Abstract: Highlights•A multi-dimensional feature extraction scheme is designed to profile heterogeneous ICS devices.•A GNN framework is built for device-level rather than system-wise anomaly recognition.•Evaluation on ICS datasets proves the framework’s superiority to mainstream methods.