The Causal Gap: Why Correlation-Based Triage Fails Low-and-Slow Attacks

Abstract

Modern SIEM and autonomous SOC triage systems correlate alerts by temporal proximity and feature co-occurrence: events that happen close together in time and share features (common asset, user, network path) are grouped as likely related. This correlation architecture is effective for fast, high-signal attacks that generate multiple alerts in a short window. It is structurally blind to low-and-slow attacks — attacks in which the attacker deliberately spaces their actions across days or weeks and uses behavioral mimicry to prevent co-occurrence detection. This blindness is not a deficiency of the correlation algorithm or the underlying models; it is a consequence of the decision to use correlation as a primary detection mechanism for a threat class whose defining property is the avoidance of correlation. This article formalizes the causal gap — the structural inability of correlation-based triage to detect attacks that are designed to evade it — analyzes the mathematical conditions under which an attacker can reliably evade any correlation-based detector, and examines causal detection approaches that close the gap by reasoning about mechanism rather than co-occurrence.

Correlation in intelligence analysis is not causation. It is a heuristic — a useful shortcut that exploits the fact that causally related events tend to co-occur. A malware execution followed by a command-and-control connection followed by data staging and exfiltration produces a cluster of correlated alerts that a pattern-matching correlation engine can identify. But correlation is a two-edged tool: it reveals the presence of a fast, co-occurring attack and conceals the absence of correlation in a slow, carefully timed one. An attacker who knows that the defense uses correlation windows of N hours executes their attack across N+1 hours, exploiting the structural blind spot that the correlation architecture created. The causal gap names this blind spot, formalizes its extent, and examines what detection approaches can see what correlation cannot.

Correlation Windows and Their Structural Limitations

Alert correlation in SIEM systems operates by grouping events that share specified features within a specified time window. If event A and event B share a common asset identifier and occur within a one-hour window, they are correlated and may be combined into a single alert. If they occur six hours apart, they are not correlated and may not be combined. The one-hour window is a design parameter, not a physical fact — it reflects an engineering decision about what temporal proximity means for causality, not a measurement of actual causal relationships.

Sommer and Paxson (2010) identified the temporal window problem as one of the fundamental limitations of network intrusion detection: events that are causally related but temporally separated cannot be connected by a fixed-window correlation engine. This observation applies with particular force to the class of attacks known as low-and-slow attacks — advanced persistent threats, long-dwell campaigns, and supply-chain attacks in which the attacker deliberately spaces their activity to minimize the probability of temporal correlation.

The mathematical structure of the limitation is straightforward. Let W be the correlation window width. For any correlation-based detector, there exists a class of attacks — those that space all actions more than W apart — that the detector cannot identify as related. An attacker who knows W can therefore design an attack that is definitionally undetectable by correlation. Increasing W reduces this evasion space but introduces more false correlations and degrades the signal-to-noise ratio. There is no value of W that eliminates the evasion space while maintaining acceptable false-positive rates: the optimal W trades off false positives against false negatives, but the evasion class always exists.

Chandola, Banerjee and Kumar (2009) document the analogous limitation for anomaly detection: there is always a class of attacks whose statistical footprint falls within the normal behavioral envelope, making them undetectable by anomaly detection. The causal gap is the correlation analog of this fundamental limitation.

Correlation windows detect attacks that co-occur within the window; low-and-slow attacks deliberately space actions beyond the window, exploiting the structural blind spot.

🛡️ Countermeasures

Document the correlation window width in the SOC's detection capability inventory as a parameter that determines an evasion class: attackers who know this parameter can design attacks that evade correlation-based detection.
Maintain a separate detection channel for low-and-slow attacks that does not rely on temporal co-occurrence; treat these as complementary, not alternative, detection mechanisms.

Formalizing the Causal Gap

The causal gap is the set of attacks that are undetectable by any correlation-based detection system, defined formally as follows. Let A be an attack consisting of a sequence of actions a1, a2, ..., ak executed at times t1 < t2 < ... < tk. Let D be a correlation-based detector that correlates events with a window W and a feature similarity function f. D detects A if and only if there exist adjacent actions ai, aj such that |ti - tj| ≤ W and f(ai, aj) ≥ θ, where θ is the similarity threshold.

