9214 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO.

12, JUNE 15, 2022

Graph Neural Networks for Anomaly Detection in

Industrial Internet of Things
Yulei Wu , Senior Member, IEEE, Hong-Ning Dai , Senior Member, IEEE, and Haina Tang

Abstract—The Industrial Internet of Things (IIoT) plays an paradigm that facilitates the process of industry digital trans-
important role in digital transformation of traditional indus- formation [4], [5]. It allows the networked interconnection
tries toward Industry 4.0. By connecting sensors, instruments, of sensors, instruments, and other Internet of Things (IoT)
and other industry devices to the Internet, IIoT facilitates the
data collection, data analysis, and automated control, thereby devices to enable data collection, data analytics and automated
improving the productivity and efficiency of the business as control in an industry environment [6]–[9]. IIoT can, in turn,
well as the resulting economic benefits. Due to the complex improve the productivity and efficiency of the business in the
IIoT infrastructure, anomaly detection becomes an important industry, as well as the resulting economic benefits. A recent
tool to ensure the success of IIoT. Due to the nature of IIoT, report of “Bringing Smart Water Networks Into Focus” men-
graph-level anomaly detection has been a promising means to
detect and predict anomalies in many different domains, such as tioned that up to 12.5 billion USD in annual savings can be
transportation, energy, and factory, as well as for dynamically achieved from a combination of actions ranging from improved
evolving networks. This article provides a useful investigation on leakage and pressure management to streamlined water qual-
graph neural networks (GNNs) for anomaly detection in IIoT- ity monitoring.1 These actions can attribute to the development
enabled smart transportation, smart energy, and smart factory. of smart water systems that can be implemented by IIoT.
In addition to the GNN-empowered anomaly detection solutions
on point, contextual, and collective types of anomalies, useful Anomaly detection is of paramount importance in
data sets, challenges, and open issues for each type of anomalies IIoT [10]–[15]. On the one hand, traditional isolated industry
in the three identified industry sectors (i.e., smart transporta- systems are now exposed to the public access due to the intro-
tion, smart energy, and smart factory) are also provided and duction of IIoT [16]–[19]. The sensors, instruments, and other
discussed, which will be useful for future research in this area. IoT devices that were originally designed with little security
To demonstrate the use of GNN in concrete scenarios, we show
three case studies in smart transportation, smart energy, and mechanisms can be easily compromised by malicious users
smart factory, respectively. such as attackers [4], [16], [20]. Efficient detection of such
anomalies is crucial to the security of IIoT and the success of
Index Terms—Anomaly detection, graph neural networks
(GNNs), Industrial Internet of Things (IIoT), industry 4.0. related businesses. On the other hand, one of the benefits of
digital transformation of many industries is to use the collected
data to detect abnormal situations in a timely manner or even
in advance of the actual happening of anomalies [21], [22].
I. I NTRODUCTION The absence of appropriate anomaly detection may result in
ANY traditional industries that were isolated from the significant economic loss. For example, British Airways IT
M public access have started their digital transformation
under the umbrella of Industry 4.0 [1]–[3]. Such industries
systems failure resulted in 58 million GBP in lost business and
follow-up compensation claims.2 Across England and Wales,
include energy, health, manufacturing, and water, just to name nearly 3 billion litres of water is lost to leaks every day,
a few. The Industrial Internet of Things (IIoT) is an emerging resulting in considerable economic loss of water companies.3
IIoT, depending on the type of devices and working condi-
tions, may generate and collect a wide variety and large vol-
Manuscript received March 31, 2021; revised May 28, 2021 and June 18,
2021; accepted June 29, 2021. Date of publication July 2, 2021; date of current ume of data that can be used for anomaly detection [10], [23].
version June 7, 2022. This work was supported in part by the Engineering and These data may include value, image, text, audio, and video,
Physical Sciences Research Council (EPSRC) under Grant EP/R030863/1; and each device may generate and/or collect a combination
in part by the Macao Science and Technology Development Fund through
Macao Funding Scheme for Key Research and Development Projects under of different types of data [24]–[26]. Artificial intelligence
Grant 0025/2019/AKP; in part by the Open Fund of Zhejiang Lab under (AI), especially machine learning and deep learning, has
Grant 2019KE0AB03; and in part by the National Natural Science Foundation been widely adopted for anomaly detection in a wide range
of China (NSFC) under Grant 52071312. (Corresponding author: Yulei Wu.)
Yulei Wu is with the College of Engineering, Mathematics and of anomaly detection tasks [27]–[35]. Given the nature of
Physical Sciences, University of Exeter, Exeter EX4 4QF, U.K. (e-mail: IIoT, where devices are interconnected and the interconnection
[email protected]). evolves as shown in Fig. 1, graph-level anomaly detection has
Hong-Ning Dai is with the Faculty of Information Technology,
Macau University of Science and Technology, Macau, China (e-mail: 1 https://www.actu-environnement.com/media/pdf/dossiers/831-sensus-
[email protected]).
Haina Tang is with the School of Artificial Intelligence, University smart-water.pdf
2 https://www.computerweekly.com/news/252468002/BA-IT-systems-
of Chinese Academy of Sciences, Beijing 100049, China (e-mail:
[email protected]). failure-results-in-cancelled-flights-and-delays-at-London-airports
Digital Object Identifier 10.1109/JIOT.2021.3094295 3 https://www.bbc.co.uk/news/business-53274914

2327-4662 
c 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.
Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9215

transportation, smart energy, and smart factory, respec-

tively.
The remainder of this article is organized as follows.
Section II illustrates IIoT and the potential types of anomalies
in IIoT. Section III summarizes some of the important GNN
models. Sections IV–VI provide the useful public data sets,
the GNN-based anomaly detection solutions, and research
challenges and open issues for IIoT-enabled smart transporta-
tion, smart energy, and smart factory, respectively. Section VII
shows case studies of using GNN in the above three industry
areas. Finally, Section VIII concludes this article.
Fig. 1. Evolving interconnection of graph data in IIoT.

II. I NDUSTRIAL I NTERNET OF T HINGS

In this section, IIoT will be first introduced, followed by
been a promising means to detect anomalies in many differ- the explanation of three types of anomalies in IIoT.
ent domains, such as transportation and energy, as well as for
dynamically evolving networks. A. Industrial Internet of Things
Graph neural networks (GNNs) [36]–[39] have recently
been fast developed to model complex patterns in graph- IIoT is a similar term to IoT but has different focus.
structured data, and are a promising graph-level paradigm to Different from IoT that focuses on consumer devices, IIoT
carry out anomaly detection. In general, the state of a node has its focus on industrial purpose with more sophisticated
is influenced by the states of its neighbors. Specifically, each and critical devices that are usually used in high-stakes indus-
node in GNN essentially aggregates the features of its neigh- tries, such as water, health, energy, and defence [44]–[46].
boring nodes and works out its own feature representation. Essentially, IIoT provides an infrastructure that connects the
According to different variants of GNN, their neighboring industrial sensors, instruments, and other industry devices
nodes that are considered in the process of feature aggregation through wired and/or wireless networks (e.g., industrial
are different. Graph convolutional networks (GCNs) consider Ethernet, WiFi, 5G [47], and the future networks such as
the one-step neighbors of a node when calculating its aggre- 6G [48]), and enables data generation and collection through
gated features [40], [41]. Graph attention networks (GANs) these connected devices [49]. More importantly, IIoT uses the
adopt an attention function so that neighboring nodes can be generated and collected data to carry out effective data ana-
assigned with different weights when being aggregated [42]. lytics (e.g., using AI techniques) and make useful decisions
In order to maximize the effects of GNN on anomaly detection that can automate business operations and increase industry
in different IIoT application areas, the unique characteristics profits [50]. Among these, data analytics is of paramount
of the IIoT applications need to be considered in the GNN importance [51]. The CBI Ministry of Foreign Affairs indi-
model. cated in its recent report that the new 5G technology will
There are few existing studies investigating GNN- allow more than 350 000 devices to be connected per square
empowered anomaly detection solutions, and most of them are kilometer—500 times more than comparable existing tech-
designed for a general scenario without an explicit considera- nologies.4 This, in turn, significantly challenges the techniques
tion of specific industrial applications, such as [43]. The main of data analytics for IIoT.
contributions of this article can be summarized as follows. IIoT has empowered multiple industrial applications, as
1) We provide a deeper understanding of the three types of shown in Fig. 2. Take smart energy as an example. Smart
anomalies, i.e., point, contextual, and collective anoma- energy systems consist of energy generation, distribution,
lies, in the context of specific IIoT applications. and energy consumption. Various energy sources include fuel
2) We explicitly bring the suitable GNN-based solutions power plants, nuclear power stations, hydro, wind, and solar
to the context of IIoT applications, in terms of smart energies. Energy has typically been transmitted in electric-
transportation, smart energy, and smart factory. The dis- ity via power lines from energy sources to substations, which
cussion and analysis can be treated as the basis for the then transmit and distribute electricity to various electricity
further investigation and research in this area. customers, including commercial, industrial, and residential
3) We provide the useful public data sets for each type customers. It is challenging to assure the reliability of the
of anomalies in each of the above IIoT applications, complex energy systems. The proliferation of IIoT nodes and
thereby facilitating the future research. wireless/wired communication technologies brings opportuni-
4) The research challenges and open issues of GNN- ties to address this challenge, since IoT nodes, sensors, and
empowered anomaly detection for IIoT-enabled smart smart meters can sense ambience and send the data to the
transportation, smart energy, and smart factory have been control center. However, the sensory data can be tampered or
identified. This can be hopefully useful for the future wiretapped during the transmission. In addition, faults/errors
research in advancing anomaly detection in IIoT. that occur at the energy systems need to be detected and
5) To demonstrate the use of GNN in concrete scenar- 4 https://www.cbi.eu/market-information/outsourcing-itobpo/industrial-
ios, we show three case studies in IIoT-enabled smart internet-things/market-potential

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9216 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

Fig. 2. IIoT with its applications.

reported to the control center, which then takes immediate structures, such as 2-D images and 1-D text data, while
actions. Similarly, faults and anomalies should be detected GNN can process non-Euclidean data, such as social media
at IIoT-enabled smart transportation and IIoT-enabled smart networks, 3-D images, and telecom networks, and the data in
factory/manufacturing, as shown in Fig. 2. many industry settings [53], [54]. GNN propagates the node
states in an iterative manner until reaching equilibrium, using
B. Types of Anomalies in IIoT a neural network. It outputs the state representation for each
Efficient anomaly detection is a crucial factor to ensure the node. Similar to the basic graph theory, one of the important
success of IIoT. In this section, the possible types of anomalies questions in GNN is to identify which parts of the data are
in IIoT will be presented [52]. nodes and which parts are edges. Then, the graph needs to be
1) Point: Point anomalies often refer to an irregularity that translated into the features for neural networks. Essentially,
happens randomly and may have no particular reason. For each node in GNN aggregates the features of its neighboring
instance, an egress port of a router/switch in an industrial nodes and works out its own feature representation. In recent
network with an instantaneous high volume of traffic seems a years, different variants of GNNs are being developed. Readers
point anomaly since it significantly deviates from the normal can refer to some survey papers that are dedicated for GNN
volume of traffic of this port. for more details [53], [55]–[58]. As the main contribution of
2) Contextual: A contextual anomaly (a.k.a. conditional our article focuses on the application of GNN on the anomaly
anomaly) represents an abnormal behavior happening within detection in different industry sectors, the specific details of
some specific context. This type of anomalies can be identi- GNN models will not be included. In this section, we will
fied by considering both contextual and behavioral features. briefly review some important variants of GNN that would
Time and space are usually used as the contextual features. be useful for facilitating the understanding of the rest of this
The behavioral features may be a pattern of network traffic, article.
e.g., the network traffic of an industry office at weekdays is
usually much higher than that at weekends. A. Graph Convolutional Networks
3) Collective: A collection of individual data points show- GCN is considered as one of the basic variants of GNN,
ing anomalies can be treated as collective anomalies. In this and thus, it shares some key features of GNN such as working
type of anomalies, each individual data point in isolation with non-Euclidean data. The way of how convolution works
appears as normal data instances while observed in a group in GCN is the same as that in CNN, where input neurons are
exhibit unusual behaviors. For example, the past five days multiplied by a set of weights (kernels). There are basically
at 1 A . M . the network traffic of an industry production line two types of GCN: 1) spectral GCN and 2) spatial GCN. The
is slightly higher than normal; this seems to be a potential spectral GCN can be treated as a message passing along the
case for collective anomalies. In addition, collective anoma- nodes within the graph. The convolutional operation calculates
lies may also happen when the program of IIoT devices is the eigen-decomposition of the graph Laplacian that helps to
patched/upgraded, but the controller that manages the behavior understand the graph structure [40]. It considers both node
of these devices is not upgraded. features and nodes connectivity as input features so that the
model can learn the features of neighboring nodes.
III. G RAPH N EURAL N ETWORKS As GCN does not consider the ordering of node neighbors,
GNN is a more generalized convolutional neural network it cannot handle the graph data with such features, e.g., some
(CNN). CNN can only handle the data with regular (Euclidean) IIoT data sets such as smart factory data have geometric

