Dual-Branch Graph Learning with Frequency Gating for Industrial Sensor Anomaly and Cyberattack Detection

Industrial sensor systems are increasingly vulnerable to both physical anomalies and cyberattacks, while their collected time series typically present complex periodic and non-stationary characteristics, along with dynamic spatial dependencies among sensors. To address these issues, this paper proposes a dual-branch graph learning framework with frequency gating for simultaneous industrial sensor anomaly and cyberattack detection. The model first divides the input time series into multiple patches and decomposes each patch into periodic and non-stationary components via frequency analysis. Two graph isomorphism network branches, namely periodic GIN (P-GIN) and non-stationary GIN (NS-GIN), are designed to model the spatial dependencies of the two components separately, where the graph structure is adaptively learned using a Gaussian kernel-based mechanism. Furthermore, a frequency gating module is introduced in the non-stationary branch to enhance the representation of abnormal and attack-related features. Hierarchical temporal encoding is performed via intra-patch attention and inter-patch attention to capture both local and long-range temporal dependencies. Extensive experimental results on real-world industrial sensor datasets demonstrate that the proposed method achieves superior performance compared with state-of-the-art methods in both anomaly detection and cyberattack detection tasks.