| Title |
TranAD-GAT : Improvement of Anomaly Detection Model by Simultaneous Reflection of Time and Variable Relationships in Multivariate Time Series Data |
| Authors |
오준혁(Jun-Hyeok Oh) ; 이승호(Seung-Ho Lee) |
| DOI |
https://doi.org/10.5573/ieie.2026.63.4.117 |
| Keywords |
Multivariate time-series dataset; ICS security; Anomaly detection; TranAD; GAT |
| Abstract |
In this study, we propose an integrated model that considers temporal patterns and inter-variable structural information together to more reliably detect various abnormal patterns occurring in the industrial control system environment. The proposed model is designed to complement the limitations of existing approaches that rely on a single viewpoint by combining time series-based feature learning and interaction analysis between variables, which were handled separately by existing models, within a single consistent structure. In experiments conducted based on the SWaT dataset, the proposed model showed a performance improvement of about 3% in F1-score and ROC-AUC compared to the existing method. In particular, as the Recall index improved by about 6%, the rate of missing out on actual abnormalities decreased. In the qualitative analysis, it was confirmed that the abnormalities were determined by reflecting complex patterns even in the section where long-term and short-term abnormalities were mixed or when only individual variables appeared to be normal. These results show that the characteristics of the proposed model that simultaneously reflect temporal change and structural information between variables worked effectively. Overall, it was demonstrated that the approach proposed in this study can more stably capture complex abnormal patterns of industrial process data by supplementing the structural constraints of the existing model. In the future, it is expected that the possibility of using the proposed model can be further expanded through extended experiments on various industrial environments, structural optimization, and lightweight research for real-time application. |