@inproceedings{attoumiCausalGraphModeling2026,

title = {Causal Graph Modeling of Network Traffic for Early Cyberattack Prediction},

author = {H. Attoumi and E. G. Tajeuna and M. S. Allili},

editor = {Al-Mallah R. and Cuppens F. and Ayed S. and Sailhan F. and Garcia-Alfaro J.},

url = {https://www.scopus.com/pages/publications/105040543052?origin=resultslist},

doi = {10.1007/978-3-032-20026-6_10},

isbn = {03029743 (ISSN); 978-303220025-9 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {Lect. Notes Comput. Sci.},

volume = {16403 LNCS},

pages = {167–183},

publisher = {Springer Science and Business Media Deutschland GmbH},

abstract = {We propose a causal-graph forecasting framework for early cyberattack prediction that integrates causal network modeling with dynamic bipartite graph–based time series forecasting. Our method captures both the cause–effect structure of network traffic and the co-evolving, non-stationary dynamics of attack-related signals. Network entities are represented as nodes, while edges encode directional causal influences inferred from traffic flows. To model evolving dependencies, we approximate each traffic series over contiguous intervals with parametric functions and construct temporal bipartite graphs that link these models to time series, revealing shared latent patterns and context-driven relationships. This hybrid representation enables adaptive model selection and accurate forecasting of malicious behavior before it escalates. Experiments on benchmark of network traces show that our approach delivers early, interpretable, and highly accurate cyberattack predictions. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.},

note = {Journal Abbreviation: Lect. Notes Comput. Sci.},

keywords = {Attack prediction, Bipartite graphs, Causal graph, Causal network, Co-evolving time series, Cyber-attacks, Forecasting, Graph model, Graph Neural Networks, Graph theory, Network traffic, Prediction models, Time series, Times series},

pubstate = {published},

tppubtype = {inproceedings}

}