Learning Unknown Interdependencies for Decentralized Root Cause Analysis in Nonlinear Dynamical Systems

TL;DR

This paper introduces a federated learning approach to identify unknown interdependencies in nonlinear dynamical systems for decentralized root cause analysis, without sharing raw data or modifying proprietary models.

Contribution

It proposes a novel federated interdependency learning method that handles heterogeneous data and proprietary models, with theoretical guarantees and real-world validation.

Findings

Effective identification of interdependencies in complex systems

Preserves data privacy with differential privacy mechanisms

Validated on industrial cybersecurity dataset

Abstract

Root cause analysis (RCA) in networked industrial systems, such as supply chains and power networks, is notoriously difficult due to unknown and dynamically evolving interdependencies among geographically distributed clients. These clients represent heterogeneous physical processes and industrial assets equipped with sensors that generate large volumes of nonlinear, high-dimensional, and heterogeneous IoT data. Classical RCA methods require partial or full knowledge of the system's dependency graph, which is rarely available in these complex networks. While federated learning (FL) offers a natural framework for decentralized settings, most existing FL methods assume homogeneous feature spaces and retrainable client models. These assumptions are not compatible with our problem setting. Different clients have different data features and often run fixed, proprietary models that cannot be modified. This paper presents a federated cross-client interdependency learning methodology for feature-partitioned, nonlinear time-series data, without requiring access to raw sensor streams or modifying proprietary client models. Each proprietary local client model is augmented with a Machine Learning (ML) model that encodes cross-client interdependencies. These ML models are coordinated via a global server that enforces representation consistency while preserving privacy through calibrated differential privacy noise. RCA is performed using model residuals and anomaly flags. We establish theoretical convergence guarantees and validate our approach on extensive simulations and a real-world industrial cybersecurity dataset.