Historically, WSN anomaly detection primarily relied on traditional statistical methods and machine learning-based approaches. Statistical methods include Kalman filtering, autoregressive integrated moving average (ARIMA) models, and principal component analysis (PCA), while machine learning-based methods encompass clustering-based anomaly detection and dimension reduction techniques. Ref. [11] proposed a novel online adaptive Kalman filtering method specifically for real-time anomaly detection in WSNs by dynamically adjusting filtering parameters and anomaly detection thresholds in response to real-time data. Ref. [2] proposes a monotonic split-and-conquer scheme for detecting anomalous sensor data by leveraging spatio-temporal correlations between neighboring sensors through principal component analysis. Ref. [26] presents a weighted k-means spectral and hierarchical clustering ensemble scheme for graph anomaly detection, based on weighted Euclidean distance computation and weighting. Traditional statistical methods typically assume data conform to specific distribution models, which may not always hold in practical applications, limiting detection accuracy. Furthermore, these methods often exhibit high computational complexity when handling complex, high-dimensional data, making them ill-suited for real-time detection demands on large-scale datasets [27].

In contrast, deep learning methods can automatically learn complex features and patterns in data, demonstrating greater adaptability and accuracy when handling high-dimensional, nonlinear data. Furthermore, deep learning approaches can capture long-term dependencies within data, making them highly suitable for WSN data with time-series characteristics. Ref. [28] proposes a data-driven anomaly detection method termed Median Filter-Stacked Long Short-Term Memory-Exponentially Weighted Moving Average for anomaly identification. Ref. [29] integrates inductive bias and convolutional operations into Transformers, leveraging multi-layer pyramid structures and multi-level skip connections to extract multi-scale features from data. By incorporating anomaly detection into the feature space, it achieves more accurate industrial anomaly detection and localization results. Ref. [30] proposes a masked network Swin Transformer Unet for anomaly detection. It generates simulated anomalies by applying anomaly simulation and masking strategies to non-anomalous samples, leveraging the Swin Transformer’s robust global learning capability to repair masked regions. Building upon the original RWKV model, Ref. [19] proposes a novel detection scheme for harsh environments using an ensemble of autoencoders, Gaussian mixture models, and K-means, focusing on analyzing single-round forwarding rate time series of nodes. These methods demonstrate superior performance compared to traditional and machine learning approaches when handling complex, high-dimensional, long-term sequence data. However, such approaches focus solely on the temporal correlation features of WSN time-series data, making it difficult to extract latent spatial correlation information from graph-structured WSN data. Consequently, they cannot achieve spatial correlation anomaly detection for WSN time-series data.

With the emergence of graph neural networks (GNNs), anomaly detection methods leveraging these models can aggregate node information via adjacency matrices, effectively extracting spatial correlation features between nodes. Ref. [31] proposes a collaborative approach where pattern mining guides GNN algorithms to aggregate local information through connections, thereby capturing global patterns. This method employs a GNN encoder for feature aggregation, while the pattern mining algorithm supervises the GNN training process through a novel loss function. Ref. [32] proposes an interpretable spatio-temporal graph convolutional network. By integrating temporal and event similarity perspectives, IST-GCN leverages both directed and undirected graphs to capture system features, providing temporal and spatial interpretability. Ref. [33] adopts a semi-supervised learning approach relying solely on normal data for effective anomaly pattern detection, selecting the GCN-VAE model. By combining the spatial feature extraction capability of graph convolutional networks with the latent temporal feature modeling of variational autoencoders, this approach effectively detects anomalous signs in data. Ref. [34] proposes an event-aware graph attention network that detects and tracks sensors and their spatial correlations within cyber-physical systems. It graphically analyzes and models relationships between components during labeled time periods, identifying anomalies through the constructed graph model. Ref. [35] presents an anomaly detection scheme based on GAT and Informer. GAT effectively learns sequence features, while Informer excels in long-term sequence prediction. Their combined approach utilizes long-term prediction loss and short-term prediction loss to detect anomalies in multivariate time series. Short-term prediction forecasts the next time point’s value, while long-term prediction assists short-term forecasting.