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9217

TABLE I
T YPES OF GNN S AND T HEIR A PPLICATIONS IN A NOMALY D ETECTION

interpretation of the graph that shows an order according (GGSNNs) used several GGNNs operating in sequence to pro-
to their spatial positions. To address this issue, the spatial duce an output sequence. Besides GGNN, graph recurrent
GCN was developed [59]. It uses the spatial features of nodes neural networks (GRNNs) [65] were also developed to analyze
to aggregate information from the neighboring nodes. Graph dynamic graphs.
sample and aggregate (GraphSAGE) [60] worked out the fea-
ture representation of a node by aggregating the features over a D. Jump Knowledge Networks
fixed-size neighboring nodes in an inductive manner. It works
Many GNN models, such as GCN, GAN, and GraphSAGE,
well on large-scale inductive benchmarks. In addition to spatial
use the fixed number of neighboring nodes to aggregate the
GCN, spatial–temporal GCN (STGCN) can characterize cor-
representation of a central node, either in one-hop neighbor-
relations of both spatial and temporal features, thereby being
hood or multiple hops. This may not work well in certain
used in smart transportation, smart energy, and smart factory.
circumstances depending on the graph structure. Xu et al. [66]
explored the jumping knowledge networks to develop a rep-
B. Graph Attention Networks
resentation learning on graphs, where each node can flexibly
GCN works for the situation where a node has the same leverage different neighborhood ranges (i.e., different num-
weights to all its neighboring nodes, i.e., each neighboring bers of neighboring nodes) to enable better structure-aware
node contributes equally to the calculation of the feature repre- representation.
sentation of the central node. However, there are certain cases,
where assigning different importance to each neighbor’s con-
E. Self-Enhanced GNN
tribution is needed when calculating the aggregated features
of the central node. Such cases include smart grid, IoT, and Most of GNN models focus on developing effective mod-
some biological networks. GAN [42] was then developed to els without considering the quality of the input data. To this
address this limitation of GCN. In this work, the model can end, Yang et al. [67] proposed a self-enhanced GNN model to
be applicable to inductive learning problems where the model improve the quality of the input data using the outputs of exist-
can generalize to unseen graphs. ing GNN models for enhanced performance on semisupervised
classification problems, hence being named self-enhanced.
C. Gated Graph (Sequence) Neural Networks In summary, Table I summarizes major types of GNNs and
their IIoT-applications in anomaly detection. It is worth men-
GCN and GAN focus on models that produce a single out- tioning that GNNs can be used for the three types anomalies,
put such as classification. However, many real-world problems namely, point, contextual, and collective anomalies.
require outputting a sequence, such as network planning [61]
and virtual network embedding [62]. To address this issue, gate
mechanisms, such as gated recurrent unit (GRU) [63] and long IV. II OT-E NABLED S MART T RANSPORTATION
short-term memory (LSTM) [64], are used in the propaga- We are experiencing the urbanization and the proliferation
tion step to improve the long-term propagation of information of various vehicles. It has been a hot topic to implement
in the graph. Li et al. [37] developed gated GNNs (GGNN) highly efficient intelligent transportation systems (ITSs) and
where they used GRU and unrolled the recurrence for a fixed develop autonomous vehicles (AVs), consequently realizing
number of steps T, and used backpropagation through time smart transportation [68]–[72]. Meanwhile, diverse traffic sen-
to compute gradients. Gated graph sequence neural networks sors, global navigation satellite system (GNSS), radar, loop

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9218 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

data. The training process of this model is composed of clean-

ing and classification. The cleaning phase mainly aims to clean
the noisy labels while the classification is to retrain the clas-
sifier based on the corrected labels. The experimental results
on UCSD data set [85] as well as other data sets demon-
strate the effectiveness of the proposed method. Meanwhile,
Yu et al. [74] proposed a Deep STGCN to predict traffic acci-
dents. The proposed STGCN consists of a spatial GCN layer
and a combined GCN-CNN spatial–temporal layer to extract
the correlated spatial features and the spatial–temporal fea-
tures, respectively. In addition, an embedding layer is also
adopted to give a semantic representation of external features.
They also conducted experiments on traffic data sets consist-
ing of vehicle traffic, weather conditions, and accident reports.
The experimental results further confirm the effectiveness of
Fig. 3. Anomalies in IIoT-enabled smart transportation. the proposed STGCN.

detectors, light detection and ranging (LIDAR), and infrared B. Contextual

(IR) cameras deployed at ITS and AVS also generate/collect Contextual anomalies depend on the available context
massive diverse types of traffic data, which can be used to attributes [88] in traffic data. For example, the event that a
analyze the traffic status and identify possible faults in trans- car is driving in a high speed in a highway can be regarded
portation systems. As shown in Fig. 3, the traffic anomalies as a normal event while it can be regarded as an anomaly in
include abnormal traffic congestion, traffic accident, damaged a dense road.
traffic infrastructure (e.g., a road). 1) Public Data Sets: There are a number of public traffic
Traffic anomaly detection plays a critical role in fostering data sets, including taxi data sets and ride-sharing services
the urban ITS [82]. In particular, traffic anomalies are often data sets. For example, the New York City (NYC) taxi
indicators of traffic accidents, traffic congestion, traffic viola- data set [89] contains records of time and locations of pick-
tions, and damaged traffic infrastructure [83]. The detection of up and drop-off of a taxi in NYC. The Uber Movement
traffic anomalies can help to rescue casualties, restore traffic, data set7 includes data samples, each of which contains the
and make an urgent repair on damaged roads [84]. Table II traveling time, a source, and a destination of Uber ride-sharing
summarizes the GNN-based solutions for smart transportation. services across multiple cities in USA. In addition, Chicago
We next present a detailed investigation on traffic anomaly taxi data set8 offers a similar data set for taxi services in
detection based on GNNs in smart transportation. Chicago; this data set consists of taxi trip records from January
1 to April 30, 2019 in the City of Chicago. However, most of
A. Point these data sets do not contain anomalies. Thus, many recent
studies such as [75] manually inject some anomalies into the
Point anomalies correspond to abnormal events, which devi- data sets, such as Uber Movement data set, NYC taxi data set,
ate from normal distribution. For example, a broken-down and Chicago taxi data set after following a similar approach
vehicle in a highway can be regarded as a point anomaly. to [90]. Moreover, some studies such as [76] integrate events
1) Public Data Sets: There are some recent studies on col- (e.g., accidents) into traffic data sets by crawling Microblog
lecting point-anomaly data sets and conducting analysis on data.9
these data sets. In particular, the work [85] presents a frame- 2) GNN Solutions to Anomaly Detection: It is a challenging
work to detection anomalies in crowds and also releases a task to conduct anomaly detection in multidimensional traf-
crowd data set collected from University of California San fic data. There are recent advances in addressing this issue.
Diego (UCSD) campus.5 The UCSD data set consists of 98 The work [75] presents a context-augmented graph autoen-
videos, each of which has 200 frames. Besides the abnormal coder (namely, Con-GAE) for anomaly detection in city traffic.
behaviors of crowds, there is another study [86] conducting an This framework exploits graph embedding as well as con-
anomaly detection on abnormal vehicle-moving patterns on top text embedding so as to extract spatial features from traffic
of the U-turn data set.6 The work [87] also summarizes other data. Extensive experiments on several representative data sets,
data sets for anomaly detection based on visual analysis. such as Uber Movement data set, NYC taxi data set, and
2) GNN Solutions to Anomaly Detection: There are some Chicago taxi data set, demonstrate the superior performance
recent studies in addressing anomaly detection in traffic of the proposed method over other baseline methods. As
and crowds. In particular, the work [73] presents a GCN- a type of traffic anomalies, accidents have also received
based method for anomaly detection based on noisy labels.
Specifically, GCN was used to remove noises from the labeled 7 https://movement.uber.com/
8 https://data.cityofchicago.org/Transportation/TaxiTrips/wrvz-psew
5 http://www.svcl.ucsd.edu/projects/anomaly/dataset.html 9 These data sets are available at https://github.com/zzyy0929/AAAI2020-
6 https://sites.google.com/view/ybenezeth/cvpr2009 RiskOracle/.

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9219

TABLE II
S UMMARY OF THE GNN-BASED A NOMALY D ETECTION S OLUTIONS IN II OT-E NABLED S MART T RANSPORTATION

extensive attention. The work [76] presents a differential time- Besides traffic accidents, extreme weather events also affect
varying GNN (DTGN) to analyze traffic data and achieve a the traffic. Wang et al. [80] investigated the transportation
minute-level accident forecasting. The DTGN is essentially resilience under extreme weather events based GNNs. In
an extension from GCN by incorporating time-varying overall particular, they propose a graph convolutional recurrent neu-
affinity and differential GCN. The experimental results vali- ral network (GCRNN) to predict the traffic patterns under
date the effectiveness of the proposed framework. Moreover, extreme weather events. Moreover, the authors also conduct
Zhou et al. [77] proposed a framework to predict traffic acci- experiments on DiDi Chuxing, i.e., an on-demand riding ser-
dents after considering both spatial–temporal features of traffic vice in China. The experimental results also demonstrate the
data and context factors. effectiveness of the proposed method.
In addition to vehicular transportation, the railway delay
analysis based on STGCN was also conducted in [81]. In par-
C. Collective ticular, the authors in this article adopt STGCN to predict
Collective anomaly refers to a situation that a collection cascading delays in the British railway, where cascading delays
of data samples is anomalous to normal values while each are also regarded as anomalies since they are often deviated
individual sample may be within a normal range. For example, from normal operations of railways. Although the authors do
the event that a fleet of vehicles is moving slowly in a high not provide the data set for their experiments, they explicitly
way can be regarded as a collective anomaly. describe the data collection approach to crawling the railway
1) Public Data Sets: There are several public traffic data from National Rail Enquiries Data Feeds.12 The experi-
data sets available for collective anomalies. Liu et al. [78] mental results also demonstrate the superior performance than
obtained a new anomaly data set based on NYC taxi other statistical methods.
data set [89] and NYC Bike data set10 after inserting a number
of anomalies based on anomaly reports of NYC. In addition, D. Challenges and Open Issues
the work [91] presents a study on detecting collective anoma- Although GNNs have shown their strengths in anomaly
lies in crowds based on the University of Minnesota (UMN) detection in smart transportation, there are still some chal-
data set, which contains videos of escaping scenarios.11 lenges that need to be well addressed before the formal
Moreover, the work [79] also conducts anomaly detection on adoption of GNNs in smart transportation. We next present
a data set obtained from social networks (e.g., traffic acci- several representative open issues as follows.
dent reports at Twitter), remote sensing data set and vehicle 1) Data Heterogeneity: In urban transportation systems,
accidents. there are multiple types of traffic data, such as videos
2) GNN Solutions to Anomaly Detection: There are several (from surveillance cameras), traffic speeds, crowd flows,
studies toward addressing anomaly detection in traffic data. In traveling time, etc. Moreover, external factors, such as
particular, the work [78] presents a spatiotemporal multimodal road structures and weather conditions, can also influ-
fusion model (ST-MFM) to extract features from multiple ence traffic flows [92]. It is challenging to train GNNs
crowd-flow data sets and predict anomalies. In the proposed to learn from heterogeneous traffic data.
ST-MFM, a GCN was adopted to extract spatial features. It 2) Imbalance of Traffic Anomaly Data: Most of public traf-
is worth mentioning that the authors also construct a new fic data sets only contain normal traffic data samples
anomaly data set based on anomaly reports, bicycle traffic, and while few of them provide traffic anomalies. Many stud-
taxi traffic. Extensive experiments also validate the effective- ies either manually inject traffic anomalies [75] or insert
ness of the proposed model. Moreover, the work [79] presents traffic anomalies through external sources from accident
a multimodal GNN to forecast traffic risks. In this frame- reports or social networks [78]. Compared with nor-
work, GANs were leveraged to further improve the forecasting mal traffic data samples, traffic anomalies only occupy
accuracy. Extensive experiments on a real-world data set con- a small portion of the entire data set. The imbalanced
structed from traffic accidents, social networks, and remote data set often leads to poor performance [93]. It is
sensing imagery also demonstrate the superior performance of a future direction to address the imbalanced traffic-
the proposed model. anomaly data.
3) Dynamics of Traffic Data: Both the road structure and
10 https://github.com/toddwschneider/nyc-citibike-data transportation infrastructure are suffering from dynamics
11 The UMN data set is available through https://www.crcv.ucf.edu/projects/
Abnormal_Crowd/ 12 https://www.nationalrail.co.uk/46391.aspx

