[Paper Review] Root Cause Identification for Collective Anomalies in Time Series given an Acyclic Summary Causal Graph with Loops

Karim ASSAAD, Imad Ez-zejjari+1 more|arXiv (Cornell University)|Mar 7, 2023

Time Series Analysis and Forecasting4 citations

TL;DR

This paper proposes EasyRCA, a method for identifying root causes of collective anomalies in multivariate time series using an acyclic summary causal graph with loops (ASCGL) and observational data. It leverages d-separation to decompose the problem into independent subproblems and combines graph-based reasoning with direct effect comparison using a novel adjustment set, achieving high F1-scores (up to 1.0) on simulated and real IT monitoring data.

ABSTRACT

This paper presents an approach for identifying the root causes of collective anomalies given observational time series and an acyclic summary causal graph which depicts an abstraction of causal relations present in a dynamic system at its normal regime. The paper first shows how the problem of root cause identification can be divided into many independent subproblems by grouping related anomalies using d-separation. Further, it shows how, under this setting, some root causes can be found directly from the graph and from the time of appearance of anomalies. Finally, it shows, how the rest of the root causes can be found by comparing direct effects in the normal and in the anomalous regime. To this end, an adjustment set for identifying direct effects is introduced. Extensive experiments conducted on both simulated and real-world datasets demonstrate the effectiveness of the proposed method.

Motivation & Objective

• Address the challenge of root cause identification in multivariate time series when anomalous data is scarce and causal discovery is impractical.
• Overcome limitations of causal discovery methods that require large anomalous datasets and expert validation under time pressure.
• Leverage a pre-validated acyclic summary causal graph with loops (ASCGL) representing the normal regime of a dynamic system.
• Develop a scalable, efficient method that uses observational time series and causal structure to identify root causes without requiring causal discovery at inference time.
• Balance precision and recall in root cause detection by combining structural reasoning with statistical comparison of direct effects.

Proposed method

• Use d-separation to group related anomalies into independent subproblems, enabling modular root cause analysis.
• Identify root causes directly from the ASCGL and the time of appearance of anomalies when possible.
• For remaining root causes, compare direct effects between normal and anomalous regimes using a novel adjustment set for identification.
• Formalize the problem using structural causal models (SCMs) under the assumption of consistency throughout time and causal sufficiency.
• Apply structural interventions and parametric interventions in simulations to evaluate method robustness and performance.
• Use a window causal graph as an intermediate abstraction to derive the summary causal graph, which is assumed to be acyclic with self-loops for temporal dependencies.

Experimental results

Research questions

• RQ1 Can collective anomaly root cause identification be decomposed into independent subproblems using d-separation in a summary causal graph?
• RQ2 To what extent can root causes be identified directly from the graph structure and the time of anomaly appearance?
• RQ3 How effective is the proposed adjustment set in identifying direct effects for root cause inference under structural and parametric interventions?
• RQ4 How does the method perform on real-world IT monitoring data with known ground truth root causes?
• RQ5 What is the trade-off between false positives and false negatives in root cause detection compared to state-of-the-art methods?

Key findings

• EasyRCA achieved an F1-score of 1.0 on simulated data with anomaly sizes of 2000, demonstrating perfect performance in detecting structural interventions.
• EasyRCA ∗ also achieved an F1-score of 1.0 on the same data, showing robustness to small errors in the ASCGL.
• On parametric interventions, EasyRCA and EasyRCA ∗ outperformed WhyMDC, MicroCause, and CloudRanger, with a more pronounced performance gap.
• In real-world IT monitoring data, EasyRCA correctly identified PMDB and ESB as root causes, aligning with expert diagnosis and outperforming MicroCause and CloudRanger.
• The method achieved the best trade-off between false positives and false negatives, with PMDB as a root vertex and RTMB and ESB as structural interventions.
• WhyMDC and MicroCause were able to detect root vertices but failed to identify structural interventions as effectively as EasyRCA.