cs.LGMar 11, 2026
SaveSpatio-Temporal Attention Graph Neural Network: Explaining Causalities With Attention
Organizations: Aalto University School of Science Computer Science Department P.O.Box 11000, 00076 AALTO, Finland
Abstract
Industrial Control Systems (ICS) underpin critical infrastructure and face growing cyber-physical threats due to the convergence of operational technology and networked environments. While machine learning-based anomaly detection approaches in ICS shows strong theoretical performance, deployment is often limited by poor explainability, high false-positive rates, and sensitivity to evolving system behavior, i.e., baseline drifting. We propose a Spatio-Temporal Attention Graph Neural Network (STA-GNN) for unsupervised and explainable anomaly detection in ICS that models both temporal dynamics and relational structure of the system. Sensors, controllers, and network entities are represented as nodes in a dynamically learned graph, enabling the model to capture inter-dependencies across physical processes and communication patterns. Attention mechanisms provide influential relationships, supporting inspection of correlations and potential causal pathways behind detected events. The approach supports multiple data modalities, including SCADA point measurements, network flow features, and payload features, and thus enables unified cyber-physical analysis. To address operational requirements, we incorporate a conformal prediction strategy to control false alarm rates and monitor performance degradation under drifting of the environment. Our findings highlight the possibilities and limitations of model evaluation and common pitfalls in anomaly detection in ICS. Our findings emphasise the importance of explainable, drift-aware evaluation for reliable deployment of learning-based security monitoring systems.
Figures & tables
Figure 1: A schematic overview of the STA-GNN model architecture. The workflow illustrates the processing stages from input windows to the decoder producing predictions. The intermediate blocks employ a two-phase attention mechanism that generates two complementary graphs, enabling inspection of the model’s decision making.
Figure 2: Example. Attack detected and contribution highest from red (highest) to yellow (lowest). The grey edges represent the learned embeddings + prior graph structure. The red edges come from the spatial attention. Only the strongest attention weights from/to anomalous nodes are plotted for interpretability. Red edge thickness reflects to strength of the attention. The graph nodes are organised and fixed by process stages in SWaT testbed dataset used in this study.
| SWaT | Modality | Nodes | #Features | #Instances | Duration | #Attacks |
| Dataset | ||||||
| 2015 | Physical | 51 | 1 | 95 000 | 7 d normal + 4 d attack | 41 |
| NetFlow | 9 | 11 | 95 000 | 7 d normal + 4 d attack | 41 | |
| NetFlow+Payload | 9 | 14 | 95 000 | 7 d normal + 4 d attack | 41 | |
| 2017 | Physical | 51 | 1 | 49 000 | 6 d normal | 0 |
| NetFlow | 9 | 11 | 17 000 | 2 d normal | 0 |
Table 1: Overview of the SWaT datasets used in this study across physical and network modalities. Measurements from physical sensors and network traffic were aggregated and resampled to 10-second intervals.
| Feature | Description |
| NetFlow features | |
| Rows sent / received | Number of flow records sent and received |
| Bytes sent / received | Total number of bytes sent and received from frame length |
| Source port entropy | Entropy of observed source ports |
| Protocol entropy | Entropy of observed protocols |
Table 2: Aggregated node-level features for the NetFlow and NetFlow+Payload data models. All features are sampled 10 seconds interval.
| Common Hyperparameters | Value(s) | Description |
| Embedding dimension | 128 | Dimensionality of latent node and temporal representations, controlling overall model capacity and attention head size. |
| Graph attention heads | 4 | Number of parallel subspaces used in the multi-head graph attention mechanism. |
| Top- neighbors | 6 | Maximum number of neighboring nodes attended to per node, controlling graph sparsity and computational cost. |
| Weight decay | L2 regularization strength applied to model parameters during optimization. | |
| Learnable Hyperparameters | ||
| Static prior scale | 10 | Weight of the static graph similarity prior relative to the dynamic context-based similarity. With this parameter, the importance of prior graph can be controlled by initializing it. |
Table 3: Hyperparameter search space and functional roles for the proposed graph-temporal neural network model. Some common hyperparameters, e.g., learning rate, are omitted.