The causal gap of D is the set of attacks for which no pair of adjacent actions satisfies this condition: attacks where every pair of adjacent actions is either temporally separated by more than W or has feature similarity below θ. Any attacker who designs their attack to fall within the causal gap of D is guaranteed to evade detection by D, regardless of D's model quality, training data richness, or threshold optimization.

The causal gap has two dimensions: temporal and feature. The temporal gap (attacks that space actions beyond W) is the primary concern for low-and-slow attacks. The feature gap (attacks that execute different-seeming actions that do not share the features the correlation function uses) is the primary concern for multi-vector attacks that span different attack surfaces. An advanced attacker can exploit both dimensions simultaneously — spacing actions temporally AND using different accounts, assets, and network paths for each action, so that no pair of actions shares any feature.

The causal gap implies a specific governance recommendation: correlation windows should be disclosed in SOC capability assessments, because the window defines a detectable evasion space. An organization that believes its autonomous SOC provides comprehensive detection because it uses high-quality correlation models is mistaken if those models operate with correlation windows that advanced persistent threat actors know about and can exploit.

\[\text{Causal Gap}(D) = \{A : \forall (a_i, a_j) \in A, \; |t_i - t_j| > W \text{ or } f(a_i, a_j) < \theta\}\]

\[\Rightarrow \text{Any attack in Causal Gap}(D) \text{ is definitionally undetectable by } D\]

🛡️ Countermeasures

Compute the causal gap for each correlation-based detection rule in the autonomous SOC and document the minimum attack tempo and minimum feature diversity an attacker needs to evade it.
Report the causal gap in threat model assessments: for each threat actor profile, determine whether that actor's known capabilities allow them to design attacks within the causal gap.

How Low-and-Slow Attackers Exploit the Causal Gap

A sophisticated attacker exploiting the causal gap does not need to know the exact correlation window width. They need only to know that the defense uses temporal correlation and to pace their operations conservatively. Pacing operations at a rate significantly slower than the expected correlation window provides a large safety margin without requiring intelligence about the specific window parameter.

In practice, the most effective low-and-slow attack pattern combines three tactics. Tempo suppression spaces actions deliberately beyond the expected correlation window — typically by operating only during specific hours or days, introducing long delays between attack phases, and limiting the number of actions per time period. Feature diversification uses different accounts, IP addresses, assets, and network paths for different attack phases, ensuring that no two actions share the features that correlation systems use to group events. Behavioral normalization mimics legitimate behavior at each step, so each individual action, when observed in isolation, appears benign.

The combination of these three tactics creates an attack that is invisible to correlation-based detection at each timescale: in the short window, each action is individually benign; across longer windows, actions do not share features and do not form detectable clusters. Only a detection method that can reason about the causal relationship between actions — asking whether the pattern of actions is consistent with a specific attacker goal rather than asking whether the actions are statistically co-occurring — can detect this attack class.

Apruzzese et al. (2023) document empirical evidence that adversarially sophisticated attackers systematically exploit the temporal and feature limitations of detection systems. Low-and-slow attack patterns appear consistently in the case study literature for advanced persistent threat campaigns.

Each action is individually benign and temporally separated from adjacent actions; no correlation window captures two related actions as co-occurring.

🛡️ Countermeasures

Implement detection rules with extended temporal windows (7 days, 30 days, 90 days) for specific attack sequence patterns known to be used by targeted threat actors; these rules accept high false-positive rates in exchange for detection of long-dwell campaigns.
Deploy entity-based investigation that tracks behavioral state across extended time periods, not just within correlation windows, for high-value assets and privileged accounts.

Causal Detection: Reasoning About Mechanism, Not Co-occurrence

Causal detection closes the causal gap by asking a different question. Instead of asking whether events are correlated, it asks whether a sequence of events is causally consistent with a specific attacker goal. This requires a causal model — a representation of the mechanisms by which specific attack types produce observable events — rather than a statistical correlation of event features.

