The study, led by Hanjie Xu of Zhongguancun Lab and Beihang University together with Ju Ren of Tsinghua University, Jie Liu of Beijing Information Science and Technology University, Zhenya Ma, Wang Huang of Central South University, and Jianwei Niu of Beihang University, was published in the International Journal of Machine Learning and Cybernetics. The team’s model, which fuses wavelet analysis, graph neural networks, and the newly popular Mamba sequence architecture, outperformed a wide range of established baselines in extensive benchmark testing. The work addresses one of the most persistent challenges in applied machine learning: detecting anomalies in multivariate time series, where dozens or hundreds of correlated sensor channels evolve together and a fault in one can ripple through the others in complex ways.

Each of the three components of the new model plays a distinct role. Wavelet representations, the first ingredient, give the network a way to see a signal at multiple resolutions simultaneously. Traditional Fourier analysis tells an engineer which frequencies exist in a signal but says little about when they occurred, a limitation known as the time frequency trade off. Wavelet transforms solve this by decomposing a signal into localized oscillations of different scales, so the model can capture both a slow drift lasting minutes and a sharp transient lasting milliseconds. By enhancing the raw inputs with these wavelet features, the architecture extracts far richer representations of each moment in the stream than models that read the raw sensor values alone.

The second ingredient, graph neural networks, addresses the fact that sensor data is rarely a set of independent channels. In a water treatment plant, a pressure sensor upstream is physically and causally linked to a flow sensor downstream; in a server cluster, the temperature readings of adjacent racks move in concert. Graph neural networks encode these relationships explicitly, treating each sensor as a node and the learned or measured dependencies as edges. Message passing across the graph allows the model to build a picture of how the whole system should behave as a coherent network, and to flag moments when that coherence breaks down. This topology learning capability, the authors argue, is essential for detecting anomalies that only become visible when several channels are viewed together.

The third component, Mamba, is one of the most talked about architectures in artificial intelligence today. Introduced by Albert Gu and Tri Dao in late 2023, Mamba is a selective state space model that processes sequences in linear time, in contrast to the quadratic cost of transformer attention. For time series workloads, where context windows can stretch across thousands of timesteps and the model must run on resource constrained edge devices, that efficiency matters enormously. Mamba’s selective mechanism lets the network decide dynamically which parts of the past to remember and which to forget, giving it a powerful ability to follow long range sequential patterns without the memory burden that attends older recurrent designs.

What makes the new model distinctive is the way these three ideas operate together rather than in sequence. The wavelet enhanced representations give the sequence model a frequency aware view of each channel, the graph neural network binds those views into a coherent picture of system wide behavior, and the Mamba backbone explores how the entire enriched representation evolves through time. In effect, the model asks three questions at once: how is each sensor oscillating, how are the sensors related, and how are those patterns changing? An anomaly is registered when any of these three questions produces an answer that deviates from what the model has learned to expect from normal operation.

The evaluation was extensive. The researchers tested their architecture against a broad collection of time series anomaly detection baselines, spanning the main families of methods that have dominated the field over the past decade. Those baselines include long short term memory networks, which have been used for everything from spacecraft telemetry to rail transit monitoring; variational autoencoders and generative adversarial networks that learn to reconstruct normal data and flag what they cannot reconstruct; transformer models such as TranAD and the Anomaly Transformer, which use attention to model dependencies across time; and earlier graph based detectors, including graph attention networks and graph deviation networks, which pioneered the topological view of multivariate data. Across this competitive landscape, the wavelet enhanced Mamba and graph network model outperformed many prevailing approaches.

The significance of the result extends beyond leaderboard positions. Anomaly detection sits at the foundation of industrial safety, cybersecurity, financial monitoring, and healthcare. Earlier studies in the literature the team cites show detectors deployed in industrial IoT systems, smart city traffic networks, financial markets analyzed with principal component analysis and neural networks, and clinical settings where deep learning reviews promise earlier warnings. Each of these domains has its own constraints: latency requirements that forbid heavy computation, noisy training sets, and distribution shifts that arise as machines age or seasons change. A detector that combines strong accuracy with linear time sequence processing and explicit modeling of sensor topology is therefore well matched to deployment realities, particularly at the network edge where IoT devices typically live.

The Mamba component deserves particular attention because it represents a broader shift in the machine learning community. Since the original Mamba paper appeared, researchers have rapidly adapted the architecture to forecasting and detection tasks, producing variants such as bidirectional Mamba for time series prediction, spatial temporal Mamba for multivariate anomaly detection, and Mamba based foundation models for general forecasting. By embedding Mamba within a graph structure and enhancing its inputs with wavelets, the Beijing team positions their model at the intersection of several active research fronts. The graph element draws on a lineage that runs from graph convolutional networks through temporal graph convolutional networks for traffic prediction to recent topological analysis methods, while the wavelet element revives a classical signal processing tool whose value modern deep learning has increasingly rediscovered.

The study also acknowledges the practical ecosystems in which such models must be validated. The references underpinning the work include widely used benchmarks such as the MIT BIH arrhythmia database for cardiac signals, spacecraft telemetry datasets with expert labeled anomalies, and secure water treatment testbeds used in adversarial cyberattack research. Datasets of this kind have shaped the field by providing realistic fault patterns against which methods can be calibrated, and the competitive advantage the new model demonstrated against baselines on this landscape suggests it generalizes across heterogeneous data regimes rather than being tuned to a single domain. The authors declare no conflict of interest, and the work received support reflected in the supervisory and funding roles of the senior researchers on the team.

Looking ahead, the research points toward anomaly detectors that are simultaneously faster, more aware of physical structure, and more sensitive to the fine grained dynamics of the systems they watch. As billions more devices come online, the volume of time series data will only grow, and the cost of missing a fault will continue to rise, whether measured in damaged equipment, lost revenue, compromised security, or human health. A model that can read a system through its frequencies, its connections, and its history at linear cost offers a template for the next generation of monitoring infrastructure. The Beijing team’s results suggest that the combination of wavelets, graphs, and selective state space models is more than a fashionable assembly of components; it is a coherent answer to the question of how machines can learn what normal looks like in an increasingly connected world, and how quickly they can notice when that normality shatters.

Subject of Research: A wavelet-enhanced Mamba and graph neural network model for detecting anomalies in multivariate time series data from IoT systems.

Article Title: Wavelet-enhanced Mamba and graph network-based model for time series anomaly detection

Article References: Xu, H., Ren, J., Liu, J., Ma, Z., Huang, W., & Niu, J. (2026). Wavelet-enhanced Mamba and graph network-based model for time series anomaly detection. International Journal of Machine Learning and Cybernetics, 17(10), Article 475. https://doi.org/10.1007/s13042-026-03250-x

Image Credits: AI Generated

DOI: 10.1007/s13042-026-03250-x

Keywords: time series, anomaly detection, Mamba, graph neural network, wavelet transform, Internet of Things, machine learning, state space models, multivariate data, deep learning, IoT sensors, sequence modeling