However, these methods primarily focus on extracting spatio-temporal features between multiple nodes and a single temporal modality in WSNs, making it challenging to comprehensively capture the intrinsic correlations among multiple nodes and multiple temporal modalities in complex environments. At the same time, Transformer-based approaches exhibit quadratic time complexity and high memory consumption. Moreover, most existing anomaly detection methods concentrate on the acquisition and analysis of time-domain information, typically relying on statistical characteristics, trend variations, or pattern matching of time-series data to identify anomalies [27] Such approaches may pay insufficient attention to periodic features and latent anomaly patterns embedded in the frequency domain. Consequently, these methods fail to fully exploit frequency-domain characteristics, potentially limiting further improvements in detection performance.

In the field of anomaly detection, frequency domain analysis has gained increasing attention as a crucial complementary approach. By transforming time-series data into the frequency domain, it reveals periodicity, frequency distribution, and the variation patterns of different frequency components. This information plays an indispensable role in understanding data correlation features and improving detection performance [21].

Currently, for WSN anomaly detection, existing research has extensively employed various typical frequency-domain analysis methods to reveal hidden periodic or frequency-based anomaly features. Among these, the Fourier Transform (FT), as the most commonly used frequency-domain tool, can rapidly map time-domain signals to the frequency domain, uncovering stable periodic patterns. It is frequently utilized to detect anomalies caused by periodic drift or noise interference. For instance, Ref. [36] addresses sensor electrical signal acquisition in indoor environments. It employs the Fourier Transform to convert sensor-perceived signals from the time domain to the frequency domain, generating spatiotemporal image datasets. Combined with Generative Adversarial Networks (GANs), this approach detects anomalous behaviors within electrical signals. This method not only validates the effectiveness of frequency-domain information in anomaly detection for sensor-perceived signals but also demonstrates application potential in areas such as private space monitoring support and human activity perception. For multi-sensor signals of industrial gears, ref. [37] extracts frequency-domain features using the Fast Fourier Transform (FFT) and combines graph neural networks with adversarial autoencoders to achieve unsupervised anomaly detection. By mining multi-scale features within the frequency domain, this approach significantly enhances anomaly detection accuracy, validating the effectiveness of frequency-domain analysis in industrial multi-sensor scenarios. Ref. [38] proposes a frequency-domain-based anomaly detection method. It models the background in the frequency domain using the Fast Fourier Transform (FFT), detects anomalies through peak features in the amplitude spectrum and Gaussian low-pass filtering, and further suppresses non-anomalous high-frequency details using phase spectrum reconstruction. This significantly enhances background suppression capability and detection accuracy.

Additionally, wavelet transform (WT) performs localized analysis of non-stationary signals in the time-frequency domain through multiscale decomposition, widely applied for detecting sudden anomalies and local pattern changes. Ref. [39] combines continuous wavelet transform with support vector clustering to construct a lightweight unsupervised anomaly detection framework capable of effectively identifying drift anomalies in sensor data. Experimental results on the IBRL dataset validate the method’s robustness and high detection accuracy when processing non-stationary sensor signals, further demonstrating the applicability and advantages of wavelet transform in dynamic data stream scenarios. Ref. [40] proposes a variability profile anomaly detection scheme for continuous IoT stream data by integrating discrete wavelet transform with K-means clustering. By rapidly constructing and dynamically updating sensor variance profiles, it significantly enhances the accuracy and real-time performance of both short-term and long-term anomaly detection, validating the application potential of wavelet transform in large-scale online data stream scenarios. Addressing computational resource constraints at edge nodes in industrial IoT environments, ref. [41] proposes a parallel discrete wavelet transform method. It effectively compresses acoustic signals and extracts features while reducing memory consumption and computational overhead. Based on this, a lightweight anomaly detection model is developed, demonstrating its feasibility and real-time advantages in practical industrial equipment monitoring.

In recent years, adaptive decomposition methods such as Empirical Mode Decomposition (EMD) have been introduced to decompose complex nonlinear non-stationary sequences into intrinsic mode functions. This approach separates anomaly features across different frequency bands and enables anomaly point localization. These frequency-domain methods partially overcome the limitations of single-time-domain analysis, which is sensitive to noise and struggles to capture periodic variations, providing an effective complementary approach for WSN anomaly detection. By integrating multivariate empirical mode decomposition with wavelet transform, Ref. [42] addresses feature extraction challenges in vibration response data for environmental monitoring. Through signal decomposition followed by input into multiple deep learning models, it achieves efficient identification of damage types and locations within non-stationary signals, validating the practicality and high accuracy of combined EMD and time-frequency domain features for complex structural anomaly detection. Addressing security monitoring challenges for distributed sparse sensor data in industrial IoT, Ref. [43] designed an adaptive noise and energy entropy feature extraction method based on adaptive fully integrated empirical mode decomposition. Combined with a swarm-optimized classifier, it effectively extracts intrinsic modal features, enabling accurate detection of multiple anomaly perception patterns in industrial production. This validates the robustness and superiority of improved EMD and adaptive selection in sparse data scenarios.

