CausalHeal: Self-Supervised Causal Diagnosis and Guarded Autonomous Remediation for Trustworthy SD-IoT

1. Introduction

The Internet of Things (IoT) has evolved from collections of isolated sensing devices into heterogeneous cyber-physical ecosystems comprising resource-constrained endpoints, edge and cloud services, programmable networks, and application-layer control functions [1]. This architectural evolution provides substantial flexibility, but it also expands the attack surface and increases the complexity of observing, interpreting, and mitigating anomalous behavior. Software-Defined Networking (SDN) has consequently emerged as an important enabling technology for IoT because it separates forwarding from network control and provides programmable management, global traffic visibility, and dynamically enforceable policies. In Software-Defined IoT (SD-IoT), these properties can facilitate adaptive security orchestration. The same centralisation and programmability introduce dependencies across devices, forwarding infrastructure, controllers, and applications [2]. Recent studies therefore continue to report challenges associated with heterogeneous traffic, non-stationary attacks, scalability, resource constraints, and evolving threat patterns in SD-IoT environments [3].

Recent intrusion-detection research has made substantial progress in exploiting machine learning and deep learning to identify malicious IoT traffic. Contemporary approaches include recurrent architectures, attention mechanisms, ensemble learning, federated learning, autoencoders, and hybrid detection models. For example, Kareem et al. developed an attention- and fuzzy-weighted recurrent intrusion detector for SDN-IoT environments [3], while recent studies have investigated adaptive and invariant-state intrusion detection specifically for SD-IoT [1]. Other 2025–2026 work has demonstrated sophisticated IoT anomaly-detection mechanisms based on isolation methods, one-class learning, deep neural networks, and federated architectures [4,5,6]. These developments confirm the ability of learning-based systems to identify complex malicious behavior, yet the dominant formulation remains a mapping from observed traffic to an anomaly score or attack class. Consequently, detecting that a system is abnormal does not necessarily establish why it became abnormal, where the initiating failure occurred, how the abnormality propagated through dependent components, or which corrective action should be taken.

A further challenge concerns the availability and quality of labelled security data. Supervised intrusion-detection models depend on representative examples of both benign and malicious behavior, whereas real deployments continuously encounter previously unseen attacks, evolving operating regimes, severe class imbalance, and incomplete annotations. This has motivated increasing interest in unsupervised and self-supervised representation learning. Recent work has shown that masked reconstruction, temporal representation learning, contrastive objectives, and anomaly-oriented pretext tasks can reduce dependence on attack labels while capturing regularities of nominal IoT behavior. Khan and Mian [7], for example, employ entropy-guided masked representation learning for low-latency IIoT intrusion detection, while Gu [8] combines autoencoder representation learning with contrastive objectives for unsupervised IoT outlier detection. More recent work has extended self-supervised IoT intrusion detection toward spectral-temporal representations and pattern-aware anomaly modelling [9]. These developments are particularly relevant to SD-IoT because security observations arise from multiple heterogeneous views of the same operating system. Device and application telemetry may expose service state, workload, latency, or resource usage; forwarding infrastructure provides packet- and flow-level observations; and an SDN controller maintains topology, flow-rule, and control-event information. A representation learner capable of modelling consistent nominal relationships among these views can therefore provide richer evidence than a detector built on a single traffic table. Nevertheless, public IoT intrusion datasets do not generally contain fully synchronised device-, data-plane-, control-plane-, and application-plane observations. Recent comparative studies have also demonstrated that model performance can vary considerably across IoT datasets and operational environments, while edge deployment introduces non-negligible computational and energy trade-offs [10]. This distinction is important: multi-dataset evaluation can demonstrate robustness or expose domain shift, but it should not be interpreted as direct evidence of synchronized cross-plane causal behavior.

Generalization across datasets is itself an unresolved issue. IoT security benchmarks differ in feature definitions, units, acquisition pipelines, attack prevalence, protocol distributions, topology, and traffic-generation procedures. A detector that performs well within one benchmark may therefore experience severe distribution shift when deployed on another. Recent work on heterogeneous IoT anomaly detection has continued to highlight class imbalance, domain heterogeneity, non-stationarity, and the difficulty of maintaining reliable performance outside the training regime [1]. This makes transfer reliability a safety problem rather than merely an accuracy problem. In security-critical automation, a system should be capable not only of generating a prediction, but also of determining when the statistical assumptions supporting that prediction are no longer credible. Confidence calibration, validity assessment, and abstention therefore become essential components of trustworthy deployment.

A second major limitation of conventional intrusion detection is the distinction between anomaly detection and root-cause diagnosis. A large anomaly score identifies a variable or component exhibiting unusual behavior, but the most anomalous component need not be the component that initiated the disturbance. In interconnected systems, an originating fault can propagate through causal and topological dependencies, producing stronger downstream symptoms than at the initiating node. Treating magnitude alone as root-cause evidence can therefore lead to symptomatic rather than causal diagnosis. Recent work outside conventional IDS research has increasingly adopted causal graphs and network-based dependency analysis for root-cause identification. Ji et al. [11] demonstrated that causal-graph modelling can recover fault propagation pathways and identify initiating variables in tightly coupled process systems, while Saretzky et al. [12] combined network structure, anomaly detection, and causal process graphs for root-cause identification. These studies illustrate a broader transition from correlation-based fault detection toward reasoning about propagation mechanisms and causal dependencies.

This distinction is especially significant for SD-IoT. Suppose, for example, that excessive controller latency, packet loss, application response degradation, and endpoint retransmissions occur within the same observation interval. A conventional anomaly detector may correctly mark all four variables as abnormal but cannot determine whether the event originated from endpoint overload, a forwarding-path problem, a controller bottleneck, or an application-service failure. Effective diagnosis therefore requires explicit reasoning about temporal ordering, network topology, upstream and downstream dependencies, exogenous disturbances, and hypothetical interventions. Structural causal models (SCMs) provide a principled mechanism for representing such directed dependencies and for posing counterfactual questions such as whether suppressing an abnormality at a candidate node would substantially reduce downstream symptoms.

Diagnosis alone, however, does not complete the operational security loop. Contemporary cyber-physical and network infrastructures increasingly require rapid recovery from faults, configuration errors, and cyberattacks. Recent work on autonomous remediation has started to extend anomaly detection toward self-healing operation. Johnphill et al. [13], for instance, proposed a cloud-native remediation and observability framework that connects detected abnormalities with policy-driven corrective actions across heterogeneous platforms. Such developments indicate an important transition from passive monitoring to closed-loop cyber-resilience. Nevertheless, autonomous remediation introduces a new class of risk: an incorrect diagnosis can trigger a technically valid but operationally harmful response. Restarting a service, rerouting traffic, modifying a forwarding rule, isolating a node, or reverting configuration may restore one function while disrupting another. Therefore, the decision to remediate autonomously should depend not only on expected recovery benefit, but also on confidence, action cost, operational risk, scope, reversibility, and post-intervention verification.

These limitations reveal a gap between four research directions that are often studied independently: representation learning for anomaly detection, root-cause diagnosis, cross-domain validity assessment, and autonomous remediation. Recent IoT security research has advanced anomaly detection considerably [1,3,7,8,9,10,14], while causal diagnosis research has developed increasingly interpretable techniques for distinguishing initiating causes from propagated effects [11,12]. In parallel, self-healing systems are beginning to incorporate automated recovery [12,15,16]. However, there remains a need for an integrated SD-IoT framework in which detection evidence is converted into causal diagnosis, causal diagnosis informs remediation selection, and remediation is executed only when the evidence satisfies explicit safety and validity constraints. As illustrated in Figure 1, SD-IoT deployments span diverse application domains, including smart grids, healthcare, industrial IoT, smart cities, connected consumer objects, and vehicular networks.

These heterogeneous environments combine IoT devices, applications, SDN data-plane forwarding, and SDN control functions, so disturbances may propagate across multiple dependent layers, motivating cross-plane diagnosis and guarded recovery. To address this gap, this work proposes CausalHeal, a self-supervised, causality-aware, and safety-constrained framework for anomaly diagnosis and guarded self-healing in SD-IoT. CausalHeal models nominal behavior from largely unlabeled telemetry using reconstruction, temporal-prediction, and multi-view consistency objectives. When synchronized cross-plane observations are available, anomalous deviations are subsequently analysed using a topology-constrained temporal structural causal model. Rather than equating the largest anomaly with the root cause, the diagnostic stage combines exogenous residual evidence, temporal onset relationships, upstream support, graph structure, and counterfactual propagation effects to rank candidate initiating causes. The resulting causal evidence is then used to assess possible remediation actions according to expected recovery benefit, operational cost, and intervention risk.

