标题： 重新思考时空异常检测：一种因果驱动的网络安全愿景 显示英文标题

标题： Rethinking Spatio-Temporal Anomaly Detection: A Vision for Causality-Driven Cybersecurity

摘要： 随着网络物理系统日益互联和空间分布，确保其在不断演变的网络攻击下的弹性已成为关键优先事项。时空异常检测在确保系统安全和操作完整性方面发挥着重要作用。然而，当前的数据驱动方法，主要由黑盒深度学习推动，在可解释性、对分布变化的适应性以及在不断变化的系统动态下的鲁棒性方面面临挑战。在本文中，我们倡导一种因果学习视角，以推进空间分布式基础设施中的异常检测，该视角将检测建立在结构因果关系之上。我们确定并形式化了三个关键方向：因果图分析、多视图融合和持续因果图学习，每个方向在揭示时间和空间上的动态因果结构方面都具有独特优势。基于来自如水处理基础设施等现实系统的见解，我们展示了因果模型如何提供早期预警信号和根本原因归因，解决了黑盒检测器的局限性。展望未来，我们概述了以多模态、生成式AI驱动和可扩展自适应因果框架为中心的未来研究议程。我们的目标是为可扩展、自适应、可解释和空间基础的异常检测系统奠定新的研究轨迹。我们希望激发网络安全研究范式的转变，推动因果驱动的方法来应对互联基础设施中的演变威胁。 显示英文摘要

摘要： As cyber-physical systems grow increasingly interconnected and spatially distributed, ensuring their resilience against evolving cyberattacks has become a critical priority. Spatio-Temporal Anomaly detection plays an important role in ensuring system security and operational integrity. However, current data-driven approaches, largely driven by black-box deep learning, face challenges in interpretability, adaptability to distribution shifts, and robustness under evolving system dynamics. In this paper, we advocate for a causal learning perspective to advance anomaly detection in spatially distributed infrastructures that grounds detection in structural cause-effect relationships. We identify and formalize three key directions: causal graph profiling, multi-view fusion, and continual causal graph learning, each offering distinct advantages in uncovering dynamic cause-effect structures across time and space. Drawing on real-world insights from systems such as water treatment infrastructures, we illustrate how causal models provide early warning signals and root cause attribution, addressing the limitations of black-box detectors. Looking ahead, we outline the future research agenda centered on multi-modality, generative AI-driven, and scalable adaptive causal frameworks. Our objective is to lay a new research trajectory toward scalable, adaptive, explainable, and spatially grounded anomaly detection systems. We hope to inspire a paradigm shift in cybersecurity research, promoting causality-driven approaches to address evolving threats in interconnected infrastructures.