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9220 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

due to multiple factors, such as removal, relocation, and happen in this complex energy infrastructure, efficient detec-
adding of road segments, intersections, and links. As a tion or prediction would save significant loss and even human
result, the well-trained GNN models based on massive lives. Since the integration of IIoT with smart energy systems
historical traffic data cannot well handle these new sce- becomes an inevitable trend, it is a necessity to assure the relia-
narios. Meanwhile, it also takes a long time to retrain bility and security of IIoT. Anomaly detection is a prerequisite
the entire GNN model. Thus, it is expected to address to assure reliable and secure IIoT systems, as faults, errors,
this emerging issue in the future, especially for anomaly abnormal behaviors, and malicious activities can be identi-
detection in smart transportation. fied to offer early warnings [99]. Table III summarizes the
GNN-based solutions for anomaly detection in smart energy.
We next enumerate the solutions for detecting anomalies in
V. II OT-E NABLED S MART E NERGY energy systems as follows.
The ever-growing global population drives the huge demand
on energy. However, the current energy supplies heavily A. Point
depend on fossil fuels, consequently bringing huge Carbon
Faults can happen at every stage from power genera-
dioxide (CO2 ) emissions to the atmosphere. The recent
tion to power consumption. The point anomaly in smart
renewable energies (REs), such as wind power, photovoltaic
energy system is often the event that diverges from normal
(PV) energy, and hydroelectric power, can provide alter-
measurements.
native energy sources to reduce the dependence on fossil
1) Public Data Sets: There are several public data sets
fuels [94]. The new REs sources also promote the revolu-
for point anomalies. In particular, the insulation at electricity
tionary upgrading of smart energy systems, which consist
transformers is a necessity to guarantee the safety of electric-
of distributed energy generation components, energy trans-
ity systems. As one of widely used insulation methods, the
mission, and energy consumption networks. However, both
oil-paper insulation often suffers from aging and dissolving.
decentralization and complexity of the system also pose chal-
The discharge faults or thermal faults at the transformers can
lenges of maintaining the reliability, safety, and security of
fasten the dissolving process of oil-paper insulators. Since the
smart energy systems.
dissolved process of oil-paper insulators also emits chemical
The recent advances of IIoT bring opportunities to address
gas, such as C2 H2 , C2 H4 , and C2 H6 , the analysis of dissolved
the challenges of smart energy systems. First, the wide adop-
gas can be used to detect insulation faults at transformers.
tion of IIoT can establish the advanced metering infrastructure
Li [110] presented a dissolved-gas data set offered by State
(AMI) for energy systems. AMI equipped with sensors, smart
Grid Corporation of China (SGCC). This data set contains a
meters, and controllers can measure the energy data from
number of point anomalies, which deviate from normal values.
energy generation to energy consumption so as to provide
2) GNN Solutions to Anomaly Detection: There are sev-
better services [95]. Second, REs sources often suffer from
eral studies toward solving anomaly detection. In particular,
unstable energy supply due to the fluctuated weather condition
as shown in [111], there are strong correlations between the
(e.g., wind and drought). Thus, the auxiliary energy storage
emitted gases and the fault types of transformers. However,
devices are often accompanied by REs sources to balance
it is challenging for traditional machine learning models to
the supply while IoT devices deployed at both energy stor-
characterize the complex nonlinear relationship between the
age devices and REs sources can measure the voltage level to
types of dissolved gases and the types of transformer faults.
balance the entire system [96].
The recent study [100] proposes using GCNs for analyzing
Fig. 4 shows an IIoT-enabled smart energy industry. The
the nonlinear relationship mapping from the types of dissolved
energy comes from a wide range of sources, including coal,
gases to the types of transformer faults. Extensive experiments
hydro, wind, natural gas, nuclear, solar, and so on, forming a
on the above dissolved-gas data set demonstrate a much higher
complex infrastructure for the energy industry. The data gen-
diagnostic accuracy than other conventional machine learning
erated and/or collected by IIoT devices at each source site
methods.
can be first processed by edge AI (i.e., edge computing and
Besides the fault detection of transformers, GNN can also
AI processing models) [97] and the results can be uploaded
be used for fault classification in PV arrays as in [101]. As one
to the cloud AI (i.e., cloud computing and AI models) for
of the main RE sources, PV panels have been widely deployed
further processing [98]. Alternatively, local IIoT data at each
in harsh environments causing faults of PV arrays. However,
site can be partitioned and uploaded to both edge AI and
it is challenging to achieve automatic detection of the faults of
cloud AI for processing, according to the application needs
PV arrays. Specifically, a spatial GCN is adopted in [101] for
and the computing capacity at the edge. Data analysis in such
detecting PV faults with a limited number of labeled samples.
an energy industry can benefit many aspects of business oper-
ations, e.g., balancing the energy requirement between energy
sources, adjusting energy demands of a source site in the event B. Contextual
of an anomaly happening at another source site, and facilitat- Smart energy systems often consist of sensors, smart meters,
ing the strategic policy changes such as reducing the nuclear and phasor measurement units (PMUs) [112], which are
energy demands. However, if the collected/generated data are interconnected through power line communications and wire-
tampered, the resulting decision from the data analysis may less communications. These IIoT devices can collect and
harm the business operation. In addition, if certain faults would generate massive smart energy data, which can be used

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9221

Fig. 4. IIoT for an energy industry.

TABLE III
S UMMARY OF THE GNN-BASED A NOMALY D ETECTION S OLUTIONS IN II OT-E NABLED S MART E NERGY

to analyze faults, errors, and abnormal customer behaviors. work [102] presents a study on power outages in NYC influ-
Contextual anomalies in smart energy refer to data samples, enced by weather conditions. In particular, this study collects
which are anomalous to the remaining data samples in a cer- the energy information administration (EIA) energy distur-
tain context. For example, an extremely high temperature of bance events (containing outages) occurred from January 2011
a power line in winter can be regarded as an anomaly but to December 2013 among 26 304 data samples14 as well as
be regarded as a normal value in summer. For another exam- weather measurement data according to historical observa-
ple, some malicious activities on energy consumption may be tions15 at the same period and weather stations at the same
regarded as normal while the given reference electricity con- region. Moreover, the work [113] presents a labeled energy-
sumption can help to detect the abnormal energy consumption consumption data set from 500 energy customers in Ireland16
behaviors [113]. though the labeled data set is not officially released (available
1) Public Data Sets: There are some public data sets avail- upon request to the authors).
able for contextual anomalies. In particular, the work [114] 2) GNN Solutions to Anomaly Detection: There are several
presents a study on investigating electricity thefts, whose elec- attempts in applying GNNs in contextual anomaly detec-
tricity consumption is essentially anomalous to other normal tion. In particular, the work [102] leverages GCN [103] to
electricity customers. The abnormal behaviors of electricity learn from weather measurement data to predict the power
thefts include no obvious periodicity of electricity consump- outages at a given region. The power-outage problem is con-
tion in contrast to normal customers. The electricity-theft verted into a contextual-anomaly detection problem, which
data set13 was adopted in this study that was released by is modeled by a graph, in which weather stations are nodes
SGCC, which contains the electricity consumption data of
42 372 electricity customers within more than two years 14 From January 2011 to December 2013 https://wwweia.gov/electricity/
(from January 1, 2014 to October 31, 2016). Meanwhile, the monthly/
15 http://wcai.wharton.upenn.edu/earth-networks-data-portal/
13 https://github.com/henryRDlab/ElectricityTheftDetection/ 16 https://www.ucd.ie/issda/data/commissionforenergyregulationcer/

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9222 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

faults can be regarded as collective anomalies. Conventional

CNN methods cannot be applied to solve this problem because
the spatial-fault data in power distribution networks is no
longer falling into the Euclidean domain. Therefore, this article
applies a GCN framework to address this problem. In partic-
ular, the load (i.e., voltage and current) of each node (i.e., a
bus) in the IEEE 123 bus system is measured. The measured
data are then converted to a weighted undirected graph, which
is then fed into GCN for further training, as shown in Fig. 5.
Fig. 5. GNN for fault location (reproduced from [106]). The experimental results demonstrate the effectiveness of the
GCN model in localizing faults. The GCN model adopted in
this article is essentially obtained from [107]. Another simi-
and an edge represents the correlation of the measurements lar work [108] investigates the adoption of GCNs for power
between the two weather stations. The authors also manu- flow calculation based on IEEE Case 69 data. Although this
ally label the power outage event at each weather station (i.e., study mainly focuses on deriving distribution characteristics
occurred or not). Three variants of GCNs, clustering, selection of power flows, the main methodology can be further used
GCN, and aggregation GCN that are considered in this article for anomaly detection in the future. Moreover, the work [109]
demonstrate the superior performance than conventional neu- integrates GCN with an LSTM network to construct the recur-
ral networks. Moreover, the work [104] proposes a GCN-based rent GCN (RGCN). Experiments on both IEEE 39 Bus and
method for context anomaly detection (fault detection). In IEEE 300 Bus system verify the effectiveness of the proposed
particular, a structural analysis was first used to convert predi- RGCN model for collective anomaly detection so as to ensure
agnose results into graphs. Both graphs and measured data sets the stability of power grids.
are fed into the GCN for the fault detection. Experiments
were conducted on open-circuit fault data sets to evaluate
the performance of the proposed method. Furthermore, a
STGCN-based approach was proposed in [105] to investi- D. Challenges and Open Issues
gate the short-term voltage stability with consideration faults Despite the advances in applying GNNs in IIoT-enabled
(i.e., context anomalies). Realistic experiments on Guangdong energy systems, there are a number of challenges and open
Power Grid were conducted to evaluate the proposed issues to be solved in the future study. We enumerate several
method. major research problems as follows.
1) Highly Reliable GNNs for Smart Energy Systems: Smart
C. Collective energy systems have a critical requirement on the relia-
Collective anomalies are a collection of data samples, which bility of power systems. However, most of existing GNN
are anomalous to the entire data set. Regarding smart energy models cannot reach a quite high accuracy to ensure
systems, collective anomalies can happen at energy generation, the high reliability for the entire system though they
energy transmission, and energy consumption. can assist incumbent systems to identify anomalies and
1) Public Data Sets: There are several public data sets faults.
available for collective-anomaly detection in smart energy 2) Explainable GNNs for Smart Energy Systems: Like other
systems. The IEEE 123 bus is a typical benchmark system deep neural networks, the explainability of GNNs is
for node test feeders in power systems [115]. In addition to still not well explored, consequently limiting the wide
the IEEE 123 bus system, IEEE 39 bus system [116]–[118], adoption of GNNs in industrial systems, especially for
the IEEE 14 bus system [119], the IEEE 118 bus system, and smart energy systems, which have critical requirements
the 68-bus 16-machine 5-area system [120] are alternative bus on the explainability of models. It is worth investigating
systems for power grid though there are few studies on apply- explainability of GNNs in the future [122].
ing GNNs for anomaly detection on them. Most of the above 3) Integration of Multiple GNNs for Smart Energy Systems:
studies need to conduct simulations to obtain measured data. There are diverse types of energy data in smart energy
In addition to the above power grid systems, the work [121] systems. For example, historical electricity consumption
also presents a measurement study on micro-PMU sensors data often have the temporal correlation across data sam-
deployed in smart grid. In particular, the data set adopted for ples while fault-location data in smart grid have the
this study is collected from a distribution grid of the Lawrence spatial correlation. To process and analyze the diverse
Berkeley National Laboratory (LBNL).17 types of energy data (having both temporal and spa-
2) GNN Solutions to Anomaly Detection: There are several tial features), the integration of multiple GNNs, such as
recent advances in exploring GNNs for collective anomaly GCNs with GRNN, is a necessity in the future.
detection. The work [106] adopts a GCN to localize faults 4) Deployment of GNNs in Smart Energy Systems: It takes
in power distribution networks. This fault-location problem extensive computational power to train complex GNN
is essentially collective-anomaly detection, in which multiple models. Since smart meters and IIoT nodes have limited
computing capability, they may not be suitable for train-
17 LBNL open power data: https://powerdata.lbl.gov/ ing GNN models. Thus, it is a necessity to train GNN

