---
title: Dynamical Causality Attack Graph (DCAG)
url: https://www.emergentmind.com/topics/dynamical-causality-attack-graph-dcag
type: topic
---

# Dynamical Causality Attack Graph (DCAG)

Dynamical Causality Attack Graph (DCAG) denotes a class of attack-graph formalisms in which edges encode explicit causal dependencies and the graph is updated over time as attacks propagate, evidence accumulates, or system conditions change. Across the cited literature, DCAG is used in at least three closely related senses: as a physically grounded, time-indexed sequence of Measurement Causality Graphs (MCGs) for false data injection attack detection and localization in power systems [2310.10666]; as a logic-based, ontology-enriched attack graph whose predicates and causal links are continuously updated from monitoring evidence in cyber-physical environments [2202.04016]; and as a temporal, causality-weighted risk propagation model for CTCS-3 train control systems [2509.25786]. A plausible implication is that DCAG is best understood not as a single canonical algorithm, but as a unifying modeling perspective for representing attack progression through directed causal structure with explicit dynamics.

## 1. Conceptual definition and scope

DCAGs are attack graphs whose edges encode causal relations rather than only topological reachability or static dependency. In the ontology-based formulation, a DCAG is described as an attack graph “whose edges encode explicit causal dependencies among actions and system states, and whose structure is continuously updated by evidence from monitoring and semantic enrichment from an ontology of vulnerabilities” [2202.04016]. In the CTCS formulation, DCAG is introduced to represent “multi-staged, causally related, and temporal-dynamic changed attack dependencies” in train control systems [2509.25786]. In the power-system formulation, the paper does not name the model DCAG explicitly, but the time-indexed family of MCGs is interpreted as “a dynamical attack graph where edge weights evolve with system conditions and attacks” [2310.10666].

The “causality” in DCAG varies by domain. In logical cyber attack graphs, causality is represented by Horn-clause entailment and enabling relations between predicates, formalized as
$$
C(a_i, a_j) \equiv (E_i \models P_j),
$$
where the effects of one action satisfy the preconditions of another [2202.04016]. In power systems, causality is extracted from coordinated measurement fluctuations constrained by Ohm’s Law and Kirchhoff’s Laws, with directed edge weights estimated from X-learner conditional average treatment effects (CATEs) [2310.10666]. In CTCS risk assessment, causality is encoded by weighted attack-event propagation and logic gateways, separating “risk trigger” and “spread” through parameters such as $A_{n,k;i,j}$, $a_{n,k;i,j}$, and $r_{n,i}$ [2509.25786].

The “dynamical” aspect likewise takes multiple forms. In ontology-enriched attack graphs, the graph state is updated as
$$
G_t = U(G_{t-1}, E_t, O),
$$
where new monitoring evidence $E_t$ and ontology knowledge $O$ alter predicates, edges, and reachability [2202.04016]. In power systems, dynamics arise from sliding-window construction of a time-indexed graph sequence $\{\mathcal{G}_t\}$ [2310.10666]. In CTCS, dynamics are modeled through explicit time slices $t$ and $t-1$, including self-propagation terms [2509.25786].

## 2. Core representational structure

A DCAG is generally a directed graph with typed nodes and causality-bearing edges. The specific node vocabulary depends on the application domain.

| Formulation | Nodes | Edge semantics |
|---|---|---|
| Power-system DCAG [2310.10666] | Bus-level and line-level measurements | Directed causal influence $j \to i$ with weight $A_{ij} = \bar{\tau}_{j\to i}$ |
| Ontology-enriched logical DCAG [2202.04016] | Logical facts, actions, preconditions, goals, AND/OR nodes | Logical dependency and enabling relation between predicates |
| CTCS DCAG [2509.25786] | Root nodes $B_i$, exploit and extended exploit nodes $X_i$, logic gateways $G_i$ | Weighted causal propagation, conditional attack events, and gateway-mediated combination |

In the power-system interpretation, the graph at time $t$ is
$$
\mathcal{G}_t = (\mathcal{V}, \mathcal{E}_t, A^{(t)}),
$$
where nodes represent measurements such as voltage magnitude, $P/Q$ injections, and $P/Q$ flows; edges are directed and weighted; and weights are window-specific causal strengths estimated via the X-learner [2310.10666]. The resulting graph sequence $\{G_t\}_t$ is the DCAG.

