Causality-guided counterfactual debiasing for anomaly detection of cyber-physical systems
Abstract
Machine learning has become a promising technology for anomaly detection of cyber-physical systems (CPSs). However, the trained anomaly detection models always suffer from bias due to the scarcity of anomaly data in CPSs and the biased data collection process, which may poison the models' generalization ability. Recent debiasing methods are proposed to deal with the bias via resampling the training dataset, reweighting during the training phase, or adjusting the classification threshold. However, they may lose valuable information, need extra knowledge of the models, or lead to overfitting. Especially, they lack a causal understanding of the debiasing process, so they cannot point out the source and propagation of the bias and, thus, cannot deal with it in an explainable way. In this article, we propose a counterfactual debiasing framework to mitigate the bias in a well-trained model. First, we formalize the model's training and inference processes using causal graphs. Thus, we can understand the source and propagation of the model's bias through causal inference. Then, we use counterfactual inference to estimate the bias's detrimental causal effect on the prediction and remove it from the total causal effect. Therefore, we can conduct unbiased inferences with a biased model. The proposed method can remove the bias in an explainable way by incorporating causal graphs. Comprehensive experiments are conducted on seven real-world CPS datasets, i.e., IDA, MFP, ACS, SPF, UNS, NSL, and ICS. The results demonstrate the effectiveness, compatibility, and unbiasedness of the proposed approach.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Across all seven datasets, Li et al. [124]'s method achieved an average F1-score above 91%, improving both detection accuracy and process consistency compared to single time-series models.
“Across all seven datasets, their method achieved an average F1-score above 91%, improving both detection accuracy and process consistency compared to single time-series models.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [124]
Li et al. [124] proposed a causality-guided counterfactual debiasing method to mitigate detection errors caused by data bias, using seven real-world CPS datasets.
“Li et al. [124] proposed a causality-guided counterfactual debiasing method to mitigate detection errors caused by data bias, using seven real-world CPS datasets (IDA, MFP, ACS, SPF, UNS, NSL, ICS).”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [124]
Li et al. [124]'s hybrid data-based approach jointly models the causal structure between the cyber layer and the physical layer, and uses counterfactual samples generated from a Structural Causal Model (SCM) to remove non-causal correlations.
“Their hybrid data-based approach jointly models the causal structure between the cyber layer (control commands, network events) and the physical layer (process time series), and uses counterfactual samples generated from a Structural Causal Model (SCM) to remove non-causal correlations.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [124]
Several hybrid data fusion frameworks are designed to operate across multiple datasets and domains by providing generic pipelines for heterogeneous feature processing and multi-modal fusion, rather than redesigning ad hoc detectors for each individual system.
“Second, several frameworks are designed to operate across multiple datasets and domains by providing generic pipelines for heterogeneous feature processing and multi-modal fusion, rather than redesigning ad hoc detectors for each individual system [124,129,131].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [124]
Many hybrid data fusion-based anomaly detection approaches explicitly synchronize cyber-layer events with physical-layer behavior on a common time axis to detect cyber-physical inconsistencies that single-domain detectors would miss.