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9223

CPU usage, as the behaviors of some variables are interrelated

in nature. In addition, point anomalies may also be the ones
that are immediately observed without taking into account the
temporal behavior. Such anomalies may not be detected in real
time but would need to be detected effectively so as to avoid
the “butterfly effect” to slow down or malfunction the whole
manufacturing system.
1) Public Data Sets: Most of the available public data sets
can be used for the detection of point anomalies although
they are mainly used for detecting other types of anomalies.
Singapore’s Centre for Research in Cyber Security published
a set of data sets for the research of anomaly detection in
secure water treatment (SWaT) and water distribution (WADI)
systems.18 They are maintaining four testbeds: 1) electric
power intelligent control (EPIC); 2) IoT automatic security
testbed (IoTAS); 3) SWaT; and 4) WADI. SWaT is the data set
Fig. 6. Anomaly detection in smart factory. collected from continuous operations in the testbed in 11 days,
where seven days were under normal operations and four days
were under attack scenarios. There were 41 attacks launched
models at remote cloud servers while the trained mod- and the associated abnormal behaviors were labeled. WADI
els can be downloaded to local edge computing nodes is a similar data set collected from a different testbed, with
or IIoT nodes for consequent anomaly-detection tasks. 16 days of continuous operations (two days were under attack
scenarios with 15 types of attacks, the rest days were with
VI. II OT-E NABLED S MART FACTORY normal operations). The data were collected from 123 sensors
and actuators. There is another data set named critical infras-
In recent years, with the fast development and deploy-
tructure security showdown (CISS) that is aimed at detecting
ment of 5G and IoT/IIoT [132]–[134], traditional factory and
cyber attacks launched in real time on SWaT.
manufacturing environment is carrying out its digital trans-
2) GNN Solutions to Anomaly Detection: Point anoma-
formation. While such a transformation brings benefits for
lies in smart factory and manufacturing environment can be
economics, the security of the industry systems is being chal-
detected using many techniques, such as bound/limit check-
lenged [135]–[137]. This is largely due to the weakness and the
ing, rule based, clustering, and classification [140]. Many
lack of security considerations of traditional industry systems.
machine learning and deep learning techniques have been
Anomaly detection is an important tool to ensure an effective
used to extract anomaly detection rules and then detect point
identification of anomalous system behaviors in smart facto-
anomalies, including traditional CNN and LSTM. Due to the
ries [138], [139]. Fig. 6 shows several typical anomalies, such
incapability of capturing the non-Euclidean data in many real-
as an overheated lathe, defected products, flaws with the pack-
world manufacturing scenarios, GNN-based solutions have
age, and other faults. Follow-up maintenance actions can be
been proposed.
performed in time to ensure the healthy of the operation and
Due to the popularity of one class support vector machine
production systems. In this section, the three types of anoma-
in detecting outliers, Wang et al. [123] generalized it to graph
lies, i.e., point, contextual, and collective anomalies, in the
data and proposed one class GNN (OCGNN) that is a one class
context of IIoT-enabled smart factory and manufacturing will
classification framework for detecting anomalies in graph data.
be illustrated and how GNN can enable an effective anomaly
OCGNN can achieve the well-known one class objective using
detection in this context will be elaborated. The challenges
the powerful representation ability of GNN.
and open issues will be provided and discussed for guiding
For the concern of multiple variables in a time-series data,
the future research in this field. A summary of this section is
Deng and Hooi [124] proposed a structure learning approach
provided in Table IV.
in combination of GNN and used attention weights to provide
explainability for the detected anomalies. The proposed solu-
A. Point tion can handle high-dimensional time-series data. Especially,
Point anomalies are the ones that are observed anomalous it is able to capture the complex intervariable relationships,
with respect to the rest of the data in the factory/manufacturing and detect the deviation from the normal relationships.
system without any prior indication. Such anomalies may be In addition, Zhao et al. [125] also addressed the anomaly
manifested in a single variable of a factory component, e.g., a detection on multivariate time series. They proposed a self-
meter reading. For example, in a time-series temperature data supervised approach where each univariate time series was
for a manufacturing machine, a point anomaly may refer to treated as an individual feature, and two graph-attention layers
an anomalous reading returning to its previous normal state were used in parallel to learn the dependencies of multivariate
within a very short period. They may also be observed in time series in both feature and temporal dimensions.
multiple variables of a component where all the related vari-
ables are out of bounds at the same time, e.g., temperature and 18 https://itrust.sutd.edu.sg/itrust-labs_datasets/dataset_info/

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9224 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

TABLE IV
S UMMARY OF THE GNN-BASED A NOMALY D ETECTION S OLUTIONS IN II OT-E NABLED S MART FACTORY

B. Contextual this purpose, the modeling purpose shall shift to finding the
The smart factory and manufacturing system usually con- relationship among multiple variables.
sists of a considerable number of sensors, instruments, and To comprehensively consider all possible structural, context,
other IoT devices interconnected to achieve many produc- and temporal features in anomaly detection, Zheng et al. [126]
tion purposes. Certain components may also connect with proposed an end-to-end anomalous edge detection framework,
other systems in the factory, across factories, or even a third- called AddGraph, based on an extended temporal GCN with
party system. With such a distributed environment, accurate the attention mechanism. The proposed model can capture both
anomaly detection shall consider contextual information. Such short-term and long-term patterns in dynamic graphs.
information may include temporal context, spatial context, and Statistical features of the data, such as network traffic, are
external context [141]. The temporal context is the one that very important for detecting contextual anomalies, but they
is usually shown in the time-series data where the temporal were usually carried out manually using expert knowledge. To
correlation exists between observations. The spatial context avoid manual extraction of statistical features, Xiao et al. [127]
usually refers to the position information of the devices where developed an approach with two graphs: 1) first-order graph
the spatial correlation exists when the devices are working and 2) second-order graph. The former learns the latent fea-
together to carry out one task in the production environment. tures from a single entity, such as a host or a variable, and the
The external context explains how the externally connected latter learns the latent features from a global point of view. The
systems affect the internal monitoring system. For example, automatically extracted features can be used to train machine
temperature control of a production system might be related learning models for classifying network anomalies.
to the weather condition outside the factory. The weather con- A graph-based method was proposed in [128] to learn
dition could be measured by additional sensors from outside dependencies between variables in time-series data. Nodes in
of the building. the graph represent individual observations or sequences of
1) Public Data Sets: Both SWaT and WADI data sets observations, where the weighting of the link between nodes
mentioned in Section VI-A1 contain the contextual data as represents the degree of dependencies on other nodes. Low
well. Supervisory control and data acquisition (SCADA) is an weighting shows that node is flagged as anomalous.
important control and data collection mechanism in the indus-
trial system. BATADAL data are the data on hourly historical C. Collective
SCADA operations.19 It contains three data sets, where the
Different from the contextual anomalies, which focus on
first one contains the data for one-year-long normal opera-
a data instance, collective anomalies essentially are a collec-
tions, and the second and the third ones contain the data with
tion of related data instances where they are anomalous as a
14 attacks. The Xcos software20 developed by SciLab is an
group with respect to the entire data set. Note that the indi-
open-source software that can design hybrid dynamical system
vidual data instance in a collective anomaly may not show
models with the functionalities for modeling of mechanical
abnormal behaviors but their occurrence as a group exhibits
systems (e.g., automotive and aeronautics), hydraulic circuits
the anomalous behavior. For example, in an industry setting,
(e.g., dam and pipe modeling), control systems, etc. This
the memory usage of a server may be normal individually
software can be used to general industrial operational contex-
compared with the historical records. But if the pattern of
tual data [142]. Meanwhile, epanetCPA21 is an open-source
the memory consumption, as time goes, meets certain crite-
MATLAB toolbox for modeling the hydraulic response of
ria, it could show a memory leak as result of a collective
WADI systems to cyber–physical attacks. It can be used to
anomaly. In addition, on the way toward Industry 4.0, many
generate contextual data set for anomaly detection.
industry devices/sensors will adopt machine learning mod-
2) GNN Solutions to Anomaly Detection: Some of the
els to make autonomous decisions. Some potential ethical
methods mentioned in Section VI-A2 for anomaly detection
issues may surface, resulting from a collection of sensors
on multivariate time-series data can also be adopted here for
collectively behaving some anomalous actions, e.g., mak-
detecting contextual anomalies (e.g., [124], [125]). To achieve
ing bias decisions. This can also be treated as collective
19 http://www.batadal.net/data.html anomalies.
20 https://www.scilab.org/software/xcos 1) Public Data Sets: The Xcos software and the epanetCPA
21 https://github.com/rtaormina/epanetCPA tool mentioned in Section VI-B1 can be used to generate

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9225

collective data sets for anomaly detection. In addition, Denial- 2) Combination of Point, Collective, and Contextual
of-Service/Distributed Denial-of-Service (DoS/DDoS) attack Anomalies: It is more challenging for anomaly detec-
is a good example of collective anomalies. LITNET-2020 is tion if a combination of types of anomalies shows,
an annotated network benchmark data set obtained from the such as detecting collective contextual anomalies.
real-world academic network. It contains 85 network flow Dou et al. [144] proposed a framework for discov-
features of the data set and 12 attack types. “M2M Using ering this type of anomalies in multiple time series
OPC UA” [143] is a data set generated by injecting vari- based on a combination of several techniques, including
ous attacks on a OPC UA-based cyber–physical production deep learning, time-series modeling, and graph analy-
systems testbed. The attacks include DoS, eavesdropping, sis. In addition, a recent study used graph autoencoders
or man-in-the-middle attacks, and impersonation or spoof- for group anomaly detection, where graph representa-
ing attacks.22 “WUSTL-IIoT-2018” is a data set used for the tion learning is achieved to detect collective anomalies
SCADA cybersecurity research, where the attacks include port by exploiting their graph structures.25 The research in
scanner, address scan, device identification, device identifi- this horizon is still in its infancy especially in the
cation (aggressive mode), and exploit.23 It is also a useful field of anomaly detection in the smart factory and
data set for carrying out the research of the detection on col- manufacturing.
lective anomalies. In addition, the KDD 1999 data set24 has 3) Working With Other Machine Learning Techniques:
also been widely used to validate the effectiveness of collective GNN is a model to effectively learn the node repre-
anomaly detection algorithms. sentation. This representation can then be used to work
2) GNN Solutions to Anomaly Detection: Jiang et al. [129] with other machine learning and deep learning tech-
devised a GCN-based anomaly detection model that can cap- niques for carrying out anomaly detection. Factory and
ture the entities’ properties and structural information between manufacturing environment is complex. It is important
them into graphs. With the proposed model, both abnormal to carefully consider the output of GNN and the input
behaviors of individuals and the associated anomalous groups of other machine learning models for more effective and
can be detected. accurate anomaly detection.
Botnets are a major source for DoS/DDoS attacks, which
can result in collective anomalies. Zhou et al. [130] developed VII. C ASE S TUDIES
a GNN-based approach to detect the hierarchical structure of
centralized botnets and the fast-mixing structure for decen- In this section, we present several representative case stud-
tralized botnets. The outcome will then be used for learning ies to illustrate how GNN-based models work for anomaly
policies for automatic botnet detection. detection.
Protogerou et al. [131] developed a multiagent system to
exploit the collaborative and cooperative nature of intelligent A. STGNN-Based Model for Detecting Collective Anomalies
agents for anomaly detection. Each agent will be implemented in Public Transportation System
using a GNN that can learn the representation of physical The collective anomalies in public transportation systems
networks. This distributed detection approach can carry out are often the root cause of traffic jams. It is a necessity to
the efficient monitoring of the entire network infrastructure and detect traffic anomalies in public transportation systems though
can be treated as a potential candidate solution for detecting it is often a challenging task since traffic anomalies are affected
collective anomalies. by multiple factors, such as accidents, gathering, criminals,
and public events. However, existing deep learning models
D. Challenges and Open Issues can either capture spatial features (e.g., road structures) or
Although GNN has been used for enhancing the temporal features (e.g., number of vehicles across a road per
performance of anomaly detection in smart factory and man- hour), but not both. Thus, GNN-based models have potential
ufacturing systems, there are still several challenges and open to address this challenge since they have strong capability to
issues that need to investigate in future studies. learn from spatial–temporal features together.
1) Effectiveness of GNN Modeling: Some data have a clear We will next demonstrate that an STGNN-based model can
indication of node and link representation in GNN, while be used for detecting collective anomalies in a public trans-
some may be not that straightforward. For example, portation system. Fig. 7 depicts the proposed STGNN for
the node in GNN can directly model the node in an traffic anomaly detection. The proposed method works in the
industrial device/sensor, and the edge is the relationship following three steps.
between devices. In addition, the node in GNN could In step 1, we need to obtain historical traffic-flow data
model a variable in a data set, and the edge is the rela- from the public transportation system. The traffic-flow data
tionship between variables. It is still an important issue include station ID, station location, and historical crowd flows
that which part of the data is the node in GNN and at a certain station and a certain time. The crowd flows can
which part is the edge. be essentially obtained by check-in/out records (i.e., recorded
by NFC-based tokens or cards) of the public transportation
22 https://ieee-dataport.org/open-access/m2m-using-opc-ua system. In particular, we denote the incoming crowd flows
23 https://www.cse.wustl.edu/ jain/iiot/index.html
24 http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html 25 https://grlearning.github.io/papers/85.pdf

