Data-driven root-cause analysis for distributed system anomalies

TL;DR

This paper introduces a novel data-driven framework for root-cause analysis in complex distributed cyber-physical systems, utilizing symbolic dynamics and deep learning to improve accuracy and scalability in fault diagnosis.

Contribution

It proposes two new approaches, S^3 and A^3, for root-cause analysis that outperform traditional models and handle multiple operating modes effectively.

Findings

High accuracy in root-cause analysis demonstrated on synthetic data.

Effective handling of multiple nominal operation modes.

Scalable framework maintaining accuracy with system complexity.

Abstract

Modern distributed cyber-physical systems encounter a large variety of anomalies and in many cases, they are vulnerable to catastrophic fault propagation scenarios due to strong connectivity among the sub-systems. In this regard, root-cause analysis becomes highly intractable due to complex fault propagation mechanisms in combination with diverse operating modes. This paper presents a new data-driven framework for root-cause analysis for addressing such issues. The framework is based on a spatiotemporal feature extraction scheme for distributed cyber-physical systems built on the concept of symbolic dynamics for discovering and representing causal interactions among subsystems of a complex system. We present two approaches for root-cause analysis, namely the sequential state switching ($S^3$, based on free energy concept of a Restricted Boltzmann Machine, RBM) and artificial anomaly association ($A^3$, a multi-class classification framework using deep neural networks, DNN). Synthetic data from cases with failed pattern(s) and anomalous node are simulated to validate the proposed approaches, then compared with the performance of vector autoregressive (VAR) model-based root-cause analysis. Real dataset based on Tennessee Eastman process (TEP) is also used for validation. The results show that: (1) $S^3$ and $A^3$ approaches can obtain high accuracy in root-cause analysis and successfully handle multiple nominal operation modes, and (2) the proposed tool-chain is shown to be scalable while maintaining high accuracy.