Causal Graph-Based Root Cause Analysis for ICS Sensor Streams

This paper presents an unsupervised framework for root cause analysis in industrial control systems (ICS) by learning causal graphs from sensor data. Leveraging real-world measurements from the HAI testbed, the proposed method discovers directed acyclic structures that capture inter-sensor dependencies and identifies potential root causes through structural centrality metrics. Experimental results demonstrate that the learned causal graphs provide interpretable insights into system behavior and enable effective identification of influential sensors, highlighting the framework's applicability to critical infrastructure monitoring and protection.