Position Encoding-Enhanced Adaptive Expansion Graph Attention Network for Anomaly Detection in Multivariate Time Series

As cyber–physical systems continue to increase in complexity, multivariate time series exhibit not only intricate temporal patterns within individual variables but also complex inter-variable dependencies, including both synchronous and asynchronous propagation. Although existing Graph Neural Network (GNN)-based methods perform well in modeling variable dependencies, they often decouple temporal pattern processing from the graph construction. This separation often results in graph structures that lack temporal semantics and struggle to capture delayed responses among variables. To address this, we propose a Position Encoding–Enhanced Adaptive Expansion Graph Attention Network (PEE-AEGAT) for multivariate time series anomaly detection and root cause analysis. First, to embed temporal semantics directly into the graph construction process, we design a Multi-Frequency Positional Encoding Projection (MF-PEP) module that explicitly injects multi-scale periodic patterns and positional information into node embeddings. Second, we introduce a Hybrid Adaptive Graph Structure Learning (HAGSL) strategy that constructs a dual-mode graph by integrating static feature similarity with dynamic delay-aware similarity, together with a density-aware adaptive expansion mechanism for flexibly capturing dependencies. Finally, we develop a delay-aware graph attention network for information aggregation and propose an influence-based scoring mechanism to accurately identify anomaly root causes. Extensive experiments on four public real-world datasets demonstrate that PEE-AEGAT significantly outperforms state-of-the-art baselines in anomaly detection accuracy and root cause localization performance.