# Hi-RCA: A Hierarchy Anomaly Diagnosis Framework Based on Causality and Correlation Analysis
## 3 Model
### Anomalous Reason Diagroser  
Given the anomalous microservice \(m_{rc}\), the target of the _Anomalous Reason Diagnoser_ is to diagnose the real reason for the anomaly (i.e., \(e_{rc}\)) among several anomalous metrics caused by the anomaly propagation. Under multiple anomalous metrics, checking each metric's variation in isolation is insufficient, because the metric with the highest degree of anomaly may not be the root cause, but one of the affected indicators. In Hi-RCA, we focus on complex associations among various metrics, including causation and correlation. To fully utilize their relationships, we propose a hierarchy approach to diagnose the root cause gradually. In the first phase, the _Anomalous Reason Diagnoser_ identifies anomaly metric type based on the metric causality analysis, which adopts the structural causal model to formulate the causality relationship and recognizes anomalous metrics by the intervention recognition. Furthermore, based on the recognition results, anomaly knowledge graphs are generated. In the second phase, based on the correlation analysis, the _Anomalous Reason Diagnoser_ pinpoints the root cause metric and explains anomaly symptoms. Specifically, based on the anomalous type of intervention recognition, we classify one type of metric into the utilization group and the failure group, and compute the anomaly propagation graph among different groups. Finally, the root cause is located based on the graph similarity between CPG and the anomaly knowledge graph. **Intervention recognition. ** The invention recognition problem using [PERSON]'s \"Ladder of Causation\" [42]. The first layer of the causal ladder encodes the observation knowledge \(\mathbf{L_{1}}(\mathbf{X})=P(\mathbf{X})\), where \(P(\mathbf{X})\) is the joint probability distribution. The second layer encodes the interventional knowledge \(L_{2}(\mathbf{m})=P_{\mathbf{m}}\), where \(P_{\mathbf{m}}(\mathbf{X})=P(\mathbf{X}|do(\mathbf{m}))\) and \(M\subseteq\mathbf