{"id":"https://openalex.org/W7141174857","doi":"https://doi.org/10.1109/icce67443.2026.11449614","title":"CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems","display_name":"CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems","publication_year":2026,"publication_date":"2026-02-03","ids":{"openalex":"https://openalex.org/W7141174857","doi":"https://doi.org/10.1109/icce67443.2026.11449614"},"language":null,"primary_location":{"id":"doi:10.1109/icce67443.2026.11449614","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icce67443.2026.11449614","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Consumer Electronics (ICCE)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5130770612","display_name":"Jean-Jarcke Mukombelwa Malasi","orcid":null},"institutions":[{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Jean-Jarcke Mukombelwa Malasi","raw_affiliation_strings":["University of Quebec in Outaouais,Department of Computer Science and Engineering,Quebec,Canada"],"affiliations":[{"raw_affiliation_string":"University of Quebec in Outaouais,Department of Computer Science and Engineering,Quebec,Canada","institution_ids":["https://openalex.org/I33217400"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027414521","display_name":"Hajar Moudoud","orcid":"https://orcid.org/0000-0003-2979-0862"},"institutions":[{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Hajar Moudoud","raw_affiliation_strings":["University of Quebec in Outaouais,Department of Computer Science and Engineering,Quebec,Canada"],"affiliations":[{"raw_affiliation_string":"University of Quebec in Outaouais,Department of Computer Science and Engineering,Quebec,Canada","institution_ids":["https://openalex.org/I33217400"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028335166","display_name":"Rokia Missaoui","orcid":"https://orcid.org/0000-0001-7410-4177"},"institutions":[{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Rokia Missaoui","raw_affiliation_strings":["University of Quebec in Outaouais,Department of Computer Science and Engineering,Quebec,Canada"],"affiliations":[{"raw_affiliation_string":"University of Quebec in Outaouais,Department of Computer Science and Engineering,Quebec,Canada","institution_ids":["https://openalex.org/I33217400"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5130770612"],"corresponding_institution_ids":["https://openalex.org/I33217400"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.92155575,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.20010000467300415,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.20010000467300415,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.18379999697208405,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11303","display_name":"Bayesian Modeling and Causal Inference","score":0.057500001043081284,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5120999813079834},{"id":"https://openalex.org/keywords/causal-model","display_name":"Causal model","score":0.3702000081539154},{"id":"https://openalex.org/keywords/model-based-reasoning","display_name":"Model-based reasoning","score":0.3626999855041504},{"id":"https://openalex.org/keywords/automated-reasoning","display_name":"Automated reasoning","score":0.34700000286102295},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.33399999141693115},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.33149999380111694},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.31769999861717224}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6607999801635742},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5569999814033508},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5120999813079834},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3772999942302704},{"id":"https://openalex.org/C11671645","wikidata":"https://www.wikidata.org/wiki/Q5054567","display_name":"Causal model","level":2,"score":0.3702000081539154},{"id":"https://openalex.org/C37335422","wikidata":"https://www.wikidata.org/wiki/Q6888134","display_name":"Model-based reasoning","level":3,"score":0.3626999855041504},{"id":"https://openalex.org/C195344581","wikidata":"https://www.wikidata.org/wiki/Q2555318","display_name":"Automated