{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T21:04:32Z","timestamp":1792789472033,"version":"4.5.0"},"reference-count":49,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2024,2,26]],"date-time":"2024-02-26T00:00:00Z","timestamp":1708905600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2020YFB1805403"],"award-info":[{"award-number":["2020YFB1805403"]}]},{"name":"National Key Research and Development Program of China","award":["62032002"],"award-info":[{"award-number":["62032002"]}]},{"name":"National Key Research and Development Program of China","award":["B21049"],"award-info":[{"award-number":["B21049"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["2020YFB1805403"],"award-info":[{"award-number":["2020YFB1805403"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62032002"],"award-info":[{"award-number":["62032002"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["B21049"],"award-info":[{"award-number":["B21049"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100013314","name":"111 Project","doi-asserted-by":"publisher","award":["2020YFB1805403"],"award-info":[{"award-number":["2020YFB1805403"]}],"id":[{"id":"10.13039\/501100013314","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100013314","name":"111 Project","doi-asserted-by":"publisher","award":["62032002"],"award-info":[{"award-number":["62032002"]}],"id":[{"id":"10.13039\/501100013314","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100013314","name":"111 Project","doi-asserted-by":"publisher","award":["B21049"],"award-info":[{"award-number":["B21049"]}],"id":[{"id":"10.13039\/501100013314","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Time series anomaly detection is very important to ensure the security of industrial control systems (ICSs). Many algorithms have performed well in anomaly detection. However, the performance of most of these algorithms decreases sharply with the increase in feature dimension. This paper proposes an anomaly detection scheme based on Graph Attention Network (GAT) and Informer. GAT learns sequential characteristics effectively, and Informer performs excellently in long time series prediction. In addition, long-time forecasting loss and short-time forecasting loss are used to detect multivariate time series anomalies. Short-time forecasting is used to predict the next time value, and long-time forecasting is employed to assist the short-time prediction. We conduct a large number of experiments on industrial control system datasets SWaT and WADI. Compared with most advanced methods, we achieve competitive results, especially on higher-dimensional datasets. Moreover, the proposed method can accurately locate anomalies and realize interpretability.<\/jats:p>","DOI":"10.3390\/s24051522","type":"journal-article","created":{"date-parts":[[2024,2,26]],"date-time":"2024-02-26T11:31:21Z","timestamp":1708947081000},"page":"1522","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":31,"title":["Graph Attention Network and Informer for Multivariate Time Series Anomaly Detection"],"prefix":"10.3390","volume":"24","author":[{"given":"Mengmeng","family":"Zhao","sequence":"first","affiliation":[{"name":"Information Security Center, State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China"},{"name":"National Engineering Laboratory for Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing 100876, China"},{"name":"Department of Information Science and Engineering, Zaozhuang University, Zaozhuang 277160, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4415-0126","authenticated-orcid":false,"given":"Haipeng","family":"Peng","sequence":"additional","affiliation":[{"name":"Information Security Center, State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China"},{"name":"National Engineering Laboratory for Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8541-308X","authenticated-orcid":false,"given":"Lixiang","family":"Li","sequence":"additional","affiliation":[{"name":"Information Security Center, State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China"},{"name":"National Engineering Laboratory for Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yeqing","family":"Ren","sequence":"additional","affiliation":[{"name":"Information Security Center, State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China"},{"name":"National Engineering Laboratory for Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2024,2,26]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"837601","DOI":"10.1155\/2009\/837601","article-title":"Network anomaly detection based on wavelet analysis","volume":"2009","author":"Lu","year":"2008","journal-title":"EURASIP J. Adv. Signal Process."