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9226 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

Fig. 7. Spatial–temporal GNN for traffic anomaly detection in public transportation systems.

be regarded as point anomalies for analysing faults of power

transformers.
We, therefore, design a GCN-based model for detecting
point anomalies in power transformers. Fig. 8 depicts the
working flow of this model for anomaly detection of power
transformers. First, we can obtain historical DGA data from
public data sets such as [110]. After applying the Siamese
network and k-nearest neighbor (kNN) approaches, we can
generate the well-formed input data sets, which consist of
Fig. 8. GCN for power transformer anomaly detection. (S, A), where S represents the feature matrix of dissolve gases
and A denotes the adjacency matrix (i.e., characterizing the
similarity between historical samples and current samples).
at a station Ti by Cin,Ti and the outgoing crowd flows at We then feed the input data sets into a GCN, as shown in
Ti by Cout,Ti . In addition, we can obtain traffic anomalies Fig. 8. The benefits of using the GCN instead of conventional
from historical records of accidents, gathering events, crim- CNNs or other machine learning methods lie in the strong
inal reports, and other public events. The anomaly data need learning capability of GCNs in characterizing the nonlinear
to be associated with the crow-flow data according to the correlations between the types of dissolved gases and the types
spatial–temporal correlations. In step 2, we need to convert of transformer faults. Our GCN consists of three layers of
traffic-flow data into graphs (e.g., incidence graphs), which can graph convolution layers (each of which is denoted by Graph
be further processed by our STGNN. Meanwhile, historical Conv). In particular, we have
anomalies need to integrated with the traffic flows. In step 3,  
we then construct the STGNN, which consists of multiple lay- Conv(i) = g Conv(i − 1), A (1)
ers. The first GNN layer is used to capture the spatial features
where g(·, ·) denotes a nonlinear function, i ∈ {1, . . . , N}, and
while the second LSTM layer is used to extract temporal fea-
N denotes the number of graph convolution layers. When i =
tures from the historical traffic flows. We next adopt another
1, Conv(1) = g(S, A).
GNN layer to further explore the spatial–temporal dependen-
Meanwhile, we also add a dropout-based hidden layer and
cies obtained by the first two layers. We finally predict (i.e.,
a rectified linear activation unit (ReLU) between two adjacent
classify the anomalies from normal traffic flows) after passing
graph convolution layers so as to avoid overfitting and improve
the spatial–temporal features by a CNN layer.
learning effect. Finally, we apply a softmax function to final-
It is worth mentioning that this general framework can be
ize the classification results O after passing through a fully
further extended by replacing neural modules by other vari-
connected layer (i.e., Full Conn).
ants to further improve the performance. For example, we can
We will explore the usage of GCN and other GNN models
replace the LSTM module by a GRU. Meanwhile, the atten-
in anomaly detection in other smart energy systems, such as
tion mechanism can be also leveraged to improve the learning
REs, since GNN models have the strengths in capturing spa-
effectiveness.
tial correlations whereas there may exist spatial correlations
amount multiple REs.
B. GCN for Detecting Point Anomalies in Power
Transformers C. GCN-Based Model for Detecting Collective Anomalies in
Since power transformers play an important role between the Smart Factory
power transmission and power distribution, the reliability of Collective anomalies in a smart factory are usually not easy
power transforms is crucial for the safety assurance of elec- to detect. That is because, first, there are massive IIoT devices,
tricity systems. The faulty transformers emit huge amount and second, individual devices seem to function as normal but
of dissolved gases, such as C2 H6 , C2 H2 , and C2 H4 , which the behavior of many IIoT devices as a whole is abnormal.
are indicators for transformer faults. The dissolved gases can In this section, we will elaborate a concrete example of how

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9227

VIII. C ONCLUSION
This article provided a useful investigation for GNN-
empowered anomaly detection solutions for IIoT-enabled
smart transportation, smart energy, and smart factory. In partic-
ular, a deeper understanding of three types of anomalies, i.e.,
point, contextual, and collective anomalies, in the context of
above IIoT applications was provided. In addition, the useful
public data sets were provided for each type of anomalies in
the corresponding IIoT applications. Furthermore, important
Fig. 9. GCN for anomaly detection in smart factory. research challenges and open issues of GNN-based anomaly
detection solutions for the three investigated IIoT applications
were provided and discussed. Finally, we show three case
GNN can be used to detect collective anomalies in the smart studies of the use of GNN in addressing anomaly detection
factory. problems in IIoT-enabled smart transportation, smart energy,
In a smart factory as shown in Fig. 9, PLC is an industrial and smart factory. We hope that this article provides useful
digital computer that is designed for the control of man- guidance for the future research in this area.
ufacturing processes. Each PLC is associated with several
IIoT devices, and a PLC is often networked to other PLC. R EFERENCES
IIoT devices usually need to be patched due to, e.g., security [1] Y. Wu, H.-N. Dai, and H. Wang, “Convergence of blockchain and
reasons. Collective anomalies may happen when the pro- edge computing for secure and scalable IIoT critical infrastructures in
gram of several IIoT devices, such as environmental control industry 4.0,” IEEE Internet Things J., vol. 8, no. 4, pp. 2300–2317,
Feb. 2021.
devices and robot control devices, is changed/patched but the [2] D. Wang, “An enterprise data pathway to industry 4.0,” IEEE Eng.
corresponding programmable logic controller (PLC) is not Manag. Rev., vol. 46, no. 3, pp. 46–48, Sep. 2018.
upgraded. [3] N. Zhang, Y. Li, Y. Wu, and Q. Zhang, “Guest editorial: Ai empow-
ered communication and computing systems for industrial Internet of
Many traditional anomaly detection methods only consider Things,” IEEE Trans. Ind. Informat., vol. 17, no. 7, pp. 4914–4916,
the features of IIoT devices or PLC. However, in order to Jul. 2021.
detect collective anomalies, the relationships between IIoT [4] Y. Wu, Z. Wang, Y. Ma, and V. C. Leung, “Deep reinforce-
ment learning for blockchain in industrial IoT: A survey,” Comput.
devices or PLC are also important. GNN is a good candidate Netw., vol. 191, May 2021, Art. no. 108004. [Online]. Available:
to capture such relationships, and thus, it has the potential to https://www.sciencedirect.com/science/article/pii/S1389128621001213
effectively detect collective anomalies. [5] G. Culot, F. Fattori, M. Podrecca, and M. Sartor, “Addressing industry
4.0 cybersecurity challenges,” IEEE Eng. Manag. Rev., vol. 47, no. 3,
In this case study, we resort to a typical example of GNN pp. 79–86, Sep. 2019.
and GCN for the detection of collective anomalies. First, [6] R. D. Raut, A. Gotmare, B. E. Narkhede, U. H. Govindarajan, and
we transform the industrial communication network and the S. U. Bokade, “Enabling technologies for industry 4.0 manufacturing
and supply chain: Concepts, current status, and adoption challenges,”
behaviors of IIoT devices and PLC into a graph. The nodes of IEEE Eng. Manag. Rev., vol. 48, no. 2, pp. 83–102, Jun. 2020.
the graph denote the IIoT devices and PLC, as well as other [7] P. Patel, M. I. Ali, and A. Sheth, “From raw data to smart manufac-
possible factory devices, and the edges between nodes are the turing: Ai and semantic Web of Things for industry 4.0,” IEEE Intell.
Syst., vol. 33, no. 4, pp. 79–86, Jul./Aug. 2018.
structural information of these devices. [8] W. Liang, W. Huang, J. Long, K. Zhang, K.-C. Li, and D. Zhang,
Then, we can design a GCN-based anomaly detection “Deep reinforcement learning for resource protection and real-time
model. It can be an n-layers GCN model with a softmax layer detection in iot environment,” IEEE Internet Things J., vol. 7, no. 7,
pp. 6392–6401, Jul. 2020.
to train a binary classification model for “normal” and “abnor- [9] Z. Cai and Z. He, “Trading private range counting over big IoT data,”
mal.” A softmax activation function, shown in (2), can be used in Proc. IEEE 39th Int. Conf. Distrib. Comput. Syst. (ICDCS), 2019,
to calculate the classification of each node pp. 144–153.
[10] Y. Liu et al., “Deep anomaly detection for time-series data in indus-
trial IoT: A communication-efficient on-device federated learning
ezi approach,” IEEE Internet Things J., vol. 8, no. 8, pp. 6348–6358,
zi ) = 2
σ ( (2) Apr. 2021.
zk
i=1 e [11] Y. Liu, N. Kumar, Z. Xiong, W. Y. B. Lim, J. Kang, and D. Niyato,
“Communication-efficient federated learning for anomaly detection in
industrial Internet of Things,” in Proc. IEEE Global Commun. Conf.
where σ denotes the softmax, zi represents the input vector, GLOBECOM, 2020, pp. 1–6.
ezi is the standard exponential function for the input vector, [12] B. Genge, P. Haller, and C. Enächescu, “Anomaly detection in aging
and ezk is the standard exponential function for the output industrial Internet of Things,” IEEE Access, vol. 7, pp. 74217–74230,
2019.
vector. The input of the GCN model is the graph containing [13] P. Sun et al., “Context-aware learning for anomaly detection with
the IIoT devices and PLC as the nodes with features, and the imbalanced log data,” in Proc. IEEE 22nd Int. Conf. High Perform.
connections between nodes as edges of the graph. In practice, Comput. Commun. IEEE 18th Int. Conf. Smart City IEEE 6th Int. Conf.
Data Sci. Syst. (HPCC/SmartCity/DSS), 2020, pp. 449–456.
the inputs are two matrices, one is the node feature matrix [14] Y. Guo, Y. Wu, Y. Zhu, B. Yang, and C. Han, “Anomaly detection
and the other is the node adjacency matrix. Batch gradient using distributed log data: A lightweight federated learning approach,”
descent can be used to train the weights of the GCN model. in Proc. Int. Joint Conf. Neural Netw. (IJCNN), 2021, pp. 106–116.
[15] H. Cao, H. Tang, Y. Wu, F. Wang, and Y. Xu, “On accurate computation
The GCN model can output the binary classification of normal of trajectory similarity via single image super-resolution,” in Proc. Int.
and abnormal for each node. Joint Conf. Neural Netw. (IJCNN), 2021, pp. 1–9.