However, the aforementioned anomaly detection methods rely solely on frequency-domain processing and fail to fully leverage time-domain information, which limits further improvements in detection performance. Similarly, these methods focus only on spatio-temporal feature extraction between single nodes and multiple modalities or between single modalities and multiple nodes, without adequately considering spatio-temporal correlations in scenarios involving multiple nodes and multiple modalities, thereby affecting performance in complex anomaly cases.

Based on the analysis of the aforementioned related work, this paper proposes a method called TE-MSTAD to address these limitations in existing WSN anomaly detection approaches. TE-MSTAD jointly analyzes both time-domain and frequency-domain information and employs multiple information-enhancement strategies to more comprehensively capture spatial correlations among multiple nodes. Moreover, based on an improved RWKV model, a cross-modal feature extraction module is incorporated to identify anomalies across different temporal modalities, thereby enhancing overall anomaly detection performance.

The data preprocessing module transforms raw data collected by WSNs into training samples suitable for the model, primarily involving three steps: filtering, downsampling, and normalization.

First, WSN-collected data typically contains substantial high-frequency natural noise originating from environmental interference, hardware components, and other factors. This noise includes large amounts of useless or even misleading information that can interfere with the model’s extraction of key features, thereby affecting anomaly detection performance. To effectively suppress high-frequency noise, this module applies a Gaussian filter in the frequency domain. The processing steps are as follows: (2)Gσ(w)=exp⁡(−12(wσgua)2)x~(t)=ℱFFT−1(ℱFFT(Xraw(t))×Gσ(w))where Gσ(w) denotes the frequency-domain Gaussian filter, σgua represents the standard deviation of the Gaussian filter; ℱFFT and ℱFFT−1 denote the Fast Fourier Transform (FFT) and Inverse Fourier Transform (IFT), respectively; Xraw(t) is the original time-domain signal, and x~(t) is the smoothed time-domain signal obtained after filtering.

Subsequently, to reduce redundancy in the raw data, this paper employs a sliding window mechanism for time series downsampling after completing Gaussian filtering noise reduction in the frequency domain. This method segments continuous time series data by setting a sliding step size k and window length kW. Let the current time be t. Starting from this point, kW data points form a time series sample of length kW, denoted as x~raw=[xt,xt+1,…,xt+kW−1]∈RM×N×kW. After sliding window subsampling, the data x~raw is divided into k subsamples. Each subsample can be regarded as an observation sequence for a node: Xi∈RM×N×W, i∈[1,k].

Finally, to eliminate differences in dimensionality and numerical ranges between sensor data and enhance model training stability and convergence speed, this paper applies standardization to the data after downsampling. The commonly used Z-Score standardization method is employed. By subtracting the mean and dividing by the standard deviation for each data point, it is transformed into a standard normal distribution with mean 0 and standard deviation 1, thereby achieving a unified numerical scale. The specific procedure is as follows:(3)X~i,j=(Xi,j−μ(Xi,j))/σ(Xi,j)where Xi,j is the input data after downsampling of the jth mode of the ith node; μ(Xi,j) represents the mean value of Xi,j over the entire time series; σ(Xi,j) denotes the standard deviation of Xi,j; and X~i,j is the processed standardized result.

Following the data preprocessing module, this paper designs and introduces a joint time-frequency domain feature correlation learning enhancement algorithm. This algorithm aims to fully explore the spatial correlations among nodes in wireless sensor networks within the time-frequency domain, thereby constructing a more reasonable graph structure to enhance the model’s ability to represent topological information.

Specifically, this module first maps the time-domain observation data Xtime∈RM×N×W of sensor nodes to the frequency domain via Fourier transform, yielding the frequency-domain feature matrix Xfreq∈RM×N×W.

Next, to measure spatial correlation between nodes, this paper employs the Spearman correlation coefficient. The average correlation value across three modalities serves as the basis for constructing the adjacency matrix for each node. For any two nodes a and b, their correlation in the jth modality is calculated as follows:(4)ρa,bj=cov(r(Xa,j),r(Xb,j))σ(Xa,j)⋅σ(Xb,j)where ρa,bj denotes the Spearman rank correlation coefficient between nodes a and b, in the jth mode; r(⋅) represents the rank transformation applied to the sequence; cov(⋅) and σ(⋅) denote the covariance and standard deviation operations, respectively.

