Drift-Aware Memory-Augmented Spatio-Temporal Graph Attention for Industrial Anomaly Detection

Industrial Control Systems (ICSs) increasingly face cyber-physical attacks, making reliable anomaly detection essential. However, ICS data are high-dimensional multivariate time series with complex spatio-temporal dependencies and non-stationary device behaviors. Existing methods typically encode spatial relations with fixed, heuristic, or fully connected graphs and model temporal context using sliding-window or recurrent architectures, which limit long-range reasoning and assume static spatio-temporal reliability. This assumption breaks under temporal drift, where operational changes or attacks reshape device-level dynamics and alter the relative trustworthiness of local temporal patterns and cross-device dependencies. We propose DRAMA, a drift-aware, memory-augmented spatio-temporal attention framework for anomaly detection in non-stationary ICSs. DRAMA combines topology-guided and similarity-aware spatial attention with an explicit memory mechanism for retrieving long-range device-level context. It estimates device-wise drift from memory trajectories as a proxy for temporal reliability and adaptively reweights spatial and temporal evidence to emphasize stable signals while suppressing volatility-induced noise. Experiments on four real-world datasets show that DRAMA improves detection accuracy, temporal consistency, and anomaly localization under non-stationarity.