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Kanarachos, S., Mathew, J., Chroneos, A., and Fitzpatrick, M. (2015, January 6\u20138). Anomaly detection in time series data using a combination of wavelets, neural networks and Hilbert transform. Proceedings of the 2015 6th International Conference on Information, Intelligence, Systems and Applications (IISA), Corfu, Greece.","DOI":"10.1109\/IISA.2015.7388055"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Yaacob, A.H., Tan, I.K., Chien, S.F., and Tan, H.K. (2010, January 26\u201328). Arima based network anomaly detection. Proceedings of the 2010 Second International Conference on Communication Software and Networks, Singapore.","DOI":"10.1109\/ICCSN.2010.55"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Zhou, Y., Qin, R., Xu, H., Sadiq, S., and Yu, Y. (2018). A data quality control method for seafloor observatories: The application of observed time series data in the East China Sea. Sensors, 18.","DOI":"10.3390\/s18082628"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Gharghabi, S., Imani, S., Bagnall, A., Darvishzadeh, A., and Keogh, E. (2018, January 17\u201320). Matrix profile xii: Mpdist: A novel time series distance measure to allow data mining in more challenging scenarios. Proceedings of the 2018 IEEE International Conference on Data Mining (ICDM), Singapore.","DOI":"10.1109\/ICDM.2018.00119"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"141","DOI":"10.14778\/3425879.3425885","article-title":"Real-time distance-based outlier detection in data streams","volume":"14","author":"Tran","year":"2020","journal-title":"Proc. VLDB Endow."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1717","DOI":"10.14778\/3467861.3467863","article-title":"SAND: Streaming subsequence anomaly detection","volume":"14","author":"Boniol","year":"2021","journal-title":"Proc. VLDB Endow."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Su, Y., Zhao, Y., Niu, C., Liu, R., Sun, W., and Pei, D. (2019, January 4\u20138). Robust anomaly detection for multivariate time series through stochastic recurrent neural network. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.","DOI":"10.1145\/3292500.3330672"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1991","DOI":"10.1109\/ACCESS.2018.2886457","article-title":"DeepAnT: A deep learning approach for unsupervised anomaly detection in time series","volume":"7","author":"Munir","year":"2018","journal-title":"IEEE Access"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ren, H., Xu, B., Wang, Y., Yi, C., Huang, C., Kou, X., Xing, T., Yang, M., Tong, J., and Zhang, Q. (2019, January 4\u20138). Time-series anomaly detection service at microsoft. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.","DOI":"10.1145\/3292500.3330680"},{"key":"ref_11","unstructured":"Filonov, P., Lavrentyev, A., and Vorontsov, A. (2016). Multivariate industrial time series with cyber-attack simulation: Fault detection using an lstm-based predictive data model. arXiv."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Hundman, K., Constantinou, V., Laporte, C., Colwell, I., and Soderstrom, T. (2018, January 19\u201323). Detecting spacecraft anomalies using lstms and nonparametric dynamic thresholding. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, London, UK.","DOI":"10.1145\/3219819.3219845"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Sakurada, M., and Yairi, T. (2014, January 2). Anomaly detection using autoencoders with nonlinear dimensionality reduction. Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, Gold Coast, QLD, Australia.","DOI":"10.1145\/2689746.2689747"},{"key":"ref_14","unstructured":"Zong, B., Song, Q., Min, M.R., Cheng, W., Lumezanu, C., Cho, D., and Chen, H. (May, January 30). Deep autoencoding gaussian mixture model for unsupervised anomaly detection. Proceedings of the International Conference on Learning Representations, Vancouver, BC, Canada."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018). Kitsune: An ensemble of autoencoders for online network intrusion detection. arXiv.","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref_16","unstructured":"Malhotra, P., Ramakrishnan, A., Anand, G., Vig, L., Agarwal, P., and Shroff, G. (2016). LSTM-based encoder-decoder for multi-sensor anomaly detection. arXiv."},{"key":"ref_17","unstructured":"Gugulothu, N., Malhotra, P., Vig, L., and Shroff, G. (2018, January 15). Sparse neural networks for anomaly detection in high-dimensional time series. Proceedings of the AI4IOT Workshop in Conjunction with ICML, IJCAI and ECAI, Stockholm, Sweden."