GREAF: Graph-based Real-time Anomaly Detection via Forecasting for IoT-Enabled Indoor Spaces

Abstract

The increasing deployment of IoT sensors in smart homes and offices enables data-driven automation while exposing these systems to sensor faults, abnormal user activities, and unexpected event patterns. Graph Neural Networks (GNNs) offer a principled way to model spatial dependencies among sensors, yet existing GNN-based anomaly detection methods either learn graph structure dynamically or couple forecasting with heavy reconstruction modules, making both approaches impractical for resource-constrained edge deployment. This paper presents GREAF, a lightweight GNN framework for real-time anomaly detection by forecasting sensor events in IoT-enabled indoor spaces. GREAF uses a fixed, precomputed adjacency matrix derived from spectral clustering to eliminate dynamic graph construction entirely, and combines graph convolution for spatial feature propagation with a Gated Recurrent Unit (GRU) for temporal modeling. Anomalies are detected by thresholding per-sensor squared prediction errors against a calibrated residual distribution, with flagged readings removed from the stream at the individual sensor level. GREAF is evaluated on four real-world smartenvironment datasets (three custom deployments and one public dataset) using controlled synthetic anomaly injection across five threat categories. GREAF achieves competitive anomaly detection performance while reducing inference latency by 23× and model size by up to 11.6× compared to representative graph-based baselines, demonstrating that predefined sensor structure provides an effective and lightweight alternative for resource-constrained IoT indoor spaces.