Intrusion detection stops leaning on correlation alone: causal graph plus entropy compression cuts 78 flow features to 18 and reaches 97.4% accuracy

Five intrusion-detection stages now share state in one pipeline, so the causal graph constrains compression, the compressed code constrains fusion, and adversarial calibration feeds the federated trust weights. Rule-based, representation-learning and federated detectors have mostly been trained separately and combined at the output, leaving no way to check whether the retained traffic relationships are still causal. Evaluation covers three public traffic datasets, CICIDS2017, UNSW-NB15 and IoT-23, split by session, capture day and flow family, and repeated across ten random seeds.

A causal signature engine first screens time-lagged dependencies between traffic variables, an entropy-guided network compresses them into a fixed-width code, and an attention synthesizer fuses rule, temporal and learned evidence into one decision. Feature retention is no longer ranked by label relevance alone; each dimension is scored by label information divided by its own uncertainty, then adjusted by causal centrality and spurious-edge risk. On CICIDS2017 the full five-module configuration reports 97.4% accuracy, 96.4% F1 and 18.6 ms average inference latency, while removing the causal module drops accuracy to 93.1%.

The framework targets security operations centers, industrial IoT gateways and distributed enterprise environments, and was evaluated on three public datasets, CICIDS2017, UNSW-NB15 and IoT-23, covering detection quality, feature efficiency, adversarial stability and federated communication cost. The authors propose a second-tier validation on CICIoT2023, Edge IIoTset and encrypted backbone traffic, using leave-one-attack-family-out, temporal drift and cross-dataset transfer to probe unseen attacks.

Causal graphs built from observational traffic support only conservative causal-consistency claims, not definitive causal determination. Numerical results currently cover three datasets, so encrypted, cloud-native and rapidly mutating IoT malware traffic still needs separate validation. Federated synchronization carries communication overhead and availability constraints under extreme client heterogeneity, and secure aggregation provides no formal differential privacy budget. Adversarial calibration covers a limited set of feature-space attack strategies, and the optional large language model branch adds privacy, hallucination and reproducibility costs.