An anomaly behavior differentiation method for weak networks based on dual-relation graph temporal modeling

doi:10.3969/j.issn.1671-1122.2026.08.010

Abstract

Abstract:

Wireless weak-link sensor networks are long-term deployed in underground spaces, pipeline systems, and complex industrial environments. Their wireless communication links are susceptible to rainfall, high humidity, obstructions, and medium attenuation, leading to link quality fluctuations and packet loss. Abnormal data transmission behaviors in weak-link networks may arise either from external environmental changes or from malicious attacks such as selective forwarding, packet dropping, or tampering. Since environment-induced disturbances and malicious behaviors exhibit similar observation patterns, existing methods struggle to distinguish between them, limiting their capability for anomaly identification in complex scenarios.To address this, this paper proposed a dual-graph variational temporal model (DGVT). The environmental covariation graph captured node co-variations caused by rainfall, high humidity, and synchronous packet loss, while the communication link quality graph characterizes link quality and forwarding relationships under normal communication or malicious attacks. The model employed a variational graph autoencoder to learn node structural representations, a temporal module to capture the evolution of anomalies over consecutive time windows, and a multi-label prediction layer to output two non-mutually-exclusive labels: environmental covariation anomalies and attack anomalies.Experimental results show that DGVT significantly outperforms baseline methods in precision, recall, and F1-score. For attack anomalies, the F1-score and exact-match ratio improve by over 10% and 27%, respectively, compared to conventional multi-label classification models. Ablation studies further validate the critical roles of both graphs in distinguishing different anomaly types. The proposed approach extends anomaly detection from a binary "anomalous or not" judgment to a fine-grained classification of anomaly categories, offering a feasible technical pathway for differentiating environmental disturbances from malicious node behaviors in weak-link networks, and providing security support for subsequent environmental status confirmation, attack alerting, and node mitigation.

Key words: wireless weak-link sensor networks, abnormal behavior discrimination, multi-label learning, variational graph autoencoder, environment-induced anomaly

CLC Number:

TP309

Zhu Huimin, Wang Chenlong, Liu Guanghua. An anomaly behavior differentiation method for weak networks based on dual-relation graph temporal modeling[J]. Netinfo Security, 2026, 26(8): 1290-1307.

