Integrating Self-Organizing Map and Graph Neural Networks to Detect Anomalies in Time-Series Data

Anomaly detection is essential in industrial cyber-physical systems (ICPS) for monitoring both system and environmental conditions. However, effective anomaly detection remains a continuous challenge due to the complexity and diversity of operational features in both spatial and temporal domains of such systems. Current data-driven approaches utilize artificial intelligence (AI)-enabled methods, such as recurrent neural networks (RNNs) and convolutional neural networks (CNNs), to process and analyze the collected operational data. From the industrial perspective, a key challenge lies in enhancing the effectiveness and explainability, as these methods often exhibit opaque and sophisticated network structures when dealing with the complex operational data. Meanwhile, recent advancements in graph neural networks (GNNs) demonstrate its effectiveness in supporting the analysis of complex relationships and dependencies. The adoption of GNN poses, however, inherent challenges when the data are unstructured. This article designs a novel framework that integrates self-organizing maps (SOMs) and GNN for the analysis of complex operational relationships and dependencies. In particular, the adoption of SOM allows the generation graph-structured data from unstructured raw datasets and thereby enhances a GNN’s ability to differentiate normal and anomalous conditions effectively. As case studies, we select multiple public datasets to compare the performance of the proposed framework with other benchmark methods. The results show that the proposed methods present promising results. In addition, compared with other baseline methods that use GNN-based structures to detect anomalies, the proposed framework achieves the highest $F1$ -score.