Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that online cyberattack detection can be done by incrementally updating a causal graph over system sensors window by window, so the detector adapts to evolving attacks without retraining from scratch.

desk verdict Solid incremental-causal-graph idea, but the evaluation leaks test labels into the classifier input, so the reported gains are not trustworthy as evidence for the central claim. read the letter →

arxiv 2507.14387 v1 pith:BX5W3QOK submitted 2025-07-18 cs.LG cs.AI

Arun Vignesh Malarkkan , Dongjie Wang , Haoyue Bai , Yanjie Fu This is my paper · ORCID
classification cs.LGcs.AI
keywords incrementalcausalgraphlearningonlinecyberattackdetectioncyber-physicalsystemsanomalyexperiencereplayedgereinforcementconvolutionalnetworkmultivariatetimeseries
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that online cyberattack detection in critical infrastructure can be treated as incremental causal graph learning: instead of retraining a detector on the full historical stream, the system should rebuild a causal graph for each new time window, keep valuable past attack edges in a replay buffer, and reinforce edges that reappear across attack events. The proposed framework, INCADET, triggers this incremental process only when the Jensen-Shannon divergence between edge-weight distributions of consecutive static causal graphs exceeds a threshold, then classifies each window's graph with a graph convolutional network. If the claim is right, a detector of this kind would adapt to concept drift and evolving attack patterns, resist catastrophic forgetting of previously seen attacks, and use less memory than offline causal methods that retrain on large historical data. The paper reports that on four real-world testbeds, SWaT, WADI, Tennessee Eastman, and SMD, INCADET achieves higher point-adjusted F1, ROC-AUC, and PRC-AUC than static causal and deep temporal baselines.

What carries the argument

The load-bearing object is the incrementally updated causal graph, a directed acyclic graph whose nodes are sensors and actuators and whose edge weights encode causal influence strength. Each window's graph is produced by DYNOTEARS, which fits a structural equation model with lagged terms under an acyclicity constraint; the graph is then pruned to the subgraph over known attack and impact nodes, stored in a prior-knowledge replay buffer, and modified by Causal Edge Reinforcement and a Weighted Laplacian transformation to preserve spectral properties. The early-symptom trigger compares edge-weight histograms of consecutive graphs via Jensen-Shannon divergence, and the deep graph convolutional network (DGCNN) consumes the Laplacian representation to classify system status.

What would settle it

Re-run the SWaT evaluation with the attack and impact node set withheld from the replay-buffer subgraph construction, for instance using random node subsets or node sets learned without label information, and compare point-adjusted F1; if INCADET's margin over baselines disappears or drops to the no-replay-buffer level, the reported advantage depends on label-derived domain knowledge rather than on incremental causal discovery.

Watch

Extended reading notes

Core claim

The central claim is that causal structure, updated incrementally, is a stable and interpretable signal for attack status even when the data distribution drifts. In INCADET, a static causal graph is first learned per window with a score-based time-lagged structure learner (DYNOTEARS); when the edge-weight distribution of a new window diverges enough from the previous one, the framework enters an incremental phase. There it extracts the subgraph over pre-specified attack and impact nodes, stores those edges in a replay buffer, and applies Causal Edge Reinforcement so that edges recurring across attack windows receive extra weight, with cycles removed while preserving attack-node edges. The resulting graphs are fed to a deep graph convolutional network that labels each window normal or attack. The paper's own ablation indicates the replay buffer is the largest contributor to performance, and replacing the time-lagged learner with a non-temporal one sharply degrades results, which the paper reads as evidence that both memory replay and explicit temporal causality carry the framework.

Load-bearing premise

The framework assumes that the attack and impact nodes used to prune each causal graph are known in advance and can be taken from the datasets; if that node list comes from the same attack annotations used as ground truth in evaluation, the causal graphs the classifier sees are filtered by the very labels it is asked to predict.