In the logical formalism, the graph is an AND-OR directed graph $G(V; A)$ with predicate logic semantics. Nodes denote facts or actions such as $execCode(h,a)$, $harvestCredentials(h,u)$, and $logOn(h,u)$, while edges denote logical dependency. Representative rules include
$$
execCode(h, a) \rightarrow canAccesHost(h)
$$
and
$$
execCode(h, a) \land hasCredentialsOnMemory(h, u) \rightarrow harvestCredentials(h, u),
$$
with MulVAL Horn clauses realizing these dependencies [2202.04016].

In the CTCS-3 formulation, DCAG contains three node types: root nodes $B_i$ representing attack types or scenarios, exploit nodes and extended exploit nodes $X_i$ representing asset risk states, and logic gateways $G_i$ representing “sum-up relations and conditional sum-up relations” [2509.25786]. The paper distinguishes linkage attack events, conditional attack events, and weighted attack events so that risk trigger and propagation rate are explicitly parameterized.

A plausible implication is that DCAGs replace a purely structural “can reach” view of attack graphs with a “can causally enable or propagate” view, whether the causal relation is logical, statistical, or physically constrained.

## 3. Causal inference and edge construction

In the power-system setting, DCAG edge construction is based on causal strength estimation via the X-learner. For a measurement matrix $Z \in \mathbb{R}^{t \times n}$, a sliding window of width $w$ forms segments $Z_i \in \mathbb{R}^{w \times n}$. For each directed pair $(j,i)$, the framework defines pretreatment covariates $X_i = z_i^0$, a binary treatment $T_i^{(j)}$ indicating whether measurement $j$ increases over the window, and a binary outcome $Y_i^{(i)}$ indicating whether measurement $i$ increases [2310.10666]. The X-learner then estimates CATE through
$$
\mu_1(x) = \mathbb{E}[Y \mid T=1, X=x],\quad \mu_0(x) = \mathbb{E}[Y \mid T=0, X=x],
$$
$$
\tau_1(x) = \mathbb{E}[Y - \mu_0(x) \mid T=1, X=x],\quad \tau_0(x) = \mathbb{E}[\mu_1(x) - Y \mid T=0, X=x],
$$
$$
p(x) = \mathbb{P}(T=1 \mid X=x),\quad \tau(x) = w(x)\tau_0(x) + (1-w(x))\tau_1(x),
$$
with $w(x)=p(x)$ [2310.10666]. Aggregating over segments yields
$$
\bar{\tau}_{j\to i} = \frac{1}{|\mathcal{P}|} \sum_{s \in \mathcal{P}} \hat{\tau}_{j\to i}(X_s),
$$
and the adjacency entry is defined as
$$
A_{ij} = \bar{\tau}_{j\to i}.
$$

This construction is physically constrained. The paper emphasizes that coordinated fluctuations in measurements are constrained by Ohm’s Law and Kirchhoff’s Laws, and that FDIAs locally violate those constraints around targeted buses or lines [2310.10666]. The graph is therefore not merely a correlation graph; it is a directed weighted representation of estimated physical causality among measurements.

In the logical DCAG formulation, edge construction arises from rule firing and ontology-driven post-condition augmentation. The causal relation is encoded in the reuse of effects as downstream preconditions. For example, the rule
$$
logOn(_host, _user) :-
networkServiceInfo(_host, _program, _protocol, _port, _user),
hacl(_host, _h, _protocol, _port),
harvestCredentials(_h, _user).
$$
connects service exposure, network reachability, and harvested credentials to a logon action [2202.04016]. Ontology lookup further adds new predicates such as $reboot(h)$, $systemCrash(h)$, $read(memory,h)$, or $write(memory,h)$ when a CVE’s Logical Impact implies them [2202.04016]. Newly added predicates are causally wired to downstream rules whose bodies contain them.

