Automated Root Cause Analysis of Security Incidents Using Causal Machine Learning

Abstract Security incident investigation requires distinguishing an initiating mechanism from downstream symptoms. An unusual event may be statistically predictive of an incident without being the mechanism that generated it. This study evaluates a transparent causal machine learning procedure that ranks standardised mechanism residuals in a supplied structural causal graph. A six-variable linear structural model represents abstract access, policy, execution, privilege, movement and impact signals. Across 30 independently seeded replications, each containing 2,000 normal training observations and 600 synthetic incidents, a four-unit innovation shift is injected into one of three candidate mechanisms. Five mechanisms are ranked, including two downstream distractors. Marginal anomaly scoring is compared with residual scoring under the correct graph and under deletion of one generating edge. Additional experiments vary independent sensor noise from zero to twice the innovation standard deviation. Without sensor noise, mean top-one accuracy is 98.41% for residual scoring under the supplied correct graph, 86.66% for marginal scoring and 94.26% after edge deletion. At a sensor noise standard deviation of one, these values decline to 80.63%, 61.64% and 75.33%, respectively. A simulator-based repair check confirms that reversing the injected innovation removes most of the mean impact shift. These results validate the implementation under favourable, explicitly stated assumptions; they do not demonstrate causal discovery, effectiveness on operational incident records or readiness for autonomous containment. The contribution is a reproducible methodological study that separates mechanism localisation, graph dependence and counterfactual validation in security incident analysis.