Domain-Prior-Regularized Graph Modeling for Anomaly Detection in Cyber-Physical Systems

2026-07-25

AI Summary

This work addresses the challenges of anomaly detection in small-scale cyber-physical systems, where scarce anomalous labels and limited normal data often lead graph-based models to capture spurious correlations and exhibit unstable topologies. To overcome these limitations, the authors propose DPR-GM, a novel framework that leverages domain priors derived from system documentation via large language models to extract directed physical couplings. These couplings inform a fixed adjacency matrix and a structure-gating mechanism, which—combined with Pearson correlation coefficients and sensor reliability weighting—enable effective anomaly detection without introducing additional learnable parameters. Evaluated on the SKAB benchmark, DPR-GM significantly outperforms existing graph-based models, statistical methods, and deep learning baselines in terms of F1 score, AUROC, and AUPRC, demonstrating enhanced stability and interpretability under data-scarce conditions.

Abstract

Anomaly detection on multivariate sensor time series is critical for industrial monitoring of cyber-physical systems (CPS), where even subtle deviations from normal behavior can indicate process disruption. Recent graph-based approaches have made significant progress, but they often struggle in small-scale physical systems with scarce labeled anomalies and limited normal data. In such settings, graph-based models tend to capture spurious correlations and produce unstable sensor topologies. We propose DPR-GM (Domain-Prior-Regularized Graph Modeling), a forecasting-based framework that incorporates system design knowledge into graph construction. DPR-GM leverages a large language model (LLM) to extract directed physical couplings between sensor pairs from system documentation, which are encoded as a binary domain adjacency matrix serving as a structural gate over sensor relations. This gate is then modulated by Pearson correlations estimated from normal training data. The anomaly score is further weighted by sensor-level reliability derived from the coefficient of variation. All graph and weighting components are fixed prior to training and add no learnable parameters. On the SKAB benchmark, DPR-GM outperforms graph-based, statistical, and deep learning baselines across F1, AUROC, and AUPRC, showing that domain-structured graph priors are a practical alternative to fully learned topologies in data-scarce CPS.

Problem

• anomaly detection
• cyber-physical systems
• graph modeling
• data scarcity
• sensor time series

Innovation

• domain prior
• graph modeling
• anomaly detection
• cyber-physical systems
• large language model