Subsequently, the correlations within each modality in the time domain and frequency domain are averaged separately. The correlation values from the three modalities are then aggregated to obtain the node’s overall correlation score:(5)Sa,b=12N∑n=1N(ρa,b(time,n)+ρa,b(freq,n))where Sa,b represents the joint correlation score between node a and node b; N denotes the number of modalities within a single node; ρa,b(time,n) and ρa,b(freq,n) denote the data correlation in the time domain and frequency domain, respectively, for the corresponding node in the nth modality.

Finally, to construct a sparse and discriminative adjacency matrix A∈RN×N, this paper employs a Top K strategy to select the top k most relevant nodes for each node. Corresponding elements are set to 1, while all others are set to 0, thereby building an adaptive graph structure:(6)Aa,b={1,ifSa,b∈TopK(Sa,⋅)0,otherwisewhere TopK(Sa,⋅) denotes the top K nodes most correlated with node a; Aa,b represents the elements in the adjacency matrix A.

In the temporal feature extraction branch, the model takes the attribute matrix Xtime∈RB×M×N×W and adjacency matrix A∈RN×N—both processed into batches of size B—as inputs. The temporal encoder extracts temporal and spatial correlations from the input data, compressing them into a low-dimensional representation. Subsequently, the temporal decoder decodes and reconstructs the encoded representation, aiming to restore the original input sequence as faithfully as possible. The encoder and decoder work in tandem, enabling the model to capture critical temporal features. Next, we will provide a detailed introduction to the specific structure and functions of the temporal encoder module and the temporal decoder module.

In WSN anomaly detection, frequency-domain information often reveals features that temporal analysis cannot fully capture. To further illustrate the importance of frequency-domain information, a specific example is analyzed below. For instance, Fig. 3 depicts the differences between point anomalies, collective anomalies, and contextual anomalies in the time-frequency domain. In Fig. 1, the blue curve represents normal data, while the red curve indicates abnormal data. Comparing Fig. 3a,c shows that collective anomalies exhibit more pronounced changes in the frequency domain than in the time domain, making frequency-domain detection more suitable. Conversely, comparing Fig. 3a,d demonstrates that time-domain analysis is more advantageous for identifying contextual anomalies.

In the feature extraction module of the frequency domain, the input data Xtime={X1,X2,…,XT} is first mapped to the frequency domain space via Fast Fourier Transform (FFT), yielding the frequency domain tensor Xfreq={F1,F2,…,FT}. The time-frequency transformation process is as follows:(15)fα,β(k)=∑t=1Txα,β(t)(cos⁡(2πtnT)−isin⁡(2πtnT))where i denotes the imaginary part, i2=−1; xα,β(t) represents the time series corresponding to the mode β of node α in Xtime, with the superscript t∈[1,T]; similarly, fα,β(k) corresponds to the frequency domain sequence mapped from xα,β(t). However, since fα,β(k) is a complex sequence, it cannot be directly used for training neural network models. To address this issue, the frequency domain information is typically decomposed into amplitude and phase components for separate representation and storage. Specifically, for the frequency domain sequence fα,β(k), the amplitude can be understood as the Euclidean distance of this complex number from the origin in the complex plane, while the phase represents the angle formed with the positive real axis in the complex plane. Assuming fj(k)=m+ni, where m and n denote the real and imaginary parts respectively, the amplitude a and phase p are calculated as follows:(16)a=m2+n2p=arctan⁡(m/n)

By calculating the magnitude and phase of each complex element in the frequency domain sequence fa,b(k), the original complex sequence can be transformed into two real-valued sequences suitable for model training: the magnitude sequence ak and the phase sequence pk. Similarly, for each input sample set {X1,X2,…,XT}, after undergoing the time-frequency domain transformation, the magnitude matrix A∈RN×W×M and the phase matrix P∈RN×W×M can be obtained. These two matrices are concatenated and divided into batches to form the frequency-domain matrix Xfreq∈RB×N×2W×M, which serves as input to the frequency-domain encoding network. This enables the encoder to effectively extract sample features based on frequency-domain information.

