A Causal Approach to Detecting Multivariate Time-series Anomalies and Root Causes

TL;DR

This paper introduces a causal framework for detecting anomalies and their root causes in multivariate time series, improving interpretability and efficiency over traditional joint distribution models.

Contribution

It formulates anomaly detection from a causal perspective, enabling direct identification of root causes through causal structure learning and modular analysis.

Findings

Effective in simulated and real-world datasets

Robust against different types of anomalies

Facilitates root cause localization

Abstract

Detecting anomalies and the corresponding root causes in multivariate time series plays an important role in monitoring the behaviors of various real-world systems, e.g., IT system operations or manufacturing industry. Previous anomaly detection approaches model the joint distribution without considering the underlying mechanism of multivariate time series, making them computationally hungry and hard to identify root causes. In this paper, we formulate the anomaly detection problem from a causal perspective and view anomalies as instances that do not follow the regular causal mechanism to generate the multivariate data. We then propose a causality-based framework for detecting anomalies and root causes. It first learns the causal structure from data and then infers whether an instance is an anomaly relative to the local causal mechanism whose conditional distribution can be directly estimated from data. In light of the modularity property of causal systems (the causal processes to generate different variables are irrelevant modules), the original problem is divided into a series of separate, simpler, and low-dimensional anomaly detection problems so that where an anomaly happens (root causes) can be directly identified. We evaluate our approach with both simulated and public datasets as well as a case study on real-world AIOps applications, showing its efficacy, robustness, and practical feasibility.