🤖 AI Summary
This work addresses the common oversight of phase information in the frequency domain for multivariate time series anomaly detection in industrial control systems, which often hinders the identification of synchronized anomalies across sensors. To this end, the authors propose PhaseNet++, a novel framework that systematically incorporates phase cues by extracting magnitude and phase spectra via short-time Fourier transform, constructing a lightweight graph structure using phase coherence indices, and jointly reconstructing signals through an integrated architecture combining graph attention networks and a Sensor-Token Transformer. A dual-head decoder—featuring recurrent and coherence-aware branches—is further introduced to enhance modeling capacity. Evaluated on the SWaT dataset, PhaseNet++ achieves an F1-score of 90.98%, ROC-AUC of 95.66%, and average precision of 91.51%, substantially outperforming existing methods with only 264,816 additional parameters.
📝 Abstract
Multivariate time series anomaly detection in ICS has attracted growing attention due to the increasing threat of cyber-physical attacks on critical infrastructure. State-of-the-art methods model inter-sensor relationships from raw time-domain amplitude values, using graph neural networks, Transformers. However, these methods discard the phase spectrum produced by time frequency transformations, We argue that phase information constitutes a complementary and previously overlooked detection modality for ICS anomaly detection. We present PhaseNet++, a frequency-domain autoencoder that operates on the Short-Time Fourier Transform (STFT) of sliding sensor windows, retaining both magnitude and phase spectra. A Phase Coherence Index (PCI), inspired by the Phase Locking Value from neuroscience, summarizes pairwise phase consistency across frequency bins into a continuous adjacency matrix. This matrix guides a graph attention network that propagates information preferentially among phase-synchronized sensors. A sensor-token Transformer encoder captures system-wide structure, and a dual-head decoder reconstructs magnitude and phase jointly via circular and coherence-aware objectives. Evaluated on the Secure Water Treatment (SWaT) benchmark, PhaseNet++ achieves an F1-score of 90.98%, ROC-AUC of 95.66%, and average precision of 91.51%. Ablation studies show that the phase-aware front-end and PCI graph module together add only 264,816 parameters, demonstrating that the phase inductive bias is lightweight. While the absolute F1-score is second best than that of all recent raw-value methods evaluated under different protocols, we position this work as the first systematic study of phase-domain anomaly detection for ICS.