{"id":"https://openalex.org/W7225754864","doi":"https://doi.org/10.21203/rs.3.rs-11654311/v1","title":"Automated Root Cause Analysis of Security Incidents Using Causal Machine Learning","display_name":"Automated Root Cause Analysis of Security Incidents Using Causal Machine Learning","publication_year":2026,"publication_date":"2026-11-10","ids":{"openalex":"https://openalex.org/W7225754864","doi":"https://doi.org/10.21203/rs.3.rs-11654311/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-11654311/v1","doi":"https://doi.org/10.21203/rs.3.rs-11654311/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11654311/v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.21203/rs.3.rs-11654311/v1","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5161418626","display_name":"Rehana Devani","orcid":"https://orcid.org/0009-0003-8231-3448","observed_orcids":["https://orcid.org/0009-0003-8231-3448"]},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Rehana Devani","raw_affiliation_strings":["Google (United States)"],"raw_orcid":"https://orcid.org/0009-0003-8231-3448","affiliations":[{"raw_affiliation_string":"Google (United States)","institution_ids":["https://openalex.org/I1291425158"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5161418626"],"corresponding_institution_ids":["https://openalex.org/I1291425158"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5776000022888184,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5776000022888184,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3082999885082245,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.02800000086426735,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6585999727249146},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6018000245094299},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.5784000158309937},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5703999996185303},{"id":"https://openalex.org/C108650721","wikidata":"https://www.wikidata.org/wiki/Q1783253","display_name":"Counterfactual thinking","level":2,"score":0.5220000147819519},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.503000020980835},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.47049999237060547},{"id":"https://openalex.org/C63002673","wikidata":"https://www.wikidata.org/wiki/Q2260590","display_name":"Scoring rule","level":2,"score":0.4392000138759613},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4237000048160553},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.4059000015258789},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.39719998836517334},{"id":"https://openalex.org/C158600405","wikidata":"https://www.wikidata.org/wiki/Q5054566","display_name":"Causal inference","level":2,"score":0.35359999537467957},{"id":"https://openalex.org/C22679943","wikidata":"https://www.wikidata.org/wiki/Q159375","display_name":"Standard deviation","level":2,"score":0.3492000102996826},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.3452000021934509},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.3393999934196472},{"id":"https://openalex.org/C2776502983","wikidata":"https://www.wikidata.org/wiki/Q690182","display_name":"Contrast (vision)","level":2,"score":0.3384000062942505},{"id":"https://openalex.org/C45804977","wikidata":"https://www.wikidata.org/wiki/Q7239673","display_name":"Predictive modelling","level":2,"score":0.3301999866962433},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.3059999942779541},{"id":"https://openalex.org/C2987525970","wikidata":"https://www.wikidata.org/wiki/Q96374569","display_name":"Causal analysis","level":2,"score":0.29420000314712524},{"id":"https://openalex.org/C146380142","wikidata":"https://www.wikidata.org/wiki/Q1137726","display_name":"Directed graph","level":2,"score":0.2809999883174896},{"id":"https://openalex.org/C130963320","wikidata":"https://www.wikidata.org/wiki/Q1401207","display_name":"Root cause analysis","level":2,"score":0.2728999853134155},{"id":"https://openalex.org/C168820333","wikidata":"https://www.wikidata.org/wiki/Q448889","display_name":"Visual inspection","level":2,"score":0.2727999985218048},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.2694999873638153},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.26750001311302185},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.26249998807907104}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21203/rs.3.rs-11654311/v1","doi":"https://doi.org/10.21203/rs.3.rs-11654311/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11654311/v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-11654311/v1","doi":"https://doi.org/10.21203/rs.3.rs-11654311/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11654311/v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"Security":[1],"incident":[2,21,210,235],"investigation":[3],"requires":[4],"distinguishing":[5],"an":[6,20],"initiating":[7],"mechanism":[8,25,41,226],"from":[9,124],"downstream":[10,97],"symptoms.":[11],"An":[12],"unusual":[13],"event":[14],"may":[15],"be":[16],"statistically":[17],"predictive":[18],"of":[19,87,114,163,186],"without":[22],"being":[23],"the":[24,108,128,144,181,187,194],"that":[26,38,179,224],"generated":[27],"it.":[28],"This":[29],"study":[30,223],"evaluates":[31],"a":[32,44,79,158,220],"transparent":[33],"causal":[34,47,205],"machine":[35],"learning":[36],"procedure":[37],"ranks":[39],"standardised":[40],"residuals":[42],"in":[43,233],"supplied":[45,145],"structural":[46,52],"graph.":[48],"A":[49,174],"six-variable":[50],"linear":[51],"model":[53],"represents":[54],"abstract":[55],"access,":[56],"policy,":[57],"execution,":[58],"privilege,":[59],"movement":[60],"and":[61,75,111,152,171,230],"impact":[62,189],"signals.":[63],"Across":[64],"30":[65],"independently":[66],"seeded":[67],"replications,":[68],"each":[69],"containing":[70],"2,000":[71],"normal":[72],"training":[73],"observations":[74],"600":[76],"synthetic":[77],"incidents,":[78],"four-unit":[80],"innovation":[81,129,183],"shift":[82],"is":[83,102,138,219],"injected":[84,182],"into":[85],"one":[86,115],"three":[88],"candidate":[89],"mechanisms.":[90],"Five":[91],"mechanisms":[92],"are":[93],"ranked,":[94],"including":[95],"two":[96],"distractors.":[98],"Marginal":[99],"anomaly":[100],"scoring":[101,106,142,151],"compared":[103],"with":[104],"residual":[105,141],"under":[107,112,143,196],"correct":[109,146],"graph":[110,228],"deletion":[113],"generating":[116],"edge.":[117],"Additional":[118],"experiments":[119],"vary":[120],"independent":[121],"sensor":[122,133,159],"noise":[123,160],"zero":[125],"to":[126,168],"twice":[127],"standard":[130,161],"deviation.":[131],"Without":[132],"noise,":[134],"mean":[135,188],"top-one":[136],"accuracy":[137],"98.41%":[139],"for":[140,149,214],"graph,":[147],"86.66%":[148],"marginal":[150],"94.26%":[153],"after":[154],"edge":[155],"deletion.":[156],"At":[157],"deviation":[162],"one,":[164],"these":[165],"values":[166],"decline":[167],"80.63%,":[169],"61.64%":[170],"75.33%,":[172],"respectively.":[173],"simulator-based":[175],"repair":[176],"check":[177],"confirms":[178],"reversing":[180],"removes":[184],"most":[185],"shift.":[190],"These":[191],"results":[192],"validate":[193],"implementation":[195],"favourable,":[197],"explicitly":[198],"stated":[199],"assumptions;":[200],"they":[201],"do":[202],"not":[203],"demonstrate":[204],"discovery,":[206],"effectiveness":[207],"on":[208],"operational":[209],"records":[211],"or":[212],"readiness":[213],"autonomous":[215],"containment.":[216],"The":[217],"contribution":[218],"reproducible":[221],"methodological":[222],"separates":[225],"localisation,":[227],"dependence":[229],"counterfactual":[231],"validation":[232],"security":[234],"analysis.":[236]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-11T00:00:00"}