Multi-view Causal Graph Fusion Based Anomaly Detection in Cyber-Physical Infrastructures

The rise in cyber attacks on cyber-physical critical infrastructures, like water treatment networks, is evidenced by the growing frequency of breaches and the evolving sophistication of attack methods. Attack detection in such vulnerable critical infrastructures can be generalized into a task of anomaly detection with multivariate stream data. There are two essential challenges of this task: 1) Evolving and Shifting data streams; and 2) Robust Attack Pattern representation. Existing anomaly detection approaches, including statistical, distance, density, neural network, and graph-based methods, are not specialized in solving the spurious statistical relationships of evolving distribution shifts in sensing data streams. To address the two challenges, we propose a multi-view causal graph perspective, where 1) We build causal graphs to capture invariant anomaly patterns in varying streams; and 2) Introduce multi-view fusion for robust attack pattern representation. To implement this technical perspective, we develop a fused multi-view causal graph-aware anomaly detection framework. This framework includes two phases: 1) Multi-view Causal Graphs and Spectral Fusion, where we learn the dense view and sparse view causal graphs from sensory data streams and fuse the two causal graphs into a single weighted Laplacian matrix representation. 2) Graph Anomaly Detection, where we train a Deep Convolutional Graph Neural Network (DGCNN) on the Laplacian representation of the "Attack" and "Normal" status graphs to detect attack statuses on sensory data streams per time interval. Our framework achieves a ROC-Score of 82.4% and 93.2% on the SWaT and WADI Water Treatment Network Datasets with an improvement of 9.03% and 16.5% on the f1-score respectively when compared with the best-performing baseline methods on both the datasets.