A simple causal model for credential-based lateral movement specifies the mechanism: an attacker who gains credentials for account A can use those credentials to access systems that account A has access to, from which they can access systems reachable from those systems, and so on. Each step in the mechanism produces observable events: authentication logs, network connections, file accesses. A causal detector that has this mechanism model can identify a lateral movement campaign even if the steps are months apart and use different accounts, because it is asking whether the sequence is mechanistically consistent with credential-based lateral movement, not whether the events are temporally correlated.

Gretton et al. (2012) provide the statistical foundation for causal inference in multi-source data, establishing methods for detecting whether one random process causally influences another. These methods are applicable to the SOC detection context: the question of whether a sequence of security events represents a single attacker's campaign is a causal inference question, not a correlation question.

The practical implementation of causal detection in a SOC context requires knowledge engineering — building and maintaining models of attacker mechanisms — and entity state tracking — maintaining a representation of the behavioral state of each monitored entity across time. Both requirements are more expensive than correlation-based detection, which explains why correlation dominates current deployments. But for organizations facing targeted advanced persistent threat actors who know to exploit the causal gap, causal detection is the only approach that provides meaningful protection.

🛡️ Countermeasures

Invest in mechanism-based detection rules for high-priority threat actor TTPs: rather than correlating events by time and feature, define explicit causal chains (initial access → privilege escalation → lateral movement → data staging → exfiltration) and detect sequences that match the chain regardless of temporal spacing.
Implement long-term entity behavioral profiles for privileged accounts and high-value assets: these profiles detect changes in behavioral state across long time periods, closing the temporal dimension of the causal gap.
Accept the investment required for causal detection for the specific threat classes where the causal gap is the primary risk: targeted advanced persistent threats, insider threats, and supply-chain attacks that exploit the gap by design.

Limitations

Causal detection's requirement for explicit mechanism models creates a coverage gap of its own: it can only detect attack sequences that match a modeled mechanism. Unknown attack mechanisms — zero-day techniques, novel TTP combinations — will not be detected because no model exists for them. This is the trade-off: correlation can detect novel attack patterns that happen to co-occur, while causal detection can detect known attack mechanisms even when they are deliberately dispersed. A robust detection architecture requires both.

Entity state tracking across extended time periods is storage-intensive and computationally expensive. The storage requirement scales with the number of entities monitored, the number of behavioral features tracked, and the time horizon of the tracking window. For organizations with large environments, full entity state tracking may be economically infeasible. Selective deployment — tracking state only for high-value entities, privileged accounts, and externally facing systems — is a common practical compromise.

The causal gap analysis assumes that the attacker has operational patience — the willingness to execute an attack over weeks or months. Not all attackers have this property; opportunistic attackers and ransomware operators typically do not. The causal gap is primarily a concern for nation-state threat actors, organized cybercriminal groups with established command-and-control infrastructure, and sophisticated insider threats. The threat model assessment should determine whether these actor types are relevant before investing in causal detection infrastructure.

Key takeaways

The causal gap is the set of attacks undetectable by any correlation-based detector: attacks in which all adjacent actions are either temporally separated beyond the correlation window or share no correlated features — a structural limitation, not a model deficiency.
For any correlation window width W, there exists a class of attacks (those that space all actions more than W apart) that are definitionally undetectable by correlation; no amount of model improvement closes this gap.
Low-and-slow attackers exploit the causal gap through three tactics: tempo suppression (spacing actions beyond the correlation window), feature diversification (using different accounts/assets for each action), and behavioral normalization (making each individual action appear benign in isolation).
Causal detection closes the causal gap by asking whether a sequence of events is mechanistically consistent with a known attacker goal, rather than whether events co-occur; it detects known attack mechanisms regardless of temporal spacing but requires explicit mechanism models that correlation-based detection does not.
A robust detection architecture requires both correlation-based detection (for fast, high-signal attacks) and causal detection (for slow, dispersed attacks); treating them as alternatives rather than complements creates a coverage gap that sophisticated attackers exploit by design.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

✅Causal Gap Assessment Gatechecklist

Pre-deployment assessment: quantify the causal gap for each detection rule and document the complementary causal detection coverage.

