Root Cause Analysis of Anomalies in Multivariate Time Series through Granger Causal Discovery

Authors: Xiao Han, Saima Absar, Lu Zhang, Shuhan Yuan
Primary area: interpretability and explainable AI
Keywords: root cause analysis, Granger causality, multivariate time series

Abstract:
Identifying the root causes of anomalies in multivariate time series is challenging due to the complex dependencies among the series. In this paper, we propose a comprehensive approach called AERCA that inherently integrates Granger causal discovery with root cause analysis. By defining anomalies as interventions on the exogenous variables of time series, AERCA not only learns the Granger causality among time series but also explicitly models the distributions of exogenous variables under normal conditions. AERCA then identifies the root causes of anomalies by highlighting exogenous variables that significantly deviate from their normal states. Experiments on multiple synthetic and real-world datasets demonstrate that AERCA can accurately capture the causal relationships among time series and effectively identify the root causes of anomalies.

Decision: accept (oral)
Reviewer scores: 8, 8, 8, 8, 8

Reviews and discussion:
<thread>
creation date:
1730146478301

thread_type:
official_review

<thread_object>
creator: reviewer_spkl

<content>
summary:
This paper proposes AERCA, a novel method for root cause analysis (RCA) based on Granger causality. 
AERCA uses an encoder-decoder scheme to iteratively approximate the time series with an approximation of the exogenous variables (noises). 
The root causes are modeled as variables that are added to the noises but have significantly higher variance.  
By training on normal data (no root causes) AERCA is able to detect the root causes on the test-data.
This was demonstrated empirically on known synthetic (or simulated) and real-world datasets both

strengths:
The paper is very well written and the contribution is clear and novel. 
The proposed method is simple and efficient.
In particular, I would like to highlight the ability to handle multiple root causes at once and at multiple time steps, where typically existing work in RCA detects a single root cause. 
Moreover, it analytically computes the estimated root causes, rather than backtracking on the computed causal graph (as in existing work in RCA).
I highly appreciate the computational analysis and the result of Proposition 1.
The empirical evaluation is extensive and shows the method's efficiency over prior work in synthetic and real scenarios.

weaknesses:
It is hard for me to point out obvious weakness points. I will however suggest some points for potential improvement, but these do not affect my opinion negatively on the paper.

1. I think it is quite restrictive to assume that normalize data always exist or that we can distinguish them from the faulty ones. How are you sure that the data that you are training on do not contain any root cause (this could affect your training). I am referring to a real scenario where the ground truth is unknown. 

2. I would also suggest trying out a bit more intuitive real world experiment where you can show with an example the discovered root cause and its meaning (what was the fault at that node and what did it cause).

3. For the proposed setting of Eq. (5), together with the anomaly term from Eq. (2) are there any theoretical results regarding identifiability? This is well known for some cases ([1] equal variance, [2] imposing sparsity in root causes for static data). Would be interesting to see such a result and it would enhance your contribution. 

4. How big time-series can your method handle (how many variables)?

You can discuss the above by adding a limitation section.

[1] Peters, Jonas, and Peter Bühlmann. "Identifiability of Gaussian structural equation models with equal error variances." Biometrika 101.1 (2014): 219-228.
[2] Misiakos, Panagiotis, Chris Wendler, and Markus Püschel. "Learning DAGs from data with few root causes." Advances in Neural Information Processing Systems 36 (2023).

questions:
I would appreciate if you could provide some feedback on the comments on the weaknesses section. 

Also, I believe it would be helpful to provide your code as supplementary material for reproduction.

I noted two mistakes/typos:
1. In Eq. (4) you should use $g$ instead of $f$ as this should be a different function depending only on $\mathbf{u}_{\leq t- 1}$
2. In Proposition 1. I would not characterize the window $\mathbf{W}_{t-K}$ as *immediately* previous, rather just previous. Because, before you had sliding windows, each moving by one time-step.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730259183041

thread_type:
official_review

<thread_object>
creator: reviewer_j7ce

<content>
summary:
This paper proposed a method to identify the exogenous variable in multiple time series, such that if the deviation from normal state of this exogenous variable is detected, the cause relation is established. The paper built a Encode-Decode pipeline to implement their design, in which the root cause is defined from Granger causality.

strengths:
Root cause analysis is one of the most challenging problem in multivariate time series analysis. This paper proposed an algorithm to identify the significant deviation of exogenous variable from its normal state, from which one can identify the root cause among multiple time series. Clearly, this is a very interesting approach.

weaknesses:
Due to the assumption that the series are stationary, and the model is based on splitting window with fixed length $K$, thus we may regard the model from neural network as optimization processing in building ARMA model. However, if we regard it as ARMA, the content in (8) of Proposition 1 must be re-checked, since it lacks any criterion of choosing a reasonable window width $K$ (the order of model), and further more, we can not measure the effect of required parameters in the model. Actually, the coefficients of the model in this paper are trained by neural networks, which might be a nonlinear function, thus it might involve serious sensitivity effect.