“First, many approaches explicitly synchronize cyber-layer events with physical-layer behavior on a common time axis to detect cyber-physical inconsistencies that single-domain detectors would miss [122-129].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [124]
Cites
Causality: Models, Reasoning, and Inference
Pearl, J. (2009) · doi:10.1017/cbo9780511803161 · Cited by 11,653 · see citing works
(2017) · International Conference on Machine Learning · Cited by 6,382 · see citing works
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · see citing works
Moustafa, N., & Slay, J. (2015) · 2015 Military Communications and Information Systems Conference (MilCIS) · doi:10.1109/milcis.2015.7348942 · Cited by 4,033 · see citing works
Survey on deep learning with class imbalance
Johnson, J. M., & Khoshgoftaar, T. M. (2019) · Journal of Big Data · doi:10.1186/s40537-019-0192-5 · Cited by 3,032 · see citing works
Pearl, J. (2022) · ACM eBooks · doi:10.1145/3501714.3501736 · Cited by 1,039 · see citing works
Revisiting Deep Learning Models for Tabular DataPreprint
Gorishniy, Y., Rubachev, I., Khrulkov, V., & Babenko, A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.11959 · Cited by 531 · see citing works
Counterfactual VQA: A Cause-Effect Look at Language Bias
Niu, Y., Tang, K., Zhang, H., Lu, Z., Hua, X., & Wen, J.-R. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01251 · Cited by 448 · see citing works
An instance level analysis of data complexity
Smith, M. R., Martinez, T. R., & Giraud-Carrier, C. G. (2013) · Machine Learning · doi:10.1007/s10994-013-5422-z · Cited by 441 · see citing works
Model-Agnostic Counterfactual Reasoning for Eliminating Popularity Bias in Recommender System
Wei, T., Feng, F., Chen, J., Wu, Z., Yi, J., & He, X. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467289 · Cited by 325 · see citing works
Self-paced Ensemble for Highly Imbalanced Massive Data Classification
Liu, Z., Cao, W., Gao, Z., Bian, J., Chen, H., Chang, Y., & Liu, T.-Y. (2020) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde48307.2020.00078 · Cited by 235 · see citing works
A fast network intrusion detection system using adaptive synthetic oversampling and LightGBM
Liu, J., Gao, Y., & Hu, F. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102289 · Cited by 231 · see citing works
Self-citationDigital Twin-driven Online Anomaly Detection for an Automation System Based on Edge Intelligence
Huang, H., Yang, L., Wang, Y., Xu, X., & Lu, Y. (2021) · Journal of Manufacturing Systems · doi:10.1016/j.jmsy.2021.02.010 · Cited by 183 · see citing works
Pan, S., Morris, T., & Adhikari, U. (2015) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2015.2420951 · Cited by 180 · see citing works
Gupta, N., Jindal, V., & Bedi, P. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102499 · Cited by 166 · see citing works
Kong, F., Li, J., Jiang, B., Wang, H. H., & Song, H. H. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3078192 · Cited by 144 · see citing works
FaultNet: A Deep Convolutional Neural Network for Bearing Fault Classification
Magar, R., Ghule, L., Li, J., Zhao, Y. S., & Farimani, A. B. (2021) · IEEE Access · doi:10.1109/access.2021.3056944 · Cited by 124 · see citing works
Feng, C., & Tian, P. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467137 · Cited by 112 · see citing works
Synthetic Oversampling with the Majority Class: A New Perspective on Handling Extreme Imbalance
Sharma, S., Bellinger, C., Krawczyk, B., Zai͏̈ane, O. R., & Japkowicz, N. (2018) · Proceedings · doi:10.1109/icdm.2018.00060 · Cited by 103 · see citing works
Smart I/O Modules for Mitigating Cyber-Physical Attacks on Industrial Control Systems
Pearce, H. A., Pinisetty, S., Roop, P. S., Kuo, M. M. Y., & Ukil, A. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2945520 · Cited by 83 · see citing works
Detecting web attacks using random undersampling and ensemble learners
Zuech, R., Hancock, J., & Khoshgoftaar, T. M. (2021) · Journal Of Big Data · doi:10.1186/s40537-021-00460-8 · Cited by 79 · see citing works
Counterfactual Inference for Text Classification Debiasing
Chen, Q., Feng, F., Wen, L., Ma, C., & Xie, P. (2021) · doi:10.18653/v1/2021.acl-long.422 · Cited by 78 · see citing works
Improving the prediction of continuous integration build failures using deep learning
Saidani, I., Ouni, A., & Mkaouer, M. W. (2022) · Automated Software Engineering · doi:10.1007/s10515-021-00319-5 · Cited by 75 · see citing works
A Novel QKD Approach to Enhance IIOT Privacy and Computational Knacks
Singamaneni, K. K., Dhiman, G., Juneja, S., Muhammad, G., AlQahtani, S. A., & Zaki, J. F. W. (2022) · Sensors · doi:10.3390/s22186741 · Cited by 66 · see citing works