| Model | Physical-level | NetFlow | NetFlow+Payload | ||||||
| F1 | FPR | AD | F1 | FPR | AD | F1 | FPR | AD | |
| K-means | 0.29 | 0.829 | 26 | – | – | – | – | – | – |
| SVM | 0.24 | 0.860 | 33 | – | – | – | – | – | – |
| Autoencoder | 0.72 | 0.003 | 5 | 0.19 | 0.90 | 36 | 0.64 | 0.053 | 8 |
| LSTM-AE | 0.71 | 0.016 | 6 | 0.20 | 0.88 | 36 | 0.73 | 0.003 | 10 |
| LSTM-VAE | 0.72 | 0.001 | 5 | 0.23 | 0.83 | 35 | 0.72 | 0.003 | 6 |
Table 4: Model comparison across physical and network modalities in terms of F1-score, false positive rate (FPR), and the number of attacks detected (AD). The classical models with high AD suffer from high FPR, which makes them impractical for realistic deployment scenarios. The STA-GNN* refers to a simplified variant of STA-GNN without temporal encoding or the temporal attention component. The best-performing models according to F1-score and AD are highlighted in bold.
| F1-max threshold | Conformal calibration threshold | ||||||
| Dataset | Modality | F1 max | FPR max | AD | F1 | FPR | AD |
| SWaT 2015 | Physical-level | 0.77 | 0.004 | 15 | 0.03 | 0.001 | 20 |
| Netflow | 0.22 | 0.881 | 36 | 0.01 | 0.001 | 9 | |
| Netflow+Payload | 0.74 | 0.006 | 16 | 0.02 | 0.001 | 22 | |
Table 5: Evaluation results of the STA-GNN model under two thresholding strategies: F1-maximization and difference nonconformity scoring. Choosing the latter gives highest AD, but with a very low F1-score. We emphasise that F1 does not always reflect the desired performance of the model.
Figure 3: Comparison of normalised sensor response windows (shaded red) during the attack window (shaded blue and separated with blue dashed line). (a) The attack to AIT202 was detected only once in the beginning of the attack. (b) The attack to DPIT301 was detected multiple times during the attack, from various sensors and actuators (a cascade failure). For clarity, we only show top 3 anomalous sensors per detected anomaly.
Figure 4: The FPR across datasets. Top (a): Model performance with (red) and without (blue) retraining. Bottom (b): Performance with recalibration of the 2015 model using the 2017 baseline. The FPR can be controlled with recalibration, which is often more feasible than retraining the model.
| Physical-level | Netflow+Payload | ||||
| Alarms Raised | Correct | Alarms Raised | Correct | ||
| Detection | Causality | Detection | Causality | ||
| 20 | 15 | 12 | 22 | 15 | 14 |
Table 6: Summary of correct detection and causal inference performance for the SWaT 2015 dataset across Physical-level and NetFlow+Payload modalities. The pure NetFlow modality is excluded because it did not yield meaningful results; see the detailed analysis in the Appendix A.
| Attack ID | Target | Modality | Latency | Detected Nodes | Detection | Causality |
| 6 | AIT202 | Physical | Immediate ( 0 min) | AIT202, P203, PIT502 | Yes | Yes |
| 8 | DPIT301 | Physical | Delayed ( 14 min) | FIT601, DPIT301, P602 | Yes | Yes |
| 19 | AIT504 | Physical | Short delay ( 5 min) | AIT504, P502, AIT503 | Yes | Partially |
| 29 | PLC 0.20 | NetFlow+Payload | Immediate ( 0 min) | - | No | No |
| 30 | LIT101, P101, MV201 | Physical | Immediate ( 0 min) | FIT201, AIT502, P205, LIT101, AIT202 | Yes | Partially |
| 32 | PLC 0.30 | NetFlow+Payload | Immediate ( 0 min) | PLC 0.30 | Yes | Yes |
Table 7: Summary of attack-level detection performance with selected examples. Detection latency is measured from attack start to first alarm. Detection indicates whether at least one identified node corresponds to the true attack source or directly affected component. Causality evaluates whether the attention graph aligns with known system dependencies. A complete per-attack breakdown, including reasoning and full feature attribution, is provided in the Appendix Appendix: Analysis of the Attention Weights .
Figure 5: Attack on DPIT301 detected via anomalies in FIT601, with attention edges highlighting system-level dependencies between distant process stages.
Figure 6: Attack to AIT504 without (a) and with (b) soft prior graph. The soft prior helps filtering the edges that are not related to causality. The grey edges in the background are the contextual learned edges + static graph from temporal attention. Only spatial attention edges from anomalous nodes are retained for clarity. Note that the detected anomaly points are also removed, because the prior restricts the dynamical similarity.
