\\frac\{\\textbf\{Pr\}\\times\\textbf\{Re\}\}\{\\textbf\{Pr\}\+\\textbf\{Re\}\},where TP, FP, and FN denote the number of true positives, false positives, and false negatives, respectively\. The threshold for anomaly detection was determined using a grid search method to maximizeF1\.

### V\-DExperimental Settings

The proposed method was trained using the Adam optimizer\[[54](https://arxiv.org/html/2607.15799#bib.bib54)\]\. For the SWaT dataset, we used a learning rate of5×10−45\\times 10^\{\-4\}and a batch size of 32, while for the WADI dataset, we used a learning rate of1×10−31\\times 10^\{\-3\}and a batch size of 64\. Training was conducted for up to 200 epochs, with early stopping applied after 5 epochs of no improvement\. The key hyperparameters\(k,α,d\)\(k,\\alpha,d\)were selected through a validation\-based joint grid search using validation F1 score as the model\-selection criterion\. Specifically, we consideredα∈\{0\.1,0\.3,0\.6,0\.9\}\\alpha\\in\\\{0\.1,0\.3,0\.6,0\.9\\\},k∈\{5,10,15,20,25\}k\\in\\\{5,10,15,20,25\\\}, andd∈\{32,64,128,256\}d\\in\\\{32,64,128,256\\\}, and evaluated all combinations jointly\. The selected settings werek=10k=10,α=0\.6\\alpha=0\.6,d=128d=128for SWaT andk=10k=10,α=0\.3\\alpha=0\.3, andd=128d=128for WADI\. For both datasets, the sliding window sizewwwas set to 15\.

For the network architecture, including the number of layers and the TCN configuration, we adopted commonly used design choices from the TCN literature\[[55](https://arxiv.org/html/2607.15799#bib.bib55),[19](https://arxiv.org/html/2607.15799#bib.bib19)\], and evaluated small variations around them\. Deeper variants were not considered because they were unnecessarily over\-parameterized for the input dimensionality of the SWaT and WADI benchmarks\. The final architecture was selected based on the validation F1 score\. We employed a TCN with three dilated causal convolutional layers as the temporal encoder, where the dilation factors were set to 1, 2, and 4, respectively, and the filter size was set to 3\. We used an MLP consisting of 1 layer and 2 layers with a hidden dimension of 128 for SWaT and WADI, respectively\. Sensor group knowledge and process flow knowledge were obtained from the process flow diagrams of the underlying processes for the SWaT and WADI datasets, accessible at the iTrust website \(https://itrust\.sutd\.edu\.sg\)\.

### V\-EExperimental Results

#### V\-E1Comparison of Performance with Baselines

To demonstrate the effectiveness of the proposed method, we compared its anomaly detection performance against baselines\. Table II summarizes the results on the SWaT and WADI datasets\. We present the averagePr,Re, andF1over 10 repeated experiments, with values in parentheses indicating standard deviations\.

The proposed method achieved the highest averageF1scores on both SWaT \(0\.8233\) and WADI \(0\.6485\), consistently outperforming all baselines\. This superior performance can be attributed to the explicit incorporation of two types of process knowledge—sensor group knowledge and process flow knowledge—into the graph structure learning stage\. By embedding these domain insights, the model can more effectively capture complex dependencies across sensors and sub\-processes, which purely data\-driven approaches often fail to recover, leading to improved anomaly detection performance\.

We acknowledge that our method leverages additional knowledge not utilized by existing baselines, which may limit the fairness of a direct comparison\. However, our goal is not to claim superiority under identical assumptions, but rather to demonstrate the value of incorporating process knowledge—often readily available in real\-world settings—for enhancing anomaly detection\. Importantly, most baseline models are not structurally designed to incorporate such knowledge, even in simplified forms, making direct adaptation in our experiments non\-trivial\. As a result, we evaluate the baselines in their original form without process knowledge and instead focus on demonstrating the benefits of our knowledge\-guided approach\.

