Early root cause localization
Methods and systems for root cause analysis include combining system logs and system metrics into time-series data. Individual root cause analysis is performed to determine individual causal scores for respective system entities. Topological root cause analysis is performed to capture topological patterns of system anomalies. The individual causal scores and the topological patterns are integrated by a weighted sum. A corrective action is performed on an entity identified based on the weighted sum.
1 . A computer-implemented method for root cause analysis, comprising:
combining system logs and system metrics from a cyber-physical system into time-series data;
performing individual root cause analysis to determine individual causal scores for respective system entities that are related to system anomalies of the cyber-physical system based on the time-series data;
performing topological root cause analysis that utilizes disentangled causal graph learning with a graph neural network (GNN) based vector autoregressive framework to capture topological patterns of the system anomalies within the cyber-physical system in real-time through learned causal graphs based on the time-series data;
integrating the individual causal scores and topological scores resulting from the topological root cause analysis by a weighted sum to identify system entities as root causes for the system anomalies based on a likelihood of nodes of the learned causal graphs being root causes; and
performing a corrective action on an entity from the system entities identified as the root causes of the system anomalies for the cyber-physical system based on the weighted sum, the corrective action including halting a compromised process based on the root causes identified as an intrusion in the network system of the cyber-physical system.
2 . The method of claim 1 , further comprising performing early root cause localization to determine the entity after a tolerance time has elapsed.
3 . The method of claim 1 , wherein combining system logs and system metrics includes parsing the system logs to convert the system logs into respective time series.
4 . The method of claim 1 , further comprising performing trigger point detection to detect the system anomalies based on a distance measured between two consecutive batches of time-series data.
5 . The method of claim 4 , wherein the distance is measured according to a log-Euclidean distance or a log-Cholesky distance.
6 . The method of claim 4 , wherein performing trigger point detection includes generating respective covariance matrices for the two consecutive batches of time-series data and determining the distance between the covariance matrices.
7 . The method of claim 1 , wherein performing individual root cause analysis uses an extreme value theory approach.
8 . The method of claim 1 , wherein performing topological root cause analysis uses disentangled causal graph learning that separates invariant and variant causal relationships among various system entities of the cyber-physical system through learned causal graphs generated based on the time-series data.
9 . The method of claim 1 , wherein the entity is an entity within a cloud computing environment.
10 . The method of claim 1 , wherein the corrective action includes changing a configuration, environmental condition, or operational status of the entity.
11 . A system for root cause analysis, comprising:
a hardware processor; and
a memory that stores a computer program which, when executed by the hardware processor, causes the hardware processor to:
combine system logs and system metrics from a cyber-physical system into time-series data;
perform individual root cause analysis to determine individual causal scores for respective system entities that are related to system anomalies of the cyber-physical system based on the time-series data;
perform topological root cause analysis that utilizes disentangled causal graph learning with a graph neural network (GNN) based vector autoregressive framework to capture topological patterns of the system anomalies within the cyber-physical system in real-time through learned causal graphs based on the time-series data;
integrate the individual causal scores and the topological scores resulting from the topological root cause analysis by a weighted sum to identify system entities as root causes for the system anomalies based on a likelihood of nodes of the learned causal graphs being root causes; and
perform a corrective action on an entity from the system entities identified as the root causes of the system anomalies for the cyber-physical system based on the weighted sum, the corrective action including halting a compromised process based on the root causes identified as an intrusion in the network system of the cyber-physical system.
12 . The system of claim 11 , wherein the computer program further causes the hardware processor to perform early root cause localization to determine the entity after a tolerance time has elapsed.
13 . The system of claim 11 , wherein the combination of system logs and system metrics includes a parsing of the system logs to convert the system logs into respective time series.
14 . The system of claim 11 , wherein the computer program further causes the hardware processor to perform trigger point detection to detect the system anomalies based on a distance measured between two consecutive batches of time series data.
15 . The system of claim 14 , wherein the distance is measured according to a log-Euclidean distance or a log-Cholesky distance.
16 . The system of claim 14 , wherein the performance of trigger point detection includes generation of respective covariance matrices for the two consecutive batches of time-series data and determining the distance between the covariance matrices.
17 . The system of claim 11 , wherein the performance of individual root cause analysis uses an extreme value theory approach.
18 . The system of claim 11 , wherein the performance of topological root cause analysis uses disentangled causal graph learning that separates invariant and variant causal relationships among various system entities of the cyber-physical system through learned causal graphs generated based on the time-series data.
19 . The system of claim 11 , wherein the entity is an entity within a cloud computing environment.
20 . The system of claim 11 , wherein the corrective action includes a change of configuration, environmental condition, or operational status of the entity.