## 4 The Proposed TOCA-IoT Framework
### Causal Inference Using LiNGAM  
Causal inference is the process of determining whether a relationship between two variables is causal, i.e., whether changes in one variable directly cause changes in another. This is distinct from mere correlation, where two variables may vary together without one necessarily causing the other. Causal inference has significance in several areas, such  
Figure 2: The graphical illustration of the imbalanced CICIoT2023 dataset. as economics, epidemiology, and social sciences, where understanding the impact of interventions or policies is necessary. To estimate causal effects from observational data, several key assumptions are necessary:
* Consistency: The observed outcome for a treated unit is the potential outcome under treatment, and similarly for untreated units. Formally, if \(T_{i}\) is the treatment indicator (1 if treated, 0 otherwise), then \(Y_{i}\) is calculated using the following Equation (1). \[Y_{i}=T_{i}Y_{i}(1)+(1-T_{i})Y_{i}(0)\] (1)
* Overlap (Positivity): Every unit has a non-zero probability of receiving either treatment, given the covariates: \[0<P(T=1\mid X)<1\] (2) where \(Y_{i}(1)\) is the outcome if the unit receives the treatment. \(Y_{i}(0)\) is the outcome if the unit does not receive the treatment [49]. The causal effect of the treatment for unit \(i\) is then defined as: \[\tau_{i}=Y_{i}(1)-Y_{i}(0)\] (3)  
However, in practice, we can only observe one of these outcomes for each unit, leading to the \"fundamental problem of causal inference\". To address this, we often focus on average treatment effects (ATEs) over a population:  
\[\text{ATE}=\mathbb{E}[Y(1)-Y(0)]=\mathbb{E}[Y(1)]-\mathbb{E}[Y(0)] \tag{4}\]  
Under these assumptions, there are a number of methods that can be utilized to estimate causal effects. (1) Regression adjustment: estimate the outcome model directly, adjusting for covariates:  
\[Y=\beta_{0}+\beta_{1}T+\beta_{2}X+\epsilon \tag{5}\]  
The coefficient \(\beta_{1}\) represents the estimated treatment effect. (2) Instrumental Variables (IVs): when unobserved confounding is present, an instrumental variable \(Z\) that affects the treatment but not the outcome directly can be used to estimate causal effects. The IV estimator is given by:  
\[\tau_{\text{IV}}=\frac{\text{Cov}(Y,Z)}{\text{Cov}(T,Z)} \tag{6}\]  
Causal inference often involves reasoning about counterfactuals--what would have happened if a unit had received a different treatment. Causal graphs, or directed acyclic graphs (DAGs), are used to represent causal relationships and identify confounders, mediators, and colliders. For example, in a simple DAG:  
\[T\to Y\gets X \tag{7}\]  
where \(X\) is a confounder that affects both treatment \(T\) and outcome \(Y\). Adjusting for \(X\) is necessary to estimate the causal effect of \(T\) on \(Y\). The LiNGAM model is used to identify the main causal relationships between network traffic features and the occurrence of anomalies [50]. LiNGAM is a powerful causal discovery algorithm that identifies directed acyclic graphs (DAGs) representing causal relationships among variables. By analyzing the network traffic data, LiNGAM helped to determine which features are directly influential in causing network anomalies, facilitating a more targeted and interpretable anomaly detection model. The resulting causal graph provided insights into the underlying mechanisms driving network intrusions. LiNGAM is a data-driven approach that identifies the causal structures among the variables, providing insights into the direct and indirect effects. The algorithm estimates the causal relationships between the selected features, as shown in Figure 3. This step assumes that the underlying relationships are linear and non-Gaussian. The LiNGAM library is an efficient Python tool for implementing the LiNGAM algorithm. The networkx or graphvi libraries are utilized in order to perform the visualization of causal graphs.