Editorial extensions

If this is right

  • In a live deployment, the model would spend most of its time in the low-cost static phase and only pay for incremental graph learning when an early symptom trigger fires.
  • Earlier attack patterns remain usable when new attacks arrive, because reinforced replay edges preserve old causal knowledge instead of being overwritten.
  • Operators get an interpretable output: each detection is associated with a causal graph over sensors, so the implicated components are visible rather than hidden in a black-box embedding.
  • Long streams become feasible from a memory standpoint, since the stored knowledge is a buffer of attack subgraphs rather than the entire historical dataset.
  • On the four evaluated testbeds, the framework reports higher segment-level F1, ROC-AUC, and PRC-AUC than both offline causal and deep temporal baselines, particularly in high-dimensional, imbalanced data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the subgraph extraction presupposes attack and impact nodes, the method's practical value outside benchmark datasets depends on whether such domain knowledge can be obtained independently of attack labels; the paper does not evaluate that setting.
  • The reinforced edge weights could be read as an importance map for root-cause analysis: an edge that is repeatedly reinforced across attack windows marks a causal pathway that later events are likely to follow.
  • A stricter test than segment-level point-adjusted F1 would measure detection latency within a segment and per-point precision, since the paper's metrics reward any detection inside an attack window.
  • The trigger and stopping thresholds are fixed constants; making them adaptive to the running statistics of normal periods would be a natural robustness extension the paper leaves open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes INCADET, a framework for online cyberattack detection in cyber-physical systems based on incremental causal graph learning. It uses DYNOTEARS to learn static causal graphs per time window, an early symptom trigger based on Jensen-Shannon divergence between edge-weight distributions, an incremental construction module with experience replay and causal edge reinforcement, and a DGCNN classifier for graph classification. The experiments on SWaT, WADI, TE, and SMD report F1, ROC-AUC, PRC-AUC, MAR, and MAE, claiming superior performance over static causal and deep temporal baselines.

Significance. If the claims were supported, INCADET could provide an interpretable and adaptive detection method that addresses catastrophic forgetting in streaming cyber-physical data. The paper's combination of causal discovery with incremental graph learning and graph neural network classification is timely. However, the evaluation protocol appears to inject ground-truth attack/impact information into the graph features used for classification, which would invalidate the reported performance advantage. Because the central claim depends on the integrity of this evaluation, the contribution cannot be assessed as presented.

major comments (3)
  1. [Sec. III.D, Eq. (7)] The prior knowledge "attack and impact nodes" is collected "from the datasets" (Sec. III.D) and is used in Eq. (7) to extract the subgraph \hat{G}^k_A by keeping only edges (u,v) with u,v in D. Since D is derived from the same attack annotations that define the ground-truth labels y, the input graphs given to the DGCNN are filtered by the labels the model must predict. The classifier can then succeed by recognizing pre-specified attack/impact nodes rather than by learning causal or temporal structure from the data stream. This label leakage undermines the comparisons in Table 2 and the central claim of superior detection accuracy. The authors must specify how D is obtained without access to test labels, or show that the subgraph construction is label-free.
  2. [Sec. III.A, Eq. (2)] The trigger condition in Eq. (2) is inverted. Eq. (1) defines \mathcal{P}_G as 1 - JS divergence, with values closer to 1 indicating higher similarity. The early symptom trigger should fire when consecutive graphs diverge (low \mathcal{P}), but Eq. (2) triggers when \mathcal{P} > \tau_{\mathcal{P}}, i.e., on high similarity. As written, the module would activate during normal operation rather than at attack precursors. This is a load-bearing error in the methodology; the correct condition should be \mathcal{P} < \tau_{\mathcal{P}} (or the similarity measure redefined).
  3. [Sec. III.C and Sec. III.D] The paper repeatedly describes the framework as "unsupervised" (Abstract, Problem Statement), yet the DGCNN classifier is trained with binary cross-entropy loss (Eq. 14) using ground-truth labels y_i, and the graph construction uses prior knowledge collected from the datasets. This is a supervised pipeline with external label information. The claim of unsupervised online detection is therefore inaccurate and should be revised, or the authors should explain how the framework can be deployed without label access.
minor comments (5)
  1. [Sec. I and throughout] The word "casual" is used where "causal" is intended in several places (e.g., "casual relationships", "casual graph"); please correct these typos.
  2. [Sec. IV.A.2] The definition of MAE as "Proportion of normal data instances that the model predicts incorrectly" is unusual, since MAE usually denotes Mean Absolute Error; please clarify the metric name and definition.
  3. [Sec. IV.B.1] The sentence claiming improvements of ~2%, ~10.5%, ~5.5%, ~4% is not directly traceable to Table 2; specify the baseline and metric for each dataset to make the comparison transparent.
  4. [Fig. 2 caption] The caption refers to a "Deep Convolution Graph Neural Network"; the correct term in the text is "Deep Graph Convolutional Neural Network".
  5. [Sec. III.A and Sec. III.B] The symbol \omega is used both for the edge-weight distribution in Eq. (1) and for the reinforcement constant in Eq. (9); please use distinct symbols to avoid ambiguity.

Circularity Check

1 steps flagged · score 6.0 of 10

Attack subgraph construction in Eq. 7 injects ground-truth attack/impact nodes into the DGCNN input, so reported detection gains reduce to label-derived graph filtering.

  1. self definitional [Sec. III.B Eq. (7); Sec. III.D Implementation Details]
    "From the datasets, we also collect prior knowledge on the various cyberattack events including temporal attack patterns, attack and impact nodes, and attack purposes. ... We use prior attack knowledge (attack/impact points) to extract a subgraph ˆGk A from Gk A. ... ˆGk A = Gk A{(ˆu, ˆv) | ˆu ∈ D, ˆv ∈ D, and(ˆu, ˆv) ∈ Ek attack} (7) ..."

