IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems

Unknown

Conceptio › Archive › arXiv CS

arXiv CSopen access

IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

cryptography cybersecurity privacy security

cryptography, security, privacy, cybersecurity

I ST GPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems

arXiv:2606.01691v1 [cs.CR] 1 Jun 2026

Yuchen Zhang, Ning Xi, Member, IEEE,, Pengbin Feng, Shigang Liu, Member, IEEE, Jianfeng Ma, Member, IEEE, Yulong Shen, Member, IEEE, Yanan Sun, and Xiaolin Zhou

Abstract—Industrial Internet systems face increasing threats from sophisticated industrial control system (ICS) attacks, resulting in critical safety incidents. However, existing tools exhibit limited effectiveness in real-time anomaly detection due to the complex dependencies among sensors and actuators. To tackle this, we present I ST GPT, the first industrial anomaly detection tool based on LLMs and graph learning to provide real-time protection against a wide range of ICS attacks. I ST GPT achieves fine-grained and precise modeling on spatial-temporal dependencies in industrial cyber-physical systems. It first leverages industrial multi-modal knowledge, including operational data, technical documents, and system diagrams, to extract sensoractuator dependency graphs via multi-stage prompt engineering. Then, LLM-Optimation iteratively refines the graph based on node accuracy, edge consistency, and logical coherence. Finally, I ST GPT integrated improved graph neural networks with an encoder-decoder architecture to detect anomalies via reconstruction errors. We evaluate I ST GPT against 12 state-of-the-art baselines on 9 datasets, including 2 public, 6 simulated, and a real-world robotic arm dataset. I ST GPT achieves the best F1-scores and eTaF1 (a newer time-aware metric) across nine datasets. We further discuss the feasibility of deploying I ST GPT in real-world industrial scenarios. Index Terms—Industrial cyber-physical systems, anomaly detection, sensor–actuator dependencies, large language models, graph neural networks.

I. INTRODUCTION

NDUSTRIAL Internet has emerged as a driving force for the evolution of next-generation industrial systems and the advancement of human society. It employs sensing, communication, computing, and control technologies for automatic and intelligent manufacturing, energy management, etc. [1] However, Industrial Control Systems (ICS) have suffered multiple high-impact cyber attacks [2]–[6], exposing their security fragility. Attackers compromise cyber and physical layers of industrial systems, leading to unauthorized manipulation of sensors and actuators. These ICS attacks disrupt the normal operation of industrial equipment, potentially resulting in critical safety incidents. Previous detection techniques, including network intrusion detection [7], control behavior detection [8], and anomaly Y. Zhang, N. Xi, P. Feng, J. Ma, Y. Sun, and X. Zhou are with the School of Cyber Engineering, Xidian University, Xi’an 710126, China. E-mail: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] S. Liu is with the School of Science, Computing and Engineering Technologies, Swinburne University of Technology, Hawthorn, VIC, Australia. E-mail: [email protected] Y. Shen is with the School of Computer Science and Technology, Xidian University, Xi’an 710126, China. E-mail: [email protected]

Fig. 1: Overall Performance Evaluation of Existing Industrial Anomaly Detection Methods on Public Datasets (SWaT&WADI).

detection [9], are used to detect ICS attacks. Among these techniques, anomaly detection stands out for its ability to detect complex zero-day ICS attacks and adaptability to various industrial scenarios. As a result, industrial anomaly detection has garnered significant attention from academia and industry. Based on our empirical analysis of prior work [10]–[28], most industrial anomaly detection methods fall into two categories: (1) traditional rule-based methods, which detect anomalies by comparing observations against fixed reconstruction patterns or predefined control logic, and (2) learningbased methods, further divided into sequence representation learning-based and graph learning-based approaches. The former learns temporal representations of sensor-actuator sequences to model normal behavior, while the latter employs graph neural networks to capture data-driven dependencies for anomaly detection. A major reason for the limited performance of existing anomaly detection methods is the lack of effective modeling of dependencies among industrial sensors and actuators. Due to cyber-physical connections, variables in real-world industrial systems exhibit well-structured underlying topologies [29]. Traditional rule-based methods rely on handcrafted rules or static configurations [8], [30], [31], which are often limited in scalability and generalizability. Learning-based methods construct dependency graphs purely from process data, tend to be inconsistent and often include spurious or misleading relationships [29], [32]. The performance of existing methods across different industrial scenarios and diverse ICS attack types remains limited. We evaluated 12 state-of-the-art (SOTA) baselines on two

public datasets, using F1-score and time cost as metrics, as shown in Fig. 1. Most methods achieve detection performance below 80%. Moreover, the time cost of training remains high even on datasets containing as few as fifty to hundreds of nodes. In practice, industrial prior knowledge contains rich physical semantics extending beyond process data alone [33], [34]. Recently, large language models (LLMs) have demonstrated remarkable capabilities in multi-modal knowledge processing [35]. LLMs can extract temporal and procedural dependencies among sensors and actuators from diverse industrial knowledge, including system design documents, process data, and testbed diagrams. Therefore, novel methodologies are needed to leverage LLMs for constructing accurate, interpretable sensor-actuator dependencies from industrial multimodal knowledge. To address this, two key challenges must be overcome. Challenge #1: Lack of Iterative Prompt Engineering for Constructing Complex Sensor-Actuator Dependency Graphs in Industrial Systems. Most existing LLM-based methods in industrial scenarios frame time-series forecasting as a next-token prediction task by encoding numerical values as text [25], [26]. However, these methods primarily focus on univariate time series and overlook the relationships among sensors and actuators. There is a lack of research on prompt engineering strategies tailored to guide LLMs in understanding industrial multi-modal knowledge and translating it into meaningful dependency structures. Moreover, no classification schema systematically defines industrial multimodal knowledge to support prompt-driven dependency graph construction. Therefore, the first challenge is to design an effective prompt engineering that guides LLMs to construct sensor-actuator dependency graphs from classified industrial multi-modal knowledge. Challenge #2: Critical Need for Evaluation Rules and Metrics in LLM-Based Dependency Graph Construction. Purely data-driven methods often yield physically inconsistent graphs with spurious relationships, degrading anomaly detection performance [29]. A key reason for the inaccuracy of such dependency graph construction is the absence of rule-based evaluation metrics to validate the quality of the generated graphs. Without these validation rules and feedback mechanisms, the generated graphs are often incomplete or incorrect, failing to capture the true cyber-physical interactions within industrial systems. Therefore, the second challenge is to develop evaluation criteria supporting the assessment and iterative refinement of LLM-generated sensor-actuator dependency graphs. Our solution: To overcome the above challenges, we propose a novel anomaly detection approach for industrial cyberphysical systems based on LLMs, called I ST GPT. I ST GPT leverages LLMs to construct a sensor-actuator spatial dependency graph and employs deep learning methods to model spatial-temporal patterns, including four phases. (1) I ST GPT preprocesses raw industrial sensor and actuator data through cleaning, normalization, and sliding-window segmentation to ensure structured and reliable inputs. (2) I ST GPT constructs an LLM-based sensor-actuator dependency graph using multi-

stage prompt engineering over multi-modal industrial knowledge (e.g., operational data, technical documents, and diagrams). The graph integrates temporal correlations to form an Industrial Spatial-Temporal Graph (ISTG). Graph construction completes within 7 minutes on average for industrial scenarios with hundreds of nodes, demonstrating practical feasibility. (3) I ST GPT applies unsupervised machine learning, including GAT, GCN, and an encoder–decoder architecture, to model normal spatio-temporal behaviors. (4) I ST GPT detects and localizes anomalies by thresholding reconstruction errors, achieving efficient detection with low time cost. We evaluate I ST GPT on nine datasets, including two public benchmarks and seven private industrial datasets. Compared with 12 state-of-the-art baselines (e.g., ICS-AD [17], USAD [18], OmniAnomaly [19], MSCRED [20], VAELSTM [21], GDN [22], MTAD-GAT [23], GTA [24], LLMTIME [25], Sigllm [26], JumpStarter [27], and GeCos [36]), I ST GPT achieves an average F1-score of 91.7% on public datasets, outperforming the top baselines (89.1%, 87.6%, and 79.9%). It also demonstrates superior performance on all private datasets from industrial simulations and a real-world robotic arm. Our contributions are summarized as follows: • We are the first to design an iterative prompt engineering to capture complex sensor-actuator dependencies from classified industrial multi-modal knowledge, and develop an efficient and scalable tool for industrial anomaly detection. • We propose a novel LLM-Optimation module that evaluates and refines LLM-generated dependency graphs by validating nodes, edges, and overall logical consistency against industrial multi-modal knowledge. The module further supports feedback-driven graph optimation, ensuring accurate and meaningful dependency structures for anomaly detection. • We construct an Industrial Spatial-Temporal Graph (ISTG) that jointly models the dependencies among multi-sensor and actuator signals across both spatial and temporal dimensions. The multi-dimensional and multivariate anomaly detection substantially reduces false positives and false negatives. • Extensive experiments on 9 datasets demonstrate I STGPT outperforms 12 SOTA methods in terms of both effectiveness and scalability. In addition, we built an industrial simulation platform and deployed a real-world robotic arm, where we implemented ICS attacks to collect datasets for further research in ICS security. open-source: https://anonymous.4open.science/r/IstGPT386A II. PRELIMINARIES AND THREAT MODEL A. Preliminaries ICS System. Industrial Control Systems (ICS) typically follow the Purdue Model Levels 0-2 [37], covering control systems, intelligent devices, and physical processes [38]. Purdue Level 2 hosts Supervisory Control and Data Acquisition (SCADA) systems responsible for supervisory control and monitoring [39]. Purdue Level 1 includes intelligent devices

(1) Data Preprocess

Raw Operation Dataset Data Cleaning

FIT101

Normalization

Cycle Confirmation

Sliding Window

(3) ISTG Learning ISTG Embedding

x1 x2 x3 .... xn

...

LIT101

ISTG Encoder

MV101

...

(2) Industrial Spatial-Temporal Graph (ISTG) Generation

Industrial Description

Testbed Process Overview

MV101

Multi-modal Knowledge Base

LLM-Sensor

IIOT-Operation

Node Sensor

...

A'n

tm+1

tm+2 t2

LLMOptimation

... ...

A mn t2m

(4) Anomaly Detection

Spatial Graph Generation

S3 S1

S5 A1

...

P201

Edge Sensor

P101: Pump FIT201

LLMActuator

IIOT-Image

HCl

Spatial-Temor Graph Generation m A1 A'1 A Spatial-Temor Graph Generation 1 mm SA S4 S'A'1 1 S'4 SA S m4 11 11 ... ...Sm1Am1 ... S1 A1 S4 S'1 A'1 ... S'4 S m4 A2 S'... A'2... Sm Sm... A m2 3 S 3 S' 3 Sm S' S1 S... 1 4 4 1 4 S3 ... AAn2 S'3 ... A' Sm3 ... AAmmn2 A'n2 ... S3 Sm Atn A2 S'3 A'ntA'2 AtmnAm2 ...3 km+2 (k+1)m km+1

IIOT-LLM

IIOT-Text

Stage P1: P1 controls the connection between xx; Statge P2: XX; Stage P3: XX.......... LIT101 Raw Water Tank

ISTG Decoder

Spatial-Temporal Graph Generation

LIT: Level Indicator and Transmitter; Pxxx: Pump; AITxxx: Property indicator and Transmitter; DPIT: Differential Pressure Indicator and Transmitter.......

