AdaGAT: Adaptive Graph Attention Learning for Time-Series Anomaly Detection under Temporal Distribution Shifts

Urban environments continuously generate massive volumes of spatio-temporal data through transportation systems, surveillance infrastructure, mobile devices, and connected sensors. Timely and reliable anomaly detection from these evolving data streams is crucial for identifying unexpected events that deviate from normal spatio-temporal patterns. Detecting anomalies such as traffic congestion, road accidents, crime incidents, abnormal crowd gatherings, and infrastructure failures is essential for improving public safety, emergency response, infrastructure resilience, resource allocation and sustainable urban management. However, accurate anomaly detection remains challenging due to evolving temporal patterns, changing graph structures, and distribution shifts that significantly degrade the performance of conventional Graph Neural Networks (GNNs). Existing state-of-the-art approaches primarily assume stationary graph distributions or fail to adapt their graph representations to continuously changing environments. To address these challenges, we propose AdaGAT, an adaptive graph attention learning framework for robust time-series anomaly detection under temporal distribution shifts. AdaGAT explicitly estimates distribution shifts between consecutive graph snapshots and dynamically adapts graph attention to learn robust graph representations from evolving temporal data. Evaluated on three benchmark datasets, AdaGAT achieves state-of-the-art F1-scores of 0.9901 on NF-ToN-IoT-V2 and 0.9998 on CIC-ToN-IoT-V2, while maintaining competitive performance on the more challenging NF-BoT-IoT-V2 benchmark. Furthermore, controlled distribution-shift experiments demonstrate that AdaGAT exhibits graceful degradation under progressively increasing temporal and structural shifts, retaining 70.94% of its original detection performance under severe out-of-distribution conditions. These results demonstrate the effectiveness of adaptive graph attention and distribution-shift-aware neighborhood aggregation for robust anomaly detection in evolving graph environments.