Graph-Based Framework Detects IoT Anomalies Without Labels

Researchers have developed a self-supervised graph neural network framework called GraphContrast-IoT to detect anomalies in multivariate industrial Internet of Things sensor networks. Published in Discover Computing, the study addresses the limitations of current autoencoder-based and transformer-based models, which often focus primarily on temporal patterns and fail to sufficiently model the complex interactions between different sensors. By integrating physical topology with statistical correlation information, the proposed framework aims to reduce false alarms and improve detection reliability in industrial and cyber-physical systems where labelled anomaly data is scarce.

The core of the methodology involves constructing a hybrid graph that combines predefined physical connectivity with statistical inter-sensor dependencies. This hybrid adjacency matrix is estimated exclusively from normal training data and remains fixed during both training and inference. This static design eliminates the computational overhead of dynamic graph recomputation and ensures stable message passing, although it assumes that prevailing sensor relationships remain fairly constant over time. The framework does not dynamically update inter-sensor connectivity but captures changes in sensor observations within this fixed structural topology.

To learn robust representations without relying on anomaly labels, the framework employs multi-view contrastive learning. Each input time-series window is transformed into two semantically similar but stochastically perturbed views. These perturbations simulate realistic industrial disturbances, including sensor dropout to mimic communication loss, temporal warping to account for irregular sampling, and Gaussian noise injection to represent measurement errors. Additionally, controlled graph-level augmentation temporarily removes existing edges during training to enhance the model’s robustness to structural variations, while the original fixed adjacency matrix is retained for validation and inference.

The spatio-temporal encoding is handled by a specialized architecture named GCT-ADNet, which fuses graph convolution with a Temporal Convolutional Network. The graph convolution layers model spatial dependencies between physically or statistically connected sensors, while the TCN captures short- and long-term temporal dependencies within individual sensor streams. The resulting features are fused and projected into a compact latent embedding space. Anomaly scoring is then performed by calculating the Euclidean distance between each test window’s embedding and a normal reference centroid, avoiding the indirect measures of abnormality associated with reconstruction error.

Experiments were conducted on three well-known public benchmark datasets: SWaT, WADI, and SKAB. SWaT and WADI represent water treatment and water distribution cyber-physical systems, respectively, while SKAB is a controlled lab-scale IoT setup. The datasets were preprocessed using feature-wise normalization and forward filling for missing values, then sliced into fixed-length overlapping windows. The model was trained using only normal operating samples, with hyperparameters selected via a self-supervised validation objective to prevent label leakage. Five independent runs were performed using distinct random seeds to ensure reproducibility and reduce stochastic variation.

The framework demonstrated strong performance across all three datasets, achieving F1-scores of 0.941, 0.902, and 0.948 for SWaT, WADI, and SKAB, respectively. Corresponding precision values were 0.947, 0.910, and 0.953, while recall values were 0.935, 0.894, and 0.943. These results indicate that the proposed method outperforms evaluated baseline methods, including MTAD-GAT, GDN, and TranAD. The improvements are attributed to the joint modelling of inter-sensor dependencies and the discriminative power of the contrastive representation learning in the latent space.

Ablation studies revealed that hybrid graph construction and contrastive augmentation are the most critical components for overall performance. Removing these elements led to significant drops in F1-scores, particularly on the WADI dataset, where distributed sensor interactions are more complex. Replacing the TCN temporal encoder with a GRU also degraded performance, highlighting the superiority of the chosen temporal architecture in this specific context. The projection head and embedding-based anomaly scoring further enhanced latent-space discrimination, confirming that the framework’s effectiveness relies on the coordinated operation of all major design elements.

Robustness analyses tested the framework under realistic perturbations, including missing sensor observations, measurement noise, graph structure corruption, and reduced training data. The results showed that the framework maintains high anomaly-detection accuracy under these conditions, with only moderate degradation compared to the baseline setting. Graph structure corruption and limited training data caused the most significant performance loss, yet the model remained effective. This resilience is attributed to the hybrid graph construction and the contrastive training process, which forces the encoder to rely on information from related sensors rather than overfitting to individual noisy channels.

Computational efficiency was evaluated to assess the framework’s suitability for real-time monitoring. The system achieves an inference latency of 2.1 to 5.6 milliseconds per sample across the datasets, with an average throughput of approximately 196 windows per second. This low latency is possible because inference requires only a single forward pass through the encoder and a simple distance calculation, without the need for backward passes, contrastive pair generation, or online graph recomputation. The static hybrid graph further reduces operational overhead by allowing the adjacency matrix to be constructed offline.

Cross-dataset generalisation experiments demonstrated that the framework can transfer knowledge between different industrial environments without retraining. In a zero-shot setting, the model maintained 89.87% to 96.23% of its within-dataset performance when applied to new domains. The largest generalisation gap occurred when transferring from WADI to SKAB, reflecting the significant domain mismatch between the two systems. Despite this, the learned representations retained useful anomaly-ranking ability, with ROC-AUC values remaining above 0.92 in most transfer scenarios.

