Causal graph–based root-cause attribution for multi-stage enterprise attacks

Abstract

Multi-stage enterprise cyberattacks generate complex and fragmented security telemetry across endpoints, identity systems, networks, and cloud platforms. Although modern security tools can detect suspicious activities, determining the underlying root cause of an incident remains a major challenge for effective and timely response. This paper presents a causal graph–based approach for root-cause attribution in multi-stage enterprise attacks. Security entities and events are represented as typed nodes within a directed causal graph that captures plausible cause–effect relationships. Root-cause hypotheses are ranked by evaluating feasible causal paths under temporal constraints and telemetry uncertainty. The proposed approach produces interpretable causal narratives that link observed evidence to initiating attack factors, supporting more accurate and targeted incident response decisions. By reducing investigation time and improving explanation reliability, the method strengthens enterprise cyber resilience and supports the continuity of digital infrastructures.