Clustering-Based Collective Anomaly Detection in IoT Systems: A Graph Neural Network Approach

Dalila Khettaf; Djamel Djenouri; Zeinab Rezaeifar; Youcef Djenouri

cs.LGAug 26, 2026

Clustering-Based Collective Anomaly Detection in IoT Systems: A Graph Neural Network Approach

Authors: Dalila Khettaf, Djamel Djenouri, Zeinab Rezaeifar, Youcef Djenouri

Organizations: University of the West of England(UWE) Bristol BS16 1QY, England · University of South-Eastern Norway, Kongsberg, 3616 Norway

Abstract

The rapid advancement of Internet of Things (IoT) technology has led to the widespread deployment of smart, interconnected devices across a range of domains. However, this expansion has also resulted in a substantial increase in network traffic, creating more opportunities for malicious actors to launch cyberattacks and compromise sensitive information, thereby increasing the need for effective anomaly detection. The state-of-the-art in anomaly detection has predominantly focused on point anomalies. In contrast, the detection of collective anomalies remains relatively under-explored in the literature. In this paper, we introduce Unsupervised Graph Collective Anomaly Detection (UGCAD), a novel frame- work designed to identify collective anomalies in IoT network traffic. Unlike many existing methods, UGCAD operates on graph-structured data without any prior knowledge of group labels or membership. It leverages a variational graph autoencoder (VGAE) to learn the graph representation, which is subsequently used to enhance a clustering algorithm for effective grouping of nodes. To detect collective anomalies, clusters identified as normal are first aggregated and refined, after which anomaly scores are applied to detect collective anomalies. Extensive experiments conducted on the CICIoT2023 and ToN-IoT network datasets demonstrate the effectiveness of UGCAD in both clustering and collective anomaly detection (CAD). Furthermore, comparative evaluations against several traditional and state-of-the-art clustering-based CAD approaches confirm the superiority of UGCAD in accurately detecting collective anomalies.

Figures & tables

Method	DL	Clustering	Graph Data	CAD	Prior Knowledge	Supervised
GLAD [ 10 ]	No	No	Yes	Yes	No	No
FGM [ 11 ]	No	Yes	Yes	No	No	No
CHGM [ 16 ]	No	No	Yes	No	Yes	No
CPA-TCN [ 12 ]	Yes	No	Yes	No	No	No
iForestFS [ 13 ]	No	No	Yes	No	No	No
Method by [ 14 ]	Yes	No	Yes	No	No	No

TABLE I : Comparison of Collective Anomaly Detection Methods

Graph	# Nodes	# Edges	# Normal	# Anomalous
$G_{1}$	12,500	31,250	10,000	2,500
$G_{2}$	125,000	312,500	100,000	25,000
$G_{3}$	1,250,000	368,735	1,000,000	250,000
$G^{\prime}_{1}$	12,000	60,000	96,000	2,400
$G^{\prime}_{2}$	16,000	80,000	13,600	2,400
$G^{\prime}_{3}$	24,000	120,000	21,600	2,400

TABLE II : Statistics about the generated graphs.

Dataset	Metric	KNN	OCSVM	LOF	IF	Ours
CICIoT2023	AUC	0.411	0.503	0.754	0.481	~1
CICIoT2023	PR	0.198	0.198	0.560	0.204	~1
TON-IoT	AUC	0.319	0.495	0.583	0.535	0.61
TON-IoT	PR	0.1474	0.212	0.267	0.224	0.557

TABLE III : The Evaluation Results of UGCAD versus Traditional Anomaly Detection Methods.

Dataset	$G_{1}$	$G_{2}$	$G_{3}$
Purity	0.996	0.997	0.998

TABLE IV : Performance of the EDC Module w.r.t Cluster Purity.

Panel of Figure 6 — Fig. 3 : Performance comparison of different methods on the three graphs $G_{1}$ , $G_{2}$ , and $G_{3}$ , respectively

Fig. 5 : Visualization on the $G_{3}$ dataset using PCA.

Explore similar work

Hierarchical Reference Sets for Robust Unsupervised Detection of Scattered and Clustered Outliers
Mar 13, 2026Yiqun Zhang, Zexi Tan, Xiaopeng Luo +1Anomaly Detection Unsupervised Anomaly Detection
School of Computer Science and Technology, Guangdong University of Technology, Guangzhou, China
CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification
May 7, 2026Iason Ofeidis, Nikos Papadis, Randeep Bhatia +2IoT Intrusion Detection Network Intrusion Detection
Yale University, New Haven, CT, USA · Nokia Bell Labs, Murray Hill, NJ, USA
An Efficient Unsupervised Federated Learning Approach for Anomaly Detection in Heterogeneous IoT Networks
Feb 27, 2026Mohsen Tajgardan, Atena Shiranzaei, Mahdi Rabbani +2Unsupervised Anomaly Detection Anomaly Detection
Faculty of Electrical and Computer Engineering, Qom University of Technology, Qom, Iran · Department of Computer Engineering, Faculty of Industry and Mining (Khash), Sistan and Baluchestan University, Zahedan, Iran · Canadian Institute for Cybersecurity, University of New Brunswick, NB, Canada +1

Mar 13, 2026J/K move · Enter open · S save

Hierarchical Reference Sets for Robust Unsupervised Detection of Scattered and Clustered Outliers

Yiqun Zhang, Zexi Tan, Xiaopeng Luo, Yunlin Liu

School of Computer Science and Technology, Guangdong University of Technology, Guangzhou, China

Anomaly Detection Unsupervised Anomaly Detection

Open paper AskPDF arXiv

Most real-world IoT data analysis tasks, such as clustering and anomaly event detection, are unsupervised and highly susceptible to the presence of outliers. In addition to sporadic scattered outliers caused by factors such as faulty sensor readings, IoT systems often exhibit clustered outliers. These occur when multiple devices or nodes produce similar anomalous measurements, for instance, owing to localized interference, emerging security threats, or regional false alarms, forming micro-clusters. These clustered outliers can be easily mistaken for normal behavior because of their relatively high local density, thereby obscuring the detection of both scattered and contextual anomalies. To address this, we propose a novel outlier detection paradigm that leverages the natural neighboring relationships using graph structures. This facilitates multi-perspective anomaly evaluation by incorporating reference sets at both local and global scales derived from the graph. Our approach enables the effective recognition of scattered outliers without interference from clustered anomalies, whereas the graph structure simultaneously helps reflect and isolate clustered outlier groups. Extensive experiments, including comparative performance analysis, ablation studies, validation on downstream clustering tasks, and evaluation of hyperparameter sensitivity, demonstrate the efficacy of the proposed method. The source code is available at https://github.com/gordonlok/DROD.

Abstract

Explore similar work

Hierarchical Reference Sets for Robust Unsupervised Detection of Scattered and Clustered Outliers

CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification

An Efficient Unsupervised Federated Learning Approach for Anomaly Detection in Heterogeneous IoT Networks