The escalating threat of cyberattacks on real-time critical infrastructures poses significant risks to public safety, necessitating detection methods that can effectively capture complex system interdependencies and adapt to evolving attack patterns. Traditional real-time anomaly detection techniques often produce excessive false positives due to their statistical sensitivity to high data variability and class imbalance. To address these limitations, recent research has explored modeling causal relationships among system components. However, prior work predominantly focuses on offline causal graph-based approaches that require static historical data and fail to generalize to real-time settings. These methods are fundamentally constrained by: (1) their inability to adapt to dynamic shifts in data distribution without retraining, and (2) the risk of catastrophic forgetting when lacking timely supervision in live systems. To overcome these challenges, we proposeINCADET, a novel framework forincremental causal graph learningtailored to real-time cyberattack detection. INCADET dynamically captures evolving system behavior by incrementally updating causal graphs across streaming time windows. The framework comprises three modules:1) Early Symptom Detection:Detects transitions in system status using divergence in edge-weight distributions across sequential causal graphs.2) Incremental Causal Graph Learning:Leverages experience replay and edge reinforcement to continually refine causal structures while preserving prior knowledge.3) Causal Graph Classification:Employs Graph Convolutional Networks (GCNs) to classify system status using the learned causal graphs. Extensive experiments on real-world critical infrastructure datasets demonstrate that INCADET achieves superior accuracy, robustness, and adaptability compared to both offline, online, and deep temporal baselines in evolving attack scenarios.

In real-world applications, domain data often contains identifiable or sensitive attributes, is subject to strict regulations (e.g., HIPAA, GDPR), and requires explicit data feature engineering for interpretability and transparency. Existing feature engineering primarily focuses on advancing downstream task performance, often risking privacy leakage. We generalize this learning task under such new requirements as Privacy-Preserving Data Reprogramming (PPDR): given a dataset, transforming features to maximize target attribute prediction accuracy while minimizing sensitive attribute prediction accuracy. PPDR poses challenges for existing systems: 1) generating high-utility feature transformations without being overwhelmed by a large search space, and 2) disentangling and eliminating sensitive information from utility-oriented features to reduce privacy inferability. To tackle these challenges, we propose DELTA, a two-phase variational disentangled generative learning framework. Phase I uses policy-guided reinforcement learning to discover feature transformations with downstream task utility, without any regard to privacy inferability. Phase II employs a variational LSTM seq2seq encoder-decoder with a utility-privacy disentangled latent space design and adversarial-causal disentanglement regularization to suppress privacy signals during feature generation. Experiments on eight datasets show DELTA improves predictive performance by ~ 9.3% and reduces privacy leakage by ~ 35%, demonstrating robust, privacy-aware data transformation. The code repository is available at https://github.com/arunvignesh28/DELTA-PGFT.

The rise in cyber attacks on cyber-physical critical infrastructures, like water treatment networks, is evidenced by the growing frequency of breaches and the evolving sophistication of attack methods. Attack detection in such vulnerable critical infrastructures can be generalized into a task of anomaly detection with multivariate stream data. There are two essential challenges of this task: 1) Evolving and Shifting data streams; and 2) Robust Attack Pattern representation. Existing anomaly detection approaches, including statistical, distance, density, neural network, and graph-based methods, are not specialized in solving the spurious statistical relationships of evolving distribution shifts in sensing data streams. To address the two challenges, we propose a multi-view causal graph perspective, where 1) We build causal graphs to capture invariant anomaly patterns in varying streams; and 2) Introduce multi-view fusion for robust attack pattern representation. To implement this technical perspective, we develop a fused multi-view causal graph-aware anomaly detection framework. This framework includes two phases: 1) Multi-view Causal Graphs and Spectral Fusion, where we learn the dense view and sparse view causal graphs from sensory data streams and fuse the two causal graphs into a single weighted Laplacian matrix representation. 2) Graph Anomaly Detection, where we train a Deep Convolutional Graph Neural Network (DGCNN) on the Laplacian representation of the "Attack" and "Normal" status graphs to detect attack statuses on sensory data streams per time interval. Our framework achieves a ROC-Score of 82.4% and 93.2% on the SWaT and WADI Water Treatment Network Datasets with an improvement of 9.03% and 16.5% on the f1-score respectively when compared with the best-performing baseline methods on both the datasets.