#### V\-E2Ablation Study

To verify the contribution of each component in the proposed framework, we conducted an ablation study including not only the knowledge\-informed graphs but also the uninformed graph and the concatenation of the learnable embeddings\. Specifically, we compared the proposed model with five variants: removing the uninformed graph \(w/o𝒢U\\mathcal\{G\}^\{U\}\), removing the process\-flow\-informed graph \(w/o𝒢F\\mathcal\{G\}^\{F\}\), removing the sensor\-group\-informed graph \(w/o𝒢G\\mathcal\{G\}^\{G\}\), removing both knowledge\-informed graphs \(w/o𝒢F,𝒢G\\mathcal\{G\}^\{F\},\\mathcal\{G\}^\{G\}\), and removing the concatenation ofe1e\_\{1\}ande2e\_\{2\}\(w/oe1,e2e\_\{1\},e\_\{2\}concat\)\.

As shown in Table III, the performance consistently declined when each knowledge component was removed\. Removing either𝒢F\\mathcal\{G\}^\{F\}or𝒢G\\mathcal\{G\}^\{G\}led to noticeable drops in averageF1, and excluding both further degraded performance on both datasets\. These results confirm that sensor group knowledge and process flow knowledge each contribute independently to modeling inter\-sensor dependencies, and that their combination yields synergistic improvements in anomaly detection performance\. The variants without𝒢U\\mathcal\{G\}^\{U\}and without the concatenation ofe1e\_\{1\}ande2e\_\{2\}further show that the uninformed graph provides complementary data\-driven relational information beyond the knowledge\-informed graphs, while the learnable embeddings contribute useful information to the prediction module in addition to their role in graph construction\.

#### V\-E3Qualitative Analysis

To gain a deeper understanding of the model’s behavior beyond the experimental results, we present a qualitative analysis of two representative attack scenarios from the SWaT dataset\.

Case 1: Intra\-Sub\-process Dependency \(Attack on MV303\)Fig\.[5](https://arxiv.org/html/2607.15799#S5.F5)illustrates an attack scenario in sub\-process P3, where MV303 \(a valve controller\) is prevented from opening during the attack period\. The attack creates a mismatch between MV303 and other sensors within the same sub\-process, particularly MV301, another valve controller in P3 that regulates the backwashing process for the ultra\-filtration unit\. Ideally, a robust MTAD model should detect such intra\-sub\-process inconsistencies by leveraging structural knowledge that sensors within the same sub\-process tend to operate in a coordinated manner\. In this case, when MV303 behaves abnormally while MV301 continues to follow its normal pattern, the model should flag the resulting deviation through elevated prediction errors\.

![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/case1a_revised.png)\(a\)
![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/case1b_revised.png)\(b\)

Figure 5:\(a\) Predicted and observed values during the attack on MV303 for the uninformed, SG\-informed, PF\-informed, and proposed models\. The attack period is shaded in red\. \(b\) Multivariate time series of sensors MV303 and MV301 in P3 under normal conditions\.In Fig\.[5a](https://arxiv.org/html/2607.15799#S5.F5.sf1), we compare the prediction results of four model variants during the attack period \(shaded in red\):

- •Uninformed Model: Uses only data\-driven graph learning without any process knowledge
- •SG\-Informed Model: Incorporates sensor group knowledge to capture intra\-sub\-process relationships
- •PF\-Informed Model: Incorporates process flow knowledge to capture inter\-sub\-process relationships
- •Proposed Model: Combines both types of process knowledge

The key observation is that both the SG\-informed model and the proposed model exhibit significantly larger prediction errors for MV301 during the attack period\. This suggests that these models have captured the dependency between MV303 \(the attacked sensor\) and MV301 \(a related sensor within the same sub\-process\)\. This behavior is plausible because the SG\-informed model explicitly incorporates intra\-sub\-process relationships through sensor group knowledge, allowing the anomaly at MV303 to influence the prediction of MV301\. In contrast, the uninformed model and the PF\-informed model do not explicitly encode intra\-sub\-process relationships and thus fail to reflect the effect of MV303’s anomaly on MV301, resulting in smaller prediction errors and missed anomaly detection\. The strong correlation between MV303 and MV301 under normal operating conditions, as shown in Fig\.[5b](https://arxiv.org/html/2607.15799#S5.F5.sf2), suggests that these sensors exhibit coordinated behaviors within the same sub\-process\. This correlation likely reflects an underlying functional dependency, as both valves participate in the backwashing operation of the ultra\-filtration unit\.