A Transparent Framework for Evaluating Unintended Demographic Bias in Word Embeddings
Sweeney, C., & Najafian, M. (2019) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/p19-1162 · Cited by 58 · see citing works
Fairness-aware Adversarial Perturbation Towards Bias Mitigation for Deployed Deep Models
Wang, Z., Dong, X., Xue, H., Zhang, Z., Chiu, W., Wei, T., & Ren, K. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01013 · Cited by 58 · see citing works
Ruan, J., Fan, G., Zhu, Y., Liang, G., Zhao, J., Wen, F., & Dong, Z. Y. (2023) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2023.3241268 · Cited by 50 · see citing works
Robust Cyber-Physical System Enabled Smart Healthcare Unit Using Blockchain Technology
Rupa, C., Srivastava, G., Nagasree, Y., Ponugumati, A., & Ramachandran, S. (2022) · Electronics · doi:10.3390/electronics11193070 · Cited by 41 · see citing works
An empirical study of dynamic selection and random under-sampling for the class imbalance problem
Liu, S. M., Chen, J.-H., & Liu, Z. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.119703 · Cited by 33 · see citing works
X-MAN: Explaining multiple sources of anomalies in video
Szymanowicz, S., Charles, J., & Cipolla, R. (2021) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw53098.2021.00360 · Cited by 27 · see citing works
Group-Aware Threshold Adaptation for Fair Classification
Jang, T., Shi, P., & Wang, X. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i6.20657 · Cited by 26 · see citing works
Counterfactual Debiasing Inference for Compositional Action Recognition
Sun, P., Wu, B., Li, X., Li, W., Duan, L., & Gan, C. (2021) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3474085.3475472 · Cited by 25 · see citing works
Full-Loop AoI-Based Joint Design of Control and Deterministic Transmission for Industrial CPS
Lu, X., Xu, Q., Wang, X., Lin, M., Chen, C., Shi, Z., & Guan, X. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3241590 · Cited by 22 · see citing works
A Signature-Based Assistant Random Oversampling Method for Malware Detection
Pang, Y., Chen, Z., Peng, L., Ma, K., Zhao, C., & Ji, K. (2019) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2019.00042 · Cited by 20 · see citing works
Evidential Combination of Classifiers for Imbalanced Data
Niu, J., Liu, Z., Lu, Y. P., & Wen, Z. (2022) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2022.3162258 · Cited by 15 · see citing works
Inzamam-Ul-Hossain, M., & Islam, M. R. (2023) · IEEE Transactions on Computational Biology and Bioinformatics · doi:10.1109/tcbb.2022.3233473 · Cited by 15 · see citing works
CSSG: A cost‐sensitive stacked generalization approach for software defect prediction
Eivazpour, Z., & Keyvanpour, M. R. (2021) · Software Testing Verification and Reliability · doi:10.1002/stvr.1761 · Cited by 14 · see citing works
An Accuracy Network Anomaly Detection Method Based on Ensemble Model
Liu, F., Li, X., Xiong, W., Jiang, H., & Xie, G. (2021) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp39728.2021.9414675 · Cited by 9 · see citing works
Cyber-Physical Systems in Transportation
He, Y., Jolfaei, A., & Zheng, X. (2021) · Internet of things · doi:10.1007/978-3-030-92054-8_8 · Cited by 4 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A GNN-Based False Data Detection Scheme for Smart Grids
Qiu, J., Zhang, X., Wang, T., Hou, H., Wang, S., & Yang, T. (2025) · Algorithms · doi:10.3390/a18030166 · Cited by 17 · see citing works
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Fink, O., Sharma, V., Nejjar, I., Krannichfeldt, L. V., Garmaev, S., Zhang, Z., Wei, A., Frusque, G., Forest, F., Zhao, M., et al. (2026) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2026.112213 · Cited by 10 · see citing works
Meli, D. (2024) · IEEE International Conference on Automation Science and Engineering (CASE) · doi:10.1109/case59546.2024.10711445 · Cited by 9 · see citing works
“Differently from mixed causal-neural architectures [14], we use state-of-the-art PCMCI algorithm [15] to learn normal causal links, and propose a novel OUAD algorithm to estimate causal correlation during real-time acquisition of sensor data.”
MethodZhang, T., Zhu, Y., Wu, B., Zheng, C., Tan, J., & Xiong, Z. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107314 · Cited by 7 · see citing works
Tian, J., Li, M., Fang, L., & Chen, L. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3588674 · Cited by 8 · see citing works
“…methods, which are primarily categorized into three main types by training mode: supervised learning methods [10], [11], [36], [37], [38], [39], unsupervised learning methods [6], [7], [8], [9], [26], [40], [41], [42], [43], [44], and self-supervised learning methods [13], [14], [15], [45].”
