Anomaly detection has emerged as one of the core research topics to support workflow applications across various domains. To differentiate anomalies from underlying normal patterns of workflows, Graph Neural Networks (GNNs) models have been introduced. These models leverage time series data to construct graph structures, in order to explicitly capture task dependencies among industrial Internet of Things (IoT) devices, and thus, to identify deviations from predicted behaviours as anomalies. However, existing forecasting-based anomaly detection methods may not accurately detect certain anomalies, since they have seldom considered valuable information uncovered by historical sensory data, but presented as domain knowledge. To address this limitation, this paper proposes a Knowledge-enhanced graph attention-based Anomaly Detection (KeAD) method. Specifically, a knowledge-enhanced graph structure is constructed by incorporating domain-specific knowledge to represent spatio-temporal dependencies between IoT devices. Based on which, a knowledge-enhanced graph attention-based forecasting network is developed to predict the future behaviours of IoT devices. Anomalies, such as those caused by cyber-attacks in workflows, are detected by analyzing deviations from these predicted behaviours in conjunction with domain-specific knowledge. A case study is presented, along with extensive experiments conducted on publicly available datasets. Evaluation results demonstrate that KeAD outperforms the state-of-the-art techniques in terms of anomaly detection accuracy.

Anomaly detection is a long-standing research topic to support the prompt remedy of potential risks for dependency-aware tasks, where Graph Neural Networks (GNNs) models have been adopted to differentiate anomalies from normal patterns. Generally, GNN models utilize time series data to construct graph structures for capturing task dependencies between Internet of Things (IoT) devices, such that deviations from predicted behaviours are assumed as anomalies. Current forecasting-based anomaly detection methods can hardly detect anomalies, which are uncovered by historical sensory data, but are explicitly specified by domain knowledge. To solve this issue, this paper proposes a Knowledge-enhanced graph attention-based Anomaly Detection (KeAD) method. Specifically, a knowledge-enhanced graph structure is constructed by incorporating domain-specific knowledge to represent spatio-temporal dependencies between IoT devices. Thereafter, a knowledge-enhanced graph attention-based forecasting network is developed to predict future behaviours of IoT devices. Anomalies are detected by analyzing deviations from these predicted behaviours, taking domain-specific knowledge into account. Extensive experiments are conducted based on publicly-available datasets, and evaluation results demonstrate that our KeAD outperform the state-of-the-art techniques in terms of the accuracy of anomaly detection.

With the applicability of edge intelligence in various domains, anomaly detection, which aims to identify unusual and infrequent circumstances, is regarded as a regularly performed task to guarantee the health of the Internet of Things (IoT) applications. Generally, sensory data are gathered at the network edge and completely transmitted to the cloud, where computational-heavy algorithms are mostly adopted to determine the locations of anomaly. Considering the occurrence infrequency of anomalies, this strategy may transmit relatively huge volume of sensory data, which may reflect a healthy situation indeed, to the cloud. To mitigate this problem, this article proposes an accurate anomaly detection mechanism with energy efficiency in three-tier IoT–edge–cloud collaborative networks. Specifically, after gathering sensory data provided by IoT nodes in certain edge networks, the edge node applies the marching squares algorithm to generate isopleths, where an isopleth may capture the boundary of anomaly. A sensory data filtering mechanism is conducted at the edge tier, such that anomaly-relevant sensory data are transmitted to the cloud and, thus, the network traffic is decreased significantly. Thereafter, the boundary of anomaly is obtained, and the locations of candidate boundary nodes are determined by adopting the Kriging spatial interpolation algorithm at the cloud tier. These locations are traversed by mobile sensing nodes at edge networks, and their sensory data are gathered for boundary refinement. Extensive experiments are conducted on an air quality hazardous gas data set from Toward Data Science, and evaluation results show that our technique outperforms the state-of-the-art counterparts in boundary accuracy and energy consumption.