Secondly, the presentation of this paper is partially confused with standard ARMA model.  I hope the authors could rigrously distinct it with standard ARMA model, and indicates the difference. There actually exist many practical algorithms in time series theory to build an ARMA model as well as detailed performance analysis, which might help to consider the current formulation in more reasonable manner. 

In equations (1)(2), the authors lead a description on the potential exogenous intervention on a specific time series at a time step. Then the problem is to detect the abnormal exogenous variable ASAP (Def 1). To my understanding, this exogenous variable is essentially the noise in ARMA model, so the philosophy of this paper is not attractive. That is, I do not agree that the author offers a method to search the root cause which is actually as the change point that affect the trend of time series.

questions:
At line 120-121, the definition of Granger causalitysed in the literature is too sensitive. Could the authors adopt the standard definition, and make the cause effect more statistically significant but not so sensitive?

In Proposition 1, the form of the model is not aggreable with ARMA since in the latter case the width of windows, i.e., the order of model, are determined by some criterions such as AIC. But in current work, the authors didn't give any explaination. Could the authors give some ideas or explanations?

Could the authors describe the statistical property of the exogenrous variable such as distribution, the independence, and the power (variance)?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730523190705

thread_type:
official_review

<thread_object>
creator: reviewer_qzny

<content>
summary:
This paper introduces AERCA, an autoencoder-based model for root cause analysis in anomaly detection that integrates Granger causal discovery and root cause analysis using an encoder for abductive reasoning to identify exogenous variables and a decoder for deductive reasoning to reconstruct observations. This structure enables AERCA to learn causal relationships and detect anomalies by identifying deviations in exogenous variables. 
This approach is evaluated empirically on both synthetic and real-world multivariate time series data. Synthetic datasets include Lotka-Volterra and Lorenz 96, while real-world data comes from SWaT and MSDS. 
AERCA outperforms baselines in identifying causal structures and root causes, achieving high F1, AUC-PR, and AUC-ROC scores across four synthetic and two real-world datasets, with strong accuracy in both synthetic and real-world data.

strengths:
This paper has several strengths. It combines Granger causality with anomaly detection, making it suitable for complex systems with multiple interacting variables. This approach identifies not only the affected time series but also the specific time steps, offering precise localization for root cause analysis. The evaluations consider various datasets and baseline models over a range of performance metrics including F1 score and AUC-PR.

weaknesses:
The most noticeable weakness of this approach, in addition to the obvious decreased interpretability due to the reliance on the encoder-decoder autoregressive architecture, is that the model relies strongly on the correct estimation of exogenous variables, which may vary widely in real-world applications.

questions:
Can you describe what is the strategy that will need to be followed by practitioners interested in applying your framework in real world applications?

What assumptions and conditions will an interventional problem need to fulfill for your approach to appropriately model the problem?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730531264205

thread_type:
official_review

<thread_object>
creator: reviewer_ofk8

<content>
summary:
To identify root causes of anomalies in time series data, this paper models anomalies as interventions on exogenous variables. It then proposes a methodology (AERCA) to detect anomalies by explicitly modeling the mutually independent exogenous variables in the underlying autoregressive model, using encoders and decoders. A root cause is then identified by performing statistical tests on each of the associated exogenous variables. Experiments are performed for causal discovery and root cause identification on various synthetic datasets. Root cause identification is also assessed on two real datasets.

strengths:
The problem is well motivated, since root cause identifiaction is prevalent, and existing methods are impractical.

The given definition for root cause, as well as the proposed method are intuitive.

A broad range of system dynamics (ex. linear, nonlinear, lotka-volterra) are considered for empirical evaluation on synthetic datasets.

Writing and overall presentation are quite clear.

weaknesses:
I don't think that this should impact the methodology or results, but the provided definition of Granger causality seems more like actual causality, since the structural equation model is assumed to match the true data-generating process (L112). Although I checked the two references provided, I think that Granger causality is typically understood to be about aiding predictive power given an imperfect model, rather than the true model. Indeed, the causal graph (which is recovered in experiments) is typically defined from the true SEM rather than Granger causality. 

The method assumes that the exogenous variables are mutually independent, and this implicitly assumes causal sufficiency (no latent confounders). The importance of this assumption is demonstrated in the ablation experiment. I think that this assumption should be emphasized, since it does not seem like the proposed method is equipped to handle latent confounders.

It is not obvious that the method performs significantly better than alternative methods for root cause identification on real data. On the two offered datasets, performance was poor across all methods for the SwAT dataset, and besides epsilon-diagnosis, results are comprable across methods on the MSDS dataset. This may suggest that there are latent confounders, or other complications in the real datasets, which prevent AERCA from properly modeling the exogenous variables.

Discussion and analysis is limited in the experiments section.

questions:
The importance of mutually independent exogenous variables is demonstrated in the ablation study, such that the method performs significantly worse if the independence constraint is not invoked. Have the authors considered datasets where the exogenous variables are inherently correlated (due to latent confounders)? It would be interesting to see what would happen for root cause identification in this case, since this is a realistic scenario, which would likely be significantly more challenging. It would also be interesting to discuss model misspecification in this case (imposing independence constraint when it is not true).

The method seems to perform poorly on the SWaT dataset. Limited analysis/discussion is offered. Why do the authors think that this is the case? Is it due to higher numbers of root causes, latent confounders, and more complicated causal relationships? 

Similarly, is the ground truth causal graph known for the real datasets? It seems likely that the causal graph is not being learnt by AERCA given the performance on root cause identification, which suggests that the exogenous variables are not precisely modeled. 

What is the importance of assuming stationarity of the underlying process (L111)?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730688638039

thread_type:
official_review

<thread_object>
creator: reviewer_pxu9

<content>
summary:
The paper proposes the AERCA model, an encoder-decoder framework integrating Granger causal discovery with root cause analysis to address anomaly detection in multivariate time series. AERCA identifies causal relationships by defining anomalies as interventions on exogenous variables, capturing deviations that point to root causes. By explicitly modeling the distributions of exogenous variables under normal conditions, AERCA can differentiate abnormal time series data when anomalies arise. The approach achieves promising results on synthetic and real-world datasets, demonstrating its efficacy in both causal discovery and root cause identification.

strengths:
- The integration of Granger causal discovery with root cause analysis via an encoder-decoder structure is a novel approach. This fusion provides a comprehensive method to identify both causal links and root causes of anomalies.
- Modeling exogenous variables under normal conditions adds robustness to anomaly detection, enabling the model to distinguish between normal variations and true anomalies.
- Experiments conducted across multiple datasets, including synthetic and real-world time series, demonstrate AERCA’s high accuracy and adaptability, especially in distinguishing nonlinear causal relationships.
- The model is versatile, as it handles both point and sequence anomalies, making it applicable across various domains requiring real-time anomaly detection.

weaknesses:
- The paper relies on Granger causality to identify causal relationships, which only capture temporal predictability rather than true causation. This can result in spurious relationships, especially in systems with latent confounders or feedback loops, limiting the robustness of causal inference.
- AERCA assumes exogenous variables are mutually independent, which might not hold in real-world scenarios where dependencies can exist between exogenous factors. This assumption could reduce model robustness when applied to systems with interdependencies among exogenous factors.
- While the model structure is powerful, its complexity may hinder interpretability for users, especially when deployed in high-stakes industries like finance or healthcare, where transparent causal explanations are crucial.
- The paper does not extensively discuss the sensitivity of the model to hyperparameters, especially the thresholds for identifying root causes. Further analysis of parameter robustness would help ensure consistent performance across datasets.
- Granger causality is observational and cannot account for unobserved confounders, leading to potential biases in causal inference. Without mechanisms to address these confounders, causal relationships may be inaccurately represented
- One significant limitation of this paper is the omission of several proven and state-of-the-art causal discovery algorithms in its comparison. For example, while PCMCI was used as a baseline, the more efficient PCMCI+ variant (http://auai.org/uai2020/proceedings/579_main_paper.pdf) , which enhances computational performance and accuracy for high-dimensional time series, was not included. Additionally, more recent methods like Kernel-based Causal Discovery (KCD) (https://ieeexplore.ieee.org/iel7/9873850/9873995/09874142.pdf) offer advanced capabilities in handling non-linear dependencies and would have provided a stronger benchmark for evaluation. Conversely, some included approaches, such as Vector Autoregression (VAR) and Temporal Causal Discovery Framework (TCDF), are relatively outdated and come with inherent limitations, particularly in capturing complex non-linear causal relationships. Including these more robust and recent algorithms would enhance the comparative rigor and provide a clearer understanding of the proposed approach’s strengths and weaknesses relative to modern causal discovery methods.

questions:
- Why was Granger causality chosen over more robust causal methods like Structural Causal Models (SCMs) or Dynamic Causal Models (DCMs), given its limitations in capturing true causation?
- How does the model handle scenarios where exogenous variables are interdependent, as this independence assumption may not hold in real-world systems?
- Could the authors provide insights into the model’s sensitivity to key parameter settings, particularly the thresholds for anomaly and root cause detection?
- Given the complexity of the encoder-decoder structure, how do the authors intend to make the model’s reasoning more interpretable for practitioners?
- How does the model address the potential influence of latent confounders, given that Granger causality does not inherently account for unobserved variables?
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper proposes AERCA, a novel method integrating Granger causal discovery and root cause analysis to identify anomalies in multivariate time series. By modeling anomalies as interventions on exogenous variables and explicitly capturing their normal distributions, the approach provides a robust framework for causal discovery and root cause detection. The methodology is well-supported by experiments on synthetic and real-world datasets, demonstrating strong performance across various evaluation metrics. The paper’s strengths lie in its innovative combination of causal discovery and anomaly detection, effective handling of nonlinear relationships, and adaptability to point and sequence anomalies. While limitations, such as the assumption of independent exogenous variables and sensitivity to latent confounders, were noted, they do not significantly detract from the contribution. The authors addressed key concerns during the rebuttal, further improving the clarity and robustness of the work. Overall, the paper makes a significant contribution to the field of interpretable AI and time-series anomaly detection, warranting a decision of Accept.