In the CTCS DCAG, edge construction is parameterized by conditional attack events and causal intensities. For a child event $X_{n,k}$, the paper states:
$$
X_{n,k} = \sum_i (r_{n,i}/r_n)\sum_j A_{n,k;i,j}V_{i,j}.
$$
The corresponding probabilistic reasoning is written as
$$
\operatorname{Pr}\left\{X_{n,k} \mid \bigcap_i V_{i,j_i}\right\}
=
\sum_i (r_{n;i}/r_n)a_{n,k;i,j},
$$
and
$$
x_{n,k} \equiv \operatorname{Pr}\{X_{n,k}\}
=
\sum_i (r_{n;i}/r_n)\sum_j a_{n,k;i,j_i} v_{i,j_i}.
$$
The paper notes that its original typesetting contains minor bracket inconsistencies, but the intended semantics are additive combination of weighted conditional probabilities [2509.25786].

## 4. Temporal evolution and update mechanisms

Temporal updating is central to all DCAG variants. In the power-system formulation, the graph is built over sliding time windows, producing a time-indexed sequence of MCGs. The paper describes “streaming adaptation” by maintaining a sliding window, updating X-learner models online or periodically, recomputing local edge weights for the new window, and updating $A^{(t)}$ [2310.10666]. This makes the DCAG suitable for online monitoring, with dynamics captured by the evolving graph $\{G_t\}$.

In the ontology-based formulation, temporal evolution is driven by evidence ingestion and semantic enrichment. Monitoring alerts provide time-stamped facts such as victim IP, protocol, port, CVE identifiers, and sensor detections, which are matched to graph predicates through facts like $networkServiceInfo(h,s,p,a,u)$ and $vulExists(h,x,y,z)$ [2202.04016]. The update function
$$
U(G, E, O) = G'
$$
adds evidence-derived facts, projects ontology-derived logical impacts, augments edges, removes or disables invalidated edges, and preserves consistency conditions such as canonicalized predicates and AND/OR typing [2202.04016]. The graph state is therefore explicitly time-dependent:
$$
G_t = U(G_{t-1}, E_t, O).
$$

In the CTCS DCAG, temporal propagation is represented through state transitions between $t-1$ and $t$, including self-propagation and contemporaneous parent influences. A representative extended exploit-node equation is
$$
\begin{split}
X_{11',1}^{t}=& \left(\mathrm{r}_{11 ; 14} /r_{11}\right) X_{14,1}^{t} A_{11,1 ; 14, 1}\\
&+\left(r_{11 ; 1} / r_{11}\right) X_{11,2}^{t-1} A_{11,1 ; 1,1} B_{1,1} \\
&+\left(r_{11 ; 2} / r_{11}\right) X_{11,2}^{t-1} A_{11,1 ; 2,1} G_{0,1}
\end{split}
$$
together with
$$
X_{11",1}^{t}=\left(r_{11 ; 11_{t-1}} /r_{11}\right) X_{11,1}^{t-1} A_{11,1 ; 11_{t-1}, 1}.
$$
These equations encode root attacks, gateway-mediated propagation, contemporaneous dependencies, and self-propagation from the previous time slice [2509.25786].

The ontology-based and CTCS formulations both support incremental updating rather than full regeneration. In the logical system, only rules whose bodies intersect the delta facts are re-fired [2202.04016]. In the CTCS system, inference proceeds iteratively over node equations for fixed iteration counts such as 10 or 120 [2509.25786]. This suggests that DCAG dynamics may be event-driven, window-driven, or iteration-driven depending on domain requirements.

## 5. Inference, analytics, and interpretability

DCAGs are not only representational objects; they are also computational substrates for detection, localization, attribution, or risk assessment.

In the power-system formulation, the upper-level analytics module is a Graph Attention Network (GAT) operating on the MCG-derived DCAG. The architecture uses three graph attention layers with $K=3$ heads, takes row $i$ of $A$ as the input feature for node $i$, and masks edges to first-order physical neighbors [2310.10666]. The attention mechanism is defined by
$$
e_{ij} = \text{LeakyReLU}\big(\mathbf{a}^\top [\,\mathbf{W}\mathbf{h}_i \Vert \mathbf{W}\mathbf{h}_j\,] \big),
$$
$$
\alpha_{ij} = \frac{\exp(e_{ij})}{\sum_{k \in \mathcal{N}(i)} \exp(e_{ik})},
$$
with multi-head aggregation and a final layer that averages heads [2310.10666]. Measurement-wise attack probabilities are further mapped to bus-wise probabilities by a three-layer fully connected post-processor. The loss is multi-label cross-entropy over buses:
$$
\mathcal{L} = -\frac{1}{N} \sum_{s=1}^N \sum_{b=1}^{n_{\text{bus}}}
\Big(
y_{sb}\log \hat{y}_{sb} + (1-y_{sb})\log (1-\hat{y}_{sb})
\Big).
$$
Interpretability arises because attention coefficients $\alpha_{ij}$ indicate which causal edges matter for the decision, and the paper states that these patterns align with perturbed MCG substructures [2310.10666].