    D and E_attack in Eq. (7) are 'prior knowledge' collected from the same datasets whose attack segments define the ground-truth labels y_i. Eq. (7) defines the attack graph as the subgraph of G_k whose edges lie inside D and belong to E_attack; the normal graph is distinguished from the attack graph precisely by this label-derived subgraph. The DGCNN (Sec. III.C) is trained with BCE loss on these graphs and applied to test windows. Thus the classifier input encodes the attack/impact nodes taken from ground-truth attack annotations, and the reported F1/ROC/PRC gains over baselines are forced by construction rather than by genuinely unsupervised online causal discovery.

full rationale

The clearest circular step is the attack-subgraph construction. The paper collects attack/impact nodes and attack purposes from the datasets, then Eq. (7) prunes the causal graph to edges within those nodes and attack edges, and the DGCNN classifies attack vs normal using the resulting graphs. Because the pruning uses ground-truth attack annotations, the label information is an input to the classifier, so the reported accuracy advantage is partly a retrieval of injected labels. This is a genuine reduction-by-construction in the evaluation chain. I do not count the self-citations ([5], [6]) as circular: they are published prior works with independent content, and the paper's central causal discovery uses the external DYNOTEARS and DGCNN; self-citation alone is not load-bearing here. The score is 6 rather than higher because the framework does contain independently testable components (early symptom detection, DYNOTEARS-based structure learning, DGCNN) and the leakage affects the evaluation protocol rather than making the entire derivation empty.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central evaluation rests on several hand-set thresholds and on the availability of ground-truth attack and impact knowledge; these are the main load-bearing inputs that the paper does not justify or isolate.

free parameters (7)
  • Per-dataset DYNOTEARS time-lag tau = 4 (SWaT), 3 (WADI), 4 (TE), 1 (SMD)
    Chosen per dataset to maximize detection performance; Fig. 3 shows sensitivity, so the values are fit to the evaluation data.
  • Early symptom trigger threshold tau_P = ~0.9
    Hand-set threshold for Jensen-Shannon similarity; not justified by a principled criterion.
  • Causal edge reinforcement weight omega = 2
    Constant chosen to prevent overfitting; no search procedure or sensitivity is reported.
  • Stopping criterion threshold tau_hatE = 0.1
    Hand-set threshold for edge-degree distribution convergence.
  • DGCNN hyperparameters = 3 conv layers, ReLU, dropout, Adam, lr=0.01
    Architecture choices are given without sensitivity analysis; the learning rate is reported as optimized via random search.
  • Time window size k = 15 minutes
    Fixed window length for all datasets; no analysis of sensitivity to window duration is provided.
  • Edge-weight histogram bins = Not reported
    The edge weight distribution used for JS divergence requires a bin count that is never specified.
assumptions (6)
  • domain assumption DYNOTEARS recovers true causal structure from each finite time window under standard causal discovery assumptions (acyclicity, Markov or faithfulness, no hidden confounders).
    Invoked in Sec. III.B Eqs. (3)-(5) as the causal graph constructor without validation of identifiability on these datasets.
  • ad hoc to paper Reliable prior knowledge of attack points and impact points D and E_attack is available for every dataset.
    Sec. III.B Eq. (7) prunes the causal graph using D and E_attack; Sec. III.D says this prior knowledge is collected from the datasets.
  • domain assumption The normal-status causal structure is stable; only attacks cause significant graph divergence.
    Stated as an assumption in Sec. III.D; the early symptom trigger depends on this stability.
  • domain assumption Attack events are rare relative to normal operation.
    Stated in Sec. III.D as an implicit assumption; used to justify point-adjusted F1 evaluation.
  • ad hoc to paper Convergence of outdegree distributions between consecutive subgraphs indicates that incremental causal graph learning is complete.
    Eq. (12) defines the stopping criterion via JS divergence on edge-degree distributions; no evidence connects this to causal structure accuracy.
  • ad hoc to paper Reinforcing past attack edges by the constant omega preserves the spectral properties and acyclicity of the causal graph.
    Sec. III.B claims spectral preservation after Eqs. (8)-(11) and introduces protected nodes-based cycle removal without specifying the algorithm.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures." pith.science (2026). https://pith.science/paper/BX5W3QOK

@misc{pith2026250714387,
  author       = {Pith},
  title        = {Pith review of: Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BX5W3QOK}},
  note         = {Machine review of arXiv:2507.14387}
}
read the original abstract