reasoning","level":2,"score":0.34700000286102295},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.33570000529289246},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.33399999141693115},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.33149999380111694},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31769999861717224},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.3149999976158142},{"id":"https://openalex.org/C115086926","wikidata":"https://www.wikidata.org/wiki/Q17004651","display_name":"Causal reasoning","level":3,"score":0.3050000071525574},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2890999913215637},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.2770000100135803},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.26840001344680786},{"id":"https://openalex.org/C58328972","wikidata":"https://www.wikidata.org/wiki/Q184609","display_name":"Expert system","level":2,"score":0.2515000104904175},{"id":"https://openalex.org/C64357122","wikidata":"https://www.wikidata.org/wiki/Q1149766","display_name":"Causality (physics)","level":2,"score":0.25029999017715454},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.2500999867916107}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icce67443.2026.11449614","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icce67443.2026.11449614","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Consumer Electronics (ICCE)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":9,"referenced_works":["https://openalex.org/W2143891888","https://openalex.org/W2296509296","https://openalex.org/W2789828921","https://openalex.org/W2921573932","https://openalex.org/W4327750468","https://openalex.org/W4392353733","https://openalex.org/W4393150251","https://openalex.org/W4403510934","https://openalex.org/W4407070057"],"related_works":[],"abstract_inverted_index":{"Modern":[0],"intrusion":[1,56,174],"detection":[2,39,57,175],"systems":[3],"often":[4],"achieve":[5],"impressive":[6],"benchmark":[7],"accuracy":[8],"yet":[9],"fail":[10],"in":[11,128,163],"real-world":[12],"deployment,":[13],"where":[14],"network":[15,173],"behavior":[16,95],"and":[17,37,54,111,150,154,183],"attacker":[18],"tactics":[19],"continuously":[20],"evolve.":[21],"Under":[22],"concept":[23],"drift,":[24],"decision":[25],"boundaries":[26],"learned":[27,165],"offline":[28],"can":[29],"diverge":[30],"from":[31,91,141],"operational":[32],"reality,":[33],"triggering":[34],"false-alarm":[35],"cascades":[36],"creating":[38],"blind":[40],"spots":[41],"that":[42,59,78,178],"erode":[43],"analyst":[44],"trust.":[45],"In":[46],"this":[47],"paper,":[48],"we":[49,72],"propose":[50,73,148],"CausalGraph-IDS,":[51],"a":[52,75,81],"causal":[53,84,139,155,196],"language-model-assisted":[55],"framework":[58],"moves":[60],"beyond":[61],"purely":[62],"correlational":[63],"scoring":[64],"by":[65,87,101],"explicitly":[66],"verifying":[67],"multi-stage":[68],"attack":[69,166],"chains.":[70],"Additionally,":[71],"CHAIN-CRC,":[74],"unified":[76],"algorithm":[77],"(i)":[79],"learns":[80],"constrained":[82],"attack-chain":[83],"graph":[85],"guided":[86],"knowledge-based":[88],"priors":[89],"derived":[90],"widely":[92,171],"used":[93,172],"adversary":[94],"taxonomies,":[96],"(ii)":[97],"computes":[98],"robustness":[99],"scores":[100],"testing":[102],"whether":[103],"alarms":[104],"persist":[105],"under":[106],"feasible":[107,152],"counterfactual":[108,145],"security":[109],"interventions,":[110,153],"(iii)":[112],"applies":[113],"conformal":[114],"risk":[115],"control":[116],"to":[117,137,147,158],"enforce":[118],"operator-defined":[119],"false-positive":[120,191],"budgets":[121],"with":[122],"finite-sample":[123],"guarantees.Generative":[124],"models":[125],"are":[126],"integrated":[127],"strictly":[129],"assistive":[130],"roles":[131],"through":[132],"three":[133],"modules:":[134],"prior":[135],"induction":[136],"distill":[138],"constraints":[140],"unstructured":[142],"threat":[143],"reports,":[144],"generation":[146],"realistic":[149],"operationally":[151],"logic":[156],"justification":[157],"produce":[159],"human-readable":[160],"explanations":[161],"grounded":[162],"the":[164],"chain.":[167],"Experiments":[168],"on":[169],"two":[170],"benchmarks":[176],"show":[177],"CausalGraph-IDS":[179],"provides":[180],"robust,":[181],"explainable,":[182],"risk-governed":[184],"detection,":[185],"maintaining":[186],"strong":[187],"recall":[188],"at":[189],"low":[190],"rates":[192],"while":[193],"delivering":[194],"actionable":[195],"insights":[197],"for":[198],"mitigation.":[199]},"counts_by_year":[],"updated_date":"2026-03-29T06:01:01.467347","created_date":"2026-03-28T00:00:00"}