TLDR: INCADET is a novel framework for online cyberattack detection in critical infrastructures. It uses incremental causal graph learning to dynamically capture evolving system behavior. The framework consists of three modules: Early Symptom Detection, Incremental Causal Graph Learning (utilizing experience replay and edge reinforcement to prevent catastrophic forgetting), and Causal Graph Classification (using GCNs). Experiments show INCADET achieves superior accuracy, robustness, and adaptability compared to existing methods, offering improved interpretability and scalability for real-time threat detection.
Cyberattacks on critical public infrastructures, such as water treatment plants and power grids, pose a significant and evolving threat. These attacks often emerge subtly, escalating from minor data disturbances to complex intrusions that cause delayed, widespread disruptions. Traditional anomaly detection methods struggle with these challenges, frequently producing false alarms due to data variability and failing to adapt to new attack patterns or remember past knowledge.
Addressing these limitations, researchers have proposed a novel framework called INCADET: Incremental Causal Graph Learning for Online Cyberattack Detection. This innovative system is designed to dynamically identify and respond to cyber threats in real-time environments by understanding the underlying cause-and-effect relationships within complex systems.
How INCADET Works
INCADET operates through three interconnected modules:
First, the Early Symptom Detection module acts as an initial warning system. Instead of continuously processing data, it intelligently monitors for significant shifts in system behavior. It does this by comparing the causal relationships (how different components influence each other) in consecutive time windows. If the divergence between these relationships exceeds a certain threshold, it signals a potential attack precursor, triggering the next phase of incremental learning. This prevents unnecessary computational overhead by only activating the more intensive learning process when truly needed.
Second, the Incremental Causal Graph Learning module is the core of INCADET’s adaptability. Once an early symptom is detected, this module begins to build and update causal graphs that represent the system’s evolving state during an attack. A key innovation here is the use of an “Experience Replay Buffer.” This buffer selectively stores crucial information about past attack events and their impact points, preventing the system from ‘forgetting’ vital historical knowledge (a common problem known as catastrophic forgetting). Additionally, “Causal Edge Reinforcement” is employed to strengthen the weights of causal connections that frequently appear during attack scenarios, making the model more robust to noise and shifts in data distribution. This ensures that the system prioritizes critical attack patterns while filtering out spurious correlations.
Finally, the Causal Graph Classification module takes the learned causal graphs and uses a Deep Graph Convolutional Network (DGCNN) to classify the system’s status as either ‘Normal’ or ‘Attack’. By leveraging the topological patterns within these causal graphs, the DGCNN can effectively distinguish between healthy and compromised states, providing a robust and interpretable detection mechanism.
Why Causal Learning Matters
Unlike many ‘black-box’ deep learning models, INCADET’s causal approach offers greater interpretability. By explicitly modeling cause-effect relationships, it provides transparency into why a particular anomaly is detected. This means operators can not only identify an attack but also understand its root causes and how it propagates through the system, enabling more targeted and effective mitigation strategies.
Also Read:
- SamGoG: A New Framework for Balanced Graph Classification
- Enhancing Multi-Agent Learning Through Causal Knowledge Transfer in Dynamic Settings
Performance and Scalability
Extensive experiments on real-world critical infrastructure datasets, including SWaT, WADI, Tennessee Eastman, and Server Machine Dataset, demonstrate INCADET’s superior performance. It consistently outperforms traditional anomaly detection methods and even other graph-based and offline causal approaches in terms of accuracy and robustness. The framework also shows strong scalability, with its performance improving as more streaming data is processed, thanks to its memory-efficient design that avoids the need for retraining on entire historical datasets.
In summary, INCADET represents a significant step forward in securing cyber-physical infrastructures. By combining incremental learning with causal graph analysis, it offers an adaptive, accurate, and interpretable solution for detecting evolving cyberattacks in real-time. For more technical details, you can refer to the full research paper here.