A central principle of CausalHeal is that autonomy is selective rather than unconditional. Candidate actions are subjected to confidence assessment, validity checks, policy constraints, bounded execution scope, canary or sandbox validation, post-action verification, and rollback. The same principle is applied to cross-dataset transfer: a transferred detector is not considered operationally trustworthy solely because an anomaly score can be computed. Instead, label-free diagnostics assess compatibility of alarm behavior, score dispersion, nominal-core location and scale, and numerical conditioning. If those conditions are not satisfied, CausalHeal abstains from deployment. This design makes failure recognition part of the security mechanism itself rather than treating abstention as an implementation failure.

The main contributions of this paper are as follows:

1.

CausalHeal integrates nominal one-class representation learning, causal root-cause localization, and guarded remediation within a unified SD-IoT diagnosis-to-recovery framework.

2.

A topology-constrained causal model combines structural residuals, temporal ordering, upstream support, and counterfactual intervention evidence to rank plausible initiating causes rather than relying on anomaly magnitude alone.

3.

A guarded remediation mechanism evaluates corrective actions using causal evidence, expected benefit, operational cost, and risk, while supporting abstention, verification, and rollback.

4.

Public-data and synchronized controlled experiments separately evaluate anomaly detection, transfer validity, causal localization, and remediation safety, including multi-seed reproducibility and explicit abstention under unsupported cross-domain transfer.

The remainder of this paper is organised as follows. Section 2 reviews recent work on SD-IoT intrusion detection, self-supervised anomaly representation, causal root-cause analysis, domain transfer, and autonomous remediation. Section 3 presents the system model, threat assumptions, telemetry organisation, and CausalHeal architecture. Section 4 describes self-supervised nominal modelling and anomaly scoring. Section 5 develops the topology-constrained causal diagnosis and root-cause ranking procedure. Section 6 presents the guarded remediation mechanism and safety constraints. Section 7 describes the public datasets, synchronized causal benchmark, implementation details, baselines, and evaluation metrics. Section 8 presents the experimental results and ablation analysis. Finally, Section 9 discusses limitations, validity, deployment implications, and future directions before Section 10 concludes the paper.

2. Related Work

Research relevant to CausalHeal spans several areas that have generally evolved independently: SD-IoT intrusion detection, self-supervised anomaly representation, causal root-cause analysis, cross-domain generalization, and autonomous remediation. Recent 2025–2026 studies have substantially advanced each of these areas; however, comparatively few frameworks connect them into a single diagnosis-to-recovery workflow. This section reviews these directions and positions CausalHeal with respect to the most recent peer-reviewed literature.

2.1. Intrusion Detection and Security in SD-IoT

Recent SD-IoT security research has increasingly combined programmable network control with learning-based intrusion detection to address heterogeneous traffic, evolving attacks, and non-stationary operating conditions. Recurrent and attention-based detection has been explored for SDN-IoT attack classification [3], while SFARP integrates P4-based monitoring, anomaly detection, and distributed mitigation [2]. Adaptive state modelling and calibrated anomaly scoring have further been investigated to improve robustness under changing traffic conditions [1], and hybrid-testbed datasets such as ASEADOS-SDN-IoT aim to provide more realistic IoT and SDN control-plane observations [17]. Collectively, these studies improve detection, adaptation, and programmable response, but they primarily identify anomalous or malicious states and do not explicitly determine whether an observed abnormality is an initiating cause or a propagated consequence, nor do they provide intervention-level ground truth for validating causal diagnosis and remediation.

2.2. Self-Supervised and Unsupervised Anomaly Representation

To reduce dependence on costly and incomplete attack labels, recent IDS research has increasingly adopted self-supervised and unsupervised representations based on reconstruction, masking, contrastive learning, and temporal modelling. MTRC combines Transformer-based reconstruction with contrastive objectives [18], while traffic-differentiation-based self-supervision learns normal-anomalous relationships without direct attack-label optimization [19]. Entropy-guided masked reconstruction has also been applied to IIoT traffic [7], and contrastive normality modelling for low-power IoT devices has been explored in CLU-ID [20]. PAST-IoT further combines spectral-temporal representations with pattern-aware anomaly injection [9]. These approaches demonstrate the value of learning nominal or discriminative traffic structure with reduced label dependence; however, their principal objective remains anomaly or intrusion detection. CausalHeal adopts the same general representation-learning principle but treats anomaly evidence as input to a subsequent causal-diagnosis and remediation process rather than as the final security output.

Table 1. Comparison of recent approaches in SD-IoT intrusion detection, root-cause reasoning, cross-domain validation, autonomous remediation, and safety mechanisms.

Work	Main Scenario	Unsupervised	Root-Cause	Cross-Domain	Autonomous	Safety /
		Representation	Reasoning	Validation	Remediation	Abstention
[3]	SDN-IoT IDS	×	×	Limited	×	×
[2]	SD-IoT mitigation	×	×	Multi-dataset	✓	Limited
[1]	Adaptive SD-IoT IDS	Partial	×	Robustness	×	Calibration
[17]	SDN-IoT dataset	×	×	Dataset only	×	×
[18]	NIDS	✓	×	Multi-dataset	×	×
[19]	IoT IDS	✓	×	Robustness	×	×
[20]	Low-power IoT	✓	×	Unseen attacks	×	×
[9]	IoT IDS	✓	×	Detection only	×	×
[11]	Process-system RCA	×	✓	×	×	×
[21]	Manufacturing RCA	×	✓	Limited	×	×
[22]	Microservice RCA	×	✓	Benchmark	×	×
[23]	Cross-dataset IoT IDS	×	×	✓	×	×
[24]	Cross-domain IoT IDS	×	×	✓	×	×
[25]	Cross-dataset IoT IDS	×	×	✓	×	×
[15]	Self-healing 5G-IoT	×	×	×	✓	✓
[13]	CPS self-healing	×	×	Cross-platform	✓	Policy-driven
CausalHeal	SD-IoT diagnosis	✓	✓	Validity-gated	✓	✓

Legend: ✓ = supported; × = not supported. Text entries denote partial, constrained, or specialised support.

Table 1. Comparison of recent approaches in SD-IoT intrusion detection, root-cause reasoning, cross-domain validation, autonomous remediation, and safety mechanisms.

Work	Main Scenario	Unsupervised	Root-Cause	Cross-Domain	Autonomous	Safety /
		Representation	Reasoning	Validation	Remediation	Abstention
[3]	SDN-IoT IDS	×	×	Limited	×	×
[2]	SD-IoT mitigation	×	×	Multi-dataset	✓	Limited
[1]	Adaptive SD-IoT IDS	Partial	×	Robustness	×	Calibration
[17]	SDN-IoT dataset	×	×	Dataset only	×	×
[18]	NIDS	✓	×	Multi-dataset	×	×
[19]	IoT IDS	✓	×	Robustness	×	×
[20]	Low-power IoT	✓	×	Unseen attacks	×	×
[9]	IoT IDS	✓	×	Detection only	×	×
[11]	Process-system RCA	×	✓	×	×	×
[21]	Manufacturing RCA	×	✓	Limited	×	×
[22]	Microservice RCA	×	✓	Benchmark	×	×
[23]	Cross-dataset IoT IDS	×	×	✓	×	×
[24]	Cross-domain IoT IDS	×	×	✓	×	×
[25]	Cross-dataset IoT IDS	×	×	✓	×	×
[15]	Self-healing 5G-IoT	×	×	×	✓	✓
[13]	CPS self-healing	×	×	Cross-platform	✓	Policy-driven
CausalHeal	SD-IoT diagnosis	✓	✓	Validity-gated	✓	✓

Legend: ✓ = supported; × = not supported. Text entries denote partial, constrained, or specialised support.

2.3. Causal and Graph-Based Root-Cause Analysis

Recent root-cause-analysis research increasingly combines causal graphs, temporal dependencies, intervention reasoning, and multimodal system evidence to distinguish initiating causes from downstream symptoms. Explainable causal-graph methods use intervention analysis and fault-propagation paths for process-system diagnosis [11], while multi-level manufacturing RCA combines graph representations, nonlinear Granger modelling, and meta-learning to reconstruct failure evolution [21]. Temporal multiplex networks and causal process graphs similarly exploit structural dependencies for root-cause identification [12], whereas MHP-RCA integrates heterogeneous metrics, audit logs, and directed failure-propagation modelling in microservice systems [22]. Broader surveys also confirm the increasing importance of metrics, traces, logs, graphs, causal relationships, and multimodal telemetry in modern RCA [26]. Despite this progress, most existing approaches focus on manufacturing, cloud, or microservice environments and generally terminate after localization; CausalHeal instead connects topology-constrained causal diagnosis and counterfactual evidence directly to guarded remediation in SD-IoT.

