Spatio-Temporal Attention Graph Neural Network: Explaining Causalities With Attention

• Published in: IEEE Access
• Main Authors: Kosti Koistinen, Kirsi Hellsten, Joni Herttuainen, Kimmo K. Kaski
• Format: Article
• Language: English
• Published: IEEE 2026-01-01
• Subjects: Conformal prediction; critical infrastructure; cyber-physical systems; dynamic graphs; complex networks; explainability
• Online Access: https://ieeexplore.ieee.org/document/11556923/

Industrial Control Systems (ICS) underpin critical infrastructure and face growing cyber–physical threats due to the convergence of operational technology and networked environments. While machine learning–based anomaly detection approaches in ICS shows strong theoretical performance, deployment is often limited by poor explainability, high false-positive rates, and sensitivity to evolving system behavior, i.e., baseline drifting. We propose a Spatio-Temporal Attention Graph Neural Network (STA-GNN) for unsupervised and explainable anomaly detection in ICS that models both temporal dynamics and relational structure of the system. Sensors, controllers, and network entities are represented as nodes in a dynamically learned graph, enabling the model to capture inter-dependencies across physical processes and communication patterns. Attention mechanisms provide influential relationships, supporting inspection of correlations and potential causal pathways behind detected events. The approach supports multiple data modalities, including SCADA point measurements, network flow features, and payload features, and thus enables unified cyber–physical analysis. To address operational requirements, we incorporate a conformal prediction strategy to control false alarm rates and monitor performance degradation under drifting of the environment. Our findings highlight the possibilities and limitations of model evaluation and common pitfalls in anomaly detection in ICS. Our findings emphasise the importance of explainable, drift-aware evaluation for reliable deployment of learning-based security monitoring systems.