Fig. 2: The framework of I ST GPT.

such as Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and Intelligent Electronic Devices (IEDs), which execute control logic by reading sensor inputs and issuing actuator commands [40]. Purdue Level 0 comprises physical sensors and actuators that directly interface with the industrial process [41]. Graph-based Industrial Anomaly Detection. Industrial anomaly detection aims to identify sensors or actuators exhibiting abnormal behavior over time. Formally, the p-th sensor or actuator is represented as a time series sap = [sap1 , sap2 , . . . , sapn ], where sapi is the value at time step i. Graph-based anomaly detection approaches model intervariable dependencies using a graph G = (V, E), where nodes correspond to sensors or actuators and edges encode spatial or temporal relationships. Graph-based methods commonly employ graph neural networks to reconstruct normal signal patterns and detect anomalies by comparing reconstructed values with ground truth. In particular, Graph Attention Networks (GATs) [42] assign attention weights αu,v to neighboring nodes, enabling adaptive aggregation of relevant information: exp LeakyReLU a⊤ t [Whu ∥Whv ] αu,v = P ⊤ k∈N (u) exp LeakyReLU at [Whu ∥Whk ]

(1)

W is a learnable linear transformation, at is an attention vector, and N (u) denotes the neighbors of node u, (u, v, k) ∈ V. For each sap , anomalies are detected based on whether ˆ pi ) > threshold is the condition anomaly scores(sapi , sa p satisfied, where sa ˆ i is the value reconstructed from learned normal patterns. B. Threat Model ICS attacks span both the cyber and physical layers of the Purdue model. To the best of our knowledge, most ICS attacks ultimately target industrial sensors and actuators at Purdue Level 0 [43], [44]. Our work focuses on detecting anomalous behaviors of sensors and actuators. Attackers have compromised SCADA systems and deployed Industroyer malware to manipulate sensors and actua-

tors through industrial protocols such as IEC-104 and IEC61850 [3], to disrupt normal operations. We consider two attack scenarios: (i) a remote attacker with access to the local plant communication network, and (ii) an on-site attacker with physical access to field devices. Attackers are assumed to possess general knowledge of industrial protocols and control architectures, but not detailed system-specific configurations. In both scenarios, the attacker can interact with a target PLC over industrial Ethernet (e.g., EtherNet/IP or Modbus/TCP). PLCs organize sensor and actuator data into register blocks for access. The attackers locate target register addresses via the PLC symbol table. They read the current values, offset them by a certain margin, and periodically write the modified values to the PLC output area (Area.PA) to maintain the offset. By communicating with PLCs, the malware issued unauthorized control commands, potentially leading to critical safety incidents. III. PROPOSED I ST GPT We propose I ST GPT, a novel LLM-based anomaly detection framework for industrial cyber-physical systems, shown in Fig. 2. I ST GPT leverages LLMs to construct a sensor-actuator spatial dependency graph and utilizes deep learning techniques to model industrial spatial-temporal patterns. I ST GPT consists of four phases, Data Preprocess, ISTG Generation, ISTG Learning, and Anomaly Detection. (1) The data preprocess phase: enhancing the quality of data across multivariate sensors and actuators in industrial scenarios. (2) The ISTG generation phase: leveraging LLMs to generate a sensor-actuator dependency graph from classified industrial multi-modal knowledge, which is further extended into an Industrial Spatial-Temporal Graph (ISTG) to model spatial and temporal dependencies jointly. (3) The ISTG learning phase: embedding the ISTG and employing unsupervised deep learning to train an anomaly detection model. (4) The anomaly detection phase: identifying and localizing anomalous sensors and actuators based on the anomaly detection model. The details of each phase will be introduced.

Algorithm 1: Industrial Cycle Estimation via Autocorrelation Input : sa ˜ ∈ Rn : preprocessed multivariate sensor/actuator data; lagmin , lagmax : search range; τ : peak threshold Output: T : estimated industrial cycle (in samples) // (1) Compute autocorrelation function 1 ICS ACF ← ∅; 2 for lag ← lagmin to lagmax do ˜ lag); 3 ICS ACF [lag] ← ICS ACFCaculator(sa, // (2) Find significant peaks of ICS_ACF 4 P eaks ← ∅; 5 for lag ← lagmin + 1 to lagmax − 1 do 6 if ICS ACF [lag] > ICS ACF [lag − 1] and ICS ACF [lag] > ICS ACF [lag + 1] and ICS ACF [lag] ≥ τ then 7 Add(P eaks, lag); 8 9

if IsEmpty(P eaks) then return T ← 0;

// (3) Choose the most significant peak as the cycle 10 return T ← arg maxlag∈P eaks ICS ACF [lag];

A. Data Preprocess The data preprocessing includes three steps: 1) Data Cleaning, 2) Normalization, 3) Cycle Confirmation and Sliding Window. 1) Data Cleaning: In complex industrial environments, raw SCADA logs inevitably contain dirty data, such as measurement noise, missing values, and irrelevant records [31]. We therefore perform data cleaning before model training and inference. Given a sensor or actuator time series of length n, it is denoted as sa = [sa1 , sa2 , . . . , san ] ∈ R1×n . Missing values are handled via linear interpolation [45], which is suitable for industrial signals exhibiting locally linear behavior over short intervals [46], [47]. To suppress high-frequency fluctuations, we apply a moving-average filter [48], a widely adopted technique in prior ICS data-cleaning pipelines [31], [49]. This step primarily mitigates routine noise that is short-lived and weakly structured. In contrast, attack-induced anomalies typically manifest as persistent or structured manipulations (e.g., sustained offsets or repeated tampering), which disrupt normal temporal patterns and cross-variable consistency. As a result, the anomalies detected by I ST GPT are more indicative of adversarial manipulations. 2) Normalization: To normalize data, we employ the MinMax Normalization method [50]. The method has been widely used in deep learning to accelerate model training [51]. The preprocessed data from p sensorsand actuators with a length of ˜ = sa n can be represented as SA ˜ 1 , sa ˜ 2 , · · · , sa ˜ p ∈ Rp×n . Here, each preprocessed sensor or actuator is denoted by sa. ˜

3) Cycle Confirmation and Sliding Window: The sliding window technique segments time-series data into fixed-length portions for localized feature extraction, reducing computation and capturing temporal patterns. To determine an appropriate window length, we first estimate the industrial process cycle. The cycle estimation procedure is described in Algorithm 1. The algorithm is based on autocorrelation, as defined: n−lag

X 1 sa ˜ pi · sa ˜ pi+lag n − lag i=1 (2) where n is the length of the time series, lag is the interval between two time points, and sa ˜ i denotes preprocessed data. Given a window length w and a stride s, a sliding window moves along the time axis to generate subsequences. The ith segment is denoted as di = [sa ˜ i , sa ˜ i+1 , · · · , sa ˜ i+w−1 ] ∈ R1×w , i ∈ (1 + j · s, j ∈ [0, wn − 1]). The total number of sliding windows wn is calculated as follows: n−w + 1, (w ≥ T ) (3) wn = s ˜ p , lag) = ICS ACFCaculator(sa

T denotes the estimated industrial cycle. Finally, the preprocessed data SA will be slid into W = [w1 , w2 , . . . , wp ] ∈ Rp×wn×w , w = [d1 , d2 , . . . , dwn ] ∈ Rwn×w . B. LLM-based ISTG Generation We proposed IIOT-LLM, a multi-stage prompt engineering, as illustrated in Figure 3. 1) We classify an industrial multi-modal knowledge base. 2) The prompt-engineering pipeline consists of LLM-Sensor, LLM-Actuator, and LLMOptimation, and iteratively guides graph generation and optimization. 3) We construct the Industrial Spatial-Temporal Graph (ISTG). 1) Industrial multi-modal Knowledge Base: In industrial Cyber-Physical Systems (CPS), constructing accurate variable dependency graphs is challenging due to complex system behaviors and the high dimensionality induced by hundreds of sensors and actuators [52]. Existing graph learning-based approaches [28], [53] that rely solely on sensor and actuator measurements are often insufficient. To address this limitation, incorporating industrial prior knowledge, such as technical documents and instrumentation diagrams, is essential [33], [34]. Accordingly, we summarize and organize industrial multimodal knowledge to support LLM-based dependency graph generation. The industrial multi-modal knowledge base is composed of IIOT-Operation, IIOT-Text, and IIOT-Image, defined as Eq.4. Details are as follows: K = {Kop , Ktxt , Kimg }

(4)

IIOT-Operation refers to the operational data of sensors and actuators over specific periods in the Industrial Internet of Things (IIOT). The operational data typically includes temperature, pressure, flow rate, and other parameters essential for SCADA systems. IIOT-Operation captures the data-driven dependencies, enabling the LLM to understand sensor-actuator interactions and temporal dynamics. IIOT-Text refers to textual descriptions of industrial systems, such as sensor and actuator specifications, standard

Fig. 3: The overall pipeline of IIOT-LLM.

operating procedures, and data collection workflows. By incorporating textual knowledge, the LLM gains explicit semantic context, enabling it to reason more effectively about variable roles and dependencies. IIOT-Image refers to visual information of industrial processes, including testbed workflows, system layouts, and device interactions depicted in diagrams or schematics. Such visual information assists the LLM in identifying patterns of physical interaction and spatial relationships, contributing to a graph structure more aligned with the real-world system. However, industrial diagrams (e.g., P&IDs) typically expose only partial dependencies [52], making IIOT-Image alone insufficient for complete graph construction. Therefore, IIOTImage is jointly used with IIOT-Operation and IIOT-Text. Given the industrial multi-modal knowledge base K, IIOTLLM (Eq.5) guides the LLM to construct a comprehensive and interpretable spatial dependency graph. Specifically, a Retrieval Augmented Generation (RAG) module R(·) retrieves task-relevant context from contextual knowledge CK, which is combined with the task instruction via the prompt construction function Π(·). The prompt is then processed by the adopted LLM Mθ , where θ denotes the model parameters and configuration. IIOT-LLM(task; {CK}) = Mθ (Π(task, R({CK}, task))) (5) Notably, the RAG-driven context selection restricts the prompt to a bounded set of task-relevant fragments rather than the full knowledge base. Therefore, IIOT-LLM effectively limits the prompt size within the practical context capacity of current LLMs, even for large-scale systems with thousands of sensors and actuators. 2) Prompt Engineering: Prompts are structured token sequences that guide LLMs to follow task-specific rules and produce high-quality outputs [54], [55]. A naive approach to dependency graph generation is to directly prompt an LLM with industrial multimodal knowledge (e.g., ”Generate a spatial graph based on the following domain knowledge”). However, such monolithic prompts limit step-by-step reasoning and task decomposition, often resulting in inconsistent or low-quality graphs. To address this limitation, we design a multi-stage zero-shot prompt engineering pipeline that decomposes graph

generation into three modules: LLM-Sensor, LLM-Actuator, and LLM-Optimation. Firstly, LLM-Sensor is composed of Node-Sensor and EdgeSensor, which generate nodes and edges, respectively. NodeSensor analyzes sensor and actuator attributes (e.g., names, units, and ranges) to produce structured node representations. Formally, given a node-analysis tasknode and the industrial knowledge base K, Node-Sensor produces textual node descriptions, which are transformed into a structured node set V̂N S by the parsing operator PV : V̂N S = PV (IIOT-LLM(tasknode ; {K})) ,