Statistical significance tests confirmed that the performance gains over the strongest baseline, TranAD, are reliable. Paired t-tests with Holm correction showed that the improvements are statistically significant across all three datasets, with p-values below 0.05. Cohen’s d_z values exceeded 0.80, indicating large and practically meaningful effect sizes. These findings suggest that the observed improvements are not due to random variation but reflect a genuine enhancement in detection capability provided by the integrated graph-contrastive architecture.

Despite its promising results, the study acknowledges several limitations. The evaluation is restricted to three benchmark datasets, which may not fully capture the diversity and complexity of large-scale real-world IoT systems. The fixed hybrid adjacency matrix may not adapt to new dependencies arising from equipment reconfiguration or concept drift. Furthermore, the manually designed augmentation policy may not cover all possible anomaly mechanisms in every industrial domain. The training complexity is also higher than simpler models, which could pose challenges for frequent retraining on highly resource-constrained edge devices.

The source code and implementation details are publicly available to support reproducibility and further research. The framework offers a scalable, label-efficient, and computation-efficient solution for industrial monitoring, cybersecurity, and smart-infrastructure applications. Future work will explore adaptive graph-learning approaches for non-stationary settings, advanced domain-aware augmentation techniques, and lightweight model optimisation for edge deployment. This research contributes to the growing field of self-supervised anomaly detection by demonstrating the value of integrating structural and statistical sensor relationships in a unified contrastive learning framework.

The GraphContrast-IoT framework is designed for deployment on industrial edge or fog gateways and local SCADA monitoring servers, rather than directly on resource-limited Programmable Logic Controllers. In this configuration, the system receives synchronized multivariate sensor streams from connected field devices and performs real-time anomaly inference locally to minimize communication latency and bandwidth usage. While the model can be retrained at a central cloud site, the inference process relies on a pre-constructed static graph, ensuring that the computational burden of graph topology estimation does not interfere with the immediate monitoring of operational safety and reliability in cyber-physical systems.

Hyperparameter selection for the framework was conducted strictly using normal samples to preserve the self-supervised nature of the training protocol. The research team split the available normal training data into 80% for model fitting and 20% for validation, utilizing a self-supervised objective that included contrastive loss and latent-representation stability. A single common configuration was selected across all datasets to prevent overfitting to specific data characteristics, with a window size of 64, a 64-dimensional embedding space, a temperature parameter of 0.10, and a graph fusion factor of 0.5. This standardized approach ensures that performance comparisons are not influenced by unequal tuning efforts or dataset-specific optimization.

The study employed a rigorous statistical protocol to verify the reliability of the observed performance gains. The researchers conducted five independent runs using distinct random seeds to account for stochastic variation in parameter initialization and mini-batch ordering. To assess the significance of the improvements over the strongest baseline, TranAD, they first applied the Shapiro–Wilk test to confirm that the differences in F1-scores followed a normal distribution. Subsequently, two-sided paired t-tests were performed, with Holm correction applied to control the family-wise error rate across the three datasets. The resulting unadjusted p-values ranged from 0.010 to 0.018, all of which remained below the 0.05 significance threshold after adjustment, confirming that the detection improvements were statistically robust.

Computational efficiency is a critical factor for the practical deployment of anomaly detection systems in industrial environments. The GraphContrast-IoT model requires approximately 10.6 MB of storage and achieves an average inference latency of 5.1 milliseconds per window. This efficiency is largely due to the fact that the contrastive learning overhead is confined to the offline training phase; during inference, the system performs only a single forward pass through the encoder and a simple Euclidean distance calculation. This design allows the framework to maintain a high throughput of approximately 196 windows per second, making it suitable for near-real-time monitoring where rapid identification of deviations from normal operating patterns is essential for operational efficiency.

Subject of Research: Self-supervised graph neural network for multivariate industrial IoT anomaly detection

Article Title: GraphContrast IoT for self supervised graph based anomaly detection in multivariate industrial IoT sensor networks

Article References: Sarlana, S. R., Saradhi, M. V. V., Krishna, N. M., Bhavani, C. H., Nagaraju, K., & Penubaka, K. K. R. (2026). GraphContrast IoT for self supervised graph based anomaly detection in multivariate industrial IoT sensor networks. Discover Computing, 29(1), Article 864. https://doi.org/10.1007/s10791-026-10794-7

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10794-7

Keywords: GraphContrast-IoT, Self-supervised learning, Graph neural networks, Industrial IoT, Anomaly detection, Multivariate time series, Contrastive learning, SWaT dataset, WADI dataset, SKAB benchmark, Cyber-physical systems, Sensor networks, Temporal Convolutional Network, Hybrid graph construction, Latent space scoring, Edge computing, Zero-shot transfer, Robustness analysis, Inference latency, Discover Computing