{"id":"https://openalex.org/W7117154667","doi":"https://doi.org/10.1109/tbdata.2025.3648314","title":"Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures","display_name":"Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures","publication_year":2025,"publication_date":"2025-12-24","ids":{"openalex":"https://openalex.org/W7117154667","doi":"https://doi.org/10.1109/tbdata.2025.3648314"},"language":null,"primary_location":{"id":"doi:10.1109/tbdata.2025.3648314","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tbdata.2025.3648314","pdf_url":null,"source":{"id":"https://openalex.org/S2491400915","display_name":"IEEE Transactions on Big Data","issn_l":"2332-7790","issn":["2332-7790","2372-2096"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Big Data","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114337367","display_name":"Arun Vignesh Malarkkan","orcid":"https://orcid.org/0009-0000-5887-1915"},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Arun Vignesh Malarkkan","raw_affiliation_strings":["School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA"],"raw_orcid":"https://orcid.org/0009-0000-5887-1915","affiliations":[{"raw_affiliation_string":"School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101737969","display_name":"Dongjie Wang","orcid":"https://orcid.org/0000-0003-3948-0059"},"institutions":[{"id":"https://openalex.org/I146416000","display_name":"University of Kansas","ror":"https://ror.org/001tmjg57","country_code":"US","type":"education","lineage":["https://openalex.org/I146416000"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dongjie Wang","raw_affiliation_strings":["Institute for Information Sciences, University of Kansas, Lawrence, KS, USA"],"raw_orcid":"https://orcid.org/0000-0003-3948-0059","affiliations":[{"raw_affiliation_string":"Institute for Information Sciences, University of Kansas, Lawrence, KS, USA","institution_ids":["https://openalex.org/I146416000"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110322557","display_name":"Haoyue Bai","orcid":null},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Haoyue Bai","raw_affiliation_strings":["School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5121237674","display_name":"Yanjie Fu","orcid":null},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yanjie Fu","raw_affiliation_strings":["School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA"],"raw_orcid":"https://orcid.org/0000-0002-1767-8024","affiliations":[{"raw_affiliation_string":"School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA","institution_ids":["https://openalex.org/I55732556"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.792,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.92875744,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":96},"biblio":{"volume":"12","issue":"3","first_page":"881","last_page":"892"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.25270000100135803,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.25270000100135803,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.2249000072479248,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.12099999934434891,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.4462999999523163},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.44609999656677246},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.43650001287460327},{"id":"https://openalex.org/keywords/adaptability","display_name":"Adaptability","score":0.4156999886035919},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4113999903202057},{"id":"https://openalex.org/keywords/causal-model","display_name":"Causal model","score":0.36480000615119934},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.361299991607666},{"id":"https://openalex.org/keywords/causal-structure","display_name":"Causal structure","score":0.3562999963760376}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8180999755859375},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4587000012397766},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4462999999523163},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.44609999656677246},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.43650001287460327},{"id":"https://openalex.org/C177606310","wikidata":"https://www.wikidata.org/wiki/Q5674297","display_name":"Adaptability","level":2,"score":0.4156999886035919},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4113999903202057},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.41029998660087585},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3806000053882599},{"id":"https://openalex.org/C11671645","wikidata":"https://www.wikidata.org/wiki/Q5054567","display_name":"Causal model","level":2,"score":0.36480000615119934},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.361299991607666},{"id":"https://openalex.org/C163504300","wikidata":"https://www.wikidata.org/wiki/Q2364925","display_name":"Causal structure","level":2,"score":0.3562999963760376},{"id":"https://openalex.org/C7149132","wikidata":"https://www.wikidata.org/wiki/Q1377840","display_name":"Forgetting","level":2,"score":0.34470000863075256},{"id":"https://openalex.org/C185874996","wikidata":"https://www.wikidata.org/wiki/Q269699","display_name":"Interdependence","level":2,"score":0.3443000018596649},{"id":"https://openalex.org/C207390915","wikidata":"https://www.wikidata.org/wiki/Q1230525","display_name":"Divergence (linguistics)","level":2,"score":0.3375999927520752},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.3330000042915344},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.33219999074935913},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2912999987602234},{"id":"https://openalex.org/C34947359","wikidata":"https://www.wikidata.org/wiki/Q665189","display_name":"Complex