Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2606.01691 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866914621811589120 |
|---|---|
| author | Zhang, Yuchen Xi, Ning Feng, Pengbin Liu, Shigang Ma, Jianfeng Shen, Yulong Sun, Yanan Zhou, Xiaolin |
| author_facet | Zhang, Yuchen Xi, Ning Feng, Pengbin Liu, Shigang Ma, Jianfeng Shen, Yulong Sun, Yanan Zhou, Xiaolin |
| contents | Industrial Internet systems face increasing threats from sophisticated industrial control system (ICS) attacks, resulting in critical safety incidents. However, existing tools exhibit limited effectiveness in real-time anomaly detection due to the complex dependencies among sensors and actuators. To tackle this, we present IstGPT, the first industrial anomaly detection tool based on LLMs and graph learning to provide real-time protection against a wide range of ICS attacks. IstGPT achieves fine-grained and precise modeling on spatial-temporal dependencies in industrial cyber-physical systems. It first leverages industrial multi-modal knowledge, including operational data, technical documents, and system diagrams, to extract sensor-actuator dependency graphs via multi-stage prompt engineering. Then, LLM-Optimation iteratively refines the graph based on node accuracy, edge consistency, and logical coherence. Finally, IstGPT integrated improved graph neural networks with an encoder-decoder architecture to detect anomalies via reconstruction errors. We evaluate IstGPT against 12 state-of-the-art baselines on 9 datasets, including 2 public, 6 simulated, and a real-world robotic arm dataset. IstGPT achieves the best F1-scores and eTaF1 (a newer time-aware metric) across nine datasets. We further discuss the feasibility of deploying IstGPT in real-world industrial scenarios. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2606_01691 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems Zhang, Yuchen Xi, Ning Feng, Pengbin Liu, Shigang Ma, Jianfeng Shen, Yulong Sun, Yanan Zhou, Xiaolin Cryptography and Security Machine Learning Industrial Internet systems face increasing threats from sophisticated industrial control system (ICS) attacks, resulting in critical safety incidents. However, existing tools exhibit limited effectiveness in real-time anomaly detection due to the complex dependencies among sensors and actuators. To tackle this, we present IstGPT, the first industrial anomaly detection tool based on LLMs and graph learning to provide real-time protection against a wide range of ICS attacks. IstGPT achieves fine-grained and precise modeling on spatial-temporal dependencies in industrial cyber-physical systems. It first leverages industrial multi-modal knowledge, including operational data, technical documents, and system diagrams, to extract sensor-actuator dependency graphs via multi-stage prompt engineering. Then, LLM-Optimation iteratively refines the graph based on node accuracy, edge consistency, and logical coherence. Finally, IstGPT integrated improved graph neural networks with an encoder-decoder architecture to detect anomalies via reconstruction errors. We evaluate IstGPT against 12 state-of-the-art baselines on 9 datasets, including 2 public, 6 simulated, and a real-world robotic arm dataset. IstGPT achieves the best F1-scores and eTaF1 (a newer time-aware metric) across nine datasets. We further discuss the feasibility of deploying IstGPT in real-world industrial scenarios. |
| title | IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems |
| topic | Cryptography and Security Machine Learning |
| url | https://arxiv.org/abs/2606.01691 |