GRAPH NEURAL NETWORK BASED SPATIO-TEMPORAL MODELLING FOR ANOMALY DETECTION IN COMPLEX NETWORK SYSTEMS

Abstract

The high dynamics and relational nature of data generated by modern interconnected systems, such as financial transaction networks, IoT settings, communication networks, and cyber-physical systems, pose a significant challenge for anomaly detection. Such environments often have evolving graph structures, temporal dependencies and complex interaction patterns that cannot be captured by traditional machine learning approaches. In this thesis, we propose GNN-based spatio-temporal frameworks for anomaly detection in dynamic network systems via three major contributions: DySTAL-AD, CaT-GNN and STARGATE. DySTAL-AD (Dynamic Self-Attention and LSTM-based Anomaly Detection) is an anomaly detection approach for IoT communication networks based on dynamic graph construction, structural and temporal self-attention, and LSTM refinement. We evaluate the framework on the CICIDS-2017, CICIDS-2018 and CICIoT-2022 datasets, and achieve better Precision, Recall, F1-score and Accuracy compared to GCN, GAT, GRU and DySAT baselines. The second contribution, CaT-GNN [29] (Causal-Temporal Graph Neural Network), fuses causal reasoning with temporal graph learning to provide robust and interpretable fraud detection in dynamic financial transaction networks. To tackle the issue of temporal drift and spurious correlations, we propose a framework with Temporal Graph Encoder and Causal Inspector and Causal Intervener modules. Experiments on the Elliptic Bitcoin and PaySim datasets show improved AUC, F1-score, and interpretability compared to existing temporal and graph-based models. The third work, STARGATE (Spatio-Temporal Anomaly Recognition with Graph Attention Networks and Transformer Encoder), is proposed for anomaly detection in satellite telemetry systems. We use Graph Attention Networks (GAT) to model the spatial dependencies and a Transformer encoder to learn long-range temporal dependencies in the telemetry sequences. Experimental results on NASA SMAP and MSL datasets show strong anomaly detection capability with high Precision, Recall and F1-score, compared to existing baseline and hybrid models. Overall, the proposed frameworks demonstrate that the combination of graph representation learning, temporal modeling, self-attention mechanisms, recurrent refinement, transformer-based sequence learning, and causal reasoning can greatly improve the performance, robustness, and interpretability of anomaly detection in evolving complex network systems. This thesis provides scalable and efficient solutions for applications of cybersecurity, financial security, and satellite telemetry anomaly detection.