Anomaly detection with high accuracy, recall, and low error rate is critical for the safe and uninterrupted operation of cyber-physical systems. However, detecting anomalies in multimodal time series with different modalities obtained from cyber-physical systems is challenging. Although deep learning methods show very good results in anomaly detection, they fail to detect anomalies according to the requirements of cyber-physical systems. In the use of graph-based methods, data loss occurs during the conversion of time series into graphs. The fixed window size used to transform time series into graphs causes a loss of spatio-temporal correlations. In this study, we propose an Event Aware Graph Attention Network (EA-GAT), which can detect anomalies by event-based cyber-physical system analysis. EA-GAT detects and tracks the sensors in cyber-physical systems and the correlations between them. The system analyzes and models the relationship between the components during the marked periods as a graph. Anomalies in the system are found through the created graph models. Experiments show that the EA-GAT technique is more effective than other deep learning methods on SWaT, WADI, MSL datasets used in various studies. The event-based dynamic approach is significantly superior to the fixed-size sliding window technique, which uses the same learning structure. In addition, anomaly analysis is used to identify the attack target and the affected components. At the same time, with the slip subsequence module, the data is divided into subgroups and processed simultaneously.

中文翻译：

---

EA-GAT：网络物理系统上的事件感知图注意网络

具有高精度、召回率和低错误率的异常检测对于网络物理系统的安全和不间断运行至关重要。然而，检测从网络物理系统获得的不同模态的多模态时间序列中的异常具有挑战性。尽管深度学习方法在异常检测方面显示出非常好的效果，但它们未能根据信息物理系统的要求检测异常。在使用基于图的方法时，在将时间序列转换为图的过程中会发生数据丢失。用于将时间序列转换为图形的固定窗口大小会导致时空相关性的损失。在本研究中，我们提出了一种事件感知图注意网络（EA-GAT），它可以通过基于事件的网络物理系统分析来检测异常。 EA-GAT 检测并跟踪网络物理系统中的传感器以及它们之间的相关性。系统以图表的形式对标记期间内组件之间的关系进行分析和建模。通过创建的图模型发现系统中的异常情况。实验表明，在各种研究中使用的 SWaT、WADI、MSL 数据集上，EA-GAT 技术比其他深度学习方法更有效。基于事件的动态方法明显优于使用相同学习结构的固定大小滑动窗口技术。此外，异常分析用于识别攻击目标和受影响的组件。同时，通过滑动子序列模块，将数据分为子组并同时处理。