The escalating threat of cyberattacks on real-time critical infrastructures poses serious risks to public safety, demanding detection methods that effectively capture complex system interdependencies and adapt to evolving attack patterns. Traditional real-time anomaly detection techniques often suffer from excessive false positives due to their statistical sensitivity to high data variance and class imbalance. To address these limitations, recent research has explored modeling causal relationships among system components. However, prior work mainly focuses on offline causal graph-based approaches that require static historical data and fail to generalize to real-time settings. These methods are fundamentally constrained by: (1) their inability to adapt to dynamic shifts in data distribution without retraining, and (2) the risk of catastrophic forgetting when lacking timely supervision in live systems. To overcome these challenges, we propose INCADET, a novel framework for incremental causal graph learning tailored to real-time cyberattack detection. INCADET dynamically captures evolving system behavior by incrementally updating causal graphs across streaming time windows. The framework comprises three modules: 1) Early Symptom Detection: Detects transitions in system status using divergence in edge-weight distributions across sequential causal graphs. 2) Incremental Causal Graph Learning: Leverages experience replay and edge reinforcement to continually refine causal structures while preserving prior knowledge. 3) Causal Graph Classification: Employs Graph Convolutional Networks (GCNs) to classify system status using the learned causal graphs. Extensive experiments on real-world critical infrastructure datasets demonstrate that INCADET achieves superior accuracy, robustness, and adaptability compared to both static causal and deep temporal baselines in evolving attack scenarios.

Figures

Figures reproduced from arXiv: 2507.14387 by the authors.

Figure 1
Figure 1. Offline Causal Graph-based Cyberattack Detection Workflow vs. Proposed Incremental Causal Graph-based Cyberattack Detection Workflow and mitigation of such cyberattacks can be generalized as Incremental Graph-based Anomaly Detection in a Multivariate Time-Series setting [1]. Lately, the research on Incremental or Continual Graphs [2]–[5] and offline causal graph-based detection [6]–[8] have emerged as a promising ap… view at source ↗
Figure 2
Figure 2. Overview of the proposed framework INCADET. INCADET detects early attack symptoms, constructs a causal graph from streaming data, and incrementally updates it using the Experience Replay Buffer and Causal Edge Reinforcement until convergence. Leveraging ground truth causal graphs representing system behavior, a Deep Convolution Graph Neural Network effectively detects and classifies the system status in near real-ti… view at source ↗
Figure 3
Figure 3. Performance analysis of INCADET on Timelag sensitivity. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Performance analysis of INCADET on Scalability. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Offline vs. Incremental Causal Frameworks [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Mechanical Force-Driven Charge Redistribution for Hydrogen Release at Ambient Conditions in Transition Metal-Intercalated Bilayer Graphene

    cond-mat.mtrl-sci 2025-08 unverdicted novelty 5.0 of 10

    Reducing the interlayer distance of Sc-, Ti-, or V-intercalated bilayer graphene below 4.7, 5.3, or 5.1 Å drives complete hydrogen desorption at ambient conditions.

Reference graph

Works this paper leans on

61 extracted references · 43 canonical work pages · cited by 1 Pith paper

  1. [1]

    Enhancing critical infrastructure security: Unsupervised learning approaches for anomaly detection,

    A. Pinto, L.-C. Herrera, Y . Donoso, and J. A. Gutierrez, “Enhancing critical infrastructure security: Unsupervised learning approaches for anomaly detection,” International Journal of Computational Intelligence Systems , vol. 17, no. 1, p. 236, Sep 2024. [Online]. Available: https://doi.org/10.1007/s44196-024-00644-z

    work page doi:10.1007/s44196-024-00644-z 2024

  2. [2]

    Incremental graph clustering for efficient retrieval from streaming egocentric video data,

    V . Chandrasekhar, C. Tan, W. Min, L. Liyuan, L. Xiaoli, and L. J. Hwee, “Incremental graph clustering for efficient retrieval from streaming egocentric video data,” in 2014 22nd International Conference on Pattern Recognition, 2014, pp. 2631–2636

    work page 2014

  3. [3]

    Anonymous edge representation for inductive anomaly detection in dynamic bipartite graph,

    L. Fang, K. Feng, J. Gui, S. Feng, and A. Hu, “Anonymous edge representation for inductive anomaly detection in dynamic bipartite graph,” Proc. VLDB Endow. , vol. 16, no. 5, p. 1154–1167, Jan. 2023. [Online]. Available: https://doi.org/10.14778/3579075.3579088

    arXiv 2023

  4. [4]

    Anomaly detection in dynamic graphs via transformer,

    Y . Liu, S. Pan, Y . G. Wang, F. Xiong, L. Wang, Q. Chen, and V . C. Lee, “Anomaly detection in dynamic graphs via transformer,” IEEE Transactions on Knowledge and Data Engineering , vol. 35, no. 12, p. 12081–12094, Dec. 2023. [Online]. Available: http://dx.doi.org/10.1109/TKDE.2021.3124061

    work page arXiv 2023

  5. [5]