The anomaly detection method proposed in this study employs reconstruction error as the anomaly discrimination criterion, adhering to the design philosophy of autoencoder-like frameworks. During training, the model aims to minimize the discrepancy between reconstructed outputs and observed input data, leveraging this discrepancy to quantify whether anomalies exist in the input data. Considering the reconstructed outputs generated in both the time domain and frequency domain after the input data passes through the network model, they are denoted respectively as:

The reconstructed outputs generated in the time domain and frequency domain after the input data passes through the network model are denoted as X^time and X^freq, respectively, with their corresponding original inputs being Xtime and Xfreq. Additionally, the frequency-domain reconstruction result X^freq can be restored to time-domain form ℱ−1(X^freq) via inverse Fourier transform ℱ−1, enabling comparison with Xtime. Therefore, to comprehensively consider these three reconstruction errors, three loss functions are defined as follows:(21)ℒ1=1WNM∑t=1W∑i=1N∑j=1M‖X^time(i,j,t)−Xtime(i,j,t)‖22ℒ2=12WNM∑t=12W∑i=1N∑j=1M‖X^freq(i,j,t)−Xfreq(i,j,t)‖22ℒ3=1WNM∑t=1W∑i=1N∑j=1M‖ℱ−1(X^freq(i,j,t))−Xtime(i,j,t)‖22

To fully leverage both time-domain and frequency-domain information while adaptively weighting the influence of different loss terms, this paper introduces an attention-based weighting mechanism. Each loss term is assigned distinct weight coefficients via a softmax operation. Let the weight coefficients be denoted as α1,α2,α3, satisfying α1+α2+α3=1. The final total loss function and anomaly score are then expressed as:(22)scoret(i,j)=ℒtotal=α1⋅ℒ1+α2⋅ℒ2+α3⋅ℒ3

A higher anomaly score indicates greater deviation between the input data and the model prediction at that time point, making it more likely to be classified as an anomaly. By setting a threshold τ based on the final loss entropy value during model training, we can determine whether a specific time point is anomalous. When scoret(i,j) exceeds the threshold τ, the data is classified as anomalous and labeled as 1; otherwise, it is classified as non-anomalous and labeled as 0. (23)yt(i,j)={1,scoret(i,j)>τ0,scoret(i,j)≤τ

To comprehensively evaluate the performance and adaptability of the anomaly detection model proposed in this paper, experimental validation was conducted on both public datasets and real-world collected datasets. As shown in Fig. 4, the public dataset consists of WSN data collected and compiled by Intel Berkeley Research Lab through deploying multiple wireless sensor nodes (Intel Berkeley Research Lab datasets, IBRL). This dataset comprises 54 Mica2Dot sensor nodes, each collecting environmental data such as temperature, humidity, light intensity, and voltage every 31 s. As illustrated in Fig. 5, the real-world dataset was generated by constructing a WSN data collection system suitable for outdoor scenarios based on the LoRa communication protocol. This system consists of 14 distributed sensor nodes and one aggregation node. All sensor nodes were deployed in an open outdoor area, arranged sequentially along a perimeter wall at a uniform height of 35 cm above ground level. The aggregation node centrally receives data from all sensors and transmits it via WiFi to a cloud-based data center for remote data transmission and management. Each sensor node collects temperature, humidity, and voltage parameters every 30 s. The resulting dataset, named LoRA-OSD, covers the time period from 26 November 2024, to 07 January 2025, documenting environmental monitoring information during this phase.

The experimental platform configuration used in this study is as follows: the processor is an Intel^® Xeon^® Gold5218CPU@2.30 GHz, the graphics processing unit is an NVIDIA GeForce RTX 3090, and the operating system is Ubuntu 18.04.2 LTS. The experimental environment was developed using Python 3.6.9, employing the PyTorch 2.0.0 deep learning framework and integrating CUDA 11.7 for GPU-accelerated computation. During subsequent debugging experiments, the learning rate was set to lr = 0.0002, training epochs to epoch = 120, sliding window size to W = 200, sliding stride to L = 150, and the Adam optimizer was employed.

To comprehensively evaluate the performance of the proposed anomaly detection model, this paper selects Precision, Recall, and F1-score as the primary evaluation metrics. Let TP (True Positives) denote the number of samples correctly identified as anomalies, FP (False Positives) denote the number of normal samples incorrectly identified as anomalies, FN (False Negatives) denote the number of anomalies not detected, and TN (True Negatives) denote the number of samples correctly identified as normal. The confusion matrix is then represented as shown in Table 1.