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9228 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

[16] Y. Wu, Y. Ma, H.-N. Dai, and H. Wang, “Deep learning for privacy [38] H. Wang, Y. Wu, G. Min, and W. Miao, “A graph neural network-
preservation in autonomous moving platforms enhanced 5G heteroge- based digital twin for network slicing management,” IEEE Trans. Ind.
neous networks,” Comput. Netw., vol. 185, Feb. 2021, Art. no. 107743. Informat., early access, Dec. 29, 2020, doi: 10.1109/TII.2020.3047843.
[Online]. Available: https://www.sciencedirect.com/science/article/pii/ [39] K. Li, G. Lu, G. Luo, and Z. Cai, “Seed-free graph de-anonymiztiation
S138912862031327X with adversarial learning,” in Proc. CIKM, 2020, pp. 745–754.
[17] W. Ding, X. Jing, Z. Yan, and L. T. Yang, “A survey on data fusion [Online]. Available: https://doi.org/10.1145/3340531.3411970
in Internet of Things: Towards secure and privacy-preserving fusion,” [40] T. N. Kipf and M. Welling, “Semi-supervised classification with
Inf. Fusion, vol. 51, pp. 129–144, Nov. 2019. [Online]. Available: graph convolutional networks,” in Proc. 5th Int. Conf. Learn.
https://www.sciencedirect.com/science/article/pii/S1566253518304731 Represent. (ICLR), Toulon, France, Apr. 2017. [Online]. Available:
[18] X. Jing, Z. Yan, X. Jiang, and W. Pedrycz, “Network traffic fusion and https://openreview.net/forum?id=SJU4ayYgl
analysis against DDoS flooding attacks with a novel reversible sketch,” [41] J. M.-T. Wu, Z. Li, G. Srivastava, M.-H. Tasi, and J. C.-W. Lin,
Inf. Fusion, vol. 51, pp. 100–113, Nov. 2019. [Online]. Available: “A graph-based convolutional neural network stock price
https://www.sciencedirect.com/science/article/pii/S1566253518305815 prediction with leading indicators,” Softw. Pract. Exp.,
[19] Y. Liang, Z. Cai, J. Yu, Q. Han, and Y. Li, “Deep learning based infer- vol. 51, no. 3, pp. 628–644, 2021. [Online]. Available:
ence of private information using embedded sensors in smart devices,” https://onlinelibrary.wiley.com/doi/abs/10.1002/spe.2915
IEEE Netw., vol. 32, no. 4, pp. 8–14, Jul./Aug. 2018. [42] P. Velickovic, G. Cucurull, A. Casanova, A. Romero, P. Liò, and
[20] H. Wang, S. Ma, C. Guo, Y. Wu, H.-N. Dai, and D. Wu, Y. Bengio, “Graph attention networks,” in Proc. 6th Int. Conf. Learn.
“Blockchain-based power energy trading management,” ACM Trans. Represent. (ICLR), Vancouver, BC, Canada, Apr./May 2018, pp. 1–9.
Internet Technol., vol. 21, no. 2, pp. 1–16, 2021. [Online]. Available: [Online]. Available: https://openreview.net/forum?id=rJXMpikCZ
https://doi.org/10.1145/3409771 [43] L. Akoglu, H. Tong, and D. Koutra, “Graph based anomaly
[21] Y. Zuo, Y. Wu, G. Min, C. Huang, and K. Pei, “An intelligent anomaly detection and description: A survey,” Data Min. Knowl.
detection scheme for micro-services architectures with temporal and Disc., vol. 29, no. 3, pp. 626–688, 2015. [Online]. Available:
spatial data analysis,” IEEE Trans. Cogn. Commun. Netw., vol. 6, no. 2, https://doi.org/10.1007/s10618-014-0365-y
pp. 548–561, Jun. 2020. [44] D. Miller, “Blockchain and the Internet of Things in the industrial
[22] C. Huang, G. Min, Y. Wu, Y. Ying, K. Pei, and Z. Xiang, “Time sector,” IT Prof., vol. 20, no. 3, pp. 15–18, 2018.
series anomaly detection for trustworthy services in cloud comput- [45] P. Lade, R. Ghosh, and S. Srinivasan, “Manufacturing analytics and
ing systems,” IEEE Trans. Big Data, early access, Jun. 1, 2017, industrial Internet of Things,” IEEE Intell. Syst., vol. 32, no. 3,
doi: 10.1109/TBDATA.2017.2711039. pp. 74–79, May/Jun. 2017.
[23] X. Zheng and Z. Cai, “Privacy-preserved data sharing towards multiple [46] Y. Wu, H. Huang, C. Wang, and Y. Pan, 5G-Enabled Internet of Things.
parties in industrial IoTs,” IEEE J. Sel. Areas Commun., vol. 38, no. 5, Boca Raton, FL, USA: CRC Press, 2019.
pp. 968–979, May 2020. [47] X. Cheng, Y. Wu, G. Min, A. Y. Zomaya, and X. Fang, “Safeguard
[24] M. Aazam, S. Zeadally, and K. A. Harras, “Deploying fog computing network slicing in 5G: A learning augmented optimization approach,”
in industrial Internet of Things and industry 4.0,” IEEE Trans. Ind. IEEE J. Sel. Areas Commun., vol. 38, no. 7, pp. 1600–1613, Jul. 2020.
Informat., vol. 14, no. 10, pp. 4674–4682, Oct. 2018. [48] Y. Wu et al., 6G Mobile Wireless Networks. Cham, Switzerland:
[25] Z. Zhao, Y. Shi, B. Diao, and B. Wu, “Optimal data caching and for- Springer Int., 2021.
warding in industrial IoT with diverse connectivity,” IEEE Trans. Ind. [49] Y. Wu, “Cloud-edge orchestration for the Internet-of-Things:
Informat., vol. 15, no. 4, pp. 2288–2296, Apr. 2019. Architecture and Ai-powered data processing,” IEEE Internet Things
[26] X. Jing, H. Han, Z. Yan, and W. Pedrycz, “SuperSketch: A multi- J., early access, Aug. 7, 2020, doi: 10.1109/JIOT.2020.3014845.
dimensional reversible data structure for super host identification,” [50] Y. Wu, “Robust learning enabled intelligence for the Internet-of-Things:
IEEE Trans. Depend. Secure Comput., early access, Apr. 9, 2011, A survey from the perspectives of noisy data and adversarial examples,”
doi: 10.1109/TDSC.2021.3072295. IEEE Internet Things J., vol. 8, no. 12, pp. 9568–9579, Jun. 2021.
[27] L. Ruff et al., “A unifying review of deep and shallow anomaly [51] Y. Wu, F. Hu, G. Min, and A. Zomaya, Big Data and Computational
detection,” Proc. IEEE, vol. 109, no. 5, pp. 756–795, May 2021. Intelligence in Networking. Hoboken, NJ, USA: CRC Press, 2017.
[28] X. Zhang, X. Ma, N. Huyan, J. Gu, X. Tang, and L. Jiao, “Spectral- [52] R. Chalapathy and S. Chawla. (2019). Deep Learning for
difference low-rank representation learning for hyperspectral anomaly Anomaly Detection: A Survey. [Online]. Available: http://arxiv.org/abs/
detection,” IEEE Trans. Geosci. Remote Sens., early access, Jan. 13, 1901.03407.
2021, doi: 10.1109/TGRS.2020.3046727. [53] J. Zhou, G. Cui, Z. Zhang, C. Yang, Z. Liu, and M. Sun. (2018). Graph
[29] J. Lu, S. Jin, J. Liang, and C. Zhang, “Robust few-shot learning for Neural Networks: A Review of Methods and Applications. [Online].
user-provided data,” IEEE Trans. Neural Netw. Learn. Syst., vol. 32, Available: http://arxiv.org/abs/1812.08434.
no. 4, pp. 1433–1447, Apr. 2021. [54] Z. Guo, K. Yu, Y. Li, G. Srivastava, and J. C.-W. Lin, “Deep
[30] D. Zhu, Y. Sun, H. Du, N. Cao, T. Baker, and G. Srivastava, “HUNA: learning-embedded social Internet of Things for ambiguity-aware social
A method of hierarchical unsupervised network alignment for IoT,” recommendations,” IEEE Trans. Netw. Sci. Eng., early access, Jan. 5,
IEEE Internet Things J., vol. 8, no. 5, pp. 3201–3210, Mar. 2021. 2021, doi: 10.1109/TNSE.2021.3049262.
[31] C. Huang, Y. Wu, Y. Zuo, K. Pei, and G. Min, “Towards experienced [55] Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and P. S. Yu, “A compre-
anomaly detector through reinforcement learning,” in Proc. AAAI Conf. hensive survey on graph neural networks,” IEEE Trans. Neural Netw.
Artif. Intell., vol. 32, Apr. 2018, pp. 8087–8088. [Online]. Available: Learn. Syst., vol. 32, no. 1, pp. 4–24, Jan. 2021.
https://ojs.aaai.org/index.php/AAAI/article/view/12130 [56] S. Georgousis, M. P. Kenning, and X. Xie, “Graph deep learning: State
[32] C. Huang, Y. Wu, G. Min, and Y. Ying, “Kernelized convex hull of the art and challenges,” IEEE Access, vol. 9, pp. 22106–22140, 2021.
approximation and its applications in data description tasks,” in Proc. [57] Z. Zhang, P. Cui, and W. Zhu, “Deep learning on graphs: A sur-
Int. Joint Conf. Neural Netw. (IJCNN), 2018, pp. 1–8. vey,” IEEE Trans. Knowl. Data Eng., early access, Mar. 17, 2020,
[33] Y. Wu, F. Hu, G. Min, and A. Zomaya, Big Data and Computational doi: 10.1109/TKDE.2020.2981333.
Intelligence in Networking. Boca Raton, FL, USA: CRC Press, 2017. [58] N. Vesselinova, R. Steinert, D. F. Perez-Ramirez, and M. Boman,
[34] C. Zhang, M. Dong, and K. Ota, “Accelerate deep learning in “Learning combinatorial optimization on graphs: A survey with appli-
IoT: Human-interaction co-inference networking system for edge,” in cations to networking,” IEEE Access, vol. 8, pp. 120388–120416,
Proc. 13th Int. Conf. Human Syst. Interact. (HSI), 2020, pp. 1–6. 2020.
[35] C. Zhang, M. Dong, and K. Ota, “Enabling computational intelli- [59] T. Danel et al., “Spatial graph convolutional networks,” in Neural
gence for green Internet of Things: Data-driven adaptation in LPWA Information Processing, H. Yang, K. Pasupa, A. C.-S. Leung,
networking,” IEEE Comput. Intell. Mag., vol. 15, no. 1, pp. 32–43, J. T. Kwok, J. H. Chan, and I. King, Eds. Cham, Switzerland: Springer
Feb. 2020. Int., 2020, pp. 668–675.
[36] M. Gori, G. Monfardini, and F. Scarselli, “A new model for learning [60] W. L. Hamilton, R. Ying, and J. Leskovec, “Inductive representation
in graph domains,” in Proc. IEEE Int. Joint Conf. Neural Netw., vol. 2, learning on large graphs,” in Proc. 31st Int. Conf. Neural Inf. Process.
2005, pp. 729–734. Syst. (NIPS), 2017, pp. 1025–1035.
[37] Y. Li, D. Tarlow, M. Brockschmidt, and R. S. Zemel, “Gated [61] Y. Zuo, Y. Wu, G. Min, and L. Cui, “Learning-based network path
graph sequence neural networks,” in Proc. 4th Int. Conf. planning for traffic engineering,” Future Gener. Comput. Syst., vol. 92,
Learn. Represent. (ICLR), 2016, p. 6. [Online]. Available: pp. 59–67, Mar. 2019. [Online]. Available: https://www.sciencedirect.
http://arxiv.org/abs/1511.05493. com/science/article/pii/S0167739X18313244