    Incremental causal graph learning for online root cause analysis,

    D. Wang, Z. Chen, Y . Fu, Y . Liu, and H. Chen, “Incremental causal graph learning for online root cause analysis,” in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , ser. KDD ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 2269–2278. [Online]. Available: https://doi.org/10.1145/3580305.3599392

    arXiv 2023

  6. [6]

    Multi-view causal graph fusion based anomaly detection in cyber-physical infrastructures,

    A. V . Malarkkan, D. Wang, and Y . Fu, “Multi-view causal graph fusion based anomaly detection in cyber-physical infrastructures,” in Proceedings of the 33rd ACM International Conference on Information and Knowledge Management , ser. CIKM ’24. New York, NY , USA: Association for Computing Machinery, 2024, p. 4760–4767. [Online]. Available: https://doi.org...

    arXiv 2024

  7. [7]

    Entropy causal graphs for multivariate time series anomaly detection,

    F. G. Febrinanto, K. Moore, C. Thapa, M. Liu, V . Saikrishna, J. Ma, and F. Xia, “Entropy causal graphs for multivariate time series anomaly detection,” 2023

    work page 2023

  8. [8]

    Rethinking spatio-temporal anomaly detection: A vision for causality-driven cybersecurity,

    A. V . Malarkkan, H. Bai, X. Wang, A. Kaushik, D. Wang, and Y . Fu, “Rethinking spatio-temporal anomaly detection: A vision for causality-driven cybersecurity,” 2025. [Online]. Available: https://arxiv.org/abs/2507.08177

    arXiv 2025

Show all 61 references
  1. [9]

    Incremental support vector learning: Analysis, implementation and applications

    P. Laskov, C. Gehl, S. Kr ¨uger, K.-R. M ¨uller, K. P. Bennett, and E. Parrado-Hern ´andez, “Incremental support vector learning: Analysis, implementation and applications.” Journal of machine learning research, vol. 7, no. 9, 2006

    2006

  2. [10]

    Incremental svm based on reserved set for network intrusion detection,

    Y . Yi, J. Wu, and W. Xu, “Incremental svm based on reserved set for network intrusion detection,” Expert Systems with Applications , vol. 38, no. 6, pp. 7698–7707, 2011. 11

    2011

  3. [11]

    Using density-based incremental clustering for anomaly detection,

    F. Ren, L. Hu, H. Liang, X. Liu, and W. Ren, “Using density-based incremental clustering for anomaly detection,” in 2008 international conference on computer science and software engineering, vol. 3. IEEE, 2008, pp. 986–989

    2008

  4. [12]

    Adaptive real-time anomaly detec- tion with incremental clustering,

    K. Burbeck and S. Nadjm-Tehrani, “Adaptive real-time anomaly detec- tion with incremental clustering,” information security technical report , vol. 12, no. 1, pp. 56–67, 2007

    2007

  5. [13]

    Dynamic graph-based graph attention network for anomaly detection in industrial multivariate time series data,

    C. Gao, H. Ma, Q. Pei, and Y . Chen, “Dynamic graph-based graph attention network for anomaly detection in industrial multivariate time series data,” Applied Intelligence, vol. 55, no. 6, p. 517, 2025

    2025

  6. [14]

    Graph contin- ual learning network: An incremental intelligent diagnosis method of machines for new fault detection,

    S. Wang, Y . Lei, N. Lu, B. Yang, X. Li, and N. Li, “Graph contin- ual learning network: An incremental intelligent diagnosis method of machines for new fault detection,” IEEE Transactions on Automation Science and Engineering , pp. 1–11, 2024

    2024

  7. [15]

    The effectiveness of memory replay in large scale continual learning,

    Y . Balaji, M. Farajtabar, D. Yin, A. Mott, and A. Li, “The effectiveness of memory replay in large scale continual learning,” 2020

    2020

  8. [16]

    Jensen-shannon divergence and hilbert space embedding,

    B. Fuglede and F. Topsoe, “Jensen-shannon divergence and hilbert space embedding,” in International Symposium onInformation Theory, 2004. ISIT 2004. Proceedings. , 2004, pp. 31–

    2004

  9. [17]

    Dynotears: Structure learning from time-series data,

    R. Pamfil, N. Sriwattanaworachai, S. Desai, P. Pilgerstorfer, P. Beau- mont, K. Georgatzis, and B. Aragam, “Dynotears: Structure learning from time-series data,” 2020

    2020

  10. [18]

    An end-to-end deep learning architecture for graph classification,

    M. Zhang, Z. Cui, M. Neumann, and Y . Chen, “An end-to-end deep learning architecture for graph classification,” in Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence and Thirtieth Innovative Applications of Artificial Intelligence Conference and Eight...