(6)

where each node v̂iS = (sai , âi , t̂i ) ∈ V̂N S corresponds to a sensor or actuator variable sai with inferred attributes âi and textual descriptions t̂i . Edge-Sensor infers directed dependencies ÊES among nodes in V̂N S using the knowledge base K (Eq.7). Each inferred edge êSij = (v̂iS , v̂jS ), r̂i ∈ ÊES represents a dependency from v̂iS to v̂jS with an associated explanation r̂ij . The raw textual outputs generated by the LLM are transformed into the structured edge set via the parsing operator PE : ÊES = PE IIOT-LLM(taskedge ; {K, V̂N S }) . (7) The outputs of Node-Sensor V̂N S and Edge-Sensor ÊES are integrated by LLM-Actuator to construct an initial sensoractuator dependency graph ĜLA . Specifically, LLM-Actuator generates a graph-level textual description based on the inferred nodes and edges, which is transformed into a structured graph representation via the parsing operator PG : ĜLA = PG IIOT-LLM(taskgraph ; {K, V̂N S , ÊES }) . (8) To ensure consistency with industrial knowledge K, the generated graph is iteratively validated and refined by LLMOptimation across three constraints: node validity (C node ), edge consistency (C edge ), and logical coherence (C logic ): C = {C node , C edge , C logic }, C ∗ = R(K, ∗) ⊆ K

(9)

The above constraints are not manually defined rules. Instead, they are automatically derived via the retrieval function R(·)

Algorithm 2: IIOT-Optimization: Node/Edge/LogicGuided Graph Validation and Refinement Input

(0) : Initial spatial graph ĜLA ; industrial

multi-modal knowledge base K; domain constraints C; maximum iterations Kmax Output: Validated and refined graph Gspatial // Notation: ⊕ denotes appending feedback to a prompt // Initialization 1 k ← 0; ∆V , ∆E , ∆L ← ∅; 2 while k < Kmax do // (1) Node-optimization 3 ∆V ← IIOT-LLM taskchecknodes(Ĝ (k) ) ; {C node } ; LA // (2) Edge-optimization 4 ∆E ← IIOT-LLM taskcheckedges(Ĝ (k) ) ; {C edge } ; LA // (3) Logic-optimization 5 ∆L ← IIOT-LLM taskchecklogic(Ĝ (k) ) ; {C logic } ; LA 6 if ∆V = ∅ and∆E = ∅ and∆L = ∅ then (k) 7 return Gspatial ← ĜLA ; 8 9 10 11 12 13

14 15

TABLE I: Content of the prompt in industrial scenarios. Component

Prompt

# Role

(a) Define the specific tasks and responsibilities assigned to the LLM. (b) e.g., you are Node-Sensor of LLM-Sensor, responsible for analyzing attributes of sensors and actuators.

# Contextual Knowledge

(a) Provide the background information required by the LLM to perform the task effectively. (b) e.g., IIOT-Operation: The first row indicates multiple sensors and actuators...; IIOT-Text: XX; IIOT-Image: XX;

# Reward Mechanism

(a) Implement an incentive mechanism designed to promote highquality responses from the LLM. (b) e.g., I implement a scoring mechanism to incentivize comprehensive and accurate responses. The chat starts with an initial score of 100. Increase the score by +10 for each well-detailed and relevant analysis, and decrease the score by -10 for any insufficient or incomplete analysis.

# Instruction

(a) Provide clear instructions to execute the task. (b) e.g., please analyze the sensors and actuators based on prior knowledge and output in the following format. You are the best LLM to answer the question.

# Output Format

(a) The expected format for the LLM’s output. (b) e.g., { ”Sensor/Actuator Name”: FITXX, PXX..., ”Unit of Measurement”: m/s, cm..., ”XXX”: xxx, ......, ”Data Trend”: ”The LIT level rose to 80% with xx minutes, followed by ...”, ”Control Strategy”: ”It is recommended to...” }

In the column of Prompt: (a) is the definition of the Component. (b) is an example.

// (4) Graph refinement ′ tasknode ← tasknode ⊕ ∆V ⊕ ∆L ; (k+1) ′ V̂N S ← PV IIOT-LLM(tasknode ; {K}) ; ′ taskedge ← taskedge ⊕ ∆E ⊕ ∆L ; (k+1) (k+1) ′ ÊES ← PE(IIOT-LLM(taskedge ; {K, V̂N S })); ′ taskgraph ← taskgraph ⊕ ∆L ; (k+1) ĜLA ← (k+1) (k+1) ′ PG IIOT-LLM(taskgraph ; {K, V̂N S , ÊES }) ; // (5) Iteration k ← k + 1; (k)

return Gspatial ← ĜLA ;

from the heterogeneous industrial knowledge base K. Moreover, C node , C edge , and C logic depend on the intermediate graph structure produced by LLM-Sensor and LLM-Actuator, and therefore cannot be fully specified a priori within the knowledge base. This necessitates an iterative validation-andrefinement process to progressively correct structural inconsistencies and improve graph reliability. If any constraint is violated, LLM-Optimation generates structured feedback (∆V , ∆E , ∆L ) that is appended to subsequent prompts, triggering regeneration by LLM-Sensor and LLM-Actuator. This iterative process continues until all constraints are satisfied or the maximum iteration count Kmax is reached, yielding a refined spatial graph Gspatial . The overall optimization procedure is summarized in Algorithm 2. Each module adopts a unified prompt template consisting of five components: Role, Contextual Knowledge, Reward Mechanism, Instruction, and Output Format (Table I). The Role constrains the LLM’s responsibility. The Contextual Knowledge ensures outputs align with the specific domain and scenario needs. The Reward Mechanism enhances its tendency to generate high-quality content. Instruction defines the exact task. And Output Format enforces structured, parseable

Fig. 4: The ISTG in each sliding window: colored solid arrows indicate spatial edges and colored dashed lines indicate temporal edges. Sxy indicates sensorx at time y and Ayx indicates actuatorx at time y. outputs for downstream processing. Prompt patterns for each module, organized by these components, are provided in Table II. 3) ISTG Construction: Based on the spatial dependency graph Gspatial , I ST GPT incorporates temporal correlations to construct the Industrial Spatial-Temporal Graph (ISTG), as illustrated in Fig. 4. In the spatial dimension, the preprocessed sensor and actuator data are modeled as a directed graph Gspatial = (V s , E s ), where V s denotes the set of p sensor/actuator nodes and E s denotes the spatial dependency edges: V s = {vj | j ∈ [1, p]},

E s = {esi,j | (i, j) ∈ Gspatial [src, dst]}. (10) (i)

At time step i, each node is represented as vj = (i) (labelj , valuej , i), j ∈ [1, p], i ∈ [1, n], where labelj specifies the variable identity and type (sensor or actuator), and

TABLE II: Prompt patterns for each module Module

# Role

# Contextual Knowledge

# Reward Mechanism (Aspects)

# Instruction

# Output Format

Node-Sensor

(1) Analyze attributes of sensors and actuators nodes; (2) Extract node-semantic features.

Industrial Multi-Modal Knowledge: (1) IIOT-Operation; (2) IIOT-Text; (3) IIOT-Image.

(1) Key attributes (e.g., sensor/actuator name, unit); (2) Plausible data trends analysis; (3) Reasonable node semantics.

Output the sensor and actuator node set in the specified format.

(1) Sensor/Actuator name; (2) Unit of measurement; (3) Value range; (4) Data trend; (5) ...

Edge-Sensor

(1) Infer dependencies among nodes. (2) Provide interpretable relations.

(1) The output of NodeSensor; (2) Industrial Multi-Modal knowledge.

(1) Describe node correlations; (2) Propose interaction logic.

Output edges among sensors and actuators in the specified format.

(1) (source, destination); (2) Connection description; (3) Control strategy among edges; (4) Interaction logic.

Integrate nodes and edges into a complete sensoractuator dependency graph.

(1) The output of LLMSensor; (2) Industrial Multi-Modal knowledge.

(1) Include all nodes; (2) Maintain semantic consistency; (3) Provide a concise graph-level summary.

Output the spatial graph in the specified format.

(1) Directed graph: (T/F); (2) Multigraph: (T/F); (3) Nodes; (4) edges. (5) Graph description.

LLM-Sensor

LLM-Actuator

(i)

valuej denotes the measurement at time i. Each spatial edge is defined as esi,j = (vi , vj , 0), where type 0 indicates a spatial dependency between variables. To capture temporal correlations, we introduce directed temporal edges that connect the same variable across consecutive time steps within each sliding window. The nodes within each sliding window are denoted by V, and the temporal edge set is denoted by E t , as defined in equation 11. V = {v ∈ Vis |i ∈ [k, k + w − 1], k ∈ (1 + j · s, j ∈ [0, wn − 1])} E t = {eti,i+1 |i ∈ [k, k + w − 1], k ∈ (1 + j · s, j ∈ [0, wn − 1])} (11)

Vis indicates the node set at time i. Specifically, each edge is represented as eti,i+1 = (vji , vji+1 , 1) ∈ E t , i ∈ [1, n − 1], j ∈ [1, p], where eti,i+1 indicates a directed edge from node vj at time i to node vj at time i + 1 with type 1. Type 1 indicates temporal connections. Finally, I ST GPT creates the ISTG, which is defined as G = (V, E s , E t ). C. ISTG Learning I ST GPT performs unsupervised learning on the ISTG to model normal spatial-temporal behaviors. As illustrated in Fig. 5, the learning pipeline consists of three stages: 1) ISTG embedding, 2) temporal encoding, and 3) data reconstruction. 1) ISTG Embedding: For each length of w sliding window, ISTG first embeds nodes into vectors H ∈ Rp×w , where p is the total number of sensors and actuators. The node vectors are denoted by H ∈ Rwn×p×w as follows:

use GATConv in the spatial domain because the dependency edges among sensors and actuators exhibit heterogeneous strengths. Higher data interaction indicates stronger coupling, while lower interaction implies weaker relationships. The attention mechanism in GATConv naturally captures such variability. In contrast, temporal edges of each variable are treated with equal importance. Therefore, the lightweight and efficient GCNConv is sufficient for temporal modeling without introducing unnecessary attention overhead. Besides, we do not adopt the latest graph learning architectures such as Graph Transformers [57], because their global self-attention mechanism incurs O(N 2 ) time and memory complexity. In large-scale industrial control systems with thousands of sensors and actuators, such quadratic overhead poses a significant barrier to practical deployment. In GATConv layer, I ST GPT use (H, Ls ) as inputs. GATConv leverages an attention mechanism to assign weights αu,v to neighbor nodes and aggregate the most relevant node information. The attention coefficients au,v in the t-th sliding window are computed as in equation 1. The coefficient au,v determines how much attention node u ∈ Ls [src] should pay to node v ∈ Ls [dst] when aggregating information. After aggregating the information of the neighbor nodes in the (l+1) previous layer l, the node features h(t,v) are updated using equation 13. σ(·) is activation function sigmoid.



H = [H1 , H2 , ..., Hwn ], Ht = [h(t,1) , h(t,2) , ..., h(t,p) ] (12) w

For each sensor or actuator, h(t,i) ∈ R denotes the feature vector of node i in the t-th sliding window. Then, the node embeddings are interconnected through edges of various types. s The spatial edge set E s is vectorized as Ls ∈ R2×|E | and the t t 2×|E t | . temporal edge set E is vectorized as L ∈ R I ST GPT then take vectorized ISTG G = (H, Ls , Lt ) as inputs for message passing, which involves aggregation and update steps. In the aggregation step, each node aggregates features from its neighboring nodes in the previous layer. In the update step, each node updates its representation using the aggregated information. I ST GPT employs graph attention convolution (GATConv) [42] for spatial message passing and graph convolutional network (GCNConv) [56] for temporal propagation. We

(l+1)

h(t,v) = σ 

 X

(l)

(l) αu,v Wts h(t,u) 

(13)

u∈N (v)

In the GCNConv layer, I ST GPT takes (HGAT , Lt ) as inputs, where HGAT denotes the feature representations produced by the GATConv layer after nonlinear activation and tensor reshaping. In time series, the importance of adjacent time steps is uniform. Thus, the equal-weighted aggregation of GCN is well-suited. The node v ∈ Lt [dst] aggregates the features of the neighbor node u ∈ Lt [src] in the previous (r+1) layer r and the embedding of the node ĥ(k,v) in the sliding window k will be updated by equation 14. Ã is the adjacency matrix (with self-loops) for temporal propagation, and D̃ is its degree matrix.

