IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems
2026-06-01 • Cryptography and Security
Cryptography and SecurityMachine Learning
AI summaryⓘ
The authors address the challenge of detecting unusual behavior in industrial systems that control machinery, which is hard because many parts depend on each other in complex ways. They created IstGPT, a tool that combines large language models and graph learning to better understand how sensors and actuators are connected over time. By using various industrial data sources and refining the connection graphs, their method can detect anomalies more accurately and in real time. They tested IstGPT on multiple datasets and found it outperformed existing methods.
Industrial Internet of Things (IIoT)Industrial Control Systems (ICS)Anomaly DetectionLarge Language Models (LLMs)Graph Neural Networks (GNNs)Sensor-Actuator DependencyCyber-Physical SystemsEncoder-Decoder ArchitectureReconstruction ErrorTime-aware Metrics
Authors
Yuchen Zhang, Ning Xi, Pengbin Feng, Shigang Liu, Jianfeng Ma, Yulong Shen, Yanan Sun, Xiaolin Zhou
Abstract
Industrial Internet systems face increasing threats from sophisticated industrial control system (ICS) attacks, resulting in critical safety incidents. However, existing tools exhibit limited effectiveness in real-time anomaly detection due to the complex dependencies among sensors and actuators. To tackle this, we present IstGPT, the first industrial anomaly detection tool based on LLMs and graph learning to provide real-time protection against a wide range of ICS attacks. IstGPT achieves fine-grained and precise modeling on spatial-temporal dependencies in industrial cyber-physical systems. It first leverages industrial multi-modal knowledge, including operational data, technical documents, and system diagrams, to extract sensor-actuator dependency graphs via multi-stage prompt engineering. Then, LLM-Optimation iteratively refines the graph based on node accuracy, edge consistency, and logical coherence. Finally, IstGPT integrated improved graph neural networks with an encoder-decoder architecture to detect anomalies via reconstruction errors. We evaluate IstGPT against 12 state-of-the-art baselines on 9 datasets, including 2 public, 6 simulated, and a real-world robotic arm dataset. IstGPT achieves the best F1-scores and eTaF1 (a newer time-aware metric) across nine datasets. We further discuss the feasibility of deploying IstGPT in real-world industrial scenarios.