2.4. Cross-Dataset Generalization, Domain Shift, and Transfer Validity

Cross-dataset IDS studies consistently show that strong within-dataset performance does not guarantee reliable deployment under heterogeneous feature definitions, acquisition procedures, units, protocols, and attack distributions. Distributional-drift analysis demonstrates substantial performance degradation on unseen datasets [23], while CROSS-IoT shows that consistent feature extraction and semantic harmonization can improve cross-domain stability [24]. Rule-based feature and label harmonization likewise reveals considerable deterioration during direct cross-dataset testing [25], and evaluations of transfer, centralized multi-domain, and federated learning confirm that changing the learning architecture alone does not eliminate domain shift [27]. These findings motivate the CausalHeal transfer design: rather than assuming that semantically aligned features imply a trustworthy operating point, the framework evaluates label-free compatibility of alarm behavior, score dispersion, nominal-core location and scale, and numerical conditioning. Transfer is therefore treated as a validity problem in which abstention is an acceptable outcome when the target operating point cannot be supported without attack labels.

2.5. Autonomous Remediation and Self-Healing Security

Recent self-healing research extends intrusion detection toward closed-loop recovery by allowing detected abnormalities to trigger policy or learning-driven corrective actions. CROSS integrates anomaly classification, observability, and policy-based remediation across heterogeneous cyber-physical platforms [13], while reinforcement learning has been used for adaptive fault recovery in intent-based SDNs [16]. Safety-aware self-healing has also been formulated using constrained reinforcement learning and runtime shielding to prevent disruptive mitigation actions in 5G-enabled IoT systems [15]. These approaches demonstrate the feasibility of automated recovery, but action selection is typically driven by detected threat states, predefined policies, uncertainty estimates, or learned rewards. CausalHeal instead couples remediation decisions to explicit causal root-cause and counterfactual evidence while retaining abstention, bounded action scope, validation, post-action verification, and rollback to limit the risk of incorrect autonomous intervention.

2.6. Research Gap and Positioning of CausalHeal

The reviewed literature reveals strong progress, but also a fragmentation of capabilities. SD-IoT security studies increasingly exploit programmable telemetry and adaptive learning [1,2,3,17]; self-supervised IDSs reduce reliance on attack labels [7,9,18,19,20]; causal and graph-based approaches improve root-cause localization [11,12,21,22]; cross-dataset research exposes the severity of domain shift [23,24,25,27]; and emerging self-healing systems automate remediation under operational constraints [13,15,16]. Yet these capabilities are typically optimised and evaluated separately. A comparative summary of these research directions and the positioning of CausalHeal is provided in Table 1.

3. System Model and CausalHeal Architecture

This section formalizes the SD-IoT environment considered in CausalHeal, defines the telemetry and dependency model, states the threat and operational assumptions, and presents the anomaly-diagnosis-remediation architecture. The formulation deliberately distinguishes the synchronized SD-IoT scenario, in which application, data-plane, and control-plane telemetry are observed jointly, from the public-dataset scenario, in which only compatible multi-view tabular observations are available. This distinction is necessary because existing public IoT intrusion datasets generally do not provide intervention-level, time-synchronized observations across all SD-IoT planes. The closed-loop CausalHeal architecture is illustrated in Figure 2.

3.1. SD-IoT System Model

An SD-IoT environment is modelled as a programmable distributed system composed of IoT endpoints, network forwarding devices, an SDN control subsystem, and application or service components. The separation of control and forwarding functions provides centralized network visibility and policy programmability, while the IoT layer introduces heterogeneous devices, communication protocols, workloads, and resource constraints. Recent studies continue to identify these properties as both an advantage and a security challenge for SD-IoT environments [1,2,28]. The system is therefore represented by a directed dependency graph

$$\mathcal{G}=\left(\mathcal{V},\mathcal{E}\right),$$

(1)

where $\mathcal{V}$ contains monitored variables or system components, and $\mathcal{E}$ represents physically, logically, or operationally plausible dependency directions. Unlike an unrestricted learned graph, CausalHeal constrains possible causal relationships using the known SD-IoT topology and operational architecture. This prevents arbitrary dependencies between variables that cannot plausibly influence one another and reduces the risk of interpreting statistical correlation as a causal propagation path.

3.2. Cross-Plane Telemetry Model

For a synchronized SD-IoT deployment, CausalHeal collects telemetry from multiple system planes within a common observation interval. Typical device or edge telemetry may include CPU utilization, memory utilization, packet generation rate, retransmissions, communication latency, interface statistics, and service state. Data-plane telemetry may include packet and byte counts, flow duration, packet rate, queue occupancy, forwarding errors, dropped packets, active-flow counts, and port statistics. Control-plane telemetry may include Packet-In frequency, Flow-Mod activity, controller latency, rule-installation delay, topology events, and controller resource utilization. Application telemetry may contain response latency, request rate, error rate, service availability, and application resource utilization.

Because measurements can originate from sources operating at different sampling frequencies, CausalHeal maps observations to a common time grid. Let $\Delta t$ denote the selected monitoring interval. Measurements falling within

$$[t-\Delta t,t)$$

are aggregated into the corresponding synchronized state vector. Depending on the variable, aggregation may use the mean, median, sum, maximum, most recent value, or event count. The preprocessing stage performs finite-value handling, training-derived median imputation, mean/std standardization, feature screening, and semantic normalization before observations are supplied to the anomaly model.

3.3. Public-Data and Synchronized Experimental Branches

Two complementary experimental regimes are used because no single available dataset provides all information required to evaluate detection, causal diagnosis, and remediation. CICIoT2023 [29], ToN_IoT [30], Edge-IIoTset [31], and InSDN [32] are used to study anomaly-detection behavior, attack-family robustness, and cross-dataset compatibility. These datasets primarily provide network-flow, packet, protocol, or system-related attributes. This distinction prevents a methodological error in which independently collected public network datasets would be treated as if they provided synchronized controller, forwarding, endpoint, and application observations. For public datasets whose original record ordering cannot be defensibly interpreted as a chronological process, CausalHeal operates in static tabular mode. Temporal prediction is disabled rather than constructing artificial temporal relationships. Root-cause localization and remediation require stronger supervision than attack labels alone. Therefore, a synchronized SD-IoT experimental environment is used in which abnormalities can be deliberately injected into known components and their propagation observed across dependent variables.

4. Self-Supervised Nominal Representation and Anomaly Diagnosis

CausalHeal begins by learning a compact representation of nominal SD-IoT behavior and converting deviations from that representation into anomaly evidence. The objective of this stage is not to identify a predefined attack category, but to characterize regular operating structure sufficiently well that departures from nominal reconstruction, temporal evolution, or inter-view relationships can be detected. This design follows the recent movement toward reconstruction-, masking-, and contrastive-consistency-based intrusion detection [7,9,18,19,20], but the frozen implementation used in this work deliberately employs transparent linear components so that the contributions of causal diagnosis and guarded remediation can be evaluated without conflating them with a large neural architecture.

An important methodological distinction is made between the learning objective and benchmark construction. The representation-learning objectives themselves do not use attack-type labels. However, for the public-dataset experiments, the available binary labels are used to construct a nominal-only training partition so that controlled one-class evaluation can be performed. Attack samples are excluded from representation fitting and threshold estimation. Consequently, the evaluated prototype should be interpreted as nominal one-class representation learning with self-supervised objectives, rather than as a completely label-free public-dataset training procedure. Missing values were replaced using training-set medians, and numerical features were standardized using training-set mean and standard deviation. All preprocessing parameters were fitted exclusively on nominal training observations.

4.1. Masked Reconstruction Representation

The first nominal-learning component measures whether an observation can be reconstructed from the low-dimensional structure learned from normal traffic. Recent self-supervised IDS research has demonstrated the value of masked reconstruction for learning representations without directly optimizing attack labels [7,18].

Let

$${\mathbf{X}}_N\in {\mathbb{R}}^{N_N\times d}$$

denote standardized nominal training data. The raw reconstruction anomaly score is the mean squared reconstruction error

$$e_i^{\mathrm{recon}}={\displaystyle \frac{1}{d}}{∥{\mathbf{x}}_i-{\widehat{\mathbf{x}}}_i∥}_2^2.$$

(2)

An observation that lies close to the learned nominal subspace produces a small reconstruction error, whereas deviations along directions poorly represented by nominal traffic produce larger scores. This reconstruction should therefore be described as a masked low-rank reconstruction model, not as a neural autoencoder.

4.2. Temporal Prediction Consistency

Nominal network operation also exhibits temporal regularity when the records represent a valid chronological sequence. CausalHeal therefore includes an optional one-step latent prediction mechanism. Given consecutive latent states

$${\mathbf{z}}_{t-1}\mathrm{and}{\mathbf{z}}_t,$$

the nominal temporal transition is approximated by ridge regression:

$${\widehat{\mathbf{z}}}_t={\mathbf{z}}_{t-1}\mathbf{A},$$

(3)

The raw temporal anomaly score is

$$s_t^{\mathrm{pred},\mathrm{raw}}={\displaystyle \frac{1}{k}}{∥{\mathbf{z}}_t-{\widehat{\mathbf{z}}}_t∥}_2^2.$$

(4)

A large prediction error indicates a transition inconsistent with nominal temporal dynamics.