![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/case2a_revised.png)\(a\)
![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/case2b_revised.png)\(b\)

Figure 6:\(a\) Predicted and observed values during the attack on AIT504 for the uninformed, SG\-informed, PF\-informed, and proposed models\. The attack period is shaded in red\. \(b\) Multivariate time series of sensors AIT504 in P5 and FIT401 in P4 under normal conditions\.![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/Hyperparam_k.png)\(a\)
![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/Hyperparam_alpha.png)\(b\)
![Refer to caption](https://arxiv.org/html/2607.15799v1/figs/Hyperparam_d.png)\(c\)

Figure 7:Results of the hyperparameter sensitivity analysis: \(a\)kk; \(b\)α\\alpha; \(c\)dd\. Black solid circles in the boxes indicate the mean values\.Case 2: Inter\-Sub\-process Dependency \(Attack on AIT504\)Fig\.[6](https://arxiv.org/html/2607.15799#S5.F6)presents another attack scenario targeting AIT504 that measures water quality parameters in sub\-process P5\. The attack artificially manipulates the sensor value above its actual value, causing inconsistencies with related measurements in adjacent sub\-processes\. Ideally, a robust MTAD model should detect such inconsistencies by leveraging known dependencies—for example, recognizing that AIT504 is typically aligned with FIT401\. If FIT401 remains stable during the attack, the model should continue to predict normal values for AIT504, resulting in a large prediction error when its observation is manipulated\.

Fig\.[6a](https://arxiv.org/html/2607.15799#S5.F6.sf1)demonstrates how different models respond to this attack\. The PF\-informed model and proposed model demonstrate markedly higher forecasting errors for AIT504 during the attack period\. As shown in the plots, these models predict values for AIT504 that are much lower than the manipulated readings and are closer to what the true \(unmanipulated\) values are expected to be\. This leads to significant discrepancies between prediction and observation, resulting in large discrepancies that enable reliable anomaly detection\. This outcome highlights the effectiveness of explicitly incorporating inter\-sub\-process dependencies through process flow knowledge\. In particular, FIT401 is a sensor located in sub\-process P4, which directly influences sub\-process P5, where AIT504 is located\. Process flow knowledge explicitly encodes such inter\-sub\-process relationships, allowing the PF\-informed and the proposed models to leverage this dependency during prediction\. Since FIT401 remains unaffected by the attack and continues to exhibit normal behavior during the attack period, the PF\-informed and the proposed models utilize its stable pattern to infer that AIT504 should also remain within a normal range\. As a result, despite the manipulated observations of AIT504, the models predict its normal \(unmanipulated\) values\. This leads to large prediction errors during the attack period, thereby enabling effective anomaly detection\. In contrast, the uninformed model and the SG\-informed model lack this structural guidance since they do not explicitly encode such inter\-sub\-process relationships\. Consequently, they tend to overfit to the anomalous \(manipulated\) observations of AIT504 more closely, yielding lower prediction errors and failing to detect the anomaly effectively\.

Fig\.[6b](https://arxiv.org/html/2607.15799#S5.F6.sf2)further supports this interpretation by showing that AIT504 and FIT401 exhibit similar trends under normal conditions—consistent with their connection in the process flow\. The PF\-informed and the proposed models effectively leverage this knowledge to identify anomalies that break such cross\-stage consistency\.

From this qualitative analysis, we derive the following observations based on two representative attack scenarios\. First, different types of process knowledge play complementary roles in anomaly detection\. In Case 1, incorporating sensor group knowledge helps the model capture intra\-sub\-process relationships, enhancing sensitivity to anomalies affecting related sensors\. In Case 2, leveraging process flow knowledge allows the model to account for inter\-sub\-process dependencies, which is particularly beneficial when anomalies cause inconsistencies across adjacent process stages\.

Second, these observations suggest that knowledge\-informed structures can guide the model to focus on physically meaningful relationships—dependencies that may not be easily inferred from data alone—thereby improving the discovery of underlying dependency structures\.

Overall, these findings qualitatively support the design of our proposed model, which integrates both sensor group and process flow knowledge\. The results indicate that this approach leads to more robust anomaly detection performance in complex industrial systems\.

