Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition.

•A multi-dimensional feature extraction scheme is designed to profile heterogeneous ICS devices.•A GNN framework is built for device-level rather than system-wise anomaly recognition.•Evaluation on ICS datasets proves the framework’s superiority to mainstream methods.