Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Domain-Adapted Granger Causality for Real-Time Cross-Slice Attack Attribution in 6G Networks

Minh K. Quan, Pubudu N. Pathirana

TL;DR

This work tackles cross-slice attack attribution in 6G networks, where shared infrastructure creates confounding correlations that hinder causal attribution. It introduces a domain-adapted Granger causality framework that conditions on resource states and explicitly models resource contention, supported by theoretical guarantees and a real-time algorithm. Key contributions include formal problem formulation, a resource-aware extension to Granger causality with identifiable causal paths and FDR control, and extensive evaluation on a production-grade 6G testbed achieving $89.2\%$ accuracy with $<100\mathrm{ms}$ latency. The approach yields interpretable causal explanations for autonomous security orchestration, enabling timely and reliable attribution in complex, multi-slice environments.

Abstract

Cross-slice attack attribution in 6G networks faces the fundamental challenge of distinguishing genuine causal relationships from spurious correlations in shared infrastructure environments. We propose a theoretically-grounded domain-adapted Granger causality framework that integrates statistical causal inference with network-specific resource modeling for real-time attack attribution. Our approach addresses key limitations of existing methods by incorporating resource contention dynamics and providing formal statistical guarantees. Comprehensive evaluation on a production-grade 6G testbed with 1,100 empirically-validated attack scenarios demonstrates 89.2% attribution accuracy with sub-100ms response time, representing a statistically significant 10.1 percentage point improvement over state-of-the-art baselines. The framework provides interpretable causal explanations suitable for autonomous 6G security orchestration.

Domain-Adapted Granger Causality for Real-Time Cross-Slice Attack Attribution in 6G Networks

TL;DR

This work tackles cross-slice attack attribution in 6G networks, where shared infrastructure creates confounding correlations that hinder causal attribution. It introduces a domain-adapted Granger causality framework that conditions on resource states and explicitly models resource contention, supported by theoretical guarantees and a real-time algorithm. Key contributions include formal problem formulation, a resource-aware extension to Granger causality with identifiable causal paths and FDR control, and extensive evaluation on a production-grade 6G testbed achieving accuracy with latency. The approach yields interpretable causal explanations for autonomous security orchestration, enabling timely and reliable attribution in complex, multi-slice environments.

Abstract

Cross-slice attack attribution in 6G networks faces the fundamental challenge of distinguishing genuine causal relationships from spurious correlations in shared infrastructure environments. We propose a theoretically-grounded domain-adapted Granger causality framework that integrates statistical causal inference with network-specific resource modeling for real-time attack attribution. Our approach addresses key limitations of existing methods by incorporating resource contention dynamics and providing formal statistical guarantees. Comprehensive evaluation on a production-grade 6G testbed with 1,100 empirically-validated attack scenarios demonstrates 89.2% attribution accuracy with sub-100ms response time, representing a statistically significant 10.1 percentage point improvement over state-of-the-art baselines. The framework provides interpretable causal explanations suitable for autonomous 6G security orchestration.

Paper Structure

This paper contains 12 sections, 2 theorems, 5 equations, 5 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Domain-Adapted Granger Causality Framework
  3. Problem Formulation and Core Method
  4. Theoretical Guarantees
  5. Experimental Evaluation
  6. Industrial Case Study
  7. Limitations, Ethics, and Reproducibility
  8. Conclusion
  9. Appendix
  10. Parameter Learning Details
  11. Extended Experimental Details
  12. Comprehensive Performance Analysis

Key Result

Theorem 1

Under weak stationarity and regularity conditions, the enhanced F-statistic $F_{X \rightarrow Y|Z} = \frac{(RSS_R - RSS_U)/q}{RSS_U/(T-p-q-K-1)}$ follows asymptotic $F(q, T-p-q-K-1)$ distribution under $H_0: \beta_j = 0, \forall j$, enabling principled hypothesis testing.

Figures (5)

  • Figure 1: Framework overview: Telemetry from $N$ slices processed through Enhanced Granger Causality and Resource Contention Model to extract attack paths $\mathcal{C}^*$.
  • Figure 2: Performance comparison showing our method (blue) achieves highest accuracy while meeting real-time requirements (<100ms).
  • Figure 3: Scalability and Performance as a Function of Network Size ($N$).
  • Figure 4: Industrial IoT attack case study: detected causal chain (top) and resource impact timeline (bottom) demonstrating resource contention modeling effectiveness.
  • Figure 5: Sensitivity Analysis: Attribution Accuracy (%) as a function of the statistical mixing weight $\omega_1$. The peak at $\omega_1 \approx 0.67$ confirms the optimal balance, while the robust performance across a wide range ($\omega_1 \in [0.55, 0.80]$) demonstrates non-brittle generalization.

Theorems & Definitions (2)

  • Theorem 1: Enhanced Granger Causality Distribution
  • Theorem 2: Identifiability