DART-GNN: A Dynamic Recurrent Graph Neural Network for Multivariate Time Series Anomaly Detection

Abstract

Detecting anomalies in multivariate time series is critical for the safety and reliability of complex cyber-physical systems. Graph Neural Networks (GNNs) have shown great promise in this area by explicitly modeling the relational structure between sensors to improve detection. However, the performance of most GNNs is constrained by their reliance on static graphs, which are unable to capture the evolving nature of relationships between sensors in dynamic environments. To address this limitation, we propose the Dynamic Attention Recurrent Two-step Graph Neural Network (DART-GNN). Our framework constructs a time-specific dependency graph by first using a Gated Recurrent Unit (GRU) to encode temporal context and then applying a self-attention mechanism to infer relationships. A two-step Graph Attention Network (GAT) then performs deep aggregation on this dynamic graph, enabling the model to capture complex, higher-order interactions by propagating information from second-order neighbors. We validated our model's performance through rigorous experiments on the widely-used SWaT and WADI public benchmarks. The results confirm that DART-GNN achieves a new state-of-the-art, demonstrating superior performance compared to a broad spectrum of baseline methods.