In ontology-enriched logical DCAGs, inference is rule-based. Predicate reachability determines which attack paths and goals are enabled. Monitoring alerts can confirm exploitation steps, while ontology reasoning adds post-conditions that may shorten the path to a goal or reveal previously unanticipated damage [2202.04016]. The paper’s smart-city case study emphasizes that enriched graphs can reveal shorter acyclic paths to the goal “panic and violence on mass buses,” altering remediation priorities [2202.04016].

In the CTCS framework, inference combines Bayesian-style weighted updates with logic-gateway computation. Logic gateways implement combinational causality using “sum-up” and “conditional sum-up” state expressions rather than standard $p_{AND}/p_{OR}$ formulas [2509.25786]. For example, gateway $G0$ state 1 is given as
$$
A_{0,1;13,1}X_{13,1}+A_{0,2;13,1}X_{13,2}A_{0,1;15,1}X_{15,1},
$$
while gateways $G1$–$G6$ use
$$
\sum_i X_{i,1}
\quad \text{and} \quad
\sum_i X_{i,2}
$$
for their two states [2509.25786]. System-level risk is then aggregated as
$$
\begin{split}
X_{10,1}^{t}=&\frac{1}{9}\bigl(X_{9,1}^{t} +X_{18,1}^{t} +X_{4,1}^{t} +X_{8,1}^{t} + X_{6,1}^{t}\\
&+ X_{5,1}^{t} +X_{17,1}^{t} +X_{7,1}^{t} +X_{16,1}^{t}\bigr).
\end{split}
$$
The nine critical OT components are thus treated as equally weighted contributors to overall CTCS-3 system risk [2509.25786].

A common property across these formulations is interpretability. In logical DCAGs, the explanation is the predicate chain itself [2202.04016]. In power-system DCAGs, interpretation is mediated by causal subgraphs and attention coefficients [2310.10666]. In CTCS DCAGs, interpretation is given by explicit propagation equations, gateway states, and per-asset temporal risk trajectories [2509.25786].

## 6. Domain-specific instantiations and empirical findings

The power-system instantiation evaluates a causality-based FDIA detection and localization framework on the IEEE 39-bus system using 16,500 PSCAD/EMTDC simulations of 5 s at 100 Hz, with an 8:2 training/test split, 50% FDIA prevalence, attack patterns step/ramp/random, magnitudes 0.1%, 0.5%, 1%, 3%, and 5%, and targets consisting of 1–10 randomly selected buses with bias injected to their phase angles [2310.10666]. At 5% attack magnitude, the reported detection performance is Accuracy 0.9976, Precision 0.9866, Recall 0.9971, and F1 0.9898; localization performance is Accuracy 0.9759, Precision 0.8556, Recall 0.9920, and F1 0.9146 [2310.10666]. The paper further reports that when MCGs are used as input, graph-based models improve substantially, with GAT achieving accuracy greater than 98.5% and F1 greater than 0.94 in upper-level comparisons [2310.10666]. It also reports generalizability under operating-point drift, with only approximately 1% F1 drop for the proposed method versus 4–7%+ degradation for correlation-based baselines [2310.10666].

The ontology-based instantiation is validated in a smart-city cyber-physical security scenario with three virtual machines representing a starting device, breach point, and critical asset [2202.04016]. The pipeline combines Nessus Essentials, MulVAL, VDO, Prelude-ELK, Suricata, Rsyslog, and a D3.JS web interface. A representative path involves exploitation of CVE-2019-0708 on RDP over TCP/3389, followed by memory read/write logical impacts, credential harvesting, lateral logon, and downstream operational impact on transportation schedules leading to “massOnBuses” [2202.04016]. The paper states that ontology-driven enrichment adds logical impact nodes such as $reboot(h)$ and $systemCrash(h)$, producing a shorter path to the goal than in the initial graph [2202.04016].