},{"key":"ref_18","first-page":"2118","article-title":"Unsupervised deep anomaly detection for multi-sensor time-series signals","volume":"35","author":"Zhang","year":"2021","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_19","unstructured":"Zhang, C., Song, D., Chen, Y., Feng, X., Lumezanu, C., Cheng, W., Ni, J., Zong, B., Chen, H., and Chawla, N.V. (February, January 27). A deep neural network for unsupervised anomaly detection and diagnosis in multivariate time series data. Proceedings of the AAAI Conference on Artificial Intelligence, Honolulu, HI, USA."},{"key":"ref_20","unstructured":"Audibert, J., Michiardi, P., Guyard, F., Marti, S., and Zuluaga, M.A. (2020, January 6\u201310). Usad: Unsupervised anomaly detection on multivariate time series. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual Event."},{"key":"ref_21","unstructured":"Qi, Z., Xie, H., Li, Y., Tan, J., Li, F., and Lui, J. (2022). LPC-AD: Fast and Accurate Multivariate Time Series Anomaly Detection via Latent Predictive Coding. arXiv."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"12068","DOI":"10.1109\/TKDE.2021.3139916","article-title":"Adaptive memory networks with self-supervised learning for unsupervised anomaly detection","volume":"35","author":"Zhang","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1544","DOI":"10.1109\/LRA.2018.2801475","article-title":"A multimodal anomaly detector for robot-assisted feeding using an lstm-based variational autoencoder","volume":"3","author":"Park","year":"2018","journal-title":"IEEE Robot. Autom. Lett."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Xu, H., Chen, W., Zhao, N., Li, Z., Bu, J., Li, Z., Liu, Y., Zhao, Y., Pei, D., and Feng, Y. (2018, January 23\u201327). Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications. Proceedings of the 2018 World Wide Web Conference, Lyon, France.","DOI":"10.1145\/3178876.3185996"},{"key":"ref_25","unstructured":"Li, D., Chen, D., Goh, J., and Ng, S.K. (2018). Anomaly detection with generative adversarial networks for multivariate time series. arXiv."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Zhou, B., Liu, S., Hooi, B., Cheng, X., and Ye, J. (2019, January 10\u201316). BeatGAN: Anomalous Rhythm Detection using Adversarially Generated Time Series. Proceedings of the IJCAI, Macao, China.","DOI":"10.24963\/ijcai.2019\/616"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Li, D., Chen, D., Jin, B., Shi, L., Goh, J., and Ng, S.K. (2019, January 4\u20137). MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks. Proceedings of the International Conference on Artificial Neural Networks, Rhodes, Greece.","DOI":"10.1007\/978-3-030-30490-4_56"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"2941","DOI":"10.14778\/3415478.3415514","article-title":"Graphan: Graph-based subsequence anomaly detection","volume":"13","author":"Boniol","year":"2020","journal-title":"Proc. VLDB Endow."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Deng, A., and Hooi, B. (2021, January 2\u20139). Graph neural network-based anomaly detection in multivariate time series. Proceedings of the AAAI Conference on Artificial Intelligence, Virtual Event.","DOI":"10.1609\/aaai.v35i5.16523"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"9179","DOI":"10.1109\/JIOT.2021.3100509","article-title":"Learning graph structures with transformer for multivariate time series anomaly detection in iot","volume":"9","author":"Chen","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"103094","DOI":"10.1016\/j.cose.2023.103094","article-title":"GRU-Based Interpretable Multivariate Time Series Anomaly Detection in Industrial Control System","volume":"127","author":"Tang","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_32","unstructured":"Shyu, M.L., Chen, S.C., Sarinnapakorn, K., and Chang, L. (2003, January 4). A novel anomaly detection scheme based on principal component classifier. Proceedings of the IEEE Foundations and New Directions of Data Mining Workshop, Shanghai, China."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Liu, F.T., Ting, K.M., and Zhou, Z.H. (2008, January 15\u201319). Isolation forest. Proceedings of the 2008 Eighth IEEE International Conference on Data Mining, Pisa, Italy.","DOI":"10.1109\/ICDM.2008.17"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"120725","DOI":"10.1016\/j.eswa.2023.120725","article-title":"Anomaly detection for multivariate times series through the multi-scale convolutional recurrent variational autoencoder","volume":"231","author":"Xie","year":"2023","journal-title":"Expert Syst. Appl."