    2018

  11. [19]

    Pyod: A python toolbox for scalable outlier detection,

    Y . Zhao, Z. Nasrullah, and Z. Li, “Pyod: A python toolbox for scalable outlier detection,” Journal of Machine Learning Research , vol. 20, no. 96, pp. 1–7, 2019. [Online]. Available: http://jmlr.org/papers/v20/ 19-011.html

    2019

  12. [20]

    Swat: a water treatment testbed for research and training on ics security,

    A. P. Mathur and N. O. Tippenhauer, “Swat: a water treatment testbed for research and training on ics security,” in 2016 International Workshop on Cyber-physical Systems for Smart Water Networks (CySWater), 2016, pp. 31–36

    2016

  13. [21]

    Wadi: a water distribution testbed for research in the design of secure cyber physical systems,

    C. M. Ahmed, V . R. Palleti, and A. P. Mathur, “Wadi: a water distribution testbed for research in the design of secure cyber physical systems,” in Proceedings of the 3rd International Workshop on Cyber- Physical Systems for Smart Water Networks , ser. CySW ATER ’17. New York,...

    2017

  14. [22]

    Tennessee eastman simulation dataset,

    X. Chen, “Tennessee eastman simulation dataset,” 2019. [Online]. Available: https://dx.doi.org/10.21227/4519-z502

    2019 doi

  15. [23]

    Robust anomaly detection for multivariate time series through stochastic recurrent neural network,

    Y . Su, Y . Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, “Robust anomaly detection for multivariate time series through stochastic recurrent neural network,” in Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , ser. KDD ’19. New Yo...

    2019 doi

  16. [24]

    An evaluation of anomaly detection and diagnosis in multivariate time series,

    A. Garg, W. Zhang, J. Samaran, R. Savitha, and C.-S. Foo, “An evaluation of anomaly detection and diagnosis in multivariate time series,” IEEE Transactions on Neural Networks and Learning Systems , vol. 33, no. 6, pp. 2508–2517, 2022

    2022

  17. [25]

    Usad: Unsupervised anomaly detection on multivariate time series,

    J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga, “Usad: Unsupervised anomaly detection on multivariate time series,” in Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , ser. KDD ’20. New York, NY , USA: Associ...

    2020

  18. [26]

    Deep autoencoding gaussian mixture model for unsupervised anomaly detection,

    B. Zong, Q. Song, M. R. Min, W. Cheng, C. Lumezanu, D. Cho, and H. Chen, “Deep autoencoding gaussian mixture model for unsupervised anomaly detection,” in 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Confer...

    2018

  19. [27]

    Multivariate time-series anomaly detection via graph attention network,

    H. Zhao, Y . Wang, J. Duan, C. Huang, D. Cao, Y . Tong, B. Xu, J. Bai, J. Tong, and Q. Zhang, “Multivariate time-series anomaly detection via graph attention network,” in 2020 IEEE International Conference on Data Mining (ICDM) . IEEE, Nov. 2020, p. 841–850. [Online]. Availabl...

    2020

  20. [28]

    An improved data anomaly detection method based on isolation forest,

    D. Xu, Y . Wang, Y . Meng, and Z. Zhang, “An improved data anomaly detection method based on isolation forest,” in 2017 10th international symposium on computational intelligence and design (ISCID) , vol. 2. IEEE, 2017, pp. 287–291

    2017

  21. [29]

    Loda: Lightweight on-line detector of anomalies,

    T. Pevn ´y, “Loda: Lightweight on-line detector of anomalies,” Mach. Learn., vol. 102, no. 2, p. 275–304, Feb. 2016. [Online]. Available: https://doi.org/10.1007/s10994-015-5521-0

    2016 doi

  22. [30]

    Angle-based outlier detection in high-dimensional data,

    H.-P. Kriegel, M. Schubert, and A. Zimek, “Angle-based outlier detection in high-dimensional data,” in Proceedings of the 14th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , ser. KDD ’08. New York, NY , USA: Association for Computing Machinery, 20...

    2008

  23. [31]

    Anomaly detection using improved deep svdd model with data structure preservation,

    Z. Zhang and X. Deng, “Anomaly detection using improved deep svdd model with data structure preservation,” Pattern Recognition Letters, vol. 148, pp. 1–6, 2021

    2021

  24. [32]

    Causality learning: A new perspective for interpretable machine learning,

    G. Xu, T. D. Duong, Q. Li, S. Liu, and X. Wang, “Causality learning: A new perspective for interpretable machine learning,” 2020

    2020

  25. [33]

    Dags with no tears: Continuous optimization for structure learning,

    X. Zheng, B. Aragam, P. Ravikumar, and E. P. Xing, “Dags with no tears: Continuous optimization for structure learning,” 2018

    2018

  26. [34]