#### V\-E4Hyperparameter Sensitivity Analysis

We conducted a hyperparameter sensitivity analysis using the WADI dataset to investigate the impact of key hyperparameters, includingkk,α\\alpha, anddd, using a one\-factor\-at\-a\-time protocol around the selected configuration\. Specifically, when varying one hyperparameter, the other two were fixed to the values selected by the validation\-based joint grid search\. When varyingkkover\{5,10,15,20,25\}\\\{5,10,15,20,25\\\}, we fixedα=0\.3\\alpha=0\.3andd=128d=128; when varyingα\\alphaover\{0\.1,0\.3,0\.5,0\.7,0\.9\}\\\{0\.1,0\.3,0\.5,0\.7,0\.9\\\}we fixedk=10k=10andd=128d=128; and when varyingddover\{32,64,128,256\}\\\{32,64,128,256\\\}, we fixedk=10k=10andα=0\.3\\alpha=0\.3\. This analysis is intended to assess local robustness around the selected configuration rather than fully characterize higher\-order interactions among hyperparameters\. Especially, as shown in Fig\.[7](https://arxiv.org/html/2607.15799#S5.F7)\(a\) and Fig\.[7](https://arxiv.org/html/2607.15799#S5.F7)\(b\), a decrease in performance was observed whenkkandα\\alphawere too small, possibly because the learned graphs were too sparse to capture complex inter\-sensor dependencies\. Conversely, performance also declined when these parameters were excessively large, likely due to redundant edges within the graphs, impeding effective capture of inter\-sensor dependencies\.

TABLE IV:Average forecasting errors on normal and anomalous timestamps in the test set, measured by MAE and RMSE\. Values are averaged over 10 repeated experiments, with standard deviations shown in parentheses\.
#### V\-E5Forecasting Error Analysis

To directly assess the forecasting accuracy of the proposed model under normal operating conditions, which underpins the prediction\-error\-based anomaly detection mechanism, we computed the mean absolute error \(MAE\) and root mean squared error \(RMSE\) separately on normal and anomalous timestamps in the test set\. As shown in Table[IV](https://arxiv.org/html/2607.15799#S5.T4), the forecasting errors on normal timestamps are substantially lower than those on anomalous timestamps for both datasets\. These results indicate that the proposed method maintains low forecasting errors under normal operating conditions, while anomaly timestamps yield markedly larger prediction errors\. This clear separation demonstrates that forecasting error serves as an effective discriminative signal for distinguishing anomalous from normal observations, thereby validating the effectiveness of the forecasting error\-based anomaly scoring mechanism\.

## VIConclusion

We propose a process knowledge\-assisted multi\-graph dependency learning framework for GNN\-based MTAD tailored for multi\-stage industrial processes\. The core contribution lies in enhancing graph structure learning by explicitly incorporating two forms of domain knowledge: sensor group knowledge and process flow knowledge\. This structured integration helps the model to more effectively capture inter\-sensor dependencies, improving over conventional data\-driven approaches that often overlook the underlying process dynamics\. By coupling this knowledge\-guided graph structure construction with temporal modeling via TCN, the proposed method delivers more robust forecasting and improved anomaly detection performance on real\-world industrial datasets\.

A notable limitation of the current method is that it does not explicitly account for the inherent stochasticity in industrial time series data, which may lead to overconfident predictions and reduced anomaly detection robustness\. As a future direction, we plan to extend our process knowledge\-guided graph learning framework into a probabilistic forecasting\-based MTAD model\. By modeling forecast uncertainty alongside structured graph\-based dependencies, this extension seeks to enhance anomaly detection reliability while retaining the core strengths of our current approach\.

## Acknowledgment

This research was supported by the National Research Foundation of Korea \(NRF\) grant funded by the Korea government \(MSIT\) \(2023R1A2C2005453, RS\-2023\-00218913\)\.