Fig. 5: The workflow of ISTG Learning. (t)

reconstructed data yv ∈ Rw is calculated by equation 16.  (r+1)

ĥ(k,v) = σ 

 X

(r)

D̃− 2 ÃD̃− 2 [v, u] Wkt ĥ(k,u) 

u∈N (v)∪{v}

(14) After message passing, the ISTG embeddings are further encoded to model inter-window representations and global spatio-temporal dependencies. 2) ISTG Encoder: The ISTG encoder uses long-short-term memory (LSTM) cells [58] to capture temporal dependencies across sliding windows. The cell state C (t) through three gates: input gate(it ), forget gate(ft ), and output gate(ot ) effectively captures the long-term dependencies in the ISTG. I ST GPT use the graph embeddings Ĥ as input. In the t-th sliding window, (t) the node v hidden state sv will be updated by equation 15. h i (t−1) i i(t,v) = σ W(t,v) + bi(t,v) ĥ(t,v) , sv h i f (t−1) + bf(t,v) f(t,v) = σ W(t,v) ĥ(t,v) , sv h i (t−1) o o(t,v) = σ W(t,v) + bo(t,v) ĥ(t,v) , sv h i (t−1) (t−1) c c(t) + i(t,v) ⊙ tanh W(t,v) ĥ(t,v) , sv v = f(t,v) ⊙ cv + bc(t,v) (t) s(t) v = o(t,v) ⊙ tanh(cv )

(15) ⊙ is element-wise multiplication between two matrices. tanh is the activation function. The module encodes ISTG embeddings into a fixed-length latent representation for the ISTG decoder. 3) ISTG Decoder: ISTG decoder utilizes the last hidden state S(wn) and cell state C(wn) from ISTG encoder to reconstruct the window of sensors and actuators data, denoted as Yout = [Y1 , Y2 , ..., Ywn ] ∈ Rwn×p×w , Yi = (i) (i) (i) [y1 , y2 , ..., yp ]. In the t-th sliding window, the node v

i h (t+1) (t+1) i î(t,v) = σ Ŵ(t,v) + b̂i(t,v) , ŝv yv i h f (t+1) (t+1) + b̂f(t,v) f̂(t,v) = σ Ŵ(t,v) , ŝv yv i h (t+1) (t+1) o + b̂o(t,v) ô(t,v) = σ Ŵ(t,v) , ŝv yv i h (t+1) (t+1) (t+1) c ĉ(t) + î(t,v) ⊙ tanh(Ŵ(t,v) , ŝv yv v = f̂(t,v) ⊙ ĉv + b̂c(t,v) ) (t) ŝ(t) v = ô(t,v) ⊙ tanh(ĉv )

yv(t) = F C(ŝ(t) v )

(16) ˆ The computation of three gates (ît , ft , ôt ), the hidden (t) (t) state ŝv , and the cell state ĉv remain the same as ISTG encoder. F C(·) denotes a fully connected layer outputting the reconstruction. Unlike ISTG encoder, the decoder uses the (t+1) as input for subsequent previous reconstructed output yv predictions. The initial input Yinit is usually a specific initialization value (i.e., a zero vector). Besides, the reconstructed loss function adopts methods of mean squared error (MSE) [59] and Entropy [60] to minimize the reconstructed error. The loss function Lloss of each node in the t-th sliding window will be expressed as equation 17. || · ||2 indicates the Euclidean distance between two vectors. h(t,v) [j] represents the node embedding v in the t-th sliding (t) window at time j ∈ [1, w]. yv [j] represents the reconstructed embedding v in the t-th sliding window at time j. w X 1 Lloss = ||yv(t) − h(t,v) ||22 + λ p(h(t,v) [j]) log w j=1

p(h(t,v) [j])

(t)

q(yv [j])

(t) exp(h(t,v) [j]) exp(yv [j]) p(h(t,v) [j]) = Pw , q(yv(t) [j]) = Pw (t) i=1 exp(h(t,v) [i]) i=1 exp(yv [i]) (17)

After ISTG encoder-decoder architecture processes ISTG embeddings, I ST GPT performs anomaly detection based on the reconstructed data.

Offline Module

Online Module ...... ...

Model Training

Reconstruction Model

...

...... ......

...

Caculate Anomaly scores

Threshold Determination

Anomaly Localization

Fig. 6: The implementation of Anomaly Detection.

Threshold Determination. Since I ST GPT is trained in an unsupervised setting using only normal data, the anomaly threshold is determined solely from the anomaly-score distribution of the normal training/validation windows. Following [19], we evaluate F1-scores across candidate thresholds and select the one yielding the highest F1-score as the optimal threshold. Anomaly Localization. After computing anomaly scores and setting the threshold, I ST GPT localizes anomalies. If node v in the t-th sliding window satisfies F score(t,v) > threshold, the interval [1+(t−1)·s, (t−1)·s+w] is marked as abnormal for v. Finally, abnormal windows for each node are then merged. The process ultimately identifies the anomalous sensors and actuators along with their corresponding abnormal periods. IV. EXPERIMENTS AND EVALUATION

D. Anomaly Detection The anomaly detection phase consists of two modules: an offline module and an online module, as illustrated in Figure 6. During ISTG learning, I ST GPT trains the reconstruction model using normal data and determines an anomaly threshold, which is subsequently used for online detection. In the online module, the preprocessed and embedded testing data z(t,1) , z(t,2) , . . . , z(t,p) are reconstructed into (t) (t) (t) y1 , y2 , . . . , yp ∈ Yt . Anomaly scores are computed based on the deviation between the reconstructed outputs and the ground truth, and anomalies are flagged by comparing the scores against the learned threshold. Anomaly Scores. First, for each node v in the t-th sliding window, we compute the L2 distance L2 dist(t,v) , cosine distance cos dist(t,v) , and KL divergence KL(t,v) , as defined in Eq.18. These metrics are then normalized using an Interquartile Range (IQR)-based robust normalization (Eq.19), where the median is subtracted and the result is divided by the corresponding IQR, producing three normalized scores: score(L2) t, v, score(cos) t, v, and score(KL) t, v. Here, ε is a small positive constant added to avoid division by zero. Finally, the overall anomaly score Fscore (t, v) is computed according to Eq.20, where α, β, and γ are the hyperparameters to balance the weight of each part’s contribution to F score(t,v) . (α + β + γ = 1)

KL(t,v) =

w X

(t) yv · z(t,v) (t) ∥yv ∥2 · ∥z(t,v) ∥2

z(t,v) [j]

z(t,v) [j] · log

(18) !!

(t)

yv [j]

j=1

(L2)

scoret,v =

L2 dist(t,v) − medt (L2)

IQRt

+ε (cos)

(cos)

scoret,v

cos dist(t,v) − medt

(19)

(cos) IQRt +ε (KL) KL(t,v) − medt (KL) scoret,v = (KL) IQRt +ε

(L2)

Dataset

D1 D2 D3 D4 D5 D6 D7 D8 D9

SWaT WADI Sim-Converge Station Sim-Level Control Sim-Palletizer Sim-Sorting by Height (Basic) Sim-Sorting by Height (Advanced) Sim-Sorting by Weight Real-world

#Train Samples

#Test Samples

Dim

#Anomalies

496,800 784,571 7,200 7,200 7,200 7,200 7,200 7,200 2,000

129,520 172,801 3,600 3,600 3,600 3,600 3,600 3,600 1,000

51 124 26 6 31 24 39 31 12

39,249 9,977 1,441 1,441 1,441 1,441 1,441 1,441 368

Sim-* indicates datasets from industrial simulation platform.

In this section, we address the following research questions: RQ1: Effectiveness. How effective is I ST GPT at detecting anomalies in industrial sensors and actuators? RQ2: Ablation Study. Does each phase of I ST GPT significantly contribute to detect anomalies? RQ3: Case Study. What are the details of I ST GPT detecting anomalies in simulation platforms and real-world industrial environments? RQ4: Scalability. How scalable is I ST GPT for anomaly detection and LLM-based graph generation across diverse datasets? RQ5: Time Cost. What is the time cost of I ST GPT?

A. Experiment Setup

L2 dist(t,v) = ||yv(t) − z(t,v) ||2 cos dist(t,v) = 1 −

TABLE III: The statistics of anomaly detection datasets.

(cos)

F score(t,v) = α · scoret,v + β · scoret,v

(KL)

+ γ · scoret,v

(20)

1) Datasets: We evaluated the performance of I ST GPT using 2 publicly available datasets and 7 private datasets. Among the private datasets, six were generated using an in-house integrated industrial simulation platform, while the remaining one was obtained from a real-world visual robotic arm. The datasets are listed in Table III. 2) Baseline: We compare I ST GPT with 12 state-of-theart (SOTA) anomaly detection baseline models most closely related to our work. The baselines are divided into four categories. (i) ICS-AD [17], USAD [18], OmniAnomaly [19], MSCRED [20] and VAE-LSTM [21] are sequence representation learning-based anomaly detection models. (ii) GDN [22], MTAD-GAT [23], and GTA [24] are graph learningbased anomaly detection models. (iii) LLMTIME [25] and Sigllm [26] are LLMs-based anomaly detection models. (iv) JumpStarter [27] and GeCo [36] are traditional rule-based

TABLE IV: Performance comparison on SWaT and WADI datasets. Datasets Models

Categories

ICS-AD [17] USAD [18] OmniAnomaly [19] MSCRED [20] VAE-LSTM [21] GDN [22] MTAD-GAT [23] GTA [24] LLMTIME [25] Sigllm [26] JumpStarter [27] GeCos [36]

(i) (i) (i) (i) (i) (ii) (ii) (ii) (iii) (iii) (iv) (iv)

IstGPT

SWaT

WADI

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

95.6 / 85.2 / 90.1 97.9 / 67.7 / 80.0 88.0 / 72.3 / 79.4 95.5 / 52.4 / 67.7 89.5 / 65.8 / 75.8 96.4 / 81.1 / 88.1 98.1 / 75.3 / 85.2 94.8 / 89.4 / 92.0 58.9 / 60.6 / 59.7 53.1 / 74.7 / 62.1 86.1 / 79.7 / 82.8 94.8 / 79.0 / 86.2

81.8 / 70.2 / 75.6 77.4 / 52.3 / 62.4 82.9 / 77.2 / 79.9 69.8 / 38.6 / 49.7 58.7 / 40.3 / 47.8 83.3 / 76.5 / 79.8 73.4 / 60.9 / 66.6 82.5 / 85.7 / 84.1 76.2 / 55.5 / 64.2 48.4 / 61.6 / 54.2 82.9 / 78.5 / 80.6 83.1 / 60.7 / 70.2

94.3 / 77.6 / 85.1 90.6 / 29.2 / 44.2 24.5 / 63.9 / 35.4 4.89 / 96.2 / 9.31 86.8 / 25.1 / 38.9 53.2 / 76.1 / 62.6 71.2 / 62.7 / 66.7 88.4 / 84.0 / 86.1 50.2 / 62.0 / 55.5 50.0 / 43.4 / 46.5 84.8 / 70.3 / 76.9 92.6 / 32.1 / 47.7