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9229

[62] Z. Yan, J. Ge, Y. Wu, L. Li, and T. Li, “Automatic virtual network [83] L. Tišljarić, S. Fernandes, T. Carić, and J. Gama, “Spatiotemporal
embedding: A deep reinforcement learning approach with graph con- traffic anomaly detection on urban road network using tensor decom-
volutional networks,” IEEE J. Sel. Areas Commun., vol. 38, no. 6, position method,” in Discovery Science. Cham, Switzerland: Springer
pp. 1040–1057, Jun. 2020. Int., 2020, pp. 674–688.
[63] K. Cho et al., “Learning phrase representations using RNN encoder– [84] W. Jiang and J. Luo. (2021). Graph Neural Network
decoder for statistical machine translation,” in Proc. Conf. Empirical for Traffic Forecasting: A Survey. [Online]. Available:
Methods Nat. Lang. Process. (EMNLP), Oct. 2014, pp. 1724–1734. https://arxiv.org/abs/2101.11174.
[Online]. Available: https://doi.org/10.3115/v1/d14-1179 [85] W. Li, V. Mahadevan, and N. Vasconcelos, “Anomaly detection and
[64] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural localization in crowded scenes,” IEEE Trans. Pattern Anal. Mach.
Comput., vol. 9, no. 8, pp. 1735–1780, 1997. [Online]. Available: Intell., vol. 36, no. 1, pp. 18–32, Jan. 2014.
https://doi.org/10.1162/neco.1997.9.8.1735 [86] Y. Benezeth, P. Jodoin, V. Saligrama, and C. Rosenberger, “Abnormal
[65] A. Hasanzadeh, E. Hajiramezanali, K. Narayanan, N. Duffield, events detection based on spatio-temporal co-occurences,” in Proc.
M. Zhou, and X. Qian, “Variational graph recurrent neural networks,” in IEEE Conf. Comput. Vis. Pattern Recognit., 2009, pp. 2458–2465.
Proc. Adv. Neural Inf. Process. Syst., vol. 32, 2019, pp. 10700–10710. [87] K. K. Santhosh, D. P. Dogra, and P. P. Roy, “Anomaly detection
[66] K. Xu, C. Li, Y. Tian, T. Sonobe, K. Kawarabayashi, and in road traffic using visual surveillance: A survey,” ACM Comput.
S. Jegelka, “Representation learning on graphs with jumping knowl- Surveys, vol. 53, no. 6, pp. 1–26, Dec. 2020. [Online]. Available:
edge networks,” in Proc. 35th Int. Conf. Mach. Learn. (ICML), vol. 80. https://doi.org/10.1145/3417989
Stockholm, Sweden, Jul. 2018, pp. 5449–5458. [Online]. Available: [88] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A
http://proceedings.mlr.press/v80/xu18c.html survey,” ACM Comput. Surveys, vol. 41, no. 3, pp. 1–58, Jul. 2009.
[67] H. Yang, X. Yan, X. Dai, and J. Cheng. (2020). Self-Enhanced GNN: [Online]. Available: https://doi.org/10.1145/1541880.1541882
Improving Graph Neural Networks Using Model Outputs. [Online]. [89] (2021). New York City (NYC) Taxi Dataset. [Online]. Available:
Available: https://arxiv.org/abs/2002.07518. https://www1.nyc.gov/site/tlc/index.page
[68] H. Li, G. Zhao, L. Qin, H. Aizeke, X. Zhao, and Y. Yang, “A survey of [90] W. Yu, W. Cheng, C. C. Aggarwal, K. Zhang, H. Chen, and W. Wang,
safety warnings under connected vehicle environments,” IEEE Trans. “NetWalk: A flexible deep embedding approach for anomaly detection
Intell. Transp. Syst., vol. 22, no. 5, pp. 2572–2588, May 2021. in dynamic networks,” in Proc. 24th ACM SIGKDD Int. Conf. Knowl.
[69] K. Ren, Q. Wang, C. Wang, Z. Qin, and X. Lin, “The security of Disc. Data Min., 2018, pp. 2672–2681.
autonomous driving: Threats, defenses, and future directions,” Proc. [91] R. Mehran, A. Oyama, and M. Shah, “Abnormal crowd behavior detec-
IEEE, vol. 108, no. 2, pp. 357–372, Feb. 2020. tion using social force model,” in Proc. IEEE Conf. Comput. Vis.
[70] B. Yin, Y. Wu, T. Hu, J. Dong, and Z. Jiang, “An efficient collaboration Pattern Recognit., 2009, pp. 935–942.
and incentive mechanism for Internet of Vehicles (IoV) with secured [92] Z. Zheng, Y. Yang, J. Liu, H. Dai, and Y. Zhang, “Deep and embed-
information exchange based on blockchains,” IEEE Internet Things J., ded learning approach for traffic flow prediction in urban informatics,”
vol. 7, no. 3, pp. 1582–1593, Mar. 2020. IEEE Trans. Intell. Transp. Syst., vol. 20, no. 10, pp. 3927–3939,
[71] L. Cheng et al., “SCTSC: A semicentralized traffic signal control mode Oct. 2019.
with attribute-based blockchain in IoVs,” IEEE Trans. Comput. Soc. [93] J. Fang, D. Yan, J. Qiao, J. Xue, and H. Yu, “DADA: Driver attention
Syst., vol. 6, no. 6, pp. 1373–1385, Dec. 2019. prediction in driving accident scenarios,” IEEE Trans. Intell. Transp.
[72] L. Cui, D. Su, Y. Zhou, L. Zhang, Y. Wu, and S. Chen, “Edge learning Syst., early access, Jan. 1, 2021, doi: 10.1109/TITS.2020.3044678.
for surveillance video uploading sharing in public transport systems,” [94] S. S. Ali and B. J. Choi, “State-of-the-art artificial intelligence tech-
IEEE Trans. Intell. Transp. Syst., vol. 22, no. 4, pp. 2274–2285, niques for distributed smart grids: A review,” Electronics, vol. 9, no. 6,
Apr. 2021. p. 1030, 2020.
[73] J.-X. Zhong, N. Li, W. Kong, S. Liu, T. H. Li, and G. Li, “Graph [95] P. Gope, “PMAKE: Privacy-aware multi-factor authenticated key
convolutional label noise cleaner: Train a plug-and-play action classifier establishment scheme for advance metering infrastructure in smart
for anomaly detection,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern grid,” Comput. Commun., vol. 152, pp. 338–344, Feb. 2020.
Recognit. (CVPR), Jun. 2019, pp. 1237–1246. [Online]. Available: https://www.sciencedirect.com/science/article/
[74] L. Yu, B. Du, X. Hu, L. Sun, L. Han, and W. Lv, “Deep pii/S0140366419313210
spatio-temporal graph convolutional network for traffic accident [96] L. Al-Ghussain, R. Samu, O. Taylan, and M. Fahrioglu, “Sizing renew-
prediction,” Neurocomputing, vol. 423, pp. 135–147, Jan. 2021. able energy systems with energy storage systems in microgrids for max-
[Online]. Available: https://www.sciencedirect.com/science/article/pii/ imum cost-efficient utilization of renewable energy resources,” Sustain.
S092523122031451X Cities Soc., vol. 55, Apr. 2020, Art. no. 102059. [Online]. Available:
[75] Y. Hu, A. Qu, and D. Work. (2020). Graph Convolutional Networks for https://www.sciencedirect.com/science/article/pii/S2210670720300469
Traffic Anomaly. [Online]. Available: https://arxiv.org/abs/2012.13637. [97] J. Zhang, Y. Wu, G. Min, F. Hao, and L. Cui, “Balancing energy
[76] Z. Zhou, Y. Wang, X. Xie, L. Chen, and H. Liu, “RiskOracle: A minute- consumption and reputation gain of uav scheduling in edge comput-
level citywide traffic accident forecasting framework,” in Proc. AAAI ing,” IEEE Trans. Cogn. Commun. Netw., vol. 6, no. 4, pp. 1204–1217,
Conf. Artif. Intell., vol. 34, 2020, pp. 1258–1265. Dec. 2020.
[77] Z. Zhou, Y. Wang, X. Xie, L. Chen, and C. Zhu, “Foresee urban [98] D. Liu, Z. Yan, W. Ding, and M. Atiquzzaman, “A survey on secure
sparse traffic accidents: A spatiotemporal multi-granularity perspec- data analytics in edge computing,” IEEE Internet Things J., vol. 6,
tive,” IEEE Trans. Knowl. Data Eng., early access, Oct. 28, 2020, no. 3, pp. 4946–4967, Jun. 2019.
doi: 10.1109/TKDE.2020.3034312. [99] W. Liao, B. Bak-Jensen, J. R. Pillai, Y. Wang, and Y. Wang. (2021).
[78] R. Liu, S. Zhao, B. Cheng, H. Yang, H. Tang, and F. Yang, “ST- A Review of Graph Neural Networks and Their Applications in Power
MFM: A spatiotemporal multi-modal fusion model for urban anomalies Systems. [Online]. Available: https://arxiv.org/abs/2101.10025.
prediction,” in Proc. 24th Eur. Conf. Artif. Intell., 2020, pp. 1922–1929. [100] W. Liao, D. Yang, Y. Wang, and X. Ren, “Fault diagnosis of power
[79] Y. Zhang, X. Dong, L. Shang, D. Zhang, and D. Wang, “A multi-modal transformers using graph convolutional network,” CSEE J. Power
graph neural network approach to traffic risk forecasting in smart urban Energy Syst., vol. 7, no. 2, pp. 241–249, 2021.
sensing,” in Proc. 17th Annu. IEEE Int. Conf. Sens. Commun. Netw. [101] J. Fan, S. Rao, G. Muniraju, C. Tepedelenlioglu, and A. Spanias,
(SECON), 2020, pp. 1–9. “Fault classification in photovoltaic arrays using graph signal process-
[80] H.-W. Wang et al., “Evaluation and prediction of transportation ing,” in Proc. IEEE Conf. Ind. Cyberphys. Syst. (ICPS), vol. 1, 2020,
resilience under extreme weather events: A diffusion graph convolu- pp. 315–319.
tional approach,” Transp. Res. C Emerg. Technol., vol. 115, Jun. 2020, [102] D. Owerko, F. Gama, and A. Ribeiro, “Predicting power outages using
Art. no. 102619. [Online]. Available: https://www.sciencedirect.com/ graph neural networks,” in Proc. IEEE Global Conf. Signal Inf. Process.
science/article/pii/S0968090X19305868 (GlobalSIP), 2018, pp. 743–747.
[81] J. S. W. Heglund, P. Taleongpong, S. Hu, and H. T. Tran, “Railway [103] F. Gama, A. G. Marques, G. Leus, and A. Ribeiro, “Convolutional
delay prediction with spatial–temporal graph convolutional networks,” neural network architectures for signals supported on graphs,” IEEE
in Proc. IEEE 23rd Int. Conf. Intell. Transp. Syst. (ITSC), 2020, Trans. Signal Process., vol. 67, no. 4, pp. 1034–1049, Feb. 2019.
pp. 1–6. [104] Z. Chen, J. Xu, T. Peng, and C. Yang, “Graph convolutional network-
[82] M. Zhang, T. Li, Y. Yu, Y. Li, P. Hui, and Y. Zheng, “Urban anomaly based method for fault diagnosis using a hybrid of measurement and
analytics: Description, detection and prediction,” IEEE Trans. Big Data, prior knowledge,” IEEE Trans. Cybern., early access, Mar. 12, 2021,
early access, Mar. 28, 2021, doi: 10.1109/TBDATA.2020.2991008. doi: 10.1109/TCYB.2021.3059002.

