@inproceedings{malasiCausalGraphWhenCausal2026,

title = {CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems},

author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},

url = {https://www.scopus.com/pages/publications/105037367854?origin=resultslist},

doi = {10.1109/ICCE67443.2026.11449614},

isbn = {0747668X (ISSN); 979-833155343-2 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {Dig Tech Pap IEEE Int Conf Consum Electron},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Modern intrusion detection systems often achieve impressive benchmark accuracy yet fail in real-world deployment, where network behavior and attacker tactics continuously evolve. Under concept drift, decision boundaries learned offline can diverge from operational reality, triggering false-alarm cascades and creating detection blind spots that erode analyst trust. In this paper, we propose CausalGraph-IDS, a causal and language-model-assisted intrusion detection framework that moves beyond purely correlational scoring by explicitly verifying multi-stage attack chains. Additionally, we propose CHAIN-CRC, a unified algorithm that (i) learns a constrained attack-chain causal graph guided by knowledge-based priors derived from widely used adversary behavior taxonomies, (ii) computes robustness scores by testing whether alarms persist under feasible counterfactual security interventions, and (iii) applies conformal risk control to enforce operator-defined false-positive budgets with finite-sample guarantees.Generative models are integrated in strictly assistive roles through three modules: prior induction to distill causal constraints from unstructured threat reports, counterfactual generation to propose realistic and operationally feasible interventions, and causal logic justification to produce human-readable explanations grounded in the learned attack chain. Experiments on two widely used network intrusion detection benchmarks show that CausalGraph-IDS provides robust, explainable, and risk-governed detection, maintaining strong recall at low false-positive rates while delivering actionable causal insights for mitigation. © 2026 IEEE.},

note = {Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron},

keywords = {Alarm systems, Budget control, causal reasoning, Chains, Computer crime, Concept Drift, Concept drifts, Conformal Risk Control, Counterfactuals, Generative AI, Human computer interaction, Intrusion Detection, Intrusion Detection Systems, Intrusion-Detection, Knowledge based systems, Language model, LLM, LLMs, Network intrusion, Network security, Risks controls, Sampling},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{murtaza_trace_2015,

title = {A trace abstraction approach for host-based anomaly detection},

author = {S. S. Murtaza and W. Khreich and A. Hamou-Lhadj and S. Gagnon},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84953310135&doi=10.1109%2fCISDA.2015.7208644&partnerID=40&md5=30e47f711b04bc6c44be9f6daea5ebf1},

doi = {10.1109/CISDA.2015.7208644},

isbn = {978-146737557-3 (ISBN)},

year  = {2015},

date = {2015-01-01},

booktitle = {2015 IEEE Symposium on Computational Intelligence for Security and Defense Applications, CISDA 2015 - Proceedings},

pages = {170–177},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {High false alarm rates and execution times are among the key issues in host-based anomaly detection systems. In this paper, we investigate the use of trace abstraction techniques for reducing the execution time of anomaly detectors while keeping the same accuracy. The key idea is to represent system call traces as traces of kernel module interactions and use the resulting abstract traces as input to known anomaly detection techniques, such as STIDE (the Sequence Time-Delay Embedding) and HMM (Hidden Markov Models). We performed experiments on three datasets, namely, the traditional UNM dataset as well as two modern datasets, Firefox and ADFA-LD. The results show that kernel module traces can lead to similar or fewer false alarms and considerably smaller execution times compared to raw system call traces for host-based anomaly detection systems. © 2015 IEEE.},

note = {Journal Abbreviation: IEEE Symp. Comput. Intell. Secur. Def. Appl., CISDA - Proc.},

keywords = {Abstracting, Abstraction techniques, Alarm systems, Anomaly detection, Anomaly detection systems, Anomaly detector, Artificial intelligence, Chemical detection, Computer programming languages, Distributed computer systems, Errors, Hidden Markov models, Host-based Anomaly Detection System, Markov processes, Signal detection, Software dependability, Software security, System call traces, Time delay, Time delay embedding, Trace analysis, Trace Analysis and Abstraction},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{murtazaTraceAbstractionApproach2015,

title = {A trace abstraction approach for host-based anomaly detection},

author = {S. S. Murtaza and W. Khreich and A. Hamou-Lhadj and S. Gagnon},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84953310135&doi=10.1109%2fCISDA.2015.7208644&partnerID=40&md5=30e47f711b04bc6c44be9f6daea5ebf1},

doi = {10.1109/CISDA.2015.7208644},

isbn = {978-146737557-3 (ISBN)},

year  = {2015},

date = {2015-01-01},

booktitle = {2015 IEEE Symposium on Computational Intelligence for Security and Defense Applications, CISDA 2015 - Proceedings},

pages = {170–177},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {High false alarm rates and execution times are among the key issues in host-based anomaly detection systems. In this paper, we investigate the use of trace abstraction techniques for reducing the execution time of anomaly detectors while keeping the same accuracy. The key idea is to represent system call traces as traces of kernel module interactions and use the resulting abstract traces as input to known anomaly detection techniques, such as STIDE (the Sequence Time-Delay Embedding) and HMM (Hidden Markov Models). We performed experiments on three datasets, namely, the traditional UNM dataset as well as two modern datasets, Firefox and ADFA-LD. The results show that kernel module traces can lead to similar or fewer false alarms and considerably smaller execution times compared to raw system call traces for host-based anomaly detection systems. © 2015 IEEE.},

note = {Journal Abbreviation: IEEE Symp. Comput. Intell. Secur. Def. Appl., CISDA - Proc.},

keywords = {Abstracting, Abstraction techniques, Alarm systems, Anomaly detection, Anomaly detection systems, Anomaly detector, Artificial intelligence, Chemical detection, Computer programming languages, Distributed computer systems, Errors, Hidden Markov models, Host-based Anomaly Detection System, Markov processes, Signal detection, Software dependability, Software security, System call traces, Time delay, Time delay embedding, Trace analysis, Trace Analysis and Abstraction},

pubstate = {published},

tppubtype = {inproceedings}

}