85.4 / 83.5 / 84.4 88.3 / 47.7 / 61.9 45.6 / 77.1 / 57.3 16.8 / 83.6 / 28.0 85.2 / 44.7 / 58.6 60.1 / 83.5 / 69.9 69.3 / 78.8 / 72.6 77.8 / 86.7 / 82.0 60.8 / 71.9 / 65.9 42.5 / 73.4 / 53.8 82.6 / 79.4 / 81.0 91.3 / 56.3 / 69.7

97.7 / 92.6 / 95.1

92.2 / 81.7 / 86.7

94.5 / 82.8 / 88.3

81.4 / 88.7 / 84.9

(i): Sequence Representation Learning-based Methods, (ii): Graph Learning-based Methods, (iii): LLMs-based Methods, (iv): Traditional Rule-based Methods.

anomaly detection models. For a fair comparison, we reproduced all baselines following the original papers, and the available codes are released at 1 . 3) Environments: The I ST GPT framework is implemented in pytorch version 2.3.0 with CUDA 12.7 and trained on 32GB RAM machine with Intel Core Ultra-9 185H CPU and NVIDIA GeForce RTX 4060 GPU. For ISTG generation, we used GPT-4o due to its advanced multimodal capabilities, enhanced inference speed, and computational efficiency [61]. For baseline models, the hyperparameters and detection thresholds are set based on a grid search to determine the optimal values. 4) Metrics: For evaluation metrics, we use Precision (Pre), Recall (Rec), and F1-score (F1). However, these point-wise metrics tend to overemphasize long-duration attacks. Therefore, we also adopt the time-aware metrics eTaP, eTaR, and eTaF1, which evaluate detection performance at the event level by considering the temporal overlap between predicted and ground-truth anomaly intervals [62]. B. RQ1: Effectiveness. We evaluate the detection effectiveness of I ST GPT by comparing it with 12 representative anomaly detection baselines on two public datasets (Table IV). I ST GPT achieves stateof-the-art performance, ranking first on 8 out of 12 metrics and consistently attaining the highest F1 and eTaF1 on both datasets. On SWaT, I ST GPT achieves the highest recall of 92.6% while maintaining strong precision (97.7%). Its high eventaware precision (eTaP = 92.2%) indicates accurate localization of attack intervals rather than merely point-wise detections. On WADI, I ST GPT attains the highest precision of 94.5% with a competitive recall of 82.8%. Moreover, the best event-aware recall (eTaR = 88.7%) demonstrates its ability to identify the majority of attack intervals. We further analyze representative baselines that outperform I ST GPT in either precision or recall. On SWaT, MTADGAT achieves higher precision (98.1%) but substantially lower 1 https://anonymous.4open.science/r/IstGPT-386A/BASELINES.md

recall (75.3%), with event-aware precision and recall dropping to 73.4% and 60.9%, respectively. The results indicate a focus on prominent local pattern changes while failing to capture subtle or long-term dependencies. In contrast, I ST GPT improves recall by 17.3% and eTaF1 by 20.1%. On WADI, MSCRED attains a high recall of 96.2% but suffers from extremely low precision, as it lacks graph-based modeling to handle the complexity of 124 nodes, resulting in frequent false positives. By contrast, I ST GPT maintains both high precision and event-aware recall, yielding fewer false alarms and missed attack intervals. Across baselines, graph learning-based methods outperform most sequence representation learning-based approaches, achieving average improvements of 19.5% in F1 and 15.3% in eTaF1. By explicitly modeling sensor-actuator dependencies and propagating information through message passing, these methods exhibit greater robustness to noise and data imbalance. In comparison, LLM-based methods perform worse due to the absence of multivariate dependency modeling, leading to high false positives caused by generalized text reasoning and context-length limitations. Traditional rule-based methods outperform sequence-based approaches, with average F1 and eTaF1 gains of 12.8% and 14.8%, respectively, as they explicitly leverage rule-based constraints and correlations among multiple variables to detect violations of cross-variable consistency, which conceptually resemble graph-based methods. By integrating LLM-based knowledge reasoning with graph learning–based dependency modeling, I ST GPT effectively combines its complementary strengths, substantially enhancing industrial anomaly detection performance. C. RQ2: Ablation Study. We conduct ablation studies to analyze the contributions of five key factors: (1) the industrial multi-modal knowledge base, (2) the multi-stage prompting pipeline, (3) prompt components, (4) the LLM inference engine, and (5) ISTG learning algorithms. Industrial Multi-Modal Knowledge Base. As shown in Fig. 7, removing IIOT-Operation (Kop ) causes an F1 drop of

TABLE V: Performance comparison on different LLMs. Datasets LLMs ChatGPT-3.5 ChatGPT-4o Deepseek-R1-32B

Fig. 7: Performance comparison of different industrial multi-modal knowledge bases.

SWaT

WADI

Pre (%)

Rec (%)

Pre (%)

Rec (%)

65.8 97.7 78.0

83.1 92.6 85.8

0.734 0.951 0.817

64.3 94.5 74.8

79.8 82.8 84.2

0.712 0.883 0.792

and Deepseek R1-32B on both datasets. ChatGPT-3.5 struggles to capture complex industrial semantics, while Deepseek-R132B shows weaker multimodal fusion, leading to less accurate graph generation.

Fig. 8: Performance comparison of multi-stage prompting.

Fig. 10: Performance comparison of different ISTGLearning algorithms.

at least 14.2% on both SWaT and WADI, highlighting the importance of data-driven dependency cues. IIOT-Text (Ktxt ) and IIOT-Image (Kimg ) further improve F1 by about 10% on average by providing semantic and structural priors, enabling more accurate dependency graph construction. Multi-Stage Prompting Pipeline. Fig. 8 shows that removing LLM-Optimation leads to an average F1-score drop of 50.5%, demonstrating its critical role in validating and refining graph structures. Removing LLM-Sensor also degrades performance, indicating that step-wise sensor/actuator analysis is essential for reliable dependency inference.

ISTG Learning Algorithms. Fig. 10 shows that removing the encoder-decoder (En-De) module causes the largest F1 drop (46.05%), indicating its importance for temporal modeling. Removing the GAT and GCN layers reduces F1 by 33.1% and 26.8%, respectively, confirming that both spatial attention and temporal aggregation are essential. Overall, each ISTG learning component contributes meaningfully to anomaly detection performance.

Fig. 9: Performance comparison of different prompt components. Prompt Components. As shown in Fig. 9, removing any prompt component degrades performance. Omitting #Output Format causes the largest drop, underscoring the importance of structured output constraints. Removing #Contextual Knowledge also significantly hurts performance, while #Reward and #Role provide smaller but consistent gains by improving task alignment. LLM Inference Engine. Table V compares different LLM backends. ChatGPT-4o consistently outperforms ChatGPT-3.5

D. RQ3: Case Study. We applied I ST GPT to an industrial simulation platform and to an intelligent vision-based robotic arm to evaluate its anomaly-detection performance and to conduct case studies in both scenarios. 1) Industrial Simulation Case: We built an industrial simulation platform that models SCADA-PLC-Device operational processes. InPlant SCADA [63] serves as the SCADA system, Nettoplcsim-S7 [64] emulates SCADA-PLC communication, Siemens TIA Portal [65] is used for PLC programming, and Factory I/O [66] simulates physical processes. Based on this platform, we constructed six industrial scenarios2 , including Converge Station, Level Control, Palletizer, Sorting by Height (Basic), Sorting by Height (Advanced), and Sorting by Weight. For each scenario, we launched three types of ICS attacks: DoS, replay, and data tampering. Each test dataset contains 3,600 samples, among which 1,441 are anomalous due to attacks(Table III). As shown in Table VI, I ST GPT outperforms the baselines on 25 of 36 metrics across the 6 industrial simulation scenarios. Most notably, it detects all attack scenarios while 2 https://anonymous.4open.science/r/IstGPT-386A/ Industrial-Simulation-Platform/Videos/

TABLE VI: Performance (F1-score) comparison on Industrial Simulation Platform Datasets. Datasets Models

Sim-Converge Station

Sim-Level Control

Sim-Palletizer

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

ICS-AD [17] USAD [18] OmniAnomaly [19] MSCRED [20] VAE-LSTM [21] GDN [22] MTAD-GAT [23] GTA [24] LLMTIME [25] Sigllm [26] JumpStarter [27] GeCos [36]

88.2 / 70.6 / 78.4 30.1 / 59.0 / 39.9 87.8 / 88.0 / 87.9 77.7 / 84.4 / 80.9 51.6 / 42.0 / 46.3 64.9 / 90.4 / 75.6 86.7 / 66.9 / 75.5 89.9 / 53.5 / 67.1 64.5 / 56.2 / 60.1 81.3 / 90.9 / 85.8 73.4 / 91.2 / 81.4 99.9 / 78.1 / 87.7

83.8 / 85.3 / 84.6 32.5 / 79.5 / 46.2 75.2 / 94.0 / 83.6 69.8 / 92.2 / 79.5 40.9 / 71.0 / 66.6 52.6 / 95.2 / 67.8 71.4 / 83.5 / 77.0 81.6 / 76.8 / 79.2 72.3 / 78.1 / 75.1 70.9 / 95.5 / 81.4 75.7 / 95.6 / 84.5 99.4 / 89.0 / 93.9

91.8 / 56.9 / 70.3 55.1 / 42.5 / 48.0 85.6 / 84.9 / 85.3 67.2 / 91.1 / 77.4 56.0 / 46.0 / 50.5 55.9 / 94.4 / 70.2 83.2 / 91.5 / 87.2 85.1 / 56.4 / 67.9 65.8 / 77.1 / 71.0 74.5 / 79.8 / 77.1 86.1 / 81.7 / 83.9 98.7 / 37.6 / 54.5

86.7 / 78.4 / 82.4 47.4 / 71.3 / 56.9 83.2 / 92.4 / 87.6 73.8 / 95.5 / 83.3 33.5 / 73.0 / 45.9 53.0 / 97.2 / 68.6 85.4 / 95.7 / 90.3 83.2 / 78.2 / 80.6 56.4 / 88.5 / 68.9 61.3 / 89.9 / 72.9 89.6 / 90.9 / 90.2 99.7 / 68.8 / 81.4

88.3 / 81.9 / 85.0 60.7 / 48.7 / 54.1 54.7 / 86.1 / 66.9 36.7 / 93.5 / 52.7 68.0 / 52.3 / 59.1 43.0 / 95.2 / 59.3 56.3 / 65.6 / 60.6 89.1 / 90.9 / 90.0 68.1 / 73.2 / 70.6 82.7 / 95.6 / 88.7 75.4 / 87.1 / 80.8 86.8 / 93.8 / 90.1

79.9 / 91.0 / 85.1 55.2 / 74.4 / 63.4 60.8 / 93.1 / 73.6 35.5 / 96.8 / 52.0 46.6 / 76.1 / 57.8 47.8 / 97.6 / 64.2 62.1 / 82.8 / 71.0 82.6 / 95.4 / 88.6 66.3 / 86.6 / 75.1 55.6 / 97.8 / 70.9 84.7 / 93.5 / 88.9 91.4 / 96.9 / 94.0

IstGPT

85.7 / 92.2 / 88.6

92.6 / 96.1 / 94.4

82.4 / 96.4 / 88.9

85.5 / 98.2 / 91.4

94.3 / 90.3 / 92.3

95.6 / 95.2 / 95.4

Sim-Sorting by Height (Basic)

Datasets Models

Sim-Sorting by Height (Advanced)

Sim-Sorting by Weight

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

Pre / Rec / F1 (%)

eTaP / eTaR / eTaF1 (%)