network","level":2,"score":0.26759999990463257},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.26649999618530273},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.26499998569488525},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.26350000500679016},{"id":"https://openalex.org/C2780440489","wikidata":"https://www.wikidata.org/wiki/Q5227278","display_name":"Data-driven","level":2,"score":0.2540999948978424}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tbdata.2025.3648314","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tbdata.2025.3648314","pdf_url":null,"source":{"id":"https://openalex.org/S2491400915","display_name":"IEEE Transactions on Big Data","issn_l":"2332-7790","issn":["2332-7790","2372-2096"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Big Data","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.6419914364814758,"id":"https://metadata.un.org/sdg/9"}],"awards":[{"id":"https://openalex.org/G1430917891","display_name":"Collaborative Research: III: Small: Closing Sim-to-Real Gap in Reinforcement Learning via Randomization, Alignment, and Derivation","funder_award_id":"2426340","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3183835427","display_name":"Collaborative Research: III: Small: Advancing Data-Centric AI through Generative Approaches for Feature Space Reconstruction","funder_award_id":"2416727","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3505015339","display_name":"III: Small: Deep Interactive Reinforcement Learning for Self-optimizing Feature Selection","funder_award_id":"2421803","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6215751859","display_name":"CAREER:  Reinforced Imitative Graph Learning: Bridging the Gap between Perception and Prescription in Graph Sequences","funder_award_id":"2421865","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7838372035","display_name":"Collaborative Research: SHF: Small: Decentralized Edge Computing Platform for Privacy-Preserving Mobile Crowdsensing","funder_award_id":"2421864","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0,161],"escalating":[1],"threat":[2],"of":[3,112],"cyberattacks":[4],"on":[5,72,230],"real-time":[6,32,87,143],"critical":[7,232],"infrastructures":[8],"poses":[9],"significant":[10],"risks":[11],"to":[12,27,42,46,84,86,98,100,142,199,219,245],"public":[13],"safety,":[14],"necessitating":[15],"detection":[16,34],"methods":[17,90],"that":[18,77,236],"can":[19],"effectively":[20],"capture":[21],"complex":[22],"system":[23,65,150,175,221],"interdependencies":[24],"and":[25,50,82,108,196,242,249],"adapt":[26,99],"evolving":[28,149,254],"attack":[29,255],"patterns.":[30],"Traditional":[31],"anomaly":[33],"techniques":[35],"often":[36],"produce":[37],"excessive":[38],"false":[39],"positives":[40],"due":[41],"their":[43,96],"statistical":[44],"sensitivity":[45],"high":[47],"data":[48,81,104],"variability":[49],"class":[51],"imbalance.":[52],"To":[53,122],"address":[54],"these":[55,124],"limitations,":[56],"recent":[57],"research":[58],"has":[59],"explored":[60],"modeling":[61],"causal":[62,74,138,155,184,202,226],"relationships":[63],"among":[64],"components.":[66],"However,":[67],"prior":[68,206],"work":[69],"predominantly":[70],"focuses":[71],"offline":[73],"graph-based":[75],"approaches":[76],"require":[78],"static":[79],"historical":[80],"fail":[83],"generalize":[85],"settings.":[88],"These":[89],"are":[91],"fundamentally":[92],"constrained":[93],"by:":[94],"(1)":[95],"inability":[97],"dynamic":[101],"shifts":[102],"in":[103,119,174,179,253],"distribution":[105],"without":[106],"retraining,":[107],"(2)":[109],"the":[110,224],"risk":[111],"catastrophic":[113],"forgetting":[114],"when":[115],"lacking":[116],"timely":[117],"supervision":[118],"live":[120],"systems.":[121],"overcome":[123],"challenges,":[125],"we":[126],"propose":[127],"<bold":[128,166,186,208],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[129,136,167,187,209],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">INCADET</b>,":[130],"a":[131],"novel":[132],"framework":[133,162],"for":[134],"<italic":[135],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">incremental":[137],"graph":[139],"learning</i>":[140],"tailored":[141],"cyberattack":[144],"detection.":[145],"INCADET":[146,237],"dynamically":[147],"captures":[148],"behavior":[151],"by":[152],"incrementally":[153],"updating":[154],"graphs":[156],"across":[157,182],"streaming":[158],"time":[159],"windows.":[160],"comprises":[163],"three":[164],"modules:":[165],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">1)":[168],"Early":[169],"Symptom":[170],"Detection:</b>":[171],"Detects":[172],"transitions":[173],"status":[176,222],"using":[177,223],"divergence":[178],"edge-weight":[180],"distributions":[181],"sequential":[183],"graphs.":[185,227],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">2)":[188],"Incremental":[189],"Causal":[190,211],"Graph":[191,212,215],"Learning:</b>":[192],"Leverages":[193],"experience":[194],"replay":[195],"edge":[197],"reinforcement":[198],"continually":[200],"refine":[201],"structures":[203],"while":[204],"preserving":[205],"knowledge.":[207],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">3)":[210],"Classification:</b>":[213],"Employs":[214],"Convolutional":[216],"Networks":[217],"(GCNs)":[218],"classify":[220],"learned":[225],"Extensive":[228],"experiments":[229],"real-world":[231],"infrastructure":[233],"datasets":[234],"demonstrate":[235],"achieves":[238],"superior":[239],"accuracy,":[240],"robustness,":[241],"adaptability":[243],"compared":[244],"both":[246],"offline,":[247],"online,":[248],"deep":[250],"temporal":[251],"baselines":[252],"scenarios.":[256]},"counts_by_year":[{"year":2025,"cited_by_count":2}],"updated_date":"2026-05-15T06:05:50.897203","created_date":"2025-12-24T00:00:00"}