4.3. Multi-View Consistency Learning

The third anomaly signal captures relationships among complementary feature subsets. Recent self-supervised IDS studies increasingly use contrastive or multi-representation consistency to identify abnormal samples whose internal relationships differ from those observed during training [9,18,19,20]. For synchronized SD-IoT telemetry, these views may correspond naturally to device, forwarding, controller, or application groups. Public datasets, however, do not provide literal synchronized planes. The resulting raw multi-view inconsistency score is

$$\begin{array}{cc}\hfill s_t^{\mathrm{view},\mathrm{raw}}=& MSE\left({\mathbf{V}}_t^{\left(2\right)},{\mathbf{V}}_t^{\left(1\right)}{\mathbf{W}}_{12}\right)\hfill \\ \hfill & +{\displaystyle \frac{1}{2}}MSE\left({\mathbf{V}}_t^{\left(3\right)},{\mathbf{V}}_t^{\left(2\right)}{\mathbf{W}}_{23}\right)\hfill \\ \hfill & +{\displaystyle \frac{1}{2}}MSE\left({\mathbf{V}}_t^{\left(3\right)},{\mathbf{V}}_t^{\left(1\right)}{\mathbf{W}}_{13}\right).\hfill \end{array}$$

(5)

This score increases when the relationships among feature views no longer resemble their nominal mappings. For the public-data experiments, the term should therefore be called multi-view consistency rather than cross-plane consistency. Literal cross-plane interpretation is reserved for the synchronized SD-IoT branch. The reconstruction, temporal, and multi-view scores possess different numerical scales. Direct weighted addition would therefore allow whichever component happens to have the largest raw numerical range to dominate the detector. Each component score is consequently normalized relative to its nominal training distribution. After component normalization, CausalHeal constructs a fused anomaly score. When temporal ordering is unavailable, CausalHeal does not substitute a pseudo-temporal signal. Instead,

$$S_t^{\mathrm{raw},\mathrm{static}}=w_r{\overline{s}}_t^{\mathrm{rec}}+w_v{\overline{s}}_t^{\mathrm{view}}.$$

(6)

The temporal term is therefore structurally removed rather than filled using arbitrary record adjacency.

4.4. Nominal Threshold Calibration

A sample is classified as anomalous when the fused score exceeds a robust nominal threshold. For nominal training scores

$${\mathcal{S}}_N=\left\{S_1,\dots ,S_{N_N}\right\},$$

the threshold is

$$\tau =median\left({\mathcal{S}}_N\right)+\kappa MAD\left({\mathcal{S}}_N\right),$$

(7)

Cross-dataset transfer requires an additional calibration and validity procedure because a source-domain threshold cannot automatically be assumed valid in a target domain. That issue is treated separately in the transfer-validity methodology rather than modifying the within-dataset threshold using target attack labels.

4.5. Detector Configurations and Ablation Variants

To determine which forms of nominal evidence contribute to performance, the public benchmark evaluates several detector configurations. The public-data experiments compare five detector configurations. PCA Reconstruction uses nominal low-rank reconstruction error as a conventional one-class baseline, while Mahalanobis uses a ridge-stabilized multivariate distance from the nominal distribution. CausalHeal without Reconstruction removes the reconstruction component and retains temporal-prediction and multi-view evidence when valid chronology is available, or multi-view evidence alone otherwise. CausalHeal-Static combines reconstruction and multi-view consistency and is used for unordered public tabular datasets where temporal relationships cannot be justified. Finally, CausalHeal Adaptive Full combines reconstruction, temporal prediction, and multi-view consistency when valid temporal ordering exists, but automatically reduces to the static configuration when temporal information is unavailable. These variants allow the contribution of each anomaly-evidence component to be evaluated without assuming that the integrated detector must outperform simpler statistical baselines. The frozen detector hyperparameters and implementation details are summarized in Table 2.

5. Topology-Constrained Causal Root-Cause Diagnosis

Following anomaly detection, CausalHeal determines which monitored component most plausibly initiated the abnormal episode. This task is fundamentally different from identifying the variable with the largest anomaly score. In an interconnected SD-IoT system, a disturbance originating at one component may propagate through forwarding, control, device, and application dependencies, causing downstream variables to exhibit anomalies that are stronger than those observed at the initiating node. Consequently, anomaly magnitude alone may identify a prominent symptom rather than the underlying cause.

Recent root-cause-analysis research has increasingly addressed this limitation using causal graphs, multimodal telemetry, dependency structures, and intervention reasoning. Ji et al. [11], for example, use interpretable causal graphs to reconstruct fault-propagation pathways in tightly coupled process systems, while MHP-RCA integrates heterogeneous telemetry and directed propagation modelling for root-cause localization in microservice systems [22]. More recent work explicitly combines structural causal models (SCMs) with distributed-system architecture and counterfactual reasoning [33], while causal inference over multimodal system information has also been shown to improve identification of initiating events and variables [34]. CausalHeal follows this direction but adapts it to the SD-IoT context. It combines topology-constrained temporal modelling, structural residual evidence, anomaly onset ordering, upstream propagation support, and counterfactual intervention analysis. These signals are first used to construct a ranked list of candidate root causes, after which a lightweight Top-3 causal reranker resolves ambiguities among the strongest candidates.

5.1. Topology-Constrained Causal Model

The monitored SD-IoT environment is represented by the directed dependency graph where each node represents a monitored variable or component and each directed edge represents an operationally plausible influence relationship. Examples include packet-rate effects on forwarding load, forwarding load on controller request frequency, controller utilization on control latency, and control latency on downstream service behavior. Importantly, CausalHeal does not perform unrestricted causal discovery on the anomalous test observations. The possible dependency directions are constrained using the known SD-IoT topology and architecture, whereas the numerical relationships associated with those dependencies are estimated from nominal telemetry. This prevents statistically correlated but architecturally implausible relationships from being interpreted as fault-propagation paths. For node i, the nominal temporal mechanism is represented as

$$X_{i,t}=f_i\left(X_{i,t-1},Pa{\left(X_i\right)}_{t-1}\right)+U_{i,t},$$

(8)

where $Pa\left(X_i\right)$ denotes topology-permitted parents and $U_{i,t}$ represents an exogenous disturbance that is not explained by the expected behavior of the node or its parents. In the simulator prototype, $f_i(·)$ is estimated through ridge-regularized linear regression using nominal synchronized telemetry. This formulation is consistent with recent causal-system approaches in which architectural information restricts the space of plausible causal relationships rather than allowing arbitrary associations among monitored variables. C-ADL, for example, explicitly embeds SCM relationships into distributed component-connector architectures to support root-cause and counterfactual reasoning [33].

5.2. Structural Residual and Temporal Evidence

For every monitored variable, CausalHeal compares the observed value with the value predicted from its nominal causal mechanism. The structural residual is

$$e_{i,t}=X_{i,t}-{\widehat{X}}_{i,t}.$$

(9)

Residuals are normalized relative to their nominal training distributions using robust median statistics. A large residual therefore indicates that the behavior of the node cannot be adequately explained by its normal temporal state and topology-permitted parents. This distinction helps separate initiating causes from propagated symptoms. Consider a downstream node whose observed value becomes highly abnormal because its parent has already failed. Although its raw anomaly magnitude may be large, part of this deviation may remain consistent with the learned parent-child relationship. Conversely, an initiating node is more likely to exhibit an unexplained local structural shift. CausalHeal additionally estimates the onset time at which each variable first exhibits a significant residual deviation. A candidate receives stronger temporal evidence when its abnormality precedes those of its affected descendants. Exact simultaneity is not required because measurements may be sampled at finite intervals; temporal onset is therefore treated as supporting evidence rather than as a standalone causal criterion. This combination of parent-conditioned residuals and temporal ordering follows the broader RCA principle that causal diagnosis should identify abnormal mechanisms and propagation order rather than simply rank isolated anomaly magnitudes. Similar motivations underlie recent causal-graph and multimodal RCA frameworks [11,22,34].

5.3. Counterfactual Intervention Analysis

Observational evidence can identify plausible upstream candidates, but it does not directly evaluate what would happen if a candidate abnormality were removed. CausalHeal therefore performs a counterfactual intervention for each candidate. For candidate node i, its abnormal state is replaced by its learned nominal reference:

$$do\left(X_i=X_i^N\right).$$

(10)

The intervention is propagated only through descendants of $X_i$ in the topology-constrained causal graph. Upstream and unrelated variables are not modified. This restriction preserves the directional interpretation of the known SD-IoT dependency structure. This intervention-oriented interpretation is closely related to recent causal RCA research. Chen et al. [34] employ causal inference and counterfactual expectation improvement to identify cause events and triggering variables in complex systems, while C-ADL explicitly supports do-interventions and counterfactual queries over distributed architectures [33]. CausalHeal does not interpret counterfactual recovery as independent proof of causality. Instead, it is combined with residual, temporal, and topological evidence.

