Consolidating anomaly root causes and alarms using graphical granger models

1. A method for anomaly alarm consolidation comprising:

receiving, by a data storage module, time-series data from a plurality of sensors of an information technology infrastructure;

detecting a plurality of anomalies in the time-series data stored in the data storage module;

identifying a plurality of root-cause candidates for each of the anomalies;

generating, by a scenario analysis of the anomalies, a plurality of alarms, wherein the scenario analysis predicts a plurality of future expected values of the time-series data over a plurality of historical values of the time-series data using a graphical Granger causal model and generates the alarms based on a difference between the future expected values of the time-series data and actual values of the anomalies in the time-series data;

performing a belief propagation procedure between the root-cause candidates and the alarms to determine a plurality of root-causes that collectively comprise attributed root-causes for the alarms; and

outputting the plurality of root-causes as a set of consolidated alarms,

wherein the scenario analysis outputs an attribution score for each of the generated alarms paired with one of the root-cause candidates, the method further comprising:

caching the attribution score for each respective pair of the alarms and the root-cause candidates;

wherein the generating, by the scenario analysis of the anomalies, the alarms further comprises:

using the cached anomaly attribution value cached for a subsequent alarm and root-cause candidate pair upon determining that a difference between the future expected value of the time-series data and the actual value of the anomaly in the time-series data corresponding to the respective pair of the alarms and the root-cause candidate corresponding to the cached anomaly attribution value is within a given threshold of a difference between a future expected value of the time-series data and an actual value of the anomaly in the time-series data corresponding to the subsequent alarm and root-cause candidate pair, without determining an attribution value by the scenario analyses for the subsequent alarm and root-cause candidate pair.

2. The method of claim 1 , wherein each of the root-cause candidates is a set of the time-series data determined to likely cause at least one of the alarms.

3. The method of claim 1 , wherein the belief propagation procedure comprises:

determining a plurality of anomalous values of the root-cause candidates;

replacing the anomalous values of the root-cause candidates with respective expected values; and

determining a subset of the root-cause candidates, that using the respective expected values, reduces a level of anomalousness of at least one of the alarms, wherein the subset of the root-cause candidates defines the root-causes.

4. The method of claim 1 , further comprising performing an optimization of the belief propagation procedure by balancing a minimization of a number of the plurality of root-causes for the alarms and a compromise in a quality of the attributed root-causes to the alarms.

5. A non-transitory computer readable storage medium comprising computer executable instructions which when executed by a computer cause the computer to perform a method for anomaly alarm consolidation comprising:

detecting a plurality of anomalies in time-series data received from an information technology infrastructure;

generating, by a scenario analysis of the anomalies, a plurality of alarms, wherein the scenario analysis predicts a plurality of future expected values of the time-series data over a plurality of historical values of the time-series data using a graphical Granger causal model and generates the alarms based on a difference between the future expected values of the time-series data and actual values of the anomalies in the time-series data;

identifying a plurality of root-cause candidates of the alarms; and

performing a belief propagation procedure between the root-cause candidates and the alarms to determine a plurality of root-causes that collectively comprise attributed root-causes for the alarms,

wherein the scenario analysis outputs an attribution score for each of the generated alarms paired with one of the root-cause candidates, the method further comprising:

caching the attribution score for each respective pair of the alarms and the root-cause candidates;

wherein the generating, by the scenario analysis of the anomalies, the alarms further comprises:

using the cached anomaly attribution value cached for a subsequent alarm and root-cause candidate pair upon determining that a difference between the future expected value of the time-series data and the actual value of the anomaly in the time-series data corresponding to the respective pair of the alarms and the root-cause candidate corresponding to the cached anomaly attribution value is within a given threshold of a difference between a future expected value of the time-series data and an actual value of the anomaly in the time-series data corresponding to the subsequent alarm and root-cause candidate pair, without determining an attribution value by the scenario analyses for the subsequent alarm and root-cause candidate pair.

6. The non-transitory computer readable storage medium of claim 5 , wherein each of the root-causes candidates is a set of the time-series data determined to likely cause at least one of the alarms.

7. The non-transitory computer readable storage medium of claim 5 , wherein the belief propagation procedure comprises:

determining a plurality of anomalous values of the root-cause candidates;

replacing the anomalous values of the root-cause candidates with respective expected values; and

determining a subset of the root-cause candidates, that using the respective expected values, reduces a level of anomalousness of at least one of the alarms, wherein the subset of the root-cause candidates defines the root-causes.

8. The non-transitory computer readable storage medium of claim 5 , further comprising performing an optimization of the belief propagation procedure by balancing a minimization of a number of the plurality of root-causes for the alarms and a compromise in a quality of the attributed root-causes to the alarms.