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"103569","DOI":"10.1016\/j.ipm.2023.103569","article-title":"Reconstruction-based anomaly detection for multivariate time series using contrastive generative adversarial networks","volume":"61","author":"Miao","year":"2024","journal-title":"Inf. Process. Manag."},{"key":"ref_36","unstructured":"Xu, J., Wu, H., Wang, J., and Long, M. (2021). Anomaly transformer: Time series anomaly detection with association discrepancy. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Tuli, S., Casale, G., and Jennings, N.R. (2022). TranAD: Deep transformer networks for anomaly detection in multivariate time series data. arXiv.","DOI":"10.14778\/3514061.3514067"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"105964","DOI":"10.1016\/j.engappai.2023.105964","article-title":"Time-series anomaly detection with stacked Transformer representations and 1D convolutional network","volume":"120","author":"Kim","year":"2023","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_39","unstructured":"Jeong, Y., Yang, E., Ryu, J.H., Park, I., and Kang, M. (2023). AnomalyBERT: Self-Supervised Transformer for Time Series Anomaly Detection using Data Degradation Scheme. arXiv."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"119914","DOI":"10.1016\/j.ins.2023.119914","article-title":"Refining one-class representation: A unified transformer for unsupervised time-series anomaly detection","volume":"656","author":"Zhong","year":"2024","journal-title":"Inf. Sci."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Zhao, H., Wang, Y., Duan, J., Huang, C., Cao, D., Tong, Y., Xu, B., Bai, J., Tong, J., and Zhang, Q. (2020, January 17\u201320). Multivariate time-series anomaly detection via graph attention network. Proceedings of the 2020 IEEE International Conference on Data Mining (ICDM), Sorrento, Italy.","DOI":"10.1109\/ICDM50108.2020.00093"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"527","DOI":"10.1016\/j.inffus.2022.08.011","article-title":"MST-GAT: A multimodal spatial\u2013temporal graph attention network for time series anomaly detection","volume":"89","author":"Ding","year":"2023","journal-title":"Inf. Fusion"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Miao, Q., Xu, C., Zhan, J., Zhu, D., and Wu, C. (2022). An Unsupervised Short-and Long-Term Mask Representation for Multivariate Time Series Anomaly Detection. arXiv.","DOI":"10.1007\/978-981-99-1645-0_42"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Zhou, H., Zhang, S., Peng, J., Zhang, S., Li, J., Xiong, H., and Zhang, W. (2021, January 2\u20139). Informer: Beyond efficient transformer for long sequence time-series forecasting. Proceedings of the AAAI Conference on Artificial Intelligence, Virtual Event.","DOI":"10.1609\/aaai.v35i12.17325"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Mathur, A.P., and Tippenhauer, N.O. (2016, January 11). SWaT: A water treatment testbed for research and training on ICS security. Proceedings of the 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater), Vienna, Austria.","DOI":"10.1109\/CySWater.2016.7469060"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Angiulli, F., and Pizzuti, C. (2002, January 19\u201323). Fast outlier detection in high dimensional spaces. Proceedings of the European Conference on Principles of Data Mining and Knowledge Discovery, Helsinki, Finland.","DOI":"10.1007\/3-540-45681-3_2"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Lazarevic, A., and Kumar, V. (2005, January 21\u201324). Feature bagging for outlier detection. Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery in Data Mining, Chicago, IL, USA.","DOI":"10.1145\/1081870.1081891"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Aggarwal, C.C. (2015). Outlier Analysis, Springer.","DOI":"10.1007\/978-3-319-14142-8_8"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Zhan, J., Wang, S., Ma, X., Wu, C., Yang, C., Zeng, D., and Wang, S. (2022, January 22\u201327). Stgat-Mad: Spatial-Temporal Graph Attention Network For Multivariate Time Series Anomaly Detection. Proceedings of the ICASSP 2022\u20142022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Singapore.","DOI":"10.1109\/ICASSP43922.2022.9747274"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/5\/1522\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T14:05:19Z","timestamp":1760105119000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/5\/1522"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2,26]]},"references-count":49,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2024,3]]}},"alternative-id":["s24051522"],"URL":"https:\/\/doi.org\/10.3390\/s24051522","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,2,26]]}}}