## References

- \[1\]Y\. Ma et al\., “Smart actuation for end\-edge industrial control systems,”*IEEE Trans\. Autom\. Sci\. Eng\.*, vol\. 21, no\. 1, pp\. 269–283, Jan\. 2022\.
- \[2\]A\. P\. Mathur and N\. O\. Tippenhauer, “SWaT: A water treatment testbed for research and training on ICS security,” in*Proc\. Int\. Workshop Cyber\-Physical Syst\. Smart Water Netw\. \(CySWater\)*, Vienna, Austria, 2016, pp\. 31–36\.
- \[3\]Park, S\., Kim, K\. & Kim, H\. Prediction of highly imbalanced semiconductor chip\-level defects using uncertainty\-based adaptive margin learning\.IISE Transactions\.55, 147\-155, 2022
- \[4\]K\. Sharma, “Overview of industrial process automation,”*Elsevier*, 2016\.
- \[5\]Cho, H\., Koo, W\. & Kim, H\. Prediction of highly imbalanced semiconductor chip\-level defects in module tests using multimodal fusion and logit adjustment\.IEEE Transactions on Semiconductor Manufacturing\.36, 425\-433, 2023
- \[6\]H\. Zhao et al\., “Multivariate time\-series anomaly detection via graph attention network,” in*Proc\. IEEE Int\. Conf\. Data Mining \(ICDM\)*, 2020, pp\. 841–850\.
- \[7\]A\. Deng and B\. Hooi, “Graph neural network\-based anomaly detection in multivariate time series,” in*Proc\. AAAI Conf\. Artif\. Intell\.*, 2021, pp\. 4027–4035\.
- \[8\]Ma, E\., Jung, J\. & Kim, H\. Order\-based Causal Discovery for Multistage Processes\.IEEE Transactions on Knowledge And Data Engineering\. doi=10\.1109/TKDE\.2026\.3710776\. 2026\.
- \[9\]Z\. Chen et al\., “Learning graph structures with transformer for multivariate time\-series anomaly detection in IoT,”*IEEE Internet Things J\.*, vol\. 9, no\. 12, pp\. 9179–9189, 2021\.
- \[10\]W\. Chen et al\., “Deep variational graph convolutional recurrent network for multivariate time series anomaly detection,” in*Proc\. Int\. Conf\. Mach\. Learn\. \(ICML\)*, 2022, pp\. 3621–3633\.
- \[11\]S\. Han and S\. S\. Woo, “Learning sparse latent graph representations for anomaly detection in multivariate time series,” in*Proc\. ACM SIGKDD Int\. Conf\. Knowl\. Discovery Data Mining*, 2022, pp\. 2977–2986\.
- \[12\]E\. Dai and J\. Chen, “Graph\-augmented normalizing flows for anomaly detection of multiple time series,”*arXiv preprint arXiv:2202\.07857*, 2022\.
- \[13\]Y\. Shi et al\., “Robust anomaly detection for multivariate time series through temporal GCNs and attention\-based VAE,”*Knowl\.\-Based Syst\.*, vol\. 275, p\. 110725, 2023\.
- \[14\]C\. Ding, S\. Sun, and J\. Zhao, “MST\-GAT: A multimodal spatial\-temporal graph attention network for time series anomaly detection,”*Inf\. Fusion*, vol\. 89, pp\. 527–536, 2023\.
- \[15\]H\. Jo and S\.\-W\. Lee, “Edge conditional node update graph neural network for multi\-variate time series anomaly detection,”*Inf\. Sci\.*, p\. 121062, 2024\.
- \[16\]Z\. Liu, X\. Huang, J\. Zhang, Z\. Hao, J\. Li, and R\. Hu, “Multivariate time\-series anomaly detection based on enhancing graph attention networks with topological analysis,” in*Proc\. 33rd ACM Int\. Conf\. Inf\. Knowl\. Manag\. \(CIKM\)*, 2024, pp\. 1480–1490\.
- \[17\]J\. Jeong and H\. Yoon, “PGRF\-Net: A prototype\-guided relational fusion network for diagnostic multivariate time\-series anomaly detection,” in*Proc\. Int\. Conf\. Learn\. Represent\. \(ICLR\)*, 2026\.
- \[18\]P\. Velickovic et al\., “Graph attention networks,”*stat*, vol\. 1050, no\. 20, pp\. 10–48550, 2017\.