Figures/Tables 14

References 38

[1]	Liu Guanghua, Wang Chenlong, Tang Shuqi, et al. Security in wireless weak-link sensor networks: directions, recent advances, and challenges[J]. IEEE Network, 2026, 40(1): 322-329.
[2]	Liu Guanghua. Data collection in MI-assisted wireless powered underground sensor networks: directions, recent advances, and challenges[J]. IEEE Communications Magazine, 2021, 59(4): 132-138.
[3]	Akyildiz I F, Stuntebeck E P. Wireless underground sensor networks: research challenges[J]. Ad Hoc Networks, 2006, 4(6): 669-686.
[4]	Yu Xiaoqing, Han Wenting, Zhang Zenglin. Path loss estimation for wireless underground sensor network in agricultural application[J]. Agricultural Research, 2017, 6(1): 97-102.
[5]	Liu Guanghua, Wang Zehua, Jiang Tao. QoS-aware throughput maximization in wireless powered underground sensor networks[J]. IEEE Transactions on Communications, 2016, 64(11): 4776-4789.
[6]	Rajasegarar S, Leckie C, Palaniswami M. Anomaly detection in wireless sensor networks[J]. IEEE Wireless Communications, 2008, 15(4): 34-40.
[7]	Xie Min, Han Song, Tian Bo, et al. Anomaly detection in wireless sensor networks: a survey[J]. Journal of Network and Computer Applications, 2011, 34(4): 1302-1325.
[8]	Karlof C, Wagner D. Secure routing in wireless sensor networks: attacks and countermeasures[J]. Ad Hoc Networks, 2003, 1(2): 293-315.
[9]	Wood A D, Stankovic J A. Denial of Service in Sensor networks[J]. Computer, 2002, 35(10): 54-62.
[10]	Newsome J, Shi E, Song D, et al. The sybil attack in sensor networks: analysis and defenses[C]// The 3rd International Symposium on Information Processing in Sensor Networks. New York: ACM, 2004: 259-268.
[11]	Beutel J, Romer K, Ringwald M, et al. Deployment techniques for sensor networks[M]. Heidelberg: Springer, 2010: 219-248.
[12]	Branch J W, Giannella C, Szymanski B, et al. In-network outlier detection in wireless sensor networks[C]// The 26th IEEE International Conference on Distributed Computing Systems. New York: IEEE, 2006: 51.
[13]	Fawzy A, Mokhtar H, Hegazy O. Outliers detection and classification in wireless sensor networks[J]. Egyptian Informatics Journal, 2013, 14(2): 157-164.
[14]	Hong C O, Choi Y H. Proximity-based robust event detection in wireless sensor networks[J]. International Journal of Distributed Sensor Networks, 2014, 2014: 97-106.
[15]	Ma Xiaoxiao, Wu Jia, Xue Shan, et al. A comprehensive survey on graph anomaly detection with deep learning[J]. IEEE Transactions on Knowledge and Data Engineering, 2023, 35(12): 12012-12038.
[16]	Akoglu L, Tong Hanghang, Koutra D. Graph based anomaly detection and description: a survey[J]. Data Mining and Knowledge Discovery, 2015, 29(3): 626-688.
[17]	Kipf T N, Welling M. Semi-supervised classification with graph convolutional networks[C]// International Conference on Learning Representations. Toulon: ICLR, 2017: 1-14.
[18]	Kipf T N, Welling M. Variational graph auto-encoders[EB/OL]. (2016-11-21)[2026-03-25]. https://arxiv.org/abs/1611.07308.
[19]	Velickovic P, Cucurull G, Casanova A, et al. Graph attention networks[C]// International Conference on Learning Representations. San Diego: ICLR, 2018: 1-12.
[20]	Deng Ailin, Hooi B. Graph neural network-based anomaly detection in multivariate time series[C]// The AAAI Conference on Artificial Intelligence. Menlo Park: AAAI, 2021: 4027-4035.
[21]	Zhao Hang, Wang Yujing, Duan Juanyong, et al. Multivariate time-series anomaly detection via graph attention network[C]// 2020 IEEE International Conference on Data Mining. New York: IEEE, 2020: 841-850.
[22]	Audibert J, Michiardi P, Guyard F, et al. USAD: Unsupervised anomaly detection on multivariate time series[C]// The 26th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, 2020: 3395-3404.
[23]	Su Ya, Zhao Youjian, Niu Chenhao, et al. Robust anomaly detection for multivariate time series through stochastic recurrent neural network[C]// The 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, 2019: 2828-2837.
[24]	Vaswani A, Shazeer N, Parmar N, et al. Attention is all you need[C]// Advances in Neural Information Processing Systems. New York: Curran Associates, 2017: 5998-6008.
[25]	Wang Shiyu, Li Jiawei, Shi Xiaoming, et al. TimeMixer++: a general time series pattern machine for universal predictive analysis[C]// International Conference on Learning Representations. San Diego: ICLR, 2025: 1-22.
[26]	Wu Haixu, Hu Tengge, Liu Yong, et al. TimesNet: temporal 2D-variation modeling for general time series analysis[C]// International Conference on Learning Representations. San Diego: ICLR, 2023: 1-17.
[27]	Liu Yong, Hu Tengge, Zhang Haoran, et al. iTransformer: inverted transformers are effective for time series forecasting[C]// International Conference on Learning Representations. San Diego: ICLR, 2024: 1-25.
[28]	Chung J, Gulcehre C, Cho K, et al. Empirical evaluation of gated recurrent neural networks on sequence modeling[EB/OL]. (2014-12-11)[2026-03-25]. https://arxiv.org/abs/1412.3555.
[29]	Zhang Minling, Zhou Zhihua. A review on multi-label learning algorithms[J]. IEEE Transactions on Knowledge and Data Engineering, 2014, 26(8): 1819-1837.
[30]	Read J, Pfahringer B, Holmes G, et al. Classifier chains for multi-label classification[J]. Machine Learning, 2011, 85(3): 333-359.
[31]	Tsoumakas G, Katakis I. Multi-label classification: an overview[J]. International Journal of Data Warehousing and Mining, 2007, 3(3): 1-13.
[32]	Boutell M R, Luo Jiebo, Shen Xipeng, et al. Learning multi-label scene classification[J]. Pattern Recognition, 2004, 37(9): 1757-1771.
[33]	Junejo K N, Goh J. Behaviour-based attack detection and classification in cyber physical systems using machine learning[C]// The 2nd ACM International Workshop on Cyber-Physical System Security. New York: ACM, 2016: 34-43.
[34]	Cook M, Paterson C, Marnerides A K, et al. Anomaly diagnosis in cyber-physical systems[C]// ICC 2022-IEEE International Conference on Communications. New York: IEEE, 2022: 5445-5450.
[35]	Kingma D P, Welling M. Auto-encoding variational bayes[EB/OL]. (2022-12-10)[2026-03-25]. https://arxiv.org/abs/1312.6114.
[36]	Kingma D P, Ba J. Adam: a method for stochastic optimization[C]// The 3rd International Conference on Learning Representations. San Diego: ICLR, 2015: 1-13.
[37]	Pedregosa F, Varoquaux G, Gramfort A, et al. Scikit-learn: machine learning in Python[J]. Journal of Machine Learning Research, 2011, 12: 2825-2830.
[38]	Paszke A, Gross S, Massa F, et al. PyTorch:an imperative style, high-performance deep learning library[C]// Advances in Neural Information Processing Systems. New York: Curran Associates, 2019: 8024-8035.