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
9230 IEEE INTERNET OF THINGS JOURNAL, VOL. 9, NO. 12, JUNE 15, 2022

[105] Y. Luo, C. Lu, L. Zhu, and J. Song, “Data-driven short-term [126] L. Zheng, Z. Li, J. Li, Z. Li, and J. Gao, “AddGraph: Anomaly detection
voltage stability assessment based on spatial-temporal graph in dynamic graph using attention-based temporal GCN,” in Proc. 28th
convolutional network,” Int. J. Elect. Power Energy Syst., Int. Joint Conf. Artif. Intell. (IJCAI), Jul. 2019, pp. 4419–4425.
vol. 130, Sep. 2021, Art. no. 106753. [Online]. Available: [Online]. Available: https://doi.org/10.24963/ijcai.2019/614
https://www.sciencedirect.com/science/article/pii/S0142061520342988 [127] Q. Xiao, J. Liu, Q. Wang, Z. Jiang, X. Wang, and Y. Yao,
[106] K. Chen, J. Hu, Y. Zhang, Z. Yu, and J. He, “Fault location in power “Towards network anomaly detection using graph embedding,” in
distribution systems via deep graph convolutional networks,” IEEE J. Computational Science—ICCS, V. V. Krzhizhanovskaya et al., Eds.
Sel. Areas Commun., vol. 38, no. 1, pp. 119–131, Jan. 2020. Cham, Switzerland: Springer Int., 2020, pp. 156–169.
[107] M. Defferrard, X. Bresson, and P. Vandergheynst, “Convolutional neu- [128] H. Cheng, P.-N. Tan, C. Potter, and S. Klooster, “Detection
ral networks on graphs with fast localized spectral filtering,” in Proc. and characterization of anomalies in multivariate time series,”
Neural Inf. Process. Syst. (NIPS), 2016, pp. 3844–3852. in Proc. SDM, 2009, pp. 413–424. [Online]. Available:
[108] D. Wang, K. Zheng, Q. Chen, G. Luo, and X. Zhang, “Probabilistic https://epubs.siam.org/doi/abs/10.1137/1.9781611972795.36
power flow solution with graph convolutional network,” in Proc. [129] J. Jiang et al., “Anomaly detection with graph convolutional networks
IEEE PES Innov. Smart Grid Technol. Europe (ISGT-Europe), 2020, for insider threat and fraud detection,” in Proc. IEEE Mil. Commun.
pp. 650–654. Conf. (MILCOM), 2019, pp. 109–114.
[109] J. Huang, L. Guan, Y. Su, H. Yao, M. Guo, and Z. Zhong, [130] J. Zhou, Z. Xu, A. M. Rush, and M. Yu. (2020). Automating
“Recurrent graph convolutional network-based multi-task transient sta- Botnet Detection With Graph Neural Networks. [Online]. Available:
bility assessment framework in power system,” IEEE Access, vol. 8, https://arxiv.org/abs/2003.06344.
pp. 93283–93296, 2020. [131] A. Protogerou, S. Papadopoulos, A. Drosou, D. Tzovaras, and
[110] E. Li. (2019). Dissolved Gas Data in Transformer Oil—Fault Diagnosis I. Refanidis, “A graph neural network method for distributed anomaly
of Power Transformers With Membership Degree. [Online]. Available: detection in IoT,” Evol. Syst., vol. 12, no. 1, pp. 19–36, 2021. [Online].
https://ieee-dataport.org/documents/dissolved-gas-data-transformer-oil- Available: https://doi.org/10.1007/s12530-020-09347-0
fault-diagnosis-power-transformers-membership-degree [132] X. Cheng, Y. Wu, G. Min, and A. Y. Zomaya, “Network function
[111] Y. Benmahamed, M. Teguar, and A. Boubakeur, “Application of SVM virtualization in dynamic networks: A stochastic perspective,” IEEE J.
and KNN to Duval Pentagon 1 for transformer oil diagnosis,” IEEE Sel. Areas Commun., vol. 36, no. 10, pp. 2218–2232, Oct. 2018.
Trans. Dielectr. Electr. Insul., vol. 24, no. 6, pp. 3443–3451, Dec. 2017. [133] W. Miao et al., “Stochastic performance analysis of network function
virtualization in future Internet,” IEEE J. Sel. Areas Commun., vol. 37,
[112] G. Dileep, “A survey on smart grid technologies and appli-
no. 3, pp. 613–626, Mar. 2019.
cations,” Renew. Energy, vol. 146, pp. 2589–2625, Feb. 2020.
[134] B. Yin, H. Yin, Y. Wu, and Z. Jiang, “FDC: A secure federated deep
[Online]. Available: https://www.sciencedirect.com/science/article/pii/
learning mechanism for data collaborations in the Internet of Things,”
S0960148119312790
IEEE Internet Things J., vol. 7, no. 7, pp. 6348–6359, Jul. 2020.
[113] A. A. Korba, N. Tamani, Y. Ghamri-Doudane, and N. E. I. Karabadji,
[135] Y. Wu, H. N. Dai, H. Wang, and K. K. R. Choo, “Blockchain-based pri-
“Anomaly-based framework for detecting power overloading cyber-
vacy preservation for 5G-enabled drone communications,” IEEE Netw.,
attacks in smart grid AMI,” Comput. Security, vol. 96, Sep. 2020,
vol. 35, no. 1, pp. 50–56, Jan./Feb. 2021.
Art. no. 101896. [Online]. Available: https://www.sciencedirect.com/
[136] H. Huang, Ed., Blockchains for Network Security: Principles,
science/article/pii/S0167404820301693
Technologies and Applications. London, U.K.: Inst.
[114] Z. Zheng, Y. Yang, X. Niu, H. Dai, and Y. Zhou, “Wide and deep Eng. Technol., 2020. [Online]. Available: https://digital-
convolutional neural networks for electricity-theft detection to secure library.theiet.org/content/books/pc/pbpc029e
smart grids,” IEEE Trans. Ind. Informat., vol. 14, no. 4, pp. 1606–1615, [137] Y. Ma, Y. Wu, and J. Ge, Accountability and Privacy in Network
Apr. 2018. Security. Heidelberg, Germany: Springer, 2020.
[115] G. Dudgeon. (2021). IEEE 123 Node Test Feeder in Simscape [138] F. Lopez et al., “Categorization of anomalies in smart manufacturing
Power Systems. [Online]. Available: https://www.mathworks. systems to support the selection of detection mechanisms,” IEEE Robot.
com/matlabcentral/fileexchange/66599-ieee-123-node-test-feeder- Autom. Lett., vol. 2, no. 4, pp. 1885–1892, Oct. 2017.
in-simscape-power-systems [139] V. Sharma, G. Choudhary, Y. Ko, and I. You, “Behavior and vulnerabil-
[116] M. Cupelli, C. D. Cardet, and A. Monti, “Voltage stability indices ity assessment of drones-enabled Industrial Internet of Things (IIoT),”
comparison on the IEEE-39 bus system using RTDS,” in Proc. IEEE IEEE Access, vol. 6, pp. 43368–43383, 2018.
Int. Conf. Power Syst. Technol. (POWERCON), 2012, pp. 1–6. [140] J. Zhao, X. Jing, Z. Yan, and W. Pedrycz, “Network traf-
[117] M. Khodayar, G. Liu, J. Wang, and M. E. Khodayar, “Deep learning fic classification for data fusion: A survey,” Inf. Fusion,
in power systems research: A review,” CSEE J. Power Energy Syst., vol. 72, pp. 22–47, Aug. 2021. [Online]. Available:
vol. 7, no. 2, pp. 209–220, 2021. https://www.sciencedirect.com/science/article/pii/S156625352100018X
[118] H. Karimipour and H. Leung, “Relaxation-based anomaly detection in [141] A. A. Cook, G. Mısırlı, and Z. Fan, “Anomaly detection for IoT
cyber-physical systems using ensemble Kalman filter,” IET Cyber Phys. time-series data: A survey,” IEEE Internet Things J., vol. 7, no. 7,
Syst. Theory Appl., vol. 5, pp. 49–58, Mar. 2020. pp. 6481–6494, Jul. 2020.
[119] H. M. Rouzbahani, H. Karimipour, A. Rahimnejad, A. Dehghantanha, [142] K. Zope, K. Singh, S. Nistala, A. Basak, P. Rathore, and V. Runkana,
and G. Srivastava, Anomaly Detection in Cyber-Physical Systems “Anomaly detection and diagnosis in manufacturing systems: A com-
Using Machine Learning. Cham, Switzerland: Springer Int., 2020, parative study of statistical, machine learning and deep learning
pp. 219–235. techniques,” in Proc. Annu. Conf. PHM Soc., vol. 11, Sep. 2019.
[120] A. K. Singh et al., “Report on the 68-bus, 16-machine, 5- [143] R. Pinto. (2020). M2M Using OPC UA. [Online]. Available:
area system,” IEEE PES Task Force, University of Lincoln, https://ieee-dataport.org/open-access/m2m-using-opc-ua
Lincoln, U.K., Rep. 28771, 2013. [Online]. Available: [144] S. Dou, K. Yang, and H. V. Poor, “PC2A: Predicting collective contex-
https://eprints.lincoln.ac.uk/id/eprint/28771/ tual anomalies via LSTM with deep generative model,” IEEE Internet
[121] A. Barua, D. Muthirayan, P. P. Khargonekar, and M. A. Al Faruque, Things J., vol. 6, no. 6, pp. 9645–9655, Dec. 2019.
“Hierarchical temporal memory based machine learning for real-
time, unsupervised anomaly detection in smart grid: WiP abstract,” Yulei Wu (Senior Member, IEEE) received the B.Sc. degree (First Class
in Proc. ACM/IEEE 11th Int. Conf. Cyber Phys. Syst. (ICCPS), 2020, Hons.) in computer science and the Ph.D. degree in computing and mathe-
pp. 188–189. matics from the University of Bradford, Bradford, U.K., in 2006 and 2010,
[122] H. Yuan, H. Yu, S. Gui, and S. Ji. (2020). Explainability in respectively.
Graph Neural Networks: A Taxonomic Survey. [Online]. Available: He is a Senior Lecturer with the Department of Computer Science,
https://arxiv.org/abs/2012.15445. College of Engineering, Mathematics and Physical Sciences, University of
[123] X. Wang, B. Jin, Y. Du, P. Cui, and Y. Yang, “One-class graph neu- Exeter, Exeter, U.K. His expertise is on intelligent networking, and his main
ral networks for anomaly detection in attributed networks,” Neural research interests include computer networks, networked systems, software-
Comput. Appl., to be published. defined networks and systems, network management, and network security
[124] A. Deng and B. Hooi, “Graph neural network-based anomaly detection and privacy.
in multivariate time series,” in Proc. AAAI, 2021, pp. 4027–4035. Dr. Wu is an Associate Editor of IEEE T RANSACTIONS ON N ETWORK
[125] H. Zhao et al., “Multivariate time-series anomaly detection via AND S ERVICE M ANAGEMENT , IEEE T RANSACTIONS ON N ETWORK
graph attention network,” in Proc. 20th IEEE Int. Conf. Data Min. S CIENCE AND E NGINEERING, and IEEE ACCESS, and an Area Editor of
(ICDM), Sorrento, Italy, Nov. 2020, pp. 841–850. [Online]. Available: Computer Networks (Elsevier). He is a Senior Member of the ACM and a
https://doi.org/10.1109/ICDM50108.2020.00093 fellow of the Higher Education Academy.
Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.
WU et al.: GRAPH NEURAL NETWORKS FOR ANOMALY DETECTION IN INDUSTRIAL INTERNET OF THINGS 9231

Hong-Ning Dai (Senior Member, IEEE) received the Ph.D. degree in com- Haina Tang received the Ph.D. degree in computer software and theory from
puter science and engineering from the Department of Computer Science and the School of Information Science and Technology, Sun Yat-sen University,
Engineering, Chinese University of Hong Kong, Hong Kong, in 2008. Guangzhou, China, in 2012.
He is currently with the Faculty of Information Technology, Macau She is an Associate Professor with the School of Artificial Intelligence,
University of Science and Technology, Macau, China, as an Associate University of Chinese Academy of Sciences, Beijing, China. Her current
Professor. His current research interests include Internet of Things, big data, research interests include network measurement, spatiotemporal data mining,
and blockchain technology. social network analysis, and graph mining.
Dr. Dai has served as an Associate Editor/Editor for IEEE T RANSACTIONS
ON I NDUSTRIAL I NFORMATICS , IEEE S YSTEMS J OURNAL , IEEE ACCESS ,
Ad Hoc Networks, and Connection Science. He is also a Senior Member of
Association for Computing Machinery.

Authorized licensed use limited to: Northern Illinois University. Downloaded on April 07,2025 at 05:56:22 UTC from IEEE Xplore. Restrictions apply.