5.4. Composite Root-Cause Ranking

The primary RCA score combines five complementary evidence terms:

$$S_i^{\mathrm{RCA}}=w_R{R}_i+w_O{O}_i+w_C{C}_i+w_U{U}_i+w_P{P}_i,$$

(11)

where $R_i$ denotes structural-residual evidence, $O_i$ temporal onset consistency, $C_i$ counterfactual recovery evidence, $U_i$ topology-aware upstream support, and $P_i$ propagation support. For the frozen implementation,

$$S_i^{\mathrm{RCA}}=0.20R_i+0.18O_i+0.28C_i+0.22U_i+0.12P_i.$$

(12)

Counterfactual evidence receives the largest individual weight because a candidate capable of explaining recovery across its descendant subgraph provides stronger evidence than a candidate that is merely highly anomalous. The provisional root-cause estimate is

$$r^{*}=\underset{i\in \mathcal{V}}{argmax}{S}_i^{\mathrm{RCA}}.$$

(13)

However, CausalHeal retains the complete candidate ranking rather than considering only the highest-scoring node. This is necessary because several neighbouring upstream nodes may produce similar composite scores during closely coupled propagation events.

5.4.0.1. Top-3 Causal Reranking

The three highest-ranked candidates are therefore subjected to a second-stage pairwise reranker. Rather than introducing another complex model, the reranker compares each pair using six already available forms of causal evidence: topology direction, onset ordering, counterfactual benefit, structural residual evidence, upstream support, and the original RCA score. Directional topology and counterfactual evidence receive the strongest influence. If candidate i is upstream of candidate j, becomes abnormal earlier, and produces a larger reduction in descendant abnormality when counterfactually restored, the reranker favours i as the more plausible initiating cause. Only the Top-3 candidates are reordered; the remaining ranking is preserved. This deliberately limits the influence of the reranking stage and prevents weak candidates from being promoted merely through pairwise comparison. The fixed weights used in the final implementation are summarized in Table 3 rather than expanded into additional equations.

5.5. Diagnostic Confidence and Selective Output

A highest-ranked candidate is not necessarily sufficiently reliable to support autonomous intervention. CausalHeal therefore estimates diagnostic confidence using both the separation between the first two reranked candidates and the concentration of the complete RCA-score distribution. Let $M_{\mathrm{pair}}$ represent the causal preference margin between the two highest-ranked candidates and let $Q_{\mathrm{base}}$ represent confidence derived from the margin and entropy of the original RCA-score distribution. The final diagnostic confidence is

$$Q_{\mathrm{RCA}}=0.65M_{\mathrm{pair}}+0.35Q_{\mathrm{base}},0\le Q_{\mathrm{RCA}}\le 1.$$

(14)

Thus, confidence is high only when the leading candidate is clearly preferred and the candidate distribution is sufficiently concentrated. The RCA module ultimately returns

$${\mathcal{O}}_{\mathrm{RCA}}=\left\{{\pi }^{*},r^{*},Q_{\mathrm{RCA}}\right\},$$

(15)

where ${\pi }^{*}$ is the final ranked candidate list, $r^{*}$ is the most probable initiating cause, and $Q_{\mathrm{RCA}}$ is the confidence passed to the guarded remediation stage. Importantly, confidence does not alter the ground-truth evaluation of RCA accuracy. Instead, it determines whether the subsequent remediation module possesses sufficient evidence to act autonomously.

6. Risk-Aware Guarded Autonomous Remediation

Root-cause identification is useful only if the resulting diagnosis can support an appropriate recovery decision. In conventional intrusion-detection workflows, the response stage is commonly external to the detector: an alert is generated and an operator or policy engine subsequently determines how the system should react. Recent self-healing approaches have started to close this loop by connecting detection to autonomous recovery. CROSS, for example, combines anomaly monitoring with policy-driven recovery actions across cyber-physical platforms [13], while recent SDN work investigates reinforcement-learning-based self-healing fault recovery [16]. Safety-aware remediation has also emerged as a critical requirement, since an aggressive or incorrectly targeted response can itself disrupt network operation [15]. CausalHeal extends the diagnosis stage of Section 5 into a selective remediation process. The objective is not to execute an action whenever an anomaly is detected. Instead, the framework first determines whether the causal evidence is sufficiently strong, identifies several candidate recovery targets, evaluates their expected benefit, operational cost, risk, and intervention scope, and permits execution only when a sequence of safety conditions is satisfied. Otherwise, the system abstains and escalates the event for external intervention. This distinction is central to CausalHeal: autonomous remediation is optional, whereas safety checks are mandatory.

6.1. Causal-Guided Remediation Planning

The RCA stage maps the highest-ranked candidate causes to a predefined set of policy-approved remediation actions, such as rate limitation, rerouting or rule restoration, bounded device isolation, and controlled service restart or failover. CausalHeal does not generate unrestricted commands; all interventions must belong to an authorized action set, consistent with controlled self-healing policies [13]. Action selection is not determined by root-cause rank alone. CausalHeal also considers the candidate’s composite RCA score, counterfactual recovery evidence, and topology-aware upstream support when estimating whether an intervention is causally appropriate. Consequently, an action with high nominal recovery potential is not preferred when the diagnostic evidence linking its target to the observed disturbance is weak. This causal filtering connects diagnosis to remediation before candidate actions are evaluated according to their expected benefit, operational cost, and risk.

6.2. Benefit-Cost-Risk Action Utility

Each candidate action is evaluated through a utility function that balances expected recovery against the operational consequences of intervention:

$$J\left(a_i\right)=w_B{\widehat{B}}_i-w_C{C}_i-w_R{R}_i,$$

(16)

Benefit therefore receives the largest contribution, while intervention risk is penalized more strongly than ordinary operational cost. The action with the highest utility among the Top-3 causal candidates becomes the provisional remediation action:

$$a^{*}=\underset{a_i}{argmax}J\left(a_i\right).$$

(17)

Importantly, Equation (17) determines only which action would be preferred if execution were permitted. It does not bypass the subsequent safety layer. Risk-aware action selection is increasingly recognized as necessary for autonomous IoT recovery. Al Malwi et al. [15], for example, formulate self-healing IoT responses under explicit safety constraints and introduce a runtime shield that prevents disruptive mitigation decisions.

6.3. Guarded Execution, Verification, and Rollback

After action planning, CausalHeal authorizes autonomous execution only when all predefined safety conditions are satisfied. The selected action must remain within admissible risk and intervention-scope limits, possess sufficient causal benefit and expected utility, and pass the confidence and canary-validation checks. In the frozen configuration, the maximum admissible risk and action scope are 0.45 and 0.65, respectively, while the minimum causal-benefit evidence and remediation utility are 0.04 and 0.18.

$$\mathrm{Execute}\left(a^{*}\right)\iff G_Q\wedge G_R\wedge G_B\wedge G_V,$$

(18)

where the terms represent diagnostic confidence, risk/scope, causal-utility, and canary validity. If any guard fails, CausalHeal abstains from autonomous intervention. Authorized actions are subsequently evaluated during a post-action verification interval to determine whether the system state improves as expected. If the intervention fails to provide sufficient verified recovery, CausalHeal activates rollback to restore the preceding safe configuration or otherwise reverse the bounded action. Verification and rollback therefore provide a post-execution safety layer that complements the pre-action guards and limits the operational impact of incorrect diagnosis or ineffective remediation.

6.4. Distinguishing Coverage, Success, and Safety

An important aspect of the CausalHeal remediation evaluation is that success should not be reported independently of how frequently the framework chooses to act. A highly conservative system could achieve a very low unsafe-intervention rate simply by never executing an action. Conversely, an always-act policy could obtain high coverage while causing unacceptable failures. The remediation evaluation therefore separates:

• Coverage: the fraction of episodes for which autonomous execution is authorized;
• Abstention: the fraction of episodes for which the guard declines autonomous execution;
• Conditional remediation success: the fraction of executed interventions that target the correct cause, remain safe, and satisfy post-action verification;
• Unsafe-intervention rate: the fraction of executed actions that violate the safety outcome;
• Rollback rate: the fraction of executed interventions that fail verification and must be reversed; and
• Recovery gain: the observed change in system condition after execution and, when applicable, rollback.

The frozen guarded-remediation parameters used in the controlled benchmark are summarized in Table 4.

7. Experimental Methodology and Evaluation Setup

The experimental methodology is designed to evaluate the different capabilities of CausalHeal using evidence appropriate to each task. A single public intrusion dataset cannot provide reliable ground truth simultaneously for anomaly detection, causal propagation, root-cause localization, and remediation outcome. The evaluation is therefore divided into two complementary branches. First, four public IoT/SDN security datasets are used to evaluate within-dataset anomaly detection, attack-family robustness, reproducibility, and cross-dataset transfer validity. Second, a controlled synchronized SD-IoT benchmark is used to evaluate causal root-cause localization and guarded remediation under known interventions and observable propagation paths. This separation is important for avoiding unsupported claims. The public datasets are treated as static or multi-view security observations and are not interpreted as synchronized cross-plane causal telemetry. Conversely, the controlled benchmark provides known initiating causes and intervention outcomes but is not presented as a substitute for real-world production deployment. The corresponding evaluation structure is summarized in Table 5.

