Unified Alert Correlation for Cyber-Physical Power Systems via Prototype-Guided Differentiable Clustering

Problem | Method | Results | Workload | Verification | Reproducibility Guide

This repository contains the reference implementation of ACDC, a graph-free framework that couples multi-view alert representation learning with prototype-guided differentiable clustering to correct temporal-semantic bias in cyber-physical SOC alert streams.

When using this code, please cite our paper (citation will be added upon publication).

Two-stage encode-then-cluster pipelines overfit temporal adjacency under heavy interleaving, causing semantically distinct campaigns to collapse into mixed clusters. ACDC addresses this temporal-semantic bias by making clustering part of the learning objective instead of a post-hoc step on frozen embeddings.

ACDC aligns latent geometry with incident semantics rather than letting clustering inherit a prediction-shaped embedding space. The pipeline combines four complementary alert views, an unrolled Iterative Cross-Attention mechanism for differentiable prototype assignment, and jointly optimized heads for clustering-aware representation learning.

• A unified alert-correlation framework that embeds prototype-guided differentiable clustering directly into representation learning.
• A churn-robust multi-view representation that jointly models semantic intent, temporal context, host behavior, and frequency cues under mixed OT and IT telemetry.
• An evidence stack that separates primary scientific evidence (public benchmarks), mechanistic evidence (ablation, failure-mode analysis), and operational evidence (deployment-scale case study).

Results are reported as means over five random seeds on public benchmarks.

Note: Alert-SOC-2024 corresponds to the 55WD naming used in the released configs.

• Alert-SOC-2024 diagnostic slice: ISH-13 collapses into DBSCAN noise, discarding 82.95% of windows.
• HDFS subset: ISH-13 reaches Silhouette 0.9737 while ARI stays at 0.0000 and fragments into 1,015 micro-clusters.

These are not cosmetic degradations — they are structural failures that make downstream triage harder.

KernelSHAP analysis on Alert-SOC-2024 shows that semantic and frequency cues dominate high-risk tactic grouping, while temporal periodicity and host-behavior invariants help isolate benign polling and maintenance-like traffic.

The compression from raw events to analyst-facing incident clusters:

ACDC reduces per-window latency by ~34%, inference memory by 39%, and increases throughput by 56% relative to the strongest two-stage baseline.

For a full reproducibility walkthrough, see CONTRIBUTING.md. One-command Track-A claim verification:

pip install -r requirements.txt
python tools/repro/verify_track_a_claims.py --gpu 0

This writes outputs/repro/track_a_claim_manifest.json with SHA-256 digests, parsed metrics, and the manuscript rows each output supports.

• All released configs fix data.random_seed: 42.
• main.py applies that seed at both train and evaluate entrypoints.
• Public reruns are anchored to the same split/seed path and should closely match reported means.

Install dependencies:

pip install -r requirements.txt

Train:

python main.py --train --config configs/HDFS/hdfs_config.yaml --gpu 0

Evaluate:

python main.py --evaluate --config configs/HDFS/hdfs_config.yaml --gpu 0

Artifacts are written to outputs/.

Datasets are not distributed in this repository. Place local copies under datasets/ following the layout in datasets/README.md.

Licensed under GNU General Public License v3.0.