- \[19\]S\. Bai, J\. Z\. Kolter, and V\. Koltun, “An empirical evaluation of generic convolutional and recurrent networks for sequence modeling,”*arXiv preprint arXiv:1803\.01271*, 2018\.
- \[20\]V\. Chandola, A\. Banerjee, and V\. Kumar, “Anomaly detection: A survey,”*ACM Comput\. Surv\.*, vol\. 41, no\. 3, pp\. 1–58, 2009\.
- \[21\]K\. Choi et al\., “Deep learning for anomaly detection in time\-series data: Review, analysis, and guidelines,”*IEEE Access*, vol\. 9, pp\. 120043–120065, 2021\.
- \[22\]Z\. Z\. Darban et al\., “Deep learning for time series anomaly detection: A survey,”*ACM Comput\. Surv\.*, 2022\.
- \[23\]H\. Kim and H\. Kim, “Contextual anomaly detection for high\-dimensional data using Dirichlet process variational autoencoder,”*IISE Transactions*, vol\. 55, no\. 5, pp\. 433–444, 2023\.
- \[24\]H\. Kim and H\. Kim, “Contextual anomaly detection for multivariate time series data,”*Quality Engineering*, vol\. 35, no\. 4, pp\. 686–695, 2023\.
- \[25\]G\. Li and J\. J\. Jung, “Deep learning for anomaly detection in multivariate time series: Approaches, applications, and challenges,”*Inf\. Fusion*, vol\. 91, pp\. 93–102, 2023\.
- \[26\]Kim, H\. & Kim, H\. Deep embedding kernel mixture networks for conditional anomaly detection in high\-dimensional data\.International Journal of Production Research\.61, 1101\-1113, 2023\.
- \[27\]K\. Hundman et al\., “Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding,” in*Proc\. ACM SIGKDD Int\. Conf\. Knowl\. Discovery Data Mining*, 2018, pp\. 387–395\.
- \[28\]W\. Wu et al\., “Developing an unsupervised real\-time anomaly detection scheme for time series with multi\-seasonality,”*IEEE Trans\. Knowl\. Data Eng\.*, vol\. 34, no\. 9, pp\. 4147–4160, 2020\.
- \[29\]L\. Liu et al\., “Spacecraft anomaly detection with attention temporal convolution networks,”*Neural Comput\. Appl\.*, pp\. 1–9, 2023\.
- \[30\]J\. Kim, H\. Kang, and P\. Kang, “Time\-series anomaly detection with stacked transformer representations and 1D convolutional network,”*Eng\. Appl\. Artif\. Intell\.*, vol\. 120, p\. 105964, 2023\.
- \[31\]D\. Park, Y\. Hoshi, and C\. C\. Kemp, “A multimodal anomaly detector for robot\-assisted feeding using an LSTM\-based variational autoencoder,”*IEEE Robot\. Autom\. Lett\.*, vol\. 3, no\. 3, pp\. 1544–1551, 2018\.
- \[32\]D\. Li et al\., “MAD\-GAN: Multivariate anomaly detection for time series data with generative adversarial networks,” in*Proc\. Int\. Conf\. Artif\. Neural Netw\.*, 2019, pp\. 703–716\.
- \[33\]Y\. Su et al\., “Robust anomaly detection for multivariate time series through stochastic recurrent neural network,” in*Proc\. ACM SIGKDD Int\. Conf\. Knowl\. Discovery Data Mining*, 2019, pp\. 2828–2837\.
- \[34\]Z\. Zhang et al\., “STAD\-GAN: Unsupervised anomaly detection on multivariate time series with self\-training generative adversarial networks,”*ACM Trans\. Knowl\. Discovery Data*, vol\. 17, no\. 5, pp\. 1–18, 2023\.
- \[35\]J\. Audibert et al\., “USAD: UnSupervised anomaly detection on multivariate time series,” in*Proc\. ACM SIGKDD Int\. Conf\. Knowl\. Discovery Data Mining*, 2020, pp\. 3395–3404\.
- \[36\]M\. Thill, W\. Konen, H\. Wang, and T\. Bäck, “Temporal convolutional autoencoder for unsupervised anomaly detection in time series,”*Appl\. Soft Comput\.*, vol\. 112, p\. 107751, 2021\.