7.1. Public Security Datasets

Four public datasets with different traffic-generation environments and feature spaces are considered: CICIoT2023 [29], ToN_IoT [30], Edge-IIoTset [31], and InSDN [32]. This combination provides substantial heterogeneity in traffic representation, protocol composition, attack families, and acquisition methodology, making it useful for evaluating whether performance is dataset specific. All public datasets are evaluated in static tabular mode. Temporal prediction is disabled because the processed records cannot be guaranteed to represent a single continuous chronological process after sampling, file merging, and dataset construction. This prevents artificial temporal dependencies from being introduced from CSV row order. The final runs explicitly record temporal mode as disabled for all four public datasets. The characteristics, experimental roles, and principal limitations of all evaluated datasets are summarized in Table 6.

7.2. Within-Dataset Training and Evaluation Protocol

For each public dataset, model fitting is based exclusively on benign observations. To prevent a highly imbalanced attack prevalence from dominating binary evaluation, the final benchmark uses a class-balanced evaluation subset whenever sufficient records are available. Equal numbers of benign and attack observations are sampled, subject to a maximum of 50,000 observations per class. This design makes F1, precision, accuracy, and balanced accuracy easier to compare across datasets, but it also means that reported precision should not be interpreted as expected precision under natural deployment prevalence. For that reason, threshold-independent and prevalence-robust measures-particularly AUROC, balanced accuracy, recall, and FPR-are reported alongside F1. All preprocessing transformations are fitted using the nominal training data only and are then applied unchanged to evaluation records.

7.3. Attack-Family Robustness

Aggregate binary metrics can hide poor sensitivity to minority or difficult attack classes. Each public dataset is therefore additionally evaluated at the attack-family level. The median, minimum, and maximum attack-family recall are also reported. This analysis is particularly important because an apparently strong aggregate binary F1 score can coexist with very weak detection of specific attack families. Consequently, the manuscript does not use binary accuracy as the sole indicator of detector robustness.

7.4. Cross-Dataset Transfer and Label-Free Validity

Cross-dataset transfer is evaluated only when source and target datasets share sufficient semantically compatible features. A minimum of six harmonized features is required; under this criterion, only ToN_IoT [30] and InSDN [32] are evaluated bidirectionally, with 27 shared flow-level and derived features. Other dataset pairs are excluded rather than weakening the semantic-overlap requirement. This conservative design is consistent with recent cross-domain IDS studies showing that feature harmonization is essential under heterogeneous data acquisition [23,24,25,27]. Strict zero-shot transfer uses only source-domain benign data for preprocessing, model fitting, score calibration, and threshold estimation. Methods that use an unlabeled target calibration subset are treated as unsupervised domain adaptation (UDA), not zero-shot generalization. Target attack labels are never used for feature alignment, score orientation, calibration, parameter selection, or transfer-validity decisions; they are accessed only after the operational decision is frozen for retrospective evaluation.

The final validity-controlled adaptation uses SpectralCORAL with covariance condition limits $\kappa \in \{{10}^6,{10}^5,{10}^4,{10}^3\}$ and IterativeTrimmedCore target calibration. The least aggressive spectral regularization satisfying all validity requirements is selected; if none passes, transfer is rejected. Five label-free compatibility gates are applied: calibration alarm rate ($\le 0.85$), anomaly-score spread ($0.10\le {\rho }_{\mathrm{spread}}\le 10$), pseudo-normal-core median shift ($\le 5$ source MAD units), core-scale ratio ($0.10\le {\rho }_{\mathrm{core}}\le 10$), and alignment conditioning (${\kappa }_{\mathrm{align}}\le {10}^6$). Operational transfer is permitted only when all gates pass:

$$G_{\mathrm{transfer}}=G_{\mathrm{alarm}}\wedge G_{\mathrm{spread}}\wedge G_{\mathrm{shift}}\wedge G_{\mathrm{scale}}\wedge G_{\mathrm{condition}}.$$

(19)

These gates are compatibility checks rather than guarantees of target-domain discrimination. When $G_{\mathrm{transfer}}=0$, the transferred operating point is treated as unsupported and CausalHeal abstains. Target-label metrics such as AUROC and AUPRC may be examined retrospectively but never override this label-free operational decision.

7.5. Reproducibility Protocol

The final public-data configuration is frozen and evaluated using ten independent seeds, $\{7,17,27,37,47,57,67,77,87,97\}$. Model architecture, preprocessing, semantic mapping, detector weights, thresholds, calibration, SpectralCORAL parameters, validity gates, and transfer-selection rules remain unchanged across runs; only stochastic sampling varies. The primary transfer policy is SpectralCORAL with IterativeTrimmedCore calibration. Within-dataset metrics are summarized across the ten runs using the mean, standard deviation, and 95% confidence interval, while transfer validity and abstention are reported as pass frequencies. No model or validity parameter is retuned using the reproducibility results.

7.6. Controlled Synchronized Causal Benchmark

Public intrusion datasets cannot directly evaluate whether an algorithm correctly identifies an initiating component or whether an intervention reverses propagated abnormality. A separate controlled benchmark is therefore constructed to provide synchronized telemetry, explicit topology, known root causes, and observable remediation outcomes. The benchmark contains 18 synchronized variables spanning IoT/application, SDN data-plane, and SDN control-plane groups. Seven disturbance scenarios-DDoS, congestion, controller overload, link failure, sensor fault, flow-rule attack, and application failure-are evaluated over 100 independent trials each, yielding 700 controlled episodes. Each episode contains 3,200 synchronized observations, with the first 1,500 observations representing nominal operation. Noise, missing telemetry, drift, disturbance severity and duration, propagation gain, and propagation delay are randomized across trials. The variables are connected through a fixed directed topology representing plausible SD-IoT dependencies. The benchmark is therefore interpreted as a graph-consistent experimental simulator rather than a production SD-IoT deployment.

8. Results and Analysis

The public-data experiments assess within-dataset anomaly detection, attack-family robustness, reproducibility, and cross-dataset transfer validity. The controlled synchronized benchmark evaluates anomaly detection under known propagation structure, causal root-cause localization, and guarded remediation. The two branches are interpreted separately because the public datasets do not contain intervention-level causal or remediation ground truth. A central outcome of the experiments is that CausalHeal does not exhibit uniform superiority in conventional binary anomaly detection. Its strongest contribution instead emerges from combining interpretable diagnosis with conservative decision logic: the framework performs competitively in some public environments, recognizes unsupported cross-domain transfer, improves causal root-cause ranking in the controlled benchmark, and substantially reduces unsafe autonomous interventions through selective execution.

8.1. Public-Dataset Anomaly Detection

Table 7 summarizes the ten-seed results for CausalHeal and the two principal statistical baselines. Because temporal ordering was disabled for all four public datasets, CausalHeal Adaptive Full and CausalHeal-Static produce identical results, as intended. The corresponding F1 comparison among CausalHeal, PCA reconstruction, and Mahalanobis distance is shown in Figure 3.

The ten-seed results show three distinct behaviors. On CICIoT2023, CausalHeal obtains the highest operating-point F1 and balanced accuracy, with mean F1 of 0.906 and balanced accuracy of 0.905. Its mean precision and recall are 0.888 and 0.928, respectively. Nevertheless, PCA and Mahalanobis achieve higher AUROC, demonstrating that CausalHeal’s advantage occurs at the frozen nominal operating point rather than through uniformly superior ranking of all observations. On ToN_IoT [30], Mahalanobis is clearly stronger, achieving mean F1 of 0.697, balanced accuracy of 0.761, and AUROC of 0.944. CausalHeal obtains F1 of 0.569 and AUROC of 0.743. It improves F1 relative to PCA under the frozen threshold but does not match the statistical distance baseline. The Edge-IIoTset [31] results expose a different trade-off. CausalHeal achieves very high mean precision of 0.904and a low FPR of approximately 0.051, but recall falls to 0.408, resulting in F1 of 0.558. Mahalanobis and PCA achieve considerably higher recall and F1. Interestingly, CausalHeal’s balanced accuracy remains approximately 0.678, close to Mahalanobis, reflecting its conservative operating point rather than random discrimination.

For InSDN [32], the classical baselines are again stronger. PCA and Mahalanobis both obtain F1 close to 0.80, whereas CausalHeal achieves 0.671. Mahalanobis also produces an exceptionally high mean AUROC of 0.999. CausalHeal nevertheless reduces the false-positive rate relative to the nearly always-positive behavior of the two classical baselines, but this occurs at a substantial cost in attack recall. These findings are important for the paper’s positioning. The public experiments do not support a claim that CausalHeal is a universally superior binary detector. Instead, its effectiveness depends on dataset geometry and on whether reconstruction and multi-view relationships align with the underlying attack distribution.