ICS-AD [17] USAD [18] OmniAnomaly [19] MSCRED [20] VAE-LSTM [21] GDN [22] MTAD-GAT [23] GTA [24] LLMTIME [25] Sigllm [26] JumpStarter [27] GeCos [36]

72.7 / 66.2 / 69.3 36.9 / 20.3 / 26.2 90.6 / 91.6 / 91.1 35.6 / 78.9 / 49.1 37.2 / 22.9 / 28.4 47.8 / 98.1 / 64.3 71.9 / 76.9 / 74.3 68.2 / 36.9 / 47.9 35.9 / 61.8 / 45.4 36.9 / 60.4 / 45.8 64.7 / 80.5 / 71.7 81.2 / 98.9 / 89.2

63.9 / 83.1 / 72.3 24.0 / 60.2 / 34.3 83.4 / 95.8 / 89.2 24.9 / 89.5 / 39.0 14.2 / 61.5 / 23.1 42.7 / 99.1 / 59.7 73.3 / 88.5 / 80.2 64.8 / 68.5 / 66.6 41.2 / 80.9 / 54.6 28.5 / 80.2 / 42.1 72.0 / 90.3 / 80.1 78.3 / 99.5 / 87.6

92.0 / 75.2 / 82.7 41.6 / 34.9 / 38.0 58.5 / 92.8 / 71.8 54.1 / 69.0 / 60.7 23.3 / 16.0 / 19.0 70.4 / 89.7 / 78.9 67.4 / 50.8 / 57.9 91.2 / 58.4 / 71.2 34.9 / 46.8 / 40.0 52.5 / 73.4 / 61.2 74.7 / 96.7 / 84.3 70.5 / 99.7 / 82.6

75.4 / 87.6 / 81.1 27.0 / 67.5 / 38.6 66.8 / 96.4 / 78.9 32.2 / 84.5 / 46.6 9.5 / 58.0 / 16.3 49.9 / 94.9 / 65.4 57.3 / 75.4 / 65.1 67.6 / 79.2 / 72.9 36.2 / 73.4 / 48.5 43.0 / 86.7 / 57.5 61.3 / 98.4 / 75.5 32.5 / 99.8 / 49.0

79.6 / 76.3 / 77.9 35.3 / 31.7 / 33.4 80.3 / 92.9 / 86.1 59.8 / 76.7 / 67.2 41.6 / 65.4 / 50.9 59.5 / 99.2 / 74.4 77.2 / 86.0 / 81.4 87.7 / 50.2 / 63.9 61.6 / 72.4 / 66.6 67.4 / 84.9 / 75.2 77.9 / 91.1 / 84.0 74.2 / 99.3 / 84.9

54.8 / 88.1 / 67.6 40.5 / 65.9 / 50.2 65.1 / 96.5 / 77.7 32.2 / 88.3 / 47.2 19.3 / 82.7 / 31.3 44.3 / 99.6 / 61.3 61.9 / 93.0 / 74.3 76.2 / 75.1 / 75.7 25.7 / 86.2 / 39.6 34.8 / 92.5 / 50.6 70.4 / 95.6 / 81.1 58.3 / 99.7 / 73.6

IstGPT

94.6 / 99.1 / 96.8

92.8 / 99.6 / 96.1

81.3 / 98.6 / 89.1

75.6 / 99.3 / 85.9

96.2 / 98.6 / 97.4

82.5 / 99.3 / 90.1

I3 I2

I13

I12 I11 I10

Q1 Q10

Q11

Q13

Q12

Q14 Q15 Q2

I9 Q3

Q5 Q6 Q7 Q8

I8 QD30 Q9

(a) Dependency graph of Palletizer: I0-I13 are sensors, Q0-Q15 and QD30 are actuators.

(b) Detection results of I0-Pallet at entry and Q0 Pallet Feeder.

Fig. 11: Case study of Palletizer Simulation.

achieving the highest F1 and eTaF1 scores. We use the Palletizer scenario in Figure 11 to illustrate the LLM-generated dependency graph and anomaly detection results. Fig. 11 (a) shows the LLM-generated dependency graph for the Palletizer, which consists of 14 sensors and 17 actuators. Directed edges are added when LLMs infer causal influences based on an industrial multi-modal knowledge base. For example, an edge from I0-Pallet (entry sensor) to Q0-Pallet feeder reflects that pallet detection at the entry triggers the feeder to move pallets onto the line. In contrast, nodes such as I8-Start and I9-Reset are isolated, as confirmed by IIOT-Operation data showing constant zero values. Fig. 11 (b) presents the detection results for I0 and Q0

under three attack scenarios. (i) In the DoS attack, the attacker floods the PLC with large write requests and repeated reconnections, blocking timely updates from I0 and causing Q0 to remain active without pallets. (ii) In the replay attack, previously recorded normal I0 values are injected into the PLC, misleading the controller and keeping Q0 active despite the absence of pallets. (iii) In the data-tampering attack, the attacker overwrites I0 readings at high frequency, preventing Q0 from actuating even when pallets arrive, resulting in pallet accumulation. Across all scenarios, I ST GPT detects most attack-induced anomalies. When learned sensor-actuator dependencies are violated, reconstruction errors increase sharply, enabling accu-

TABLE VII: Performance comparison on Real-world datasets. Datasets Models

(a) Dependency graph and physical diagram of the real-world robotic arm.

(b) Detection results on I1-IMU Attitude Sensor.

Fig. 12: Case study on the real-world robotic arm.

Real-World Pre (%)

Rec (%)

F1 (%)

eTaP (%)

eTaR (%)

eTaF1 (%)

ICS-AD USAD OmniAnomaly MSCRED VAE-LSTM GDN MTAD-GAT GTA LLMTIME Sigllm JumpStarter GeCos

67.8 85.3 65.6 95.5 89.5 61.2 73.7 65.7 58.9 48.7 84.2 93.8

85.5 67.4 97.9 52.4 65.8 93.1 68.9 71.0 60.6 91.2 74.5 40.8

75.6 75.3 78.6 67.7 75.8 73.9 71.2 68.2 59.7 63.5 79.1 56.9

64.3 67.8 74.1 90.3 63.9 57.6 78.4 35.6 27.8 21.9 79.6 79.5

82.6 75.2 88.7 43.1 71.4 79.2 70.3 55.5 54.9 70.5 80.0 13.8

72.3 71.3 80.8 58.4 67.5 66.7 74.1 43.4 36.9 33.4 79.8 23.6

IstGPT

89.5

96.7

93.0

83.7

93.2

88.2

Attitude Sensor. Under normal operation, I1 exhibits stable periodic patterns that I ST GPT reconstructs accurately. During the attack period, reconstruction errors increase significantly, and anomaly scores exceed the threshold over most attack intervals. Only a few short anomalies are missed at the onset of the attack, where deviations remain close to normal fluctuations. As summarized in Table VII, I ST GPT achieves the best overall F1 (93.0%) and eTaF1 (88.2%) on the real-world dataset, demonstrating strong point-wise accuracy and eventlevel detection capability. Compared to methods such as MSCRED, which may achieve high precision on easily separable anomalies, I ST GPT provides a more balanced precision-recall tradeoff and reduces false negatives on subtle or short-duration abnormal segments. E. RQ4: Scalability

rate detection of abnormal intervals. Only a few anomalies at the early stage of attacks are missed, as initial signal deviations are minimal. 2) Real-world Case: We deploy a vision-based robotic arm [67] to emulate a real industrial workflow involving object identification, grasping, and placement (Fig. 12(a)). The system is controlled by a Raspberry Pi 4B [68] and consists of 8 sensors (I1–I8) and 4 actuators (Q1–Q4), including IMUbased posture sensing, joint encoders, tactile sensors, visual perception, and motor control, etc. We evaluate a DoS attack that overloads the control interface, resulting in unstable command delivery and intermittent control anomalies. Such disturbances are common in real deployments with lightweight edge controllers and bandwidthconstrained control links. Fig. 12 (a) shows the dependency graph constructed for the robotic arm, which captures the coupling between actuators and sensors. Actuators alter arm states, while sensors observe the resulting dynamics. For example, the I1-IMU Attitude Sensor is strongly influenced by the base and shoulder motions. Accordingly, Q2 (Shoulder Joint Motor) is directly connected to I1, reflecting that shoulder movements are immediately manifested in IMU readings. Joint encoders (I2/I3) further provide motion feedback that is temporally consistent with posture changes captured by I1. Fig. 12 (b) presents the detection results for the I1-IMU

Fig. 13 (a) visualizes the normalized detection performance (F1) of all methods across nine datasets (D1-D9), covering both small-scale simulations and large public benchmarks. In addition, Fig. 13 (b) also visualizes the event-aware performance (eTaF1) for all methods. 1) Scalability of Anomaly Detection: We evaluate scalability by examining performance robustness across datasets with diverse sizes and dimensionalities. As summarized in Table III, the datasets range from small simulation scenarios with a few thousand samples (e.g., D3-D8: 7,200 training samples) to large industrial benchmarks with hundreds of thousands of records (e.g., D1: 496,800; D2: 784,571). Meanwhile, the node dimensionality ranges from 6-39 channels in simulated and real-world datasets to 51 channels in D1 and up to 124 channels in D2, reflecting significantly different modeling difficulties. According to the detection results, I ST GPT consistently achieves the best F1 and eTaF1 across all datasets. Notably, its performance remains stable when scaling from lowdimensional simulation settings to the highly complex WADI dataset, demonstrating strong adaptability to large-scale industrial systems. 2) Scalability of LLM-based Graph Generation: We further evaluate the scalability of LLM-based dependency graph construction by examining whether IIOT-Optimation can refine graph quality as process scale and complexity increase.

TABLE VIII: The time cost of I ST GPT Phases Datasets

DataProcess

ISTGGen

ISTGLearning

AnomalyDetection

Total

Online Throughput

34s 73s 2s 1s

3.8m 6.7m 50s 30s

34m 75.8m 8.3m 1.7m

18s 27s 8s 5s

38.7m 84.2m 9.3m 2.3m

7195 sps 6400 sps 450 sps 200 sps

SWaT WADI Simulation Real-world

TABLE IX: Comparison of the average time costs for different baselines on various datasets

(a) Performance comparison (F1).

Datasets Models

SWaT

WADI

Simulation

Real-world

ICS-AD USAD OmniAnomaly MSCRED VAE-LSTM GDN MTAD-GAT GTA LLMTIME Sigllm JumpStarter GeCos

1.7h 7.2h 7.4h 14.2h 9.9h 1.4h 9.4h 3.3h 10.3h 23.3h 27.5m 14.1h

4.6h 10.1h 11.1h 18.3h 12.9h 1.9h 14.8h 9.3h 21.3h 1.6d 1.2h 3.2d

3.4m 4.3m 5.6m 16.8m 13.4m 1.1m 15.4m 13.9m 6.1m 1.0h 2.1m 2.4m

2.5m 1.4m 2.1m 10.1m 4.6m 31s 5.2m 3.4m 1.4m 18.3m 1.1m 11s

IstGPT

38.7m

1.4h

9.3m

6.3m

(b) Performance comparison (eTaF1).

Fig. 13: Performance comparison for different baselines on various datasets. D1: SWaT Dataset. D2: WADI Dataset. D3: Sim-Converge Station. D4: Sim-Level Control. D5: Sim-Palletizer. D6: Sim-Sorting by Height-basic. D7: SimSorting by Height-Advanced. D8: Sim-Sorting by Weight. D9: Real-world Dataset.

Such hallucinations are effectively mitigated in later iterations through the iterative prompt engineering pipeline and incremental feedback. Overall, these results demonstrate that I ST GPT scales efficiently in both anomaly detection and LLM-based graph generation across heterogeneous industrial settings.