Correlation window width W is documented for every correlation-based detection rule in the autonomous SOC
Causal gap analysis has been completed: for each rule, the minimum attack tempo and feature diversity required to evade correlation are documented
High-priority threat actor profiles have been assessed against the causal gap: for each relevant actor type, determine whether their known TTP timing falls within or outside the correlation window
At least one complementary causal or entity-based detection channel is deployed alongside correlation-based detection for high-priority threat scenarios
Extended-window detection rules (30-day, 90-day) are configured for known long-dwell attack sequences (initial access → lateral movement → data staging)
Entity state tracking is operational for all privileged accounts and externally facing high-value assets with at least 90 days of history
The SOC's threat model assessment explicitly addresses which threat actor types exploit the causal gap and documents the detection coverage gap for those actors

🧪Causal Gap Coverage Test Harnessharness

Pseudocode harness that tests whether a causal detection rule fires for known long-dwell attack sequences — run in staging with synthetic events.

# Causal Gap Coverage Test Harness
# Tests causal detection rules against low-and-slow synthetic attack sequences
# All events are synthetic; do not use real credentials or production assets

CORRELATION_WINDOW_HOURS = 4  # replace with actual correlation window
TEST_SPACING_DAYS = 15        # deliberately exceeds correlation window

def generate_low_and_slow_sequence(n_steps, spacing_days):
    # Generate synthetic events separated by spacing_days
    # using different synthetic accounts for each step
    events = []
    base_time = datetime.now()
    accounts = [f'canary-acct-{i:03d}' for i in range(n_steps)]
    for i in range(n_steps):
        events.append({
            'time': base_time + timedelta(days=i * spacing_days),
            'account': accounts[i],
            'action': ATTACK_SEQUENCE[i],
            'asset': f'canary-asset-{i:02d}',
        })
    return events

# Test 1: Verify correlation FAILS to detect (expected)
def test_correlation_blind_spot(events):
    correlated = correlate_events(events, window_hours=CORRELATION_WINDOW_HOURS)
    assert len(correlated) == 0, 'Correlation detected low-and-slow (unexpected)'
    return PASS

# Test 2: Verify causal detection FIRES
def test_causal_detection(events):
    causal_alert = run_causal_detector(events, rule='credential-lateral-movement')
    assert causal_alert is not None, 'Causal detection MISSED low-and-slow attack'
    assert causal_alert.severity >= 'MEDIUM', 'Causal detection severity too low'
    return PASS

sequence = generate_low_and_slow_sequence(n_steps=4, spacing_days=TEST_SPACING_DAYS)
test_correlation_blind_spot(sequence)
test_causal_detection(sequence)

Staging only. Inject synthetic events spaced beyond the correlation window and verify that causal detection (not correlation) fires.

Glossary

Causal Gap: The set of attacks that are definitionally undetectable by any correlation-based detection system — attacks where all adjacent actions are either temporally separated beyond the correlation window or share no correlated features.
Low-and-Slow Attack: An attack strategy in which the attacker deliberately spaces actions across extended time periods and uses diverse accounts, assets, and network paths to avoid temporal and feature correlation.
Correlation Window: The time interval within which events must co-occur to be grouped as potentially related by a SIEM or alert correlation engine; defines the temporal dimension of the causal gap.
Tempo Suppression: A low-and-slow attack tactic in which all actions are spaced further apart than the defender's expected correlation window, ensuring no two adjacent actions fall within the same correlation interval.
Causal Detection: A detection approach that asks whether a sequence of events is mechanistically consistent with a known attacker goal rather than whether events are temporally or feature-correlated; not dependent on correlation window width.
Entity State Tracking: A detection infrastructure component that maintains a representation of the behavioral state of each monitored entity across extended time periods, enabling detection of state changes regardless of the temporal correlation window.

Abstract

Correlation Windows and Their Structural Limitations

Formalizing the Causal Gap

How Low-and-Slow Attackers Exploit the Causal Gap

Causal Detection: Reasoning About Mechanism, Not Co-occurrence

Limitations

Key takeaways

Practitioner Toolkit

Glossary

References