DDoS attack on wireless cyber–physical systems: A Stackelberg game approach
Peng, L., Yi, Y., & Ji, Z. (2025) · Communications in Nonlinear Science and Numerical Simulation · doi:10.1016/j.cnsns.2025.108945 · Cited by 7 · see citing works
Counterfactual graph convolution with quantified discrepancies for fraud detection
Zhang, J., Man, X., Zhao, H., & Ni, L. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.129281 · Cited by 4 · see citing works
Counterfactual Covariate Causal Discovery on Nonlinear Extremal Quantiles
Yin, T., Chen, H., Huang, D., & Wang, H. (2024) · IEEE Transactions on Instrumentation and Measurement · doi:10.1109/tim.2024.3488141 · Cited by 3 · see citing works
DGCDN: robust acoustic fault diagnosis via domain-generalized causal disentanglement
Wei, Z., Zhai, R., & Su, C. (2025) · Measurement Science and Technology · doi:10.1088/1361-6501/ae252d · Cited by 1 · see citing works
Alkhamis, S. A., Alhalangy, A., Eltayeb, G. E. A., & Abouelkheir, E. (2026) · Symmetry · doi:10.3390/sym18081292 · Cited by 1 · see citing works
“As a result, they may detect anomalous patterns but cannot directly model subsystem dependency violations, a challenge increasingly highlighted in cyber-physical anomaly detection research [16,17].”
InfluentialFormal Modeling and Quantitative Evaluation for Online Monitoring Systems in Nuclear Facilities
Fang, L., Tang, W., Wang, X., Liu, J. P., & Wang, S. (2025) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc58881.2025.11343677
“Given the real-time and responsive control logic and flow in the online monitoring systems [9], a modeling language capable of formalizing control flow should be developed to facilitate the safety verification of such systems.”
Self-citationJiang, H., You, J., Shi, J., Chen, Z., Gou, H., Ming, X., & Sun, P. Z. H. (2026) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2026.3689196
“On the other hand, causal application studies [12], [13], [14], [15], [16], [17] assume a reliable CKG is available and use it as prior knowledge to enhance downstream tasks [18], [19].”
Al-Hija’a, A. A., Szekeres, B. J., & Andó, M. (2026) · The International Journal of Advanced Manufacturing Technology · doi:10.1007/s00170-026-18904-x
CAL-IoT: A Causal Attention Framework for Robust and Explainable Intrusion Detection in IoT Networks
Sun, L., Li, J., Li, M., Ma, J., Sun, R., Sun, H., & Wang, X. (2026) · IEEE International Conference on Smart Internet of Things (SmartIoT) · doi:10.1109/smartiot70864.2026.00057
“…use causal effect analysis to filter spurious features [17]; Chen et al. cast cross-domain industrial intrusion detection as causal domain adaptation [18]; and Tang et al. introduce a counterfactual debiasing framework that corrects class-imbalance bias in cyber-physical anomaly detection [19].”
- Authors
- Tang, W., Liu, J., Zhou, Y., & Ding, Z.
- Affiliations
- Shanghai Key Laboratory of Trustworthy Computing (CN)
- Nanyang Technological University (SG)
- Zhejiang Sci-Tech University (CN)
- Venue
- IEEE Transactions on Industrial Informatics
- Published
- 2024-03
- Volume
- 20
- Issue
- 3
- Pages
- 4582-4593
- ISSN
- 1551-3203 (ISSN-L)
- 1941-0050
- OpenAlex
- W4388145615
- Cited by
- 16
- References
- 39
- Citations by year
- 2026: 6 · 2025: 8 · 2024: 2
- FWCI
- 1.50
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Industrial Informatics (publishedVersion)
- DR-NTU (Nanyang Technological University) (submittedVersion)
- Funders
- National Key Research and Development Program of China (2022YFC3302600)
- National Natural Science Foundation of China (61972150, 62132014)
- Central University Basic Research Fund of China
- Ministry of Education - Singapore (MOET2EP20120-0004)
- Zhejiang Provincial Key Research and Development Program of China (2022C01045)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- anomaly detection, cyber-physical systems, model bias, causal graphs, counterfactual inference, data scarcity, industrial control systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