Fig. 14 shows that the average number of nodes, edges, and logic violations decreases steadily over IIOT-LLM iterations. Convergence occurs within 10 iterations for simulations with fewer than 30 nodes, and within 17 (SWaT) and 23 (WADI) iterations for larger benchmarks. We also observe occasional LLM hallucinations during iterative optimization. For instance, on the D8 dataset, IIOTOptim briefly stagnates in a few iterations (5-6 or 7-8).

F. RQ5: Time Cost.

Fig. 14: The average number of node/edge/logic violations across 9 datasets during IIOT-LLM iterations.

We measure the average runtime of I ST GPT over three runs on all datasets. As reported in Table VIII, the overall time cost is dominated by the ISTG learning phase. The first three phases of I ST GPT (i.e., DataProcess, ISTG-Gen, and ISTGLearning) are performed offline, and only the final anomaly detection phase operates online. For large-scale datasets with several hundred thousand records, the total training and detection time is approximately one hour, while for datasets with only a few thousand records, it remains within 10 minutes. On SWaT and WADI (approximately 100K samples at 1Hz), I ST GPT achieves an online throughput of 6.8K samples/s. On smaller simulation and real-world datasets (around 1K samples), the online throughput is 325 samples/s, mainly due to fixed initialization and I/O overheads. The hardware configuration (CPU/GPU/RAM) is detailed at the beginning of Section IV-A. For industrial real-time control systems, the latency of the online anomaly detection phase is the primary concern during deployment. The measured online throughput indicates that I ST GPT can process incoming measurements within millisecond-level latency, which is sufficient for timely detection and mitigation in typical industrial control systems. We further compare the total time cost (including both offline and online phases) of I ST GPT with 12 baselines in

Table IX. On large-scale datasets, I ST GPT exhibits substantially lower runtime than most baselines. On smaller datasets, it incurs slightly higher overhead but remains within a reasonable range, as I ST GPT involves iterative LLM-based graph generation rather than purely data-driven learning. Overall, the results demonstrate that I ST GPT achieves practical efficiency for industrial-scale anomaly detection. V. DISCUSSION I ST GPT demonstrates strong accuracy and scalability for industrial anomaly detection. We now discuss several directions for future research. • Effective deployment of I ST GPT relies on industrial multimodal knowledge, which corresponds to standard engineering artifacts commonly maintained in modern ICS environments (e.g., system documentation and control logic). Such knowledge is typically collected during system design and commissioning, and thus represents a one-time, reusable asset that enables largely automated anomaly detection with minimal additional human intervention. • By detecting abnormal sensors or actuators, I ST GPT can support timely mitigation actions (e.g., component isolation), thereby substantially reducing potential damage. However, due to inherent CPS constraints such as delayed observability and limited in-process intervention, some attack effects may still occur before detection [69], [70]. Future work will explore tighter integration with complementary defense mechanisms, including resilient network architectures [71] and predictive maintenance strategies [72], to further reduce end-to-end attack impact in ICS environments. • I ST GPT primarily detects realistic industrial attack scenarios that introduce observable spatiotemporal inconsistencies. An advanced, sophisticated adversary with knowledge of the dependency graph could potentially perform attacks that resemble normal causal behavior. However, executing such graph-aware false data injection attacks in practice is challenging because the attacker must simultaneously satisfy tightly coupled constraints on node validity, edge consistency, and logical coherence. As system scale increases, maintaining stealthy manipulations within the normal operating manifold becomes increasingly difficult, thereby significantly increasing the attack cost and making such attacks much harder in practice. VI. RELATED WORK Industrial Sensors and Actuators Anomaly Detection. Existing approaches for industrial anomaly detection can be broadly categorized into three classes. (1) Traditional rule-based methods. JumpStarter [27] applies compressed sensing to detect anomalies by comparing reconstructed signals with original observations. RRCF [73] and SPOT [74] rely on extreme value theory to identify rare events by modeling statistical tails in data streams. However, most rule-based methods struggle with high-dimensional and multivariate industrial data. Although approaches such as GeCo [36] attempt to address this challenge through complex rule modeling, they are often time-consuming, unstable, and

difficult to scale, limiting their robustness in realistic industrial environments. (2) Sequence representation learning-based methods. USAD [18] employs adversarial autoencoders to detect anomalies using weighted reconstruction errors. OmniAnomaly [19] leverages stochastic recurrent neural networks to learn latent representations and flags anomalies when reconstruction probabilities drop below a threshold. Despite their effectiveness in temporal modeling, these methods lack explicit representations of inter-variable dependencies, which restricts their performance in structured industrial systems with strong sensor–actuator coupling. (3) Graph learning-based methods. GDN [22] detects anomalies by forecasting each sensor value based on its neighbors in a learned dependency graph. MTAD-GAT [23] captures both feature-wise and temporal dependencies using graph attention mechanisms. PGRGAT [29] further incorporates physical constraints into graph attention networks to improve anomaly detection. While these approaches explicitly model inter-variable relationships, they often incur high computational overhead due to data-driven dependency learning, limiting their practicality in large-scale industrial deployments. LLM-based Anomaly Detection. Recent studies explore large language models (LLMs) for time-series anomaly detection. LLMTIME [25] formulates forecasting as next-token prediction over text-encoded numerical sequences, enabling zeroshot detection. SigLLM [26] identifies anomalies by measuring discrepancies between predicted and observed signals. LLMAD [75] leverages in-context learning and chain-of-thought prompting to retrieve similar patterns for anomaly detection and interpretation. However, these methods primarily focus on univariate signals and overlook inter-variable dependencies, resulting in limited accuracy for complex industrial processes. In contrast, our work pioneers the use of LLMs for dependency graph construction, enabling accurate and interpretable modeling of industrial sensor-actuator relationships.

VII. CONCLUSION We present I ST GPT, the first LLM- and graph learningbased industrial anomaly detection tool that constructs interpretable spatial-temporal graphs to detect anomalies in real time. I ST GPT leverages a multi-stage prompt engineering pipeline to extract sensor-actuator dependencies from industrial multi-modal knowledge, forming accurate spatial graphs. It then models spatial-temporal patterns via graph neural networks and an improved encoder-decoder architecture to detect anomalies through reconstruction errors. To ensure graph accuracy, I ST GPT introduces LLM-Optimation to iteratively validate and refine graph structure from the perspective of node accuracy, edge consistency, and logical coherence. Extensive experiments on 9 datasets, including public, simulation-based, and real-world cases, demonstrate that I ST GPT achieves high detection performance and outperforms 12 state-of-theart baselines. These results highlight I ST GPT’s effectiveness, scalability, and feasibility in practical industrial scenarios.

R EFERENCES [1] Y. Hu, Q. Jia, Y. Yao, Y. Lee, M. Lee, C. Wang, X. Zhou, R. Xie, and F. R. Yu, “Industrial internet of things intelligence empowering smart manufacturing: A literature review,” IEEE Internet of Things Journal, vol. 11, no. 11, pp. 19 143–19 167, 2024. [2] S. S. Buchanan, Cyber-attacks to industrial control systems since stuxnet: A systematic review. Capitol Technology University, 2022. [3] L. Salazar, S. R. Castro, J. Lozano, K. Koneru, E. Zambon, B. Huang, R. Baldick, M. Krotofil, A. Rojas, and A. A. Cardenas, “A tale of two industroyers: It was the season of darkness,” in 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024, pp. 312–330. [4] M. Pollard, “A case study of russian cyber-attacks on the ukrainian power grid: Implications and best practices for the united states,” Pepperdine Policy Review, vol. 16, no. 1, p. 1, 2024. [5] J. Cervini, A. Rubin, and L. Watkins, “Don’t drink the cyber: Extrapolating the possibilities of oldsmar’s water treatment cyberattack,” in International conference on cyber warfare and security, vol. 17, no. 1. Academic Conferences International Limited, 2022, pp. 19–25. [6] Z. Liu, W. Yang, S. Wang, and H. Fan, “Intrusion prevention system against spoofed data frames at the electronic control unit level,” Journal of Networking and Network Applications, vol. 5, no. 1, pp. 1–12, 2025. [7] B. Hu, Y. Bi, M. Zhi, K. Zhang, F. Yan, Q. Zhang, and Z. Liu, “A deep one-class intrusion detection scheme in software-defined industrial networks,” IEEE Transactions on Industrial Informatics, vol. 18, no. 6, pp. 4286–4296, 2021. [8] M. Ike, K. Phan, K. Sadoski, R. Valme, and W. Lee, “Scaphy: Detecting modern ics attacks by correlating behaviors in scada and physical,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 20–37. [9] A. B. Nassif, M. A. Talib, Q. Nasir, and F. M. Dakalbab, “Machine learning for anomaly detection: A systematic review,” Ieee Access, vol. 9, pp. 78 658–78 700, 2021. [10] O. Lamberts, K. Wolsing, and E. Wagner, “[sok] evaluations in industrial intrusion detection research,” Journal of Systems Research, 3 (1), 2023. [11] J. Giraldo, D. Urbina, A. Cardenas, J. Valente, M. Faisal, J. Ruths, N. O. Tippenhauer, H. Sandberg, and R. Candell, “A survey of physics-based attack detection in cyber-physical systems,” ACM Computing Surveys (CSUR), vol. 51, no. 4, pp. 1–36, 2018. [12] Y. Luo, Y. Xiao, L. Cheng, G. Peng, and D. Yao, “Deep learning-based anomaly detection in cyber-physical systems: Progress and opportunities,” ACM Computing Surveys (CSUR), vol. 54, no. 5, pp. 1–36, 2021. [13] G. Apruzzese, P. Laskov, and J. Schneider, “Sok: Pragmatic assessment of machine learning for network intrusion detection,” in 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE, 2023, pp. 592–614. [14] A. Balla, M. H. Habaebi, M. R. Islam, and S. Mubarak, “Applications of deep learning algorithms for supervisory control and data acquisition intrusion detection system,” Cleaner Engineering and Technology, vol. 9, p. 100532, 2022. [15] C. Fung, S. Srinarasi, K. Lucas, H. B. Phee, and L. Bauer, “Perspectives from a comprehensive evaluation of reconstruction-based anomaly detection in industrial control systems,” in European Symposium on Research in Computer Security. Springer, 2022, pp. 493–513. [16] K. Qin, M. Xu, B. A. Muhammad, and J. Han, “Mtad rf: Multivariate time-series anomaly detection based on reconstruction and forecast,” Journal of Networking and Network Applications, vol. 3, no. 1, pp. 45– 57, 2023. [17] C. Fung, E. Zeng, and L. Bauer, “Attributions for ml-based ics anomaly detection: From theory to practice,” in Proc. 31st Netw. Distrib. Syst. Secur. Symp, 2024. [18] J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga, “Usad: Unsupervised anomaly detection on multivariate time series,” in Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, 2020, pp. 3395–3404. [19] Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, “Robust anomaly detection for multivariate time series through stochastic recurrent neural network,” in Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, 2019, pp. 2828– 2837. [20] C. Zhang, D. Song, Y. Chen, X. Feng, C. Lumezanu, W. Cheng, J. Ni, B. Zong, H. Chen, and N. V. Chawla, “A deep neural network for unsupervised anomaly detection and diagnosis in multivariate time series data,” in Proceedings of the AAAI conference on artificial intelligence, vol. 33, no. 01, 2019, pp. 1409–1416.

