Automated root cause analysis of anomalies
A data processing system implements performing a root cause analysis that includes identifying a first anomalous signal data predictive of a root cause of a first anomaly in signal data received from a computing system, analyzing the sub-signals of the first anomalous signal data to generate labeled training data, training a gradient boosted tree model using the labeled training data, generating a decision tree based approximating a predictive performance of the gradient boosted tree model, determining insights data predictive of the root cause of the first anomaly based on the gradient boosted tree model and the decision tree, aggregating the insights and analyzing the aggregated insights data to determine a predicted root cause for the first anomaly, determining a confidence level associated with the predicted root cause, and categorizing the predicted root cause into one of a plurality of categories based on the confidence level.
1 . A data processing system comprising:
a processor; and
a memory storing executable instructions that, when executed, cause the processor alone or in combination with other processors to perform operations of:
analyzing signal data indicative of a performance of components of a computing system with an anomaly detection unit to obtain first anomalous signal data associated with a first anomaly detected in the signal data, the first anomalous signal data comprising a plurality of sub-signals, each sub-signal representing an aspect of the performance of the computing system;
analyzing the plurality of sub-signals of the first anomalous signal data using a root cause analysis framework to generate a predicted root cause of the first anomaly by:
analyzing each sub-signal of the first anomalous signal data using a data labeling unit of a root cause analysis framework to generate labeled training data, the labeled training data including an indication whether each sub-signal contributed to the first anomaly;
training a first machine learning model using a model training unit of the root cause analysis framework, the model training unit being configured to train the first machine learning model as a gradient boosted decision tree model using gradient boosting;
reducing a complexity of the first machine learning model using ensemble-pruning to reduce computational resources utilized by the first machine learning model;
analyzing the first machine learning model using the model training unit to generate a decision tree based on a tree structure of the first machine learning model, the decision tree approximating a predictive performance of the first machine learning model; and
determining the predicted root cause of the first anomaly using the decision tree;
analyzing the predicted root cause using a large language model to obtain one or more remedial measures for correcting the predicted root cause of the first anomaly, the one or more remedial measures comprising one or more actions of correcting an error in executable program code of a software component associated with the first anomaly and adjusting one or more configuration parameters associated with one or more software or one or more hardware components of the computing system;
generating a visualization of the predicted root cause and the one or more remedial measures; and
causing an application to present the visualization of the predicted root cause and the one or more remedial measures on a display of a client device.
2 . The data processing system of claim 1 , wherein analyzing the first anomalous signal data using the root cause analysis framework further comprises:
determining first insights data predictive of a root cause of the first anomaly by performing a feature importance analysis of the first machine learning model, the first insights data being associated with a single factor contributing to the root cause of the first anomaly;
determining second insights data predictive of the root cause of the first anomaly by parsing decision tree paths of the decision tree, the second insights data being associated with multiple factors contributing to the root cause;
aggregating at least a portion of the first insights data and the second insights data into aggregated sub-signal data;
analyzing the aggregated sub-signal data using the anomaly detection unit to obtain second anomalous signal data;
analyzing the second anomalous signal data using the root cause analysis framework to determine a predicted root cause of the first anomaly and a confidence level associated with the predicted root cause; and
categorizing the predicted root cause into a certainty category selected from among a plurality of certainty categories based on the confidence level associated with the predicted root cause.
3 . The data processing system of claim 1 , wherein analyzing each sub-signal of the first anomalous signal data using the data labeling unit of a root cause analysis framework to generate the labeled training data further comprises for a respective sub-signal:
analyzing the respective sub-signal to determine a quality level associated with the respective sub-signal;
analyzing the respective sub-signal based on the quality level associated with the respective sub-signal to determine whether the respective sub-signal contributed to the first anomaly based on the respective sub-signal satisfying a quality-level specific threshold; and
generating the labeled training data for the respective sub-signal, the labeled training data including an indication whether the respective sub-signal contributed to the first anomaly based on the respective sub-signal satisfying a quality-level specific threshold.
4 . The data processing system of claim 2 , wherein categorizing the predicted root cause further comprises selecting the certainty category based on the second anomalous signal data satisfying a selection criterion associated with the certainty category.
5 . The data processing system of claim 1 , wherein the first machine learning model is an XGBoost model.
6 . The data processing system of claim 5 , wherein analyzing the first machine learning model to generate the decision tree further comprises generating the decision tree using an XGBoost tree approximator.
7 . The data processing system of claim 2 , wherein generating the visualization of the predicted root cause further comprises:
constructing a first prompt for a large language model (LLM) to cause the LLM to generate a description of the first anomaly, the predicted root cause, and the certainty category; and
providing the first prompt to the LLM to cause the LLM to generate the description of the first anomaly, the predicted root cause, and the certainty category.
8 . The data processing system of claim 7 , wherein constructing the first prompt further comprises:
obtaining a persona indicator associated a user for whom the visualization is to be generated,
wherein constructing the first prompt further comprises including a persona description in the first prompt based on the persona indicator, the persona description providing contextual information to the first prompt to customize the description for the user.
9 . The data processing system of claim 8 , wherein constructing the first prompt further comprises:
selecting a first prompt template from among a plurality of prompt templates based on one or both of the certainty category and the persona indicator; and
constructing the first prompt based on the first prompt template.
10 . The data processing system of claim 7 , wherein the large language model is implemented using a Generative Pre-trained Transformer (GPT) model.
11 . The data processing system of claim 1 , wherein analyzing the first anomalous signal data using the root cause analysis framework further comprises generating one or more mitigating actions that can be performed to correct the first anomaly.
