Formal framework for quantitative Root Cause Analysis

Summary:

• Root cause analysis (RCA): decomposition of dynamic system into individual components

  • Graphical models: language of causal models

  • Causal Bayesian Network: decomposition of distribution into directed graph of conditional distributions

  • Functional Causal Model: independent structural equations/functions for each directed graph node, with independent noise variables

  • Key idea: each graph node represents an independent mechanism (represented by conditional distribution or function)

  • Different from analyzing treatment effects;

    • Root cause is the earliest cause in a chain of events that lead to a type of event

      • Finding root causes partitions the causal graph into semi-independent components

    • Treatment effects can be computed for any event in the chain

  • Contribution of mechanisms

    • Take causal graph

    • Replace some node with a baseline mechanism

    • Compute the impact of the replacement action on some output quantity

    • Keep replacing to find the residual impact of other node, after accounting for impact of previously replaced nodes

    • The result depends on chosen order and the baseline we choose

    • Contributions needs to sum up to something meaningful

    • Baselines:

      • RCA of Outliers: replace anomalous noise with normal value

      • Distribution Change: replace existing conditional distribution with baseline conditional

      • Intrinsic Causal Contribution: Set random noise of node to a constant

    • Intuition:

      • If node’s anomalous value may be the root cause, which propagates through normal causal mechanism of causal children (probed by changing values)

      • If node has an anomalous mechanism, normal values of causal parents propagate anomalously (probed by changing noise or the function at node)

• RCA of outliers

  • Take the probability of unlikely event of interest

  • Rewrite graph as just a function of of noise terms

  • Compute the sensitivity of the event to the value of the noise term, in some sequence after the prior nodes’ impact has been considered

  • Average over all possible orders

• RCA of distribution changes

  • We observe the joint distribution of data has changed

  • Want to assign responsibility to nodes

  • Observe: KL-distance between two distribution decomposes into per-node distances

    • Caveat: conditional KL distances contain distribution of parents

  • Intuition: most distribution changes are local

    • Look for the few nodes that have changed

    • Use conditional independence tests to find them

  • Idea: attribute variance in target variable to causal nodes

    • Compare variance of variable conditional on some nodes to variance conditional to 1 fewer causal nodes

    • Highlights impact of the removed node on the variance

    • Average over possible orderings of removals

  • Intuition:

    • Attribution replaces mechanisms, not values

    • Want to know which part of change is due to a single node’s mechanism, not its parents

    • Don’t want to attribute contribution to nodes that just propagate anomalies

• Limitations of RCA

  • Typically can talk about unusual behavior

  • Can’t say much about how things should work

  • To capture those, need to specify baseline distributions about what should be considered normal behavior for a given node