符号	含义
${{\mathbf{X}}^{\left(t \right)}}$	第t个时间窗的节点特征矩阵
${{H}^{\left(1:L \right)}}$	序列样本的时间增强节点特征矩阵
$x_{i}^{\left(t \right)}$	节点在时间窗内的特征向量
$\left[ {{\rho }_{i}},{{\rho }_{i,env}},{{\rho }_{i,atk}},{{r}_{i}},{{s}_{i}},{{m}_{i}},{{q}_{i}},{{c}_{i}} \right]$	节点丢包、环境丢包、攻击丢包、雨区标记、同步丢包、湿度、信噪比和连续异常特征
$A_{c}^{\left(t \right)}A_{d}^{\left(t \right)}$	通信链路质量邻接矩阵、环境协同变化邻接矩阵
${{G}^{(t)}}$	第t个时间窗对应的带属性双关系图
${{S}_{k}}$	由连续L个时间窗构成的序列样本
${{Z}^{\left(t \right)}}$	VGAE输出的节点潜在表示矩阵
${{\mu }^{\left(t \right)}},{{\sigma }^{\left(t \right)}}$	节点潜在分布的均值和标准差
$p=\left[ {{p}_{env}},{{p}_{atk}}\left],y= \right[{{y}_{env}},{{y}_{atk}} \right]$	两个非互斥标签的预测概率、环境扰动与攻击异常真值
${{y}_{env}},{{y}_{atk}}$	环境协同变化异常标签与攻击异常标签
${{\tau }_{env}},{{\tau }_{atk}}$	环境协同变化异常与攻击异常的判定阈值

配置项	设置	说明
NS-3与场景	ns-3.33；20 m×20 m； 100节点	1个汇聚节点，节点为随机静态位置
仿真时长	1800 s/轮；30轮	RngRun范围为1001~1030
攻击比例	BH=0.15/0.20/0.25；SF=0.15/0.20/0.25	每轮独立抽取
攻击起始	20~50s，步长5 s	每轮随机；之前攻击标签恒为0
雨区	宽、高各6~10 m；概率0.45~0.75	位置与范围逐轮随机
湿/干期	湿期：15~55 s；干期：10~40 s	雨脉冲0.2~1.0 min，间隔5~25 s
温度	基准：13℃~17℃；振幅：3℃~6℃	逐轮随机

配置项	设置
操作系统	Ubuntu 20.04.1 LTS
Python版本	Python 3.8.10
PyTorch版本	PyTorch 2.3.1 CPU版本
NS-3平台	ns-3.33
CPU	4 vCPU，Intel(R) Core(TM) Ultra 5 225，VMware虚拟化环境
Linux内核	5.15.0-139-generic

模型	Env F1	Attack F1	Exact Match	Hamming Loss
DGVT	0.9693	0.9572	0.8896	0.0581
TimeMixer++-style^[25]	0.9298	0.9235	0.8000	0.1111
TimesNet-style^[26]	0.9146	0.8858	0.7370	0.1537
iTransformer-style^[27]	0.9161	0.9173	0.7852	0.1241
Zhang^[29]	0.8025	0.9420	0.6407	0.1889
Cook^[34]	0.8154	0.9467	0.6444	0.1778

场景组	场景	Env F1	Attack F1	Exact Match	Hamming Loss
基准	基准场景	0.9693	0.9572	0.8896	0.0581
环境扰动	降雨强度随机	0.9219	0.8841	0.7333	0.1444
环境扰动	雨区范围随机	0.6517	0.7667	0.4889	0.3278
环境扰动	湿度起始偏移	0.8027	0.9459	0.6111	0.2056
环境扰动	湿度变化缩放	0.8679	0.8741	0.6889	0.1722
攻击扰动	攻击强度变化	0.9508	0.8841	0.7778	0.1222
攻击扰动	攻击行为集中	0.9593	0.8841	0.7889	0.1167