{"id":"https://openalex.org/W4415974448","doi":"https://doi.org/10.1016/j.procs.2025.09.516","title":"Towards Graph-based Self-learning of Industrial Process Behaviour for Anomaly Detection","display_name":"Towards Graph-based Self-learning of Industrial Process Behaviour for Anomaly Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4415974448","doi":"https://doi.org/10.1016/j.procs.2025.09.516"},"language":"en","primary_location":{"id":"doi:10.1016/j.procs.2025.09.516","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.516","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1016/j.procs.2025.09.516","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5090671263","display_name":"Ankush Meshram","orcid":"https://orcid.org/0000-0001-6903-9446"},"institutions":[{"id":"https://openalex.org/I102335020","display_name":"Karlsruhe Institute of Technology","ror":"https://ror.org/04t3en479","country_code":"DE","type":"education","lineage":["https://openalex.org/I102335020","https://openalex.org/I1305996414"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Ankush Meshram","raw_affiliation_strings":["KASTEL Security Research Labs, Vision and Fusion Laboratory (IES), Karlsruhe Institute of Technology, 76131 Karlsruhe, Germany"],"affiliations":[{"raw_affiliation_string":"KASTEL Security Research Labs, Vision and Fusion Laboratory (IES), Karlsruhe Institute of Technology, 76131 Karlsruhe, Germany","institution_ids":["https://openalex.org/I102335020"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045974121","display_name":"Markus Karch","orcid":"https://orcid.org/0000-0002-5683-4499"},"institutions":[{"id":"https://openalex.org/I4210111500","display_name":"Fraunhofer Institute of Optronics, System Technologies and Image Exploitation","ror":"https://ror.org/01zx97922","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210111500","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Markus Karch","raw_affiliation_strings":["Information Management and Production Control, Fraunhofer Institute of Optronics, System Technologies and Image Exploitation (IOSB), 76131 Karlsruhe, Germany"],"affiliations":[{"raw_affiliation_string":"Information Management and Production Control, Fraunhofer Institute of Optronics, System Technologies and Image Exploitation (IOSB), 76131 Karlsruhe, Germany","institution_ids":["https://openalex.org/I4210111500"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023136097","display_name":"Christian Haas","orcid":"https://orcid.org/0000-0002-2690-5962"},"institutions":[{"id":"https://openalex.org/I4210111500","display_name":"Fraunhofer Institute of Optronics, System Technologies and Image Exploitation","ror":"https://ror.org/01zx97922","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210111500","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Christian Haas","raw_affiliation_strings":["Information Management and Production Control, Fraunhofer Institute of Optronics, System Technologies and Image Exploitation (IOSB), 76131 Karlsruhe, Germany"],"affiliations":[{"raw_affiliation_string":"Information Management and Production Control, Fraunhofer Institute of Optronics, System Technologies and Image Exploitation (IOSB), 76131 Karlsruhe, Germany","institution_ids":["https://openalex.org/I4210111500"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5073930300","display_name":"J\u00fcrgen Beyerer","orcid":"https://orcid.org/0000-0003-3556-7181"},"institutions":[{"id":"https://openalex.org/I4210111500","display_name":"Fraunhofer Institute of Optronics, System Technologies and Image Exploitation","ror":"https://ror.org/01zx97922","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210111500","https://openalex.org/I4923324"]},{"id":"https://openalex.org/I102335020","display_name":"Karlsruhe Institute of Technology","ror":"https://ror.org/04t3en479","country_code":"DE","type":"education","lineage":["https://openalex.org/I102335020","https://openalex.org/I1305996414"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"J\u00fcrgen Beyerer","raw_affiliation_strings":["Information Management and Production Control, Fraunhofer Institute of Optronics, System Technologies and Image Exploitation (IOSB), 76131 Karlsruhe, Germany","KASTEL Security Research Labs, Vision and Fusion Laboratory (IES), Karlsruhe Institute of Technology, 76131 Karlsruhe, Germany"],"affiliations":[{"raw_affiliation_string":"Information Management and Production Control, Fraunhofer Institute of Optronics, System Technologies and Image Exploitation (IOSB), 76131 Karlsruhe, Germany","institution_ids":["https://openalex.org/I4210111500"]},{"raw_affiliation_string":"KASTEL Security Research Labs, Vision and Fusion Laboratory (IES), Karlsruhe Institute of Technology, 76131 Karlsruhe, Germany","institution_ids":["https://openalex.org/I102335020"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5090671263"],"corresponding_institution_ids":["https://openalex.org/I102335020"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.40933651,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"270","issue":null,"first_page":"3913","last_page":"3923"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.8938999772071838,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.8938999772071838,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.038100000470876694,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.027799999341368675,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6485000252723694},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5281000137329102},{"id":"https://openalex.org/keywords/preprocessor","display_name":"Preprocessor","score":0.34779998660087585},{"id":"https://openalex.org/keywords/snapshot","display_name":"Snapshot (computer storage)","score":0.3467000126838684},{"id":"https://openalex.org/keywords/power-graph-analysis","display_name":"Power graph analysis","score":0.3384000062942505},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3325999975204468},{"id":"https://openalex.org/keywords/convolutional-neural-network","display_name":"Convolutional neural