Precision measures the proportion of samples correctly classified as anomalies (True Positives, TP) among all samples predicted as anomalies (True Positives + False Positives, TP + FP). A high precision indicates fewer false positives and higher predictive reliability. Its formula is:(24)Precision=TPTP+FP

Recall measures the proportion of actual anomalies (TP + FN) that are correctly identified by the model. A high recall indicates fewer false negatives and stronger detection capability. Its formula is:(25)Recall=TPTP+FN

The F1-score is the harmonic mean of precision and recall, serving as a balanced, comprehensive evaluation metric between these two indicators. The F1-score unifies precision and recall into a single metric. Unlike simple arithmetic averaging, F1 employs harmonic averaging. This ensures that when either precision or recall is too low, the F1-score drops significantly. This prevents an excessively high value in one dimension from masking a low value in the other. Consequently, the F1-score provides a more comprehensive reflection of the model’s overall performance in practical detection tasks. Its formula is: (26)F1=2×Precision×RecallPrecision+Recall

To evaluate the role and performance of each module in the proposed network model, corresponding ablation experiments were designed and conducted. In these experiments, multiple ablation schemes were established, removing or modifying specific key modules within the network model to assess their actual impact on overall performance. The following ablation schemes were designed:

Scheme 1: Remove the CE module that extracts intermodal correlations, reverting to the original RWVK model.

Scheme 2: Modify the topology information enhancement method to use only GAT networks in both the time and frequency domains.

Scheme 3: Modify the topology learning enhancement method to compute correlations only in the temporal domain to obtain the adjacency matrix.

Scheme 4: Simultaneously modify both the topology information enhancement method and the topology learning enhancement method. Use only the GAT network on both the time-frequency domain branch and the time domain branch, and employ the adjacency matrix computed solely in the time domain.

Scheme 5: Remove the frequency domain branch after attribute matrix input, perform feature extraction solely in the time domain, and complete both reconstruction and anomaly detection.

Scheme 6: Remove the time-domain branch after attribute matrix input, perform feature extraction solely in the frequency domain, and complete both the reconstruction and anomaly detection tasks.

Scheme 7: Use the complete model designed in this paper without any removal or modification.

The experimental results for different ablation schemes are shown in Table 2. Since scheme 1 removed the CFE module, the RWKV model in the experiment could not effectively mine potential correlation features between multimodal data and lost its ability to extract multimodal correlations. Therefore, compared to the baseline model (Scheme 7), the model in this scheme overlooked a significant number of intermodal correlation anomalies during detection, resulting in decreases of 4.51%, 15.74%, and 10.28% in precision, recall, and F1 score, respectively. In scheme 2, both the temporal and spatial domains of the model employ a single GAT for spatial feature extraction, failing to fully leverage the strengths and complementarity of different submodels. Compared to the baseline model, the F1 score decreased by 5.34%, while precision and recall dropped by 0.99% and 9.56%, respectively. This indicates that a single graph neural network architecture has limitations in extracting topological features and fails to adequately detect anomalies between nodes. Scheme 3 restricted the construction of the adjacency matrix to time-domain information only, neglecting hidden features in the frequency domain. The F1 score decreased by approximately 2.71%, indicating that phase, frequency, and other information in the frequency domain can significantly enhance the node association patterns captured by the adjacency matrix, thereby improving the quality of spatial structure learning. Scheme 4 simultaneously modifies both information enhancement methods of the model: it removes the ensemble approach for multiple submodels in the topological information enhancement and simplifies the adjacency matrix construction to rely solely on temporal correlations. Experimental results show that compared to the baseline model, the F1 score decreased by 6.71%. This indicates a noticeable decline in overall model performance, validating the synergistic role of both topological information enhancement approaches in improving anomaly detection capabilities. Schemes 5 and 6, which removed the frequency domain or time domain branch respectively, exhibited significant deficiencies in information capture, resulting in F1 score decreases of 8.11% and 10.25%. This demonstrates that a single-branch structure struggles to comprehensively capture the latent time-frequency feature information within the data. As the complete model, scheme 7 integrates multimodal modeling, topological information enhancement, graph structure learning, and dual-branch time-frequency feature extraction, demonstrating optimal performance.