[21] S. Lin, R. Clark, R. Birke, S. Schönborn, N. Trigoni, and S. Roberts, “Anomaly detection for time series using vae-lstm hybrid model,” in ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). Ieee, 2020, pp. 4322–4326. [22] A. Deng and B. Hooi, “Graph neural network-based anomaly detection in multivariate time series,” in Proceedings of the AAAI conference on artificial intelligence, vol. 35, no. 5, 2021, pp. 4027–4035. [23] H. Zhao, Y. Wang, J. Duan, C. Huang, D. Cao, Y. Tong, B. Xu, J. Bai, J. Tong, and Q. Zhang, “Multivariate time-series anomaly detection via graph attention network,” in 2020 IEEE international conference on data mining (ICDM). IEEE, 2020, pp. 841–850. [24] Z. Chen, D. Chen, X. Zhang, Z. Yuan, and X. Cheng, “Learning graph structures with transformer for multivariate time-series anomaly detection in iot,” IEEE Internet of Things Journal, vol. 9, no. 12, pp. 9179–9189, 2021. [25] N. Gruver, M. Finzi, S. Qiu, and A. G. Wilson, “Large language models are zero-shot time series forecasters,” Advances in Neural Information Processing Systems, vol. 36, pp. 19 622–19 635, 2023. [26] S. Alnegheimish, L. Nguyen, L. Berti-Equille, and K. Veeramachaneni, “Large language models can be zero-shot anomaly detectors for time series?” arXiv preprint arXiv:2405.14755, 2024. [27] M. Ma, S. Zhang, J. Chen, J. Xu, H. Li, Y. Lin, X. Nie, B. Zhou, Y. Wang, and D. Pei, “{Jump-Starting} multivariate time series anomaly detection for online service systems,” in 2021 USENIX Annual Technical Conference (USENIX ATC 21), 2021, pp. 413–426. [28] J. Zhan, S. Wang, X. Ma, C. Wu, C. Yang, D. Zeng, and S. Wang, “Stgatmad: Spatial-temporal graph attention network for multivariate time series anomaly detection,” in ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2022, pp. 3568–3572. [29] W. Wu, C. Song, J. Zhao, and Z. Xu, “Physics-informed gated recurrent graph attention unit network for anomaly detection in industrial cyberphysical systems,” Information Sciences, vol. 629, pp. 618–633, 2023. [30] Y. Chi, Y. Dong, Z. J. Wang, F. R. Yu, and V. C. Leung, “Knowledgebased fault diagnosis in industrial internet of things: a survey,” IEEE Internet of Things Journal, vol. 9, no. 15, pp. 12 886–12 900, 2022. [31] Q. Lin, S. Adepu, S. Verwer, and A. Mathur, “Tabor: A graphical modelbased approach for anomaly detection in industrial control systems,” in Proceedings of the 2018 on asia conference on computer and communications security, 2018, pp. 525–536. [32] L. Shuaiyi, K. Wang, L. Zhang, and B. Wang, “Process-oriented heterogeneous graph learning in gnn-based ics anomalous pattern recognition,” Pattern Recognition, vol. 141, p. 109661, 2023. [33] G. E. Karniadakis, I. G. Kevrekidis, L. Lu, P. Perdikaris, S. Wang, and L. Yang, “Physics-informed machine learning,” Nature Reviews Physics, vol. 3, no. 6, pp. 422–440, 2021. [34] W. Wu, C. Song, J. Liu, and J. Zhao, “Data-knowledge-driven distributed monitoring for large-scale processes based on digraph,” Journal of Process Control, vol. 109, pp. 60–73, 2022. [35] A. Hurst, A. Lerer, A. P. Goucher, A. Perelman, A. Ramesh, A. Clark, A. Ostrow, A. Welihinda, A. Hayes, A. Radford et al., “Gpt-4o system card,” arXiv preprint arXiv:2410.21276, 2024. [36] K. Wolsing, E. Wagner, L. Lux, K. Wehrle, M. Henze, and F. Fraunhofer, “Gecos replacing experts: Generalizable and comprehensible industrial intrusion detection,” in USENIX Security, 2025. [37] H. Holm, M. Karresand, A. Vidström, and E. Westring, “A survey of industrial control system testbeds,” in Secure IT Systems: 20th Nordic Conference, NordSec 2015, Stockholm, Sweden, October 19–21, 2015, Proceedings. Springer, 2015, pp. 11–26. [38] M. Conti, D. Donadel, and F. Turrin, “A survey on industrial control system testbeds and datasets for security research,” IEEE Communications Surveys & Tutorials, vol. 23, no. 4, pp. 2248–2294, 2021. [39] D. Upadhyay and S. Sampalli, “Scada (supervisory control and data acquisition) systems: Vulnerability assessment and security recommendations,” Computers & Security, vol. 89, p. 101666, 2020. [40] C. Wester, N. Engelman, T. Smith, K. Odetunde, B. Anderson, and J. Reilly, “The role of the scada rtu in today’s substation,” in 2015 68th Annual Conference for Protective Relay Engineers. IEEE, 2015, pp. 622–628. [41] B. Tomar and N. Kumar, “Plc and scada based industrial automated system,” in 2020 IEEE International Conference for Innovation in Technology (INOCON). IEEE, 2020, pp. 1–5. [42] P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y. Bengio, “Graph attention networks,” arXiv preprint arXiv:1710.10903, 2017. [43] E. D. Emake, I. A. Adeyanju, and G. O. Uzedhe, “Industrial control systems (ics): Cyber attacks & security optimization,” International

Journal of Computer Engineering and Information Technology, vol. 12, no. 5, pp. 31–41, 2020. [44] A. M. Koay, R. K. L. Ko, H. Hettema, and K. Radke, “Machine learning in industrial control system (ics) security: current landscape, opportunities and challenges,” Journal of Intelligent Information Systems, vol. 60, no. 2, pp. 377–405, 2023. [45] G. Huang, “Missing data filling method based on linear interpolation and lightgbm,” in Journal of Physics: Conference Series, vol. 1754, no. 1. IOP Publishing, 2021, p. 012187. [46] S. Li, D. Hong, and H. Wang, “Relation inference among sensor time series in smart buildings with metric learning,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 04, 2020, pp. 4683–4690. [47] T. Wan, B. Shao, S. Ma, Y. Zhou, Q. Li, and Y. Chai, “In-sensor computing: materials, devices, and integration technologies,” Advanced materials, vol. 35, no. 37, p. 2203830, 2023. [48] F. R. Macaulay, “Introduction to” the smoothing of time series”,” in The smoothing of time series. NBER, 1931, pp. 17–30. [49] S. Golestan, M. Ramezani, J. M. Guerrero, F. D. Freijedo, and M. Monfared, “Moving average filter based phase-locked loops: Performance analysis and design guidelines,” IEEE transactions on power electronics, vol. 29, no. 6, pp. 2750–2763, 2013. [50] P. J. M. Ali, “Investigating the impact of min-max data normalization on the regression performance of k-nearest neighbor with different similarity measurements,” ARO-The Scientific Journal of Koya University, vol. 10, no. 1, pp. 85–91, 2022. [51] L. Huang, J. Qin, Y. Zhou, F. Zhu, L. Liu, and L. Shao, “Normalization techniques in training dnns: Methodology, analysis and application,” IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 8, pp. 10 173–10 196, 2023. [52] R. Zhai, J. Zeng, and Z. Ge, “Structured principal component analysis model with variable correlation constraint,” IEEE Transactions on Control Systems Technology, vol. 30, no. 2, pp. 558–569, 2021. [53] S. Li, W. Meng, S. He, J. Bi, and G. Liu, “Staged: A spatial-temporal aware graph encoder–decoder for fault diagnosis in industrial processes,” IEEE Transactions on Industrial Informatics, vol. 20, no. 2, pp. 1742– 1752, 2023. [54] X. Liu, J. Wang, J. Sun, X. Yuan, G. Dong, P. Di, W. Wang, and D. Wang, “Prompting frameworks for large language models: A survey,” arXiv preprint arXiv:2311.12785, 2023. [55] B. Chen, Z. Zhang, N. Langrené, and S. Zhu, “Unleashing the potential of prompt engineering in large language models: a comprehensive review,” arXiv preprint arXiv:2310.14735, 2023. [56] S. Zhang, H. Tong, J. Xu, and R. Maciejewski, “Graph convolutional networks: a comprehensive review,” Computational Social Networks, vol. 6, no. 1, pp. 1–23, 2019. [57] A. Shehzad, F. Xia, S. Abid, C. Peng, S. Yu, D. Zhang, and K. Verspoor, “Graph transformers: A survey,” IEEE Transactions on Neural Networks and Learning Systems, 2026. [58] A. Sherstinsky, “Fundamentals of recurrent neural network (rnn) and long short-term memory (lstm) network,” Physica D: Nonlinear Phenomena, vol. 404, p. 132306, 2020. [59] A. Jadon, A. Patil, and S. Jadon, “A comprehensive survey of regressionbased loss functions for time series forecasting,” in International Conference on Data Management, Analytics & Innovation. Springer, 2024, pp. 117–147. [60] A. Mao, M. Mohri, and Y. Zhong, “Cross-entropy loss functions: Theoretical analysis and applications,” in International conference on Machine learning. PMLR, 2023, pp. 23 803–23 828. [61] M. Leon, “Gpt-5 and open-weight large language models: Advances in reasoning, transparency, and control,” Information Systems, p. 102620, 2025. [62] W.-S. Hwang, J.-H. Yun, J. Kim, and B. G. Min, “Do you know existing accuracy metrics overrate time-series anomaly detections?” in Proceedings of the 37th ACM/SIGAPP Symposium on Applied Computing, 2022, pp. 403–412. [63] “Inplant scada,” https://www.supcon.com/new/NBD/. [64] “Nettoplcsim - network extension for plcsim,” https://nettoplcsim. sourceforge.net/. [65] “Totally integrated automation portal,” https://www.siemens.com/ global/en/products/automation/industry-software/automation-software/ tia-portal.html. [66] “Factory i/o,” https://factoryio.com/. [67] “Armpi fpv,” https://www.hiwonder.com.cn/product-detail/ArmPi-FPV. html. [68] “Raspberrypi 4b,” https://www.raspberrypi.com/products/ raspberry-pi-4-model-b/.

[69] M. R. Asghar, Q. Hu, and S. Zeadally, “Cybersecurity in industrial control systems: Issues, technologies, and challenges,” Computer Networks, vol. 165, p. 106946, 2019. [70] F. Hofer, M. Sehr, A. Sangiovanni-Vincentelli, and B. Russo, “Industrial control via application containers: Maintaining determinism in iaas,” Systems Engineering, vol. 24, no. 5, pp. 352–368, 2021. [71] X. Qin, F. Jiang, X. Qin, L. Ge, M. Lu, and R. Doss, “Cgan-based cyber deception framework against reconnaissance attacks in ics,” Computer Networks, vol. 251, p. 110655, 2024. [72] M. Nankya, R. Chataut, and R. Akl, “Securing industrial control systems: Components, cyber threats, and machine learning-driven defense strategies,” Sensors, vol. 23, no. 21, p. 8840, 2023. [73] S. Guha, N. Mishra, G. Roy, and O. Schrijvers, “Robust random cut forest based anomaly detection on streams,” in International conference on machine learning. PMLR, 2016, pp. 2712–2721. [74] A. Siffer, P.-A. Fouque, A. Termier, and C. Largouet, “Anomaly detection in streams with extreme value theory,” in Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining, 2017, pp. 1067–1075. [75] J. Liu, C. Zhang, J. Qian, M. Ma, S. Qin, C. Bansal, Q. Lin, S. Rajmohan, and D. Zhang, “Large language models can deliver accurate and interpretable time series anomaly detection,” arXiv preprint arXiv:2405.15370, 2024.

Record · ID 246432 · SHA-256 62c9f3cc44f179e3
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.