Figure 7: Analysis Pipeline
| Model | Attack | Attack Time | Attack Description | Alarm Raised | Detected Correctly | Causality Detected Correctly | Detected Features | Details |
| 2015 | 1 | 28/12/2015 10:29:14 - 10:44:53 | Open MV101. Tank overflow. | No | - | - | No alarms raised before the second attack. | |
| 2015 | 2 | 28/12/2015 10:51:08 - 10:58:30 | Turn on P102. Pipe bursts. | Yes | No | Yes | FIT601, MV303, MV301 | The alarm raised at 10:52:30 falls within the ground-truth attack interval and therefore meets the temporal criterion for correct detection. However, the set of alarmed features does not directly include the true attack point, P102. Inspection of the attention graph shows that FIT601 exhibits strong outgoing attention toward P101, P102, MV301, MV302, and PIT502. In addition, MV303, MV301, and MV302 form strongly connected patterns, with evident internal subsystem coupling between MV303 and MV302, as well as between MV301 and MV201. Although both P101 and P102 receive attention, P102 is explicitly present as a destination node. This suggests that the attack on P102 primarily manifested through altered pump behavior, leading to observable flow deviations captured by FIT601, which in turn triggered control responses reflected in MV301 and MV303. |
| 2015 | 3 | 28/12/2015 11:22:00 - 11:28:22 | Increase by 1 mm every second. Tank Underflow; Damage P101. | No | - | - | - | No alarms raised between 10:52:30 and 12:00:40. |
| 2015 | 4 | 28/12/2015 11:47:30 - 11:54:08 | Open MV504. Halt RO shut down sequence; Reduce life of RO. | No | - | - | - | The alarm at 12:00:40 occurs after the attack window and does not involve the true attack point MV504. Given the temporal mismatch and lack of architectural relevance among the alarmed features, the alarm is considered a false positive and the attack a missed detection. |
| 2015 | 6 | 28/12/2015 12:00:55 -12:04:10 | Set value of AIT202 as 6. P203 turns off; Change in water quality. | Yes | Yes | Yes | AIT202, P203, PIT502 | The alarm raised at 12:00:40 occurs immediately prior to the labeled attack interval (12:00:55–12:04:10) and correctly includes the true attack point AIT202. Analysis of the attention graph indicates that anomalies originating in water quality measurements (AIT202) propagate to pump behavior at P203. Multiple upstream components (P201–P206, FIT201, MV201, and AIT201) exhibit strong attention toward P203, identifying it as a downstream aggregation point in the process flow. Furthermore, PIT502 receives substantial attention from a wide range of upstream flow, pump, and analyser variables (e.g. MV101, P302, and AIT401), consistent with pressure variations arising as downstream effects rather than serving as the root cause of the anomaly. |
| 2015 | 7 | 28/12/2015 12:08:25 - 12:15:33 | Water level increased above HH. Stop of inflow; Tank underflow; Damage P301. | No | - | - | - | No alarms raised between 12:00:40 and 13:12:40. |
Table 8: SWaT2015 Physical.
| Model | Attack | Attack Time | Attack Description | Alarm Raised | Detected Correctly | Causality Detected Correctly | Details |
| 2015 | 2 | 28/12/2015 10:51:08 - 10:58:30 | Turn on P-102. Pipe bursts. | Yes | Yes | Yes | The PLC .10 and .20 have highest scores. .60 raises often alarm when .10 is disturbed. This is expected because system is closed. Attention edges show correlation between .10, .60 and .20. |
| 2015 | 3 | 28/12/2015 11:22:00 - 11:28:22 | Increase by 1 mm every second. Tank Underflow; Damage P101 | Yes | No | Partially | Attack Detected in .60-,.40- and .30. The attack was to .10. .60 and .10 are connected in closed loop, and therefore, any attacks through .10 might resonate in .60. |
| 2015 | 7 | 28/12/2015 12:08:25 - 12:15:33 | Water level in-creased above HH. Stop of inflow; Tank underflow; Damage P301. | Yes | Yes | No | Attack detected in .30 and .40. The attention edges remain inconclusive. Most of the edges originate from .10 which was not part of the attack. |
| 2015 | 8 | 28/12/2015 13:10:10 - 13:26:13 | Set value of DPIT as >40kpa. Backwash process is started again and again; Normal operation stops; Decrease in water level of tank 401. Increase in water level of tank 301. | Yes | Yes | Yes | Attack detected in .30, .40, and .60, as expected. Highest attention weights show correct origins. |
| 2015 | 11 | 28/12/2015 14:19:00 - 14:28:20 | Set value of FIT-401 as 0. UV shutdown; P-501 turns off. | Yes | Yes | Partially | Correct source. The PLC:s around .40 raise alarms. One of three highest attention edges show relation between .40 and .60. The rest point to .10, which is considered incorrect. |
| 2015 | 17 | 29/12/2015 14:38:12 - 14:50:08 | Do not let MV-303 open. Halt of stage 3 because change in the backwash process. | Yes | Yes | Partially | Alarm in .60 and .30. Known behaviour for backwash to affect the 60. Part of the edges point to .20, which is considered incorrect. |
Table 9: SWaT2015 Netflow+Payload.