8.2. Ablation and Multi-Seed Reproducibility

Removing the reconstruction component substantially weakens CausalHeal on most datasets. Mean F1 decreases from 0.906 to 0.541 on CICIoT2023 [29], from 0.569 to 0.454 on ToN_IoT [30], and from 0.558 to 0.513 on Edge-IIoTset [31]. InSDN [32] is an apparent exception: removing reconstruction gives F1 of 0.673 compared with 0.671 for the full detector. This result should not be interpreted as an improvement, because the no-reconstruction variant incurs an FPR of approximately 0.498 and balanced accuracy of only 0.640, whereas the full model reduces FPR to 0.239 and increases balanced accuracy to 0.708. Thus, F1 alone obscures a substantial change in the detector’s operating behavior. The sensitivity of validation F1 and balanced accuracy to the latent reconstruction dimension is shown in Figure 4.

The ten-seed analysis also reveals different levels of sampling sensitivity. CausalHeal’s F1 standard deviation is approximately 0.041 on CICIoT2023 [29] and 0.025 on Edge-IIoTset [31], indicating comparatively stable behavior. Variation is larger for ToN_IoT [30] 0.070 and especially InSDN [32] 0.141. The corresponding nominal 95% confidence intervals for CausalHeal F1 are approximately 0.880–0.931 on CICIoT2023, 0.542–0.574 on Edge-IIoTset, 0.526–0.613 on ToN_IoT, and 0.584–0.759 on InSDN. The broader confidence interval for InSDN indicates sensitivity to sampled nominal and attack observations. Consequently, single-seed performance would have provided an overly fragile basis for comparing the methods. The final reproducibility experiment uses ten frozen seeds, and no algorithmic or threshold tuning is performed after the reproducibility stage. The attack-family robustness results across the public datasets are summarized in Figure 5. The ten-seed mean F1 scores and corresponding 95% confidence intervals are shown in Figure 6.

8.3. Attack-Family Robustness

Aggregate binary performance conceals substantial variation among attack categories. This effect is especially pronounced for ToN_IoT and Edge-IIoTset. For example, in the first frozen run, ToN_IoT recall is approximately 0.954 for DDoS and 0.883 for injection, but only 0.0075 for backdoor, 0.033 for scanning, 0.077 for DoS, and 0.144 for ransomware. Edge-IIoTset [31] shows even stronger attack-specific separation. DDoS-ICMP and DDoS-UDP are detected with essentially complete recall in the same run, whereas Backdoor, DDoS-HTTP, SQL injection, Uploading, Ransomware, and XSS have very low recall. InSDN [32] similarly exhibits considerable family dependence. In the first run, Probe recall is approximately 0.53 and DDoS recall 0.40, whereas BFA, DoS, and Web-Attack are detected much less reliably.

CICIoT2023 [29] is more favourable, although low-sample fragmentation attacks remain difficult. In the first run, DDoS-ACK fragmentation is missed completely and DDoS-UDP fragmentation is also missed, whereas many high-volume DDoS families are detected with recall close to one. The attack-family analysis therefore reinforces a key conclusion from the dataset-wise results: high aggregate performance cannot be assumed to imply uniform protection across heterogeneous attack mechanisms. In particular, lower-volume or semantically subtle attacks are substantially more difficult for the nominal anomaly representation than high-intensity flooding behavior. The effect of the nominal training-data fraction on the F1 performance of the evaluated detectors is shown in Figure 8.

Figure 7. Effect of nominal training-data fraction on F1 performance of PCA, Mahalanobis, and CausalHeal.

Figure 7. Effect of nominal training-data fraction on F1 performance of PCA, Mahalanobis, and CausalHeal.

Figure 8. Transfer-validity gate pass frequencies across ten seeds. Score-spread and core-scale failures result in zero validity for all tested alignments.

Figure 8. Transfer-validity gate pass frequencies across ten seeds. Score-spread and core-scale failures result in zero validity for all tested alignments.

8.4. Controlled Synchronized Anomaly Detection

The controlled synchronized benchmark evaluates the full detection architecture under conditions in which temporal and cross-plane relationships are meaningful. The ablation results are summarized in Table 8.

The results show that the complete representation improves the balance between recall and precision. Removing cross-plane consistency slightly reduces F1 to 0.810 while producing a more conservative detector with high precision and low FPR. Removing reconstruction or temporal prediction causes larger F1 reductions. The extremely high recall but poor precision of the simple PCA and Mahalanobis configurations indicates that the synchronized benchmark cannot be solved reliably by treating every large multivariate deviation as an attack. The combined nominal representation is substantially better calibrated to the propagation environment. Importantly, these results are specific to the controlled synchronized benchmark and should not be used to contradict the public-data results, where simple statistical baselines are sometimes stronger. The two experiments address different data regimes. Figure 8 summarizes the label-free validity-gate frequencies across the ten reproducibility runs. The alarm-rate and core-shift criteria pass consistently, while the score-spread and core-scale gates fail in all runs for both transfer directions and all tested spectral-conditioning values. Although covariance conditioning is largely stabilized by SpectralCORAL, no configuration satisfies all validity requirements simultaneously. Consequently, the validity-pass frequency is 0% and the frozen operational policy abstains from transfer in 100% of runs. Table 9 summarizes the label-free transfer-validity results for bidirectional ToN_IoT-InSDN adaptation. Although the alarm-rate and core-shift gates pass consistently, the score-spread and core-scale gates fail in all tested configurations.

8.5. Causal Root-Cause Localization and Top-3 Reranking

Table 10 reports root-cause localization performance over the 700 controlled episodes. No individual evidence source is sufficient for reliable exact localization: magnitude ranking achieves only 28.1% Top-1 accuracy, while structural residuals are more effective for narrowing the candidate set, reaching approximately 0.696 Top-3 accuracy. Combining residual, onset, counterfactual, upstream, and propagation evidence raises Top-3 accuracy to approximately 80.3%. The complete RCA model achieves Top-1 accuracy of 0.306 before reranking. Pairwise reranking of the three strongest candidates increases Top-1 accuracy to 0.370, corresponding to an approximately 21% relative improvement. Top-3 accuracy remains unchanged at 0.803 because the reranker only reorders the existing candidate set, while MRR improves from 0.571 to 0.604 and the mean true-cause rank decreases to approximately 2.47. These results indicate that the principal strength of the causal diagnosis stage is its ability to place the initiating component within a small set of plausible candidates in roughly four out of five episodes, while the Top-3 reranker improves the probability of ranking the correct component first.

8.6. Guarded Autonomous Remediation and Coverage–Safety Trade-Off

Table 11 summarizes the remediation results and highlights the trade-off between autonomous coverage and operational safety. The rule-based policy acts on every episode but performs poorly, with low conditional success, a high unsafe-intervention rate, and negative mean recovery gain. The unguarded CausalHeal planner improves recovery, achieving 41.4% conditional success and a mean recovery gain of 0.191, but still produces an unsafe-intervention rate of approximately 32.7%.

Applying the complete guard mechanism substantially changes this operating point. CausalHeal Full Guarded executes autonomously in approximately 23.3% of episodes and abstains in 76.7%. Among authorized interventions, conditional success reaches approximately 44.2%, while the unsafe-intervention rate falls to approximately 0.6%, representing an approximately 98.1% relative reduction compared with the unguarded planner. Mean recovery gain also increases from 0.191 to 0.257. The lower autonomous coverage is therefore a deliberate consequence of selective autonomy rather than a weakness hidden from evaluation. Removing the guards increases coverage to 100% but also raises the unsafe-action rate from approximately 0.6% to 32.7%. The guarded configuration additionally exhibits a rollback rate of approximately 55.8%, showing that pre-execution filtering cannot guarantee successful recovery. Rollback therefore provides a necessary post-action safety mechanism for interventions that fail to produce sufficient verified improvement.

9. Discussion, Limitations, and Deployment Implications

The experimental results show that the value of CausalHeal lies less in maximizing a single anomaly-detection metric and more in combining anomaly evidence, causal diagnosis, transfer validity, and selective remediation within one safety-oriented workflow. This distinction is important because the public-data and controlled experiments reveal different strengths and limitations. On the public datasets, conventional PCA and Mahalanobis models remain competitive and sometimes outperform CausalHeal, whereas the synchronized benchmark demonstrates the additional value of causal and guarded reasoning once reliable system structure and intervention-level information are available.

9.1. Interpretation of the Public-Data Results

The public-dataset experiments demonstrate that anomaly detection remains strongly dependent on dataset characteristics. CausalHeal performs particularly well on CICIoT2023 [29], achieving a ten-seed mean F1 of approximately 0.906 and balanced accuracy of approximately 0.905, Mahalanobis provides stronger results on ToN_IoT [30], while PCA and Mahalanobis outperform CausalHeal on several InSDN [32] and Edge-IIoTset [31] metrics.