    Outlier detection for temporal data: A survey,

    M. Gupta, J. Gao, C. C. Aggarwal, and J. Han, “Outlier detection for temporal data: A survey,” IEEE Transactions on Knowledge and Data Engineering, vol. 26, no. 9, pp. 2250–2267, 2014

    2014

  27. [35]

    Deep learning for time series anomaly detection: A survey,

    Z. Zamanzadeh Darban, G. I. Webb, S. Pan, C. Aggarwal, and M. Salehi, “Deep learning for time series anomaly detection: A survey,” ACM Computing Surveys , vol. 57, no. 1, p. 1–42, Oct. 2024. [Online]. Available: http://dx.doi.org/10.1145/3691338

    2024 doi

  28. [36]

    Deep learning for anomaly detection in time-series data: Review, analysis, and guidelines,

    K. Choi, J. Yi, C. Park, and S. Yoon, “Deep learning for anomaly detection in time-series data: Review, analysis, and guidelines,” IEEE Access, vol. 9, pp. 120 043–120 065, 2021

    2021

  29. [37]

    Robustness of autoen- coders for anomaly detection under adversarial impact,

    A. Goodge, B. Hooi, S. K. Ng, and W. S. Ng, “Robustness of autoen- coders for anomaly detection under adversarial impact,” in Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelli- gence, ser. IJCAI’20, 2021

    2021

  30. [38]

    A deep neural network for unsupervised anomaly detection and diagnosis in multivariate time series data,

    C. Zhang, D. Song, Y . Chen, X. Feng, C. Lumezanu, W. Cheng, J. Ni, B. Zong, H. Chen, and N. V . Chawla, “A deep neural network for unsupervised anomaly detection and diagnosis in multivariate time series data,” Proceedings of the AAAI Conference on Artificial Intelligence, vo...

    2019 doi

  31. [39]

    Context-aware domain adaptation for time series anomaly detection,

    K.-H. Lai, L. Wang, H. Chen, K. Zhou, F. Wang, H. Yang, and X. Hu, “Context-aware domain adaptation for time series anomaly detection,” 2023

    2023

  32. [40]

    D. Li, D. Chen, B. Jin, L. Shi, J. Goh, and S.-K. Ng, MAD- GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks . Springer International Publishing, 2019, p. 703–716. [Online]. Available: http://dx.doi.org/10.1007/ 978-3-030-30490-4 56

    2019

  33. [41]

    Dct-gan: Dilated convolutional transformer-based gan for time series anomaly detection,

    Y . Li, X. Peng, J. Zhang, Z. Li, and M. Wen, “Dct-gan: Dilated convolutional transformer-based gan for time series anomaly detection,” IEEE Transactions on Knowledge and Data Engineering , vol. 35, no. 4, pp. 3632–3644, 2023

    2023

  34. [42]

    Graph anomaly detection in time series: A survey,

    T. K. K. Ho, A. Karami, and N. Armanfard, “Graph anomaly detection in time series: A survey,” 2023

    2023

  35. [43]

    Deep into Hypersphere: Robust and Unsupervised Anomaly Discovery in Dynamic Networks,

    X. Teng, M. Yan, A. M. Ertugrul, and Y .-R. Lin, “Deep into Hypersphere: Robust and Unsupervised Anomaly Discovery in Dynamic Networks,” in Proceedings of the 27th International Joint Conference on Artificial Intelligence (IJCAI 2018) , 2018. [Online]. Available: http://goo.gl/e3aons

    2018

  36. [44]

    Adversarial autoencoder for unsupervised time series anomaly detection and interpretation,

    X. Chen, L. Deng, Y . Zhao, and K. Zheng, “Adversarial autoencoder for unsupervised time series anomaly detection and interpretation,” in Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining , ser. WSDM ’23. New York, NY , USA: Association fo...

    2023

  37. [45]

    Stackvae- g: An efficient and interpretable model for time series anomaly detection,

    W. Li, W. Hu, T. Chen, N. Chen, and C. Feng, “Stackvae- g: An efficient and interpretable model for time series anomaly detection,” AI Open , vol. 3, pp. 101–110, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2666651022000110

    2022

  38. [46]

    Regraphgan: A graph generative adversarial network model for dynamic network anomaly detection,

    D. Guo, Z. Liu, and R. Li, “Regraphgan: A graph generative adversarial network model for dynamic network anomaly detection,” Neural Netw., vol. 166, no. C, p. 273–285, Sep. 2023. [Online]. Available: https://doi.org/10.1016/j.neunet.2023.07.026

    2023 doi

  39. [47]

    Mim-gan-based anomaly detection for multivariate time series data,

    S. Lu, Z. Dong, D. Cai, F. Fang, and D. Zhao, “Mim-gan-based anomaly detection for multivariate time series data,” in 2023 IEEE 98th Vehicular Technology Conference (VTC2023-Fall). IEEE, Oct. 2023, p. 1–7. [Online]. Available: http://dx.doi.org/10.1109/VTC2023-Fall60731. 2023.10333517

    2023

  40. [48]

    Hybrid anomaly detection via multihead dynamic graph attention networks for multivariate time series,

    L. Zhou, Q. Zeng, and B. Li, “Hybrid anomaly detection via multihead dynamic graph attention networks for multivariate time series,” IEEE Access, vol. 10, pp. 40 967–40 978, 2022. 12

    2022

  41. [49]

    Anomaly detection in dynamic graphs via transformer,

    Y . Liu, S. Pan, Y . G. Wang, F. Xiong, L. Wang, Q. Chen, and V . C. Lee, “Anomaly detection in dynamic graphs via transformer,” IEEE Transactions on Knowledge and Data Engineering , vol. 35, no. 12, pp. 12 081–12 094, 2023

    2023

  42. [50]

    Generative and contrastive self-supervised learning for graph anomaly detection,

    Y . Zheng, M. Jin, Y . Liu, L. Chi, K. T. Phan, and Y .-P. P. Chen, “Generative and contrastive self-supervised learning for graph anomaly detection,” IEEE Trans. on Knowl. and Data Eng. , vol. 35, no. 12, p. 12220–12233, Oct. 2021. [Online]. Available: https://doi.org/10.1109...

    2021

  43. [51]

    Anomal-e: A self- supervised network intrusion detection system based on graph neural networks,

    E. Caville, W. W. Lo, S. Layeghy, and M. Portmann, “Anomal-e: A self- supervised network intrusion detection system based on graph neural networks,” Knowledge-Based Systems, vol. 258, p. 110030, Dec. 2022. [Online]. Available: http://dx.doi.org/10.1016/j.knosys.2022.110030

    2022

  44. [52]

    Hierarchical graph neural networks for causal discovery and root cause localization,

    D. Wang, Z. Chen, J. Ni, L. Tong, Z. Wang, Y . Fu, and H. Chen, “Hierarchical graph neural networks for causal discovery and root cause localization,” 2023

    2023

  45. [53]

    A causal approach to detecting multivariate time-series anomalies and root causes,

    W. Yang, K. Zhang, and S. C. H. Hoi, “A causal approach to detecting multivariate time-series anomalies and root causes,” 2022

    2022

  46. [54]

    Semi- supervised anomaly detection via adaptive reinforcement learning- enabled method with causal inference for sensor signals,

    X. Chen, R. Xiaoa, Z. Zeng, Z. Qiu, S. Zhang, and X. Du, “Semi- supervised anomaly detection via adaptive reinforcement learning- enabled method with causal inference for sensor signals,” 2024

    2024

  47. [55]

    Causal inference for time series analysis: problems, methods and evaluation,

    R. Moraffah, P. Sheth, M. Karami, A. Bhattacharya, Q. Wang, A. Tahir, A. Raglin, and H. Liu, “Causal inference for time series analysis: problems, methods and evaluation,” Knowledge and Information Systems, vol. 63, no. 12, p. 3041–3085, Nov. 2021. [Online]. Available: http://...

    2021 doi

  48. [56]

    Deep learning-based group causal inference in multivariate time-series,

    W. Ahmad, M. Shadaydeh, and J. Denzler, “Deep learning-based group causal inference in multivariate time-series,” 2024

    2024

  49. [57]

    Causal discovery with attention-based convolutional neural networks,

    M. Nauta, D. Bucur, and C. Seifert, “Causal discovery with attention-based convolutional neural networks,” Machine Learning and Knowledge Extraction , vol. 1, no. 1, pp. 312–340, 2019. [Online]. Available: https://www.mdpi.com/2504-4990/1/1/19

    2019

  50. [58]

    Neural granger causality,

    A. Tank, I. Covert, N. Foti, A. Shojaie, and E. B. Fox, “Neural granger causality,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 8, pp. 4267–4279, 2022

    2022

  51. [59]

    Discovering contemporaneous and lagged causal relations in autocorrelated nonlinear time series datasets,

    J. Runge, “Discovering contemporaneous and lagged causal relations in autocorrelated nonlinear time series datasets,” 2020

    2020

  52. [60]

    Causal inference on time series using structural equation models,

    J. Peters, D. Janzing, and B. Sch ¨olkopf, “Causal inference on time series using structural equation models,” 2012

    2012

  53. [61]

    Leveraging Causal Information for Multivariate Timeseries Anomaly Detection,

    L. Heppel, A. Gerhardus, F. Rewicki, J. Deeken, and G. Waxenegger- Wilfing, “Leveraging Causal Information for Multivariate Timeseries Anomaly Detection,” in 35th International Conference on Principles of Diagnosis and Resilient Systems (DX 2024) , ser. Open Access Series in I...

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.