Anomaly Detection in Industrial Internet of Things: A Graph Learning Approach With Spatiotemporal Interactions

In real-world industrial activities, large industrial systems typically have complex network structures composed of multiple devices, where the operating status of devices is reflected by real-time data collected from sensors. The Industrial Internet of Things (IIoT) enables real-time data exchange between industrial devices, facilitating more efficient and convenient control of production activities. However, this also means that data anomalies are no longer confined to individual devices; they can spread to other normal devices through data interaction, potentially leading to severe consequences. Detecting data anomalies in large-scale industrial networks with hundreds of nodes and handling multiple heterogeneous data streams while preventing the propagation of anomalies is a complex and critical task. To address this challenge, we propose H-IIoTAD, a spatio-temporal interaction-based graph neural network for anomaly detection in IIoT systems. Our approach introduces a novel neighbor feature aggregation mechanism that dynami cally adjusts aggregation weights based on the anomaly levels of neighboring nodes. Furthermore, inspired by differentiable graph pooling techniques, we design a hierarchical representation learning strategy that aggregates node features into process-level and subsystem-level representations. This enables hierarchical anomaly detection and propagation analysis. To ensure research rigor, we conduct extensive experiments on the real-world HAI (HAI-22.04 and HAI-23.05) and SWaT industrial datasets. We further perform temporal stability analyses, ablation studies of key modules, and evaluations across 58 diverse anomaly scenarios to assess the robustness of the proposed approach. Experimental results demonstrate that the proposed approach effectively detects anomalies under diverse anomaly scenarios and provides interpretable insights into anomaly propagation patterns.