network","score":0.32679998874664307},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.29589998722076416}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.800000011920929},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6485000252723694},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5281000137329102},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4262999892234802},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.421999990940094},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4120999872684479},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.34779998660087585},{"id":"https://openalex.org/C55282118","wikidata":"https://www.wikidata.org/wiki/Q252683","display_name":"Snapshot (computer storage)","level":2,"score":0.3467000126838684},{"id":"https://openalex.org/C106937863","wikidata":"https://www.wikidata.org/wiki/Q7236518","display_name":"Power graph analysis","level":3,"score":0.3384000062942505},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3325999975204468},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.32679998874664307},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3046000003814697},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.29589998722076416},{"id":"https://openalex.org/C61665672","wikidata":"https://www.wikidata.org/wiki/Q303100","display_name":"Graph isomorphism","level":4,"score":0.2897999882698059},{"id":"https://openalex.org/C157406716","wikidata":"https://www.wikidata.org/wiki/Q4115842","display_name":"Topological graph theory","level":5,"score":0.2696000039577484},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.26579999923706055},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.26570001244544983},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2632000148296356},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.2621999979019165},{"id":"https://openalex.org/C64339825","wikidata":"https://www.wikidata.org/wiki/Q722659","display_name":"Graph property","level":5,"score":0.2596000134944916},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.25679999589920044},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.2567000091075897},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.2554999887943268}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1016/j.procs.2025.09.516","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.516","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},{"id":"pmh:oai:publica.fraunhofer.de:publica/499209","is_oa":true,"landing_page_url":"https://publica.fraunhofer.de/handle/publica/499209","pdf_url":null,"source":{"id":"https://openalex.org/S4306400318","display_name":"Fraunhofer-Publica (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"journal article"}],"best_oa_location":{"id":"doi:10.1016/j.procs.2025.09.516","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.516","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320325698","display_name":"Helmholtz Association","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W2064741734","https://openalex.org/W2086789804","https://openalex.org/W2089554624","https://openalex.org/W2130196635","https://openalex.org/W2600702321","https://openalex.org/W2740051095","https://openalex.org/W3036521665","https://openalex.org/W3087257704","https://openalex.org/W3134204681","https://openalex.org/W3152893301","https://openalex.org/W3187966659","https://openalex.org/W3191490876","https://openalex.org/W3196581146","https://openalex.org/W3208773001","https://openalex.org/W4387583549"],"related_works":[],"abstract_inverted_index":{"The":[0],"increasing":[1],"sophistication":[2],"of":[3,17,31,38,79,100,129,178,187,197,212],"cyber":[4],"threats":[5],"targeting":[6],"industrial":[7,22,39,81,210],"control":[8],"systems":[9],"(ICS)":[10],"necessitates":[11],"advanced":[12],"anomaly":[13,46,68,154,206],"detection":[14,155,207],"techniques":[15],"capable":[16],"identifying":[18],"attacks":[19],"by":[20],"analyzing":[21],"process":[23,203],"data":[24],"exchange.":[25],"This":[26],"paper":[27],"addresses":[28],"the":[29,35,55,74,87,98,127,167,179,185,195,209,213],"challenge":[30],"representing":[32],"and":[33,61,76,92,107,121,175,194],"learning":[34],"spatio-temporal":[36,56,189],"characteristics":[37,57,190],"network":[40],"communication":[41],"as":[42,58],"Graph":[43,63,103,118,122],"for":[44,67,126,205],"self-learning":[45],"detection.":[47,69],"We":[48,96],"propose":[49],"a":[50,136],"novel":[51],"framework":[52],"that":[53,145],"models":[54,148],"graph":[59,71,130,192],"snapshots":[60],"applies":[62],"Neural":[64,114],"Networks":[65],"(GNNs)":[66],"Each":[70],"snapshot":[72],"captures":[73],"structural":[75],"temporal":[77],"dynamics":[78],"PROFINET-based":[80],"traffic,":[82],"with":[83],"edge":[84],"features":[85],"encoding":[86,188],"payload":[88],"transitions,":[89],"timing":[90],"intervals,":[91],"cycle":[93],"counter":[94],"differences.":[95],"evaluate":[97],"performance":[99],"an":[101],"isotropic":[102,168],"Convolutional":[104],"Network":[105,115],"(GCN)":[106],"anisotropic":[108,146,198],"GNN":[109,147],"variants":[110],"\u2013":[111,125],"Message":[112],"Passing":[113],"(MPNN),":[116],"Gated":[117],"ConvNet":[119],"(GatedGCN)":[120],"Transformer":[123],"(GT)":[124],"task":[128],"classification":[131],"on":[132,161,191],"real-world":[133],"datasets":[134],"from":[135],"miniaturized":[137,180],"deterministic":[138],"production":[139,215],"plant.":[140,181,216],"Our":[141],"evaluation":[142],"results":[143],"demonstrate":[144],"(MPNN,":[149],"GatedGCN,":[150],"GT)":[151],"achieve":[152],"complete":[153],"(specificity)":[156],"while":[157],"maintaining":[158],"perfect":[159],"recall":[160],"normal":[162,174],"behavior":[163],"(sensitivity).":[164],"In":[165],"contrast,":[166],"GCN":[169],"fails":[170],"to":[171,200],"distinguish":[172],"between":[173],"anomalous":[176],"states":[177],"These":[182],"findings":[183],"highlight":[184],"efficacy":[186],"edges":[193],"capability":[196],"GNNs":[199],"learn":[201],"complex":[202],"behaviors":[204],"in":[208],"networks":[211],"evaluated":[214]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-11-06T00:00:00"}