- \[37\]S\. Tuli, G\. Casale, and N\. R\. Jennings, “TranAD: Deep transformer networks for anomaly detection in multivariate time series data,”*arXiv preprint arXiv:2201\.07284*, 2022\.
- \[38\]X\. Wang et al\., “Variational transformer\-based anomaly detection approach for multivariate time series,”*Measurement*, vol\. 191, p\. 110791, 2022\.
- \[39\]Z\. Dai, L\. He, S\.\-H\. Yang, and M\. Leeke, “SARAD: Spatial association\-aware anomaly detection and diagnosis for multivariate time series,” in*Proc\. 38th Conf\. Neural Inf\. Process\. Syst\. \(NeurIPS\)*, 2024, pp\. 48371–48410\.
- \[40\]X\. Wu, X\. Qiu, Z\. Li, Y\. Wang, J\. Hu, C\. Guo, H\. Xiong, and B\. Yang, “CATCH: Channel\-aware multivariate time series anomaly detection via frequency patching,” in*Proc\. 13th Int\. Conf\. Learn\. Represent\. \(ICLR\)*, 2025, pp\. 17017–17045\.“
- \[41\]G\. Zhong, P\. Wang, J\. Yuan, Z\. Li, and L\. Chen, “Multi\-resolution decomposable diffusion model for non\-stationary time series anomaly detection,” in*Proc\. 13th Int\. Conf\. Learn\. Represent\. \(ICLR\)*, 2025\.
- \[42\]S\. Guan et al\., “GTAD: Graph and temporal neural network for multivariate time series anomaly detection,”*Entropy*, vol\. 24, no\. 6, p\. 759, 2022\.
- \[43\]H\. Kim, J\. Mok, D\. Lee, J\. Lew, S\. Kim, and S\. Yoon, “Causality\-aware contrastive learning for robust multivariate time\-series anomaly detection,” in*Proc\. 42nd Int\. Conf\. Mach\. Learn\. \(ICML\)*, 2025, pp\. 30591–30608\.
- \[44\]Z\. Z\. Darban, G\. I\. Webb, S\. Pan, C\. C\. Aggarwal, and M\. Salehi, “CARLA: Self\-supervised contrastive representation learning for time series anomaly detection,”*Pattern Recognit\.*, vol\. 157, 2025, Art\. no\. 110874\.
- \[45\]A\. Vaswani et al\., “Attention is all you need,” in*Adv\. Neural Inf\. Process\. Syst\.*, vol\. 30, 2017\.
- \[46\]E\. Jang, S\. Gu, and B\. Poole, “Categorical reparameterization with Gumbel\-softmax,”*arXiv preprint arXiv:1611\.01144*, 2016\.
- \[47\]X\. Zheng et al\., “DAGs with NO TEARS: Continuous optimization for structure learning,” in*Adv\. Neural Inf\. Process\. Syst\.*, vol\. 31, 2018\.
- \[48\]F\. G\. Febrinanto et al\., “Entropy causal graphs for multivariate time series anomaly detection,”*ACM Trans\. Intell\. Syst\. Technol\.*, vol\. 16, no\. 6, pp\. 1–25, 2025\.
- \[49\]T\. N\. Kipf and M\. Welling, “Semi\-supervised classification with graph convolutional networks,”*arXiv preprint arXiv:1609\.02907*, 2016\.
- \[50\]V\. Nair and G\. E\. Hinton, “Rectified linear units improve restricted Boltzmann machines,” in*Proc\. Int\. Conf\. Mach\. Learn\. \(ICML\)*, 2010, pp\. 807–814\.
- \[51\]T\. Salimans and D\. P\. Kingma, “Weight normalization: A simple reparameterization to accelerate training of deep neural networks,” in*Adv\. Neural Inf\. Process\. Syst\.*, vol\. 29, 2016\.
- \[52\]B\. Xu et al\., “Empirical evaluation of rectified activations in convolutional network,”*arXiv preprint arXiv:1505\.00853*, 2015\.
- \[53\]C\. M\. Ahmed, V\. R\. Palleti, and A\. P\. Mathur, “WADI: A water distribution testbed for research in the design of secure cyber physical systems,” in*Proc\. 3rd Int\. Workshop Cyber\-Physical Syst\. Smart Water Netw\.*, 2017, pp\. 25–28\.
- \[54\]D\. P\. Kingma and J\. Ba, “Adam: A method for stochastic optimization,”*arXiv preprint arXiv:1412\.6980*, 2014\.
- \[55\]A\. van den Oordet al\., “WaveNet: A generative model for raw audio,” 2016, arXiv:1609\.03499\.