The CTCS-3 instantiation models on-board, trackside, and central subsystems, including RBC, CBI, LEU, Balise, Track Circuit, CTC, TCC, TSR server, BTS, routers, switches, servers, and printers [2509.25786]. Root attack levels are set as $P(B_{1,1}) = 2$ for IT malware, $P(B_{3,1}) = 2$ for OT malware, and $P(B_{2,1}) = 1$, $P(B_{4,1}) = 1$ for IT network and OT wireless attacks [2509.25786]. Temporal self-propagation is set as $P(A_{i,1; i_{t-1}, 1}) = 0.9$, gateway $G0$ propagation probabilities are 0.01, and domain-specific propagation probabilities distinguish central IT, trackside OT, and signal-security cross-protocol links [2509.25786]. The results show that risk propagates faster in the central subsystem than in the trackside subsystem, that wireless attacks produce higher system risk than wired network attacks, and that malware in both IT and OT has more system impact than network or wireless attacks, with OT malware having the largest overall effect [2509.25786]. With functional safety considered for CBI, the overall system risk $X_{10,1}$ remains less than or equal to 0.6 in the long run; without it, the system reaches “totally at security risk” after 120 iterations [2509.25786].

## 7. Relation to adjacent attack-graph paradigms, assumptions, and limitations

DCAG differs from static attack graphs by making time and causal propagation explicit. In the ontology-based comparison, static logical graphs are described as typically built once from scans and lacking post-deployment incorporation of real-time alerts or ontology-derived post-conditions [2202.04016]. In the CTCS comparison, conventional attack graphs are said to lack temporal accumulation, explicit causal intensities, and logic gateways for cycles and multi-stage causality [2509.25786]. The power-system formulation similarly contrasts causal graphs with CNN/LSTM and raw-data GCN methods that learn latent correlations and are brittle under operating-point drift [2310.10666].

Relative to probabilistic or Bayesian graph models, DCAG occupies an intermediate position. The ontology-based work notes that Bayesian or probabilistic graphs represent uncertainty but often require more complex inference and acyclicity constraints, whereas the logical DCAG preserves direct explainability at the cost of not modeling uncertainty explicitly [2202.04016]. The CTCS work instead incorporates Bayesian-style probability updates within a graph that still includes logic gateways and temporal recurrence [2509.25786]. This suggests that “DCAG” is compatible with both deterministic logical inference and weighted probabilistic propagation, provided causality and temporal evolution remain first-class modeling elements.

Several assumptions recur across the literature. The power-system approach assumes local stationarity within windows, synchronized measurements of sufficient quality, moderate Gaussian noise, and adequacy of linear/logistic base models under the chosen trend abstraction [2310.10666]. The ontology-enriched approach assumes deterministic causality and reliable alerts, as well as ontology coverage for relevant CVEs and impacts [2202.04016]. The CTCS framework depends on expert or empirical parameterization of propagation probabilities and causal intensities and does not report formal convergence criteria or exact computational complexity [2509.25786].

The principal limitations also vary by domain. In power systems, residual confounding, weak causal signals, sophisticated multi-measurement adversaries, and real-system idiosyncrasies outside EMT simulations may degrade robustness [2310.10666]. In ontology-enriched DCAGs, partial observability, alert false positives, and lack of native probabilistic and temporal-logic machinery remain limitations [2202.04016]. In CTCS DCAGs, the absence of a general risk-equals-probability-times-impact metric, the need for parameter calibration, and the use of fixed iteration counts rather than formal convergence testing constrain interpretability and transferability [2509.25786].

Taken together, these formulations indicate that DCAG is a general framework for attack reasoning in which directed causal structure evolves over time and supports online detection, localization, attribution, or risk propagation analysis. This suggests that the central intellectual contribution of DCAG lies less in a single standardized data structure than in a modeling discipline: causal edges must correspond to domain-meaningful enabling or propagation mechanisms, and the graph must be updated as evidence, state, or operating conditions change.

Source: https://www.emergentmind.com/topics/dynamical-causality-attack-graph-dcag