12 . A method implemented in a data processing system for performing a root cause analysis, the method comprising:
analyzing signal data indicative of a performance of components of a computing system with an anomaly detection unit to obtain first anomalous signal data associated with a first anomaly detected in the signal data, the first anomalous signal data comprising a plurality of sub-signals, each sub-signal representing an aspect of the performance of the computing system;
analyzing the plurality of sub-signals of the first anomalous signal data using a root cause analysis framework to generate a predicted root cause of the first anomaly by:
analyzing each sub-signal of the first anomalous signal data using a data labeling unit of a root cause analysis framework to generate labeled training data, the labeled training data including an indication whether each sub-signal contributed to the first anomaly;
training a first machine learning model using a model training unit of the root cause analysis framework, the model training unit being configured to train the first machine learning model as a gradient boosted decision tree model using gradient boosting;
reducing a complexity of the first machine learning model using ensemble-pruning to reduce computational resources utilized by the first machine learning model;
analyzing the first machine learning model using the model training unit to generate a decision tree based on a tree structure of the first machine learning model, the decision tree approximating a predictive performance of the first machine learning model; and
determining the predicted root cause of the first anomaly using the decision tree;
analyzing the predicted root cause using a large language model to obtain one or more remedial measures for correcting the predicted root cause of the first anomaly, the one or more remedial measures comprising one or more actions of correcting an error in executable program code of a software component associated with the first anomaly and adjusting one or more configuration parameters associated with one or more software or one or more hardware components of the computing system;
generating a visualization of the predicted root cause and the one or more remedial measures; and
causing an application to present the visualization of the predicted root cause and the one or more remedial measures on a display of a client device.
13 . A data processing system comprising:
a processor; and
a memory storing executable instructions that, when executed, cause the processor alone or in combination with other processors to perform operations of:
receiving, in a user interface of a data portal application, an input requesting access to a timeseries signal data;
sending a request to a root cause analysis framework to access the timeseries signal data based on the input and to analyze the timeseries signal data and to identify anomalies in the timeseries signal data by:
analyzing the timeseries signal data, the timeseries signal data being indicative of a performance of components of a computing system with an anomaly detection unit of the root cause analysis framework to obtain first anomalous signal data associated with a first anomaly detected in the timeseries signal data, the first anomalous signal data comprising a plurality of sub-signals, each sub-signal representing an aspect of the performance of the computing system,
analyzing the plurality of sub-signals of the first anomalous signal data using a root cause analysis unit of the root cause analysis framework to generate a predicted root cause of the first anomaly by:
analyzing each sub-signal of the first anomalous signal data using a data labeling unit of a root cause analysis framework to generate labeled training data, the labeled training data including an indication whether each sub-signal contributed to the first anomaly;
training a first machine learning model using a model training unit of the root cause analysis framework, the model training unit being configured to train the first machine learning model as a gradient boosted decision tree model using gradient boosting;
reducing a complexity of the first machine learning model using ensemble-pruning to reduce computational resources utilized by the first machine learning model;
analyzing the first machine learning model using the model training unit to generate a decision tree based on a tree structure of the first machine learning model, the decision tree approximating a predictive performance of the first machine learning model; and
determining the predicted root cause of the first anomaly using the decision tree;
analyzing the predicted root cause using a large language model to obtain one or more remedial measures for correcting the predicted root cause of the first anomaly, the one or more remedial measures comprising one or more actions of correcting an error in executable program code of a software component associated with the first anomaly and adjusting one or more configuration parameters associated with one or more software or one or more hardware components of the computing system; and
generating visualization data providing a visual representation of the predicted root cause and the one or more remedial measures, the visualization data including a timeseries plot of the timeseries signal data and anomaly information identifying anomalies in the timeseries signal data;
receiving the visualization data from the root cause analysis framework;
presenting the visualization data including the timeseries plot on a user interface of the data portal application, the timeseries plot including an anomaly indication for each anomaly in the timeseries signal data;
receiving a user input selecting a first anomaly indication associated with a first anomaly;
sending a request to the root cause analysis framework for anomaly information for the first anomaly;
receiving the anomaly information for the first anomaly from the root cause analysis framework, the anomaly information including a predicted root cause for the first anomaly and a confidence level associated with the predicted root cause; and
presenting the anomaly information in an anomaly detail pane of the user interface of the data portal application.
14 . The data processing system of claim 13 , wherein the anomaly detail pane includes a link, which when activated, causes the data portal application to request additional information regarding a root cause of the first anomaly from a root cause analysis framework.
15 . The data processing system of claim 13 , wherein the memory further includes instructions configured to cause the processor alone or in combination with other processors to perform operations of:
presenting a conversation interface pane in the user interface of the data portal application, the conversation interface pane providing an input for natural language prompts to query a root cause analysis framework;
receiving a first natural language prompt as an input, the first natural language prompt requesting additional information from the root cause analysis framework;
sending the first natural language prompt to the root cause analysis framework to be executed by a large language model;
receiving a response from the root cause analysis framework that includes the additional information; and
presenting the response in the conversation interface pane.
16 . The data processing system of claim 13 , wherein the anomaly information includes a visualization of a primary cause of the first anomaly, the visualization being generated by the root cause analysis framework using a generative machine learning model trained to generate the visualization based on sub-signal data associated with the first anomaly obtained from the timeseries signal data.
17 . The data processing system of claim 13 , wherein the memory further includes instructions configured to cause the processor alone or in combination with other processors to perform operations of:
obtaining a persona indicator that has been input in the user interface of the data portal application, the persona indicator indicating a type of user for which the anomaly information is to be customized; and
sending the persona indicator to the root cause analysis framework to cause the root cause analysis framework to customize the anomaly information according to the type of user associated with the persona indicator.