Clustering-Based Collective Anomaly Detection in IoT Systems: A Graph Neural Network Approach

Researchers introduced Unsupervised Graph Collective Anomaly Detection (UGCAD), a framework that uses a variational graph autoencoder (VGAE) to learn graph representations and enhance clustering for identifying collective anomalies in IoT network traffic without prior group labels or membership knowledge. Experiments on the CICIoT2023 and ToN-IoT network datasets showed UGCAD outperformed several traditional and state-of-the-art clustering-based collective anomaly detection approaches in both clustering and detection accuracy. The work, published as arXiv:2609.22166v1, targets a gap in anomaly detection research that has predominantly focused on point anomalies rather than collective anomalies.

arXiv:2609.22166v1 Announce Type: new Abstract: The rapid advancement of Internet of Things IoT technology has led to the widespread deployment of smart, interconnected devices across a range of domains. However, this expansion has also resulted in a substantial increase in network traffic, creating more opportunities for malicious actors to launch cyberattacks and compromise sensitive information, thereby increasing the need for effective anomaly detection. The state-of-the-art in anomaly detection has predominantly focused on point anomalies. In contrast, the detection of collective anomalies remains relatively under-explored in the literature. In this paper, we introduce Unsupervised Graph Collective Anomaly Detection UGCAD , a novel frame- work designed to identify collective anomalies in IoT network traffic. Unlike many existing methods, UGCAD operates on graph-structured data without any prior knowledge of group labels or membership. It leverages a variational graph autoencoder VGAE to learn the graph representation, which is subsequently used to enhance a clustering algorithm for effective grouping of nodes. To detect collective anomalies, clusters identified as normal are first aggregated and refined, after which anomaly scores are applied to detect collective anomalies. Extensive experiments conducted on the CICIoT2023 and ToN-IoT network datasets demonstrate the effectiveness of UGCAD in both clustering and collective anomaly detection CAD . Furthermore, comparative evaluations against several traditional and state-of-the-art clustering-based CAD approaches confirm the superiority of UGCAD in accurately detecting collective anomalies.