In the model architecture, an asymmetric design is adopted for the time-domain and frequency-domain branches, where GCN and GAT are employed in the time-domain branch, while PPNP and GAT are introduced in the frequency-domain branch. To validate the effectiveness of this design, a systematic comparison of different graph neural network combinations is conducted, as shown in Table 3, including configurations that incorporate PPNP in the time domain or use only GCN/GAT in the frequency domain. The experimental results indicate that model performance varies across domains, with PPNP achieving superior performance in the frequency-domain branch (F1-score of 92.52%), while its inclusion in the time domain does not yield significant improvements. From a theoretical perspective, PPNP can be regarded as a spectral-domain filtering method with global smoothing and information propagation properties, which is beneficial for modeling low-frequency structural information in the frequency domain. Therefore, incorporating PPNP in the frequency-domain branch enables more effective feature extraction, whereas GCN and GAT are sufficient for capturing local temporal dependencies in the time domain. Based on both experimental observations and theoretical insights, the proposed asymmetric architecture achieves a favorable balance between detection performance and model complexity.

To comprehensively validate the effectiveness and advantages of the proposed method, comparative experiments were conducted against the following four existing approaches:

MTAD-GAT [31] integrates a one-dimensional convolutional neural network (1D CNN), GAT and gated recurrent unit (GRU) to build a multivariate time-series anomaly detection framework that combines reconstruction and prediction, where 1D CNN extracts features, GAT models temporal and feature dependencies, and GRU performs reconstruction and trend prediction. GAT-GRU [8] focuses on multi-dimensional feature extraction across temporal, modal, and spatial domains by first applying GAT to capture local and global dynamic relationships, followed by GRU to model long-term dependencies and perform dimensionality reduction, and finally reapplying GAT for spatial feature extraction and anomaly detection via reconstruction error. GLSL [10] constructs multiple graph structures from a modal perspective for WSN data, utilizes GAT to extract spatio-temporal features across modalities, employs GRU to capture long-term dependencies, and integrates reconstruction and prediction mechanisms to enhance detection performance and adaptability in multi-modal scenarios.

The experimental results are shown in Table 4. Our proposed method achieves optimal or near-optimal performance in terms of Precision, Recall, and F1-score, with an F1-score of 92.52%, surpassing all comparison methods and demonstrating outstanding capability in WSN anomaly detection tasks. Furthermore, the method achieves an AUC of 0.95, indicating robust discrimination ability and stability across different decision thresholds. In terms of model complexity, the parameter count is 0.80 M, which is significantly lower than that of GAT-GRU (36.5 M) and comparable to GLSL (0.6 M), suggesting that the proposed method maintains high performance while remaining computationally efficient and suitable for resource-constrained WSN scenarios.

A comparative analysis reveals specific limitations of the existing approaches that affect detection effectiveness. MTAD-GAT incorporates a graph attention mechanism to model temporal and feature dimensions, but its adjacency matrix is either static or pre-defined, lacking a data-driven graph structure learning mechanism, resulting in limited adaptability to true inter-node relationships. GAT-GRU attempts multidimensional graph modeling via a multi-level GAT fusion strategy; however, its topology remains rule-based without enhanced topological learning. Despite achieving an F1-score of 90.3% and a Precision of 93.3%, its Recall of 87.5% indicates potential omissions in capturing all anomalous points. GLSL constructs graph structures from a modal perspective and combines reconstruction with prediction mechanisms to enhance robustness, achieving an F1-score of 90.6%. Nonetheless, its modal partitioning is relatively fixed and cannot dynamically learn the coupling relationships or importance differences between time and frequency domains, leaving room for improvement in anomaly feature expressiveness.

In contrast, our method significantly outperforms the aforementioned approaches. With a Precision of 91.04% and a Recall of 94.09%, it ensures accurate anomaly identification while covering a higher proportion of anomalous samples. The improvement in AUC further demonstrates reliable performance across different thresholds, and the low parameter count confirms its efficiency under computationally constrained WSN environments.

In the frequency-domain feature processing stage, a Gaussian filter is introduced to suppress high-frequency noise. Considering that anomaly signals, especially point anomalies, may contain high-frequency components, a range of filter parameters is systematically evaluated, and σ = 200 is selected. Under this setting, the filter exhibits a weak low-pass characteristic, preserving the main signal components within 0–30 Hz while smoothing high-frequency random noise. Given the properties of WSN data, background noise typically manifests as low-amplitude high-frequency fluctuations, whereas anomalies tend to show more significant amplitude variations; thus, the filtering strategy has limited impact on anomaly features. To further illustrate its effectiveness, Fig. 6 presents a comparison of time- and frequency-domain representations before and after filtering, where the positions and amplitudes of anomalies remain largely unchanged in the time domain, and the low-frequency components are well preserved in the frequency domain. In addition, the results in Table 5 show that the F1-score improves from 91.89% to 92.52% after applying the filtering strategy, indicating that it effectively reduces noise interference with minimal degradation of anomaly information, thereby enhancing detection performance.

