Rethinking Spatio-Temporal Anomaly Detection: A Vision for Causality-Driven Cybersecurity

2025/07/10 by Malarkkan, Arun Vignesh, Bai, Haoyue, Wang, Xinyuan +3 · 3 citations
#Artificial Intelligence (cs.AI) #Emerging Technologies (cs.ET) #F.2.2 #FOS: Computer and information sciences #I.2.1 #I.2.4 #I.2.7 #Machine Learning (cs.LG) #Neural and Evolutionary Computing (cs.NE)

paper · doi:10.48550/arxiv.2507.08177

Abstract

As cyber-physical systems grow increasingly interconnected and spatially distributed, ensuring their resilience against evolving cyberattacks has become a critical priority. Spatio-Temporal Anomaly detection plays an important role in ensuring system security and operational integrity. However, current data-driven approaches, largely driven by black-box deep learning, face challenges in interpretability, adaptability to distribution shifts, and robustness under evolving system dynamics. In this paper, we advocate for a causal learning perspective to advance anomaly detection in spatially distributed infrastructures that grounds detection in structural cause-effect relationships. We identify and formalize three key directions: causal graph profiling, multi-view fusion, and continual causal graph learning, each offering distinct advantages in uncovering dynamic cause-effect structures across time and space. Drawing on real-world insights from systems such as water treatment infrastructures, we illustrate how causal models provide early warning signals and root cause attribution, addressing the limitations of black-box detectors. Looking ahead, we outline the future research agenda centered on multi-modality, generative AI-driven, and scalable adaptive causal frameworks. Our objective is to lay a new research trajectory toward scalable, adaptive, explainable, and spatially grounded anomaly detection systems. We hope to inspire a paradigm shift in cybersecurity research, promoting causality-driven approaches to address evolving threats in interconnected infrastructures.

Citations

• Interpretable Neural Causal Models with TRAM-DAGs
• Causal-discovery-based root-cause analysis and its application in time-series prediction error diagnosis
• Which bits went where? Past and future transfer entropy decomposition with the information bottleneck
• Causality from Bottom to Top: A Survey
• Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy
• Graph Neural Network-Based Anomaly Detection in Multivariate Time Series
• Towards Causal Representation Learning
• Causal Sufficiency and Actual Causation
• Masked Gradient-Based Causal Structure Learning
• Review of Causal Discovery Methods Based on Graphical Models
• A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data
• Collective Anomaly Detection based on Long Short Term Memory Recurrent Neural Network

Cited by

• DELTA: Variational Disentangled Learning for Privacy-Preserving Data Reprogramming
• Causal Graph Profiling via Structural Divergence for Robust Anomaly Detection in Cyber-Physical Systems
• Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures

Related

• Causal Graph Profiling via Structural Divergence for Robust Anomaly Detection in Cyber-Physical Systems
• Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures
• Explainable Online Unsupervised Anomaly Detection for Cyber-Physical Systems via Causal Discovery from Time Series
• MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
• Unsupervised Spatio-Temporal State Estimation for Fine-grained Adaptive Anomaly Diagnosis of Industrial Cyber-physical Systems