# Online Identification of IT Systems through Active Causal Learning

arXiv: https://arxiv.org/abs/2509.02130 · HTML: https://mlsanity.com/paper/2509.02130/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 21 of its 82 references that are in the map.
- First posted on arXiv 2 Sep 2025.

## Builds on (most cited first, 21 of 21)

- [Active Learning for Nonlinear System Identification with Guarantees](https://mlsanity.com/paper/2006.10277/) (2020)
- [Combinatorial Bayesian Optimization using the Graph Cartesian Product](https://mlsanity.com/paper/1902.00448/) (2019)
- [Causal Bayesian Optimization](https://mlsanity.com/paper/2005.11741/) (2020)
- [Developing Optimal Causal Cyber-Defence Agents via Cyber Security Simulation](https://mlsanity.com/paper/2207.12355/) (2022)
- [Active Bayesian Causal Inference](https://mlsanity.com/paper/2206.02063/) (2022)
- [Active Learning for Optimal Intervention Design in Causal Models](https://mlsanity.com/paper/2209.04744/) (2022)
- [Model-based Causal Bayesian Optimization](https://mlsanity.com/paper/2211.10257/) (2022)
- [Intrusion Prevention through Optimal Stopping](https://mlsanity.com/paper/2111.00289/) (2021)
- [Dynamic Causal Bayesian Optimization](https://mlsanity.com/paper/2110.13891/) (2021)
- [Learning Near-Optimal Intrusion Responses Against Dynamic Attackers](https://mlsanity.com/paper/2301.06085/) (2023)
- [Multi-task Causal Learning with Gaussian Processes](https://mlsanity.com/paper/2009.12821/) (2020)
- [Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Search](https://mlsanity.com/paper/2407.11070/) (2024)
- [Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination](https://mlsanity.com/paper/2508.05188/) (2025)
- [Measuring the robustness of Gaussian processes to kernel choice](https://mlsanity.com/paper/2106.06510/) (2021)
- [Adaptive Network Security Policies via Belief Aggregation and Rollout](https://mlsanity.com/paper/2507.15163/) (2025)
- [Functional Causal Bayesian Optimization](https://mlsanity.com/paper/2306.06409/) (2023)
- [Online Incident Response Planning under Model Misspecification through Bayesian Learning and Belief Quantization](https://mlsanity.com/paper/2508.14385/) (2025)
- [Probabilistic Active Learning of Functions in Structural Causal Models](https://mlsanity.com/paper/1706.10234/) (2017)
- [Rollout Algorithms and Approximate Dynamic Programming for Bayesian Optimization and Sequential Estimation](https://mlsanity.com/paper/2212.07998/) (2022)
- [Optimal Security Response to Network Intrusions in IT Systems](https://mlsanity.com/paper/2502.02541/) (2025)
- [Active Learning of Continuous-time Bayesian Networks through Interventions](https://mlsanity.com/paper/2105.14742/) (2021)

## Abstract (arXiv)

Identifying a causal model of an IT system is fundamental to many branches of systems engineering and operation. Such a model can be used to predict the effects of control actions, optimize operations, diagnose failures, detect intrusions, etc., which is central to achieving the longstanding goal of automating network and system management tasks. Traditionally, causal models have been designed and maintained by domain experts. This, however, proves increasingly challenging with the growing complexity and dynamism of modern IT systems. In this paper, we present the first principled method for online, data-driven identification of an IT system in the form of a causal model. The method, which we call active causal learning, estimates causal functions that capture the dependencies among system variables in an iterative fashion using Gaussian process regression based on system measurements, which are collected through a rollout-based intervention policy. We prove that this method is optimal in the Bayesian sense and that it produces effective interventions. Experimental validation on a testbed shows that our method enables accurate identification of a causal system model while inducing low interference with system operations.