To evaluate the computational efficiency of the proposed method, we conducted a comparative experiment with the Transformer model. Specifically, the RWKV module in our model was replaced with a standard Transformer, and the CFE module was substituted with a cross-attention mechanism. Inference experiments were then performed, and the single-sample inference time and peak memory usage were recorded. The results are summarized in Table 6:

To evaluate the impact of the parameter K in the Top-K graph construction strategy, a systematic analysis was conducted under different K settings, as shown in Table 7.

It can be observed that when K is relatively small, the constructed graph is sparse, and potential inter-node relationships are not fully captured, leading to suboptimal performance in terms of Precision, Recall, and F1-score. As K increases, the model performance improves and reaches its optimum at K = 3, achieving the highest F1-score of 92.52%. However, when K becomes excessively large, the graph becomes increasingly dense, which may introduce redundant connections and noise, thereby interfering with feature propagation and degrading the overall performance. These results indicate that an appropriate choice of K can effectively balance the preservation of informative topological structures and the suppression of noise, and thus K = 3 is selected as the default setting in this study.

To further validate the anomaly detection performance of the proposed TE-MSTAD network model across diverse application scenarios, this paper designed comparative experiments based on indoor and outdoor multi-scenario environments. The typical indoor sensor network dataset IBRL and the self-built outdoor LoRA-OSD real-world monitoring dataset were selected, covering complex data features from multi-modal, multi-node collection in wireless sensor networks under varying conditions. By training and testing the model on both datasets, we comprehensively evaluate the proposed method’s generalization capability and robustness across multiple scenarios and data distributions. Specific experimental results are shown in Table 8.

The table demonstrates that the proposed TE-MSTAD model achieves outstanding anomaly detection performance on both datasets, maintaining high levels across all metrics. For the indoor IBRL dataset, the model exhibits high recall in capturing complex multi-node, multi-modal relationships, indicating strong sensitivity to anomalous data. On the outdoor LoRA-OSD dataset with complex scenarios, the model demonstrates robust adaptability and stability, achieving an F1 score slightly higher than IBRL. This validates TE-MSTAD’s generalization capability and robustness across diverse environments. This further demonstrates that TE-MSTAD can effectively enhance the accuracy and robustness of anomaly detection in wireless sensor networks, exhibiting strong practical potential in complex, multi-modal, multi-node industrial scenarios.

In this section, several representative experimental samples are selected to conduct a case study on the anomaly detection performance of the proposed model. As shown in Fig. 7, temperature and humidity data collected from node 21 over 4800 time steps are presented, where correlation anomalies are injected into the data. In the figure, the red and green curves represent the temperature and humidity measurements, respectively, the black line denotes the ground-truth anomaly labels, the blue line indicates the model predictions, and the orange markers highlight misclassified points. This visualization clearly demonstrates the effectiveness of the model in handling cross-modal correlation anomalies and further validates the collaborative functionality and rational design of the proposed modules.

Fig. 8a illustrates the temperature time series of node 21 in the IBRL dataset over 2240 time steps. The blue curve represents the original normal data, while the red, green, and purple curves correspond to injected point anomalies, contextual anomalies, and collective anomalies, respectively. In Fig. 8b, a sliding window approach with a window size of 200 is employed to construct test samples, and anomaly detection is performed based on the model predictions. Fig. 8b shows the distribution of anomaly labels for different anomaly types, while Fig. 8c presents the detection results. The comparison indicates that the predicted labels are highly consistent with the ground-truth labels in most cases, with a small number of misclassifications mainly occurring when the sliding window first covers anomaly points or in segments with significant fluctuations in the original data. Overall, the proposed method is capable of accurately identifying multiple types of anomalies, demonstrating strong practicality and robustness.

Fig. 9a shows the temperature time series of three neighboring nodes (23, 25 and 27), where point anomalies are injected into node 23. Fig. 9b presents the corresponding anomaly detection results. It can be observed that the model successfully detects all point anomalies at node 23, indicating strong capability in capturing local temporal perturbations. Meanwhile, no false positives are observed for nodes 25 and 27, suggesting that by explicitly modeling graph structural dependencies, the proposed method effectively constrains the propagation of anomaly responses, ensuring that anomalies remain localized to the affected nodes and avoiding spurious detections caused by spatial correlation propagation.