This outcome is not unexpected. A nominal representation that performs well on one traffic distribution may be less appropriate for another dataset in which attacks differ primarily along simple global statistical directions. Mahalanobis distance can be particularly effective when attack observations are well separated from the benign covariance structure. Conversely, CausalHeal benefits more when attacks disturb relationships among several feature views rather than merely shifting individual feature magnitudes. The results therefore argue against treating model complexity as a proxy for superiority. A more sophisticated framework should not be expected to dominate a simpler detector in every binary-classification benchmark. The purpose of the public-data branch is instead to determine whether the anomaly representation provides a sufficiently useful front end for a broader diagnosis-and-recovery system. The ten-seed results also reveal substantial variability on some datasets. CausalHeal is relatively stable on CICIoT2023 [29] and Edge-IIoTset [31] but displays larger variance on InSDN [32] and, to a lesser extent, ToN_IoT [30]. This reinforces the importance of reporting reproducibility rather than selecting one favourable random split.

The attack-family results further show that aggregate binary detection can hide important weaknesses. High-volume DDoS and flooding attacks are often detected reliably, whereas several backdoor, scanning, ransomware, injection-like, and low-frequency attack types exhibit much lower recall. This behavior suggests that CausalHeal is more sensitive to attacks that cause substantial departures from learned nominal traffic structure than to attacks designed to remain statistically close to normal operation. The limitation is not unique to the proposed method. Recent IoT IDS research similarly identifies minority attacks, class imbalance, heterogeneous traffic, and previously unseen behavior as persistent detection challenges [1,7,9,14]. From an operational perspective, this result means that anomaly detection should not be evaluated only through micro-averaged binary metrics. A system that detects dominant flooding attacks accurately while missing low-volume reconnaissance or stealthy application attacks may still provide incomplete security coverage. Future deployments should therefore retain attack-family or behavioral-stratum analysis whenever sufficient labels are available for retrospective assessment.

9.2. Cross-Dataset Transfer Validity and Domain Shift

The cross-dataset experiments show that semantic feature overlap alone does not guarantee operationally valid anomaly transfer. Although ToN_IoT and InSDN share 27 harmonized features, no SpectralCORAL configuration satisfies the full label-free validity criterion in any of the ten reproducibility runs in either direction. Consequently, the primary transfer policy supports zero runs and abstains in 100% of cases. The failure is driven primarily by persistent score-spread and pseudo-normal core-scale incompatibility. Spectral clipping improves covariance conditioning, but does not restore compatible anomaly-score geometry between the two domains. This indicates that the transfer limitation is not merely numerical ill-conditioning, but reflects deeper differences in data distributions and measurement semantics.

Similar feature names may still correspond to different units, aggregation windows, acquisition procedures, or protocol definitions, particularly for flow duration and derived packet or byte-rate features. Therefore, future cross-domain deployment should treat independently verified unit and semantic normalization as part of feature-ontology construction rather than as target-performance tuning. These results are consistent with recent cross-dataset IDS studies reporting substantial degradation after domain transfer [23,24,25,27]. CausalHeal therefore treats transfer validity as an operational decision problem: when compatibility cannot be established without target attack labels, the system abstains rather than reporting unsupported transferred predictions.

9.3. Causal Diagnosis and Guarded Remediation

The controlled experiments show that reliable root-cause localization requires combining multiple causal signals rather than relying on anomaly magnitude alone. The full CausalHeal RCA model places the true initiating component within the Top-3 candidates in 80.3% of the 700 controlled episodes, while the Top-3 reranker improves Top-1 localization from 30.6% to 37.0%, corresponding to an approximately 21% relative improvement. These results indicate that causal reasoning is more effective for producing a small set of plausible initiating causes than for guaranteeing exact Top-1 identification in every episode. This interpretation is consistent with recent RCA approaches emphasizing causal structure, propagation paths, multimodal evidence, and counterfactual reasoning [14,21]. The remediation results further demonstrate the importance of selective autonomy. The unguarded causal planner acts in every episode but produces an unsafe-intervention rate of approximately 32.7%. In contrast, the complete guarded policy reduces unsafe interventions to approximately 0.6%, an approximately 98% relative reduction, while autonomously acting in 23.3% of episodes and abstaining in 76.7%. The reduced coverage is therefore a deliberate safety trade-off rather than a failure of the remediation mechanism.

Post-action verification and rollback provide an additional safety layer because pre-execution confidence and canary validation cannot guarantee successful recovery. CausalHeal consequently applies two stages of protection: pre-action guards determine whether an intervention should be attempted, whereas post-action verification determines whether the intervention should remain in force. Failed or insufficient interventions are rolled back, limiting the operational consequences of incorrect diagnosis or action selection. This selective and reversible design is consistent with recent safety-aware self-healing approaches [12,15,16].

9.4. Limitations and Threats to Validity

Several limitations constrain the interpretation and generalization of the reported results. The public datasets provide heterogeneous network, flow, packet, and host-related observations but not fully synchronized device-, data-plane-, control-plane-, and application-level telemetry. Consequently, the public-data consistency objective represents multi-view consistency, whereas literal cross-plane causal reasoning is evaluated only in the synchronized controlled benchmark.

The controlled benchmark provides intervention-level ground truth but does not reproduce the full complexity of a production SD-IoT deployment. Its dependency topology is predefined, only seven disturbance scenarios are considered, and remediation outcomes are generated under controlled conditions. Although noise, drift, missing telemetry, propagation characteristics, and event severity are randomized, unobserved dependencies and real operational side effects may not be represented. The current SCM also relies on relatively simple temporal regression mechanisms; therefore, the causal and remediation results should be interpreted as mechanism-level validation rather than production-scale evidence of autonomous self-healing. current simulation prototype implements self-supervised objectives using masked PCA reconstruction, temporal regression, and ridge-based multi-view consistency rather than deep neural representation learning. Public-dataset labels are used only to construct the benign training partition, while attack samples are excluded from representation fitting and threshold estimation. Thus, the evaluated detector is more precisely characterized as nominal one-class learning with self-supervised objectives. More expressive masked, contrastive, temporal models could be investigated in future work [7,9,18,19,20]. Finally, several experimental-validity considerations remain. Public datasets are subsampled and evaluated using balanced test sets, so precision and F1 do not directly represent natural deployment prevalence. Target-unlabeled calibration may contain attacks, and the five transfer-validity thresholds are predeclared operational heuristics rather than guarantees of target-domain accuracy. Results across ten random seeds reduce dependence on a single split, but the corresponding uncertainty estimates should be viewed primarily as reproducibility indicators.

9.5. Future Research Directions

Future work will focus on validating CausalHeal in a physical or virtual SD-IoT testbed with synchronized device, data-plane, control-plane, and application telemetry; developing a formal feature ontology and unit-normalization procedure for cross-domain transfer; and replacing the current transparent PCA/ridge prototype with more expressive self-supervised and nonlinear causal models. Further research should also incorporate formal safety constraints, service-level objectives, and human oversight into remediation policies, while investigating calibrated transfer confidence and principled abstention rather than forcing predictions under severe domain shift.

10. Conclusions

This paper presented CausalHeal, a self-supervised and causality-aware framework for anomaly diagnosis, causal root-cause localization, validity-aware cross-dataset transfer, and guarded autonomous remediation in SD-IoT environments. Rather than treating anomaly detection, diagnosis, and recovery as independent tasks, CausalHeal combines nominal representation learning, topology-constrained causal reasoning, selective transfer, and risk-aware remediation within a unified security workflow. The experiments show that CausalHeal should not be interpreted as a universally superior binary detector. Public-dataset performance remains strongly dataset-dependent, while the cross-dataset study demonstrates the value of explicit validity assessment: none of the evaluated ToN_IoT–InSDN transfer configurations satisfies all label-free compatibility conditions, leading the frozen operational policy to abstain in 100% of reproducibility runs rather than report unsupported transferred predictions.

In the synchronized controlled benchmark, the complete detector achieves an F1 of 0.823, while causal diagnosis places the true initiating component within the Top-3 candidates in 80.3% of 700 episodes. Top-3 reranking improves exact Top-1 localization from 30.6% to 37.0%. Guarded remediation further reduces the unsafe-intervention rate from approximately 32.7% under unguarded execution to approximately 0.6%, demonstrating the value of selective autonomy, abstention, verification, and rollback. The results support CausalHeal as an interpretable and safety-constrained diagnosis-to-recovery framework whose contribution lies not only in detecting abnormal behavior, but also in determining when causal and operational evidence is sufficient to support transfer or autonomous action. Future work will focus on synchronized SD-IoT testbed validation, stronger self-supervised and nonlinear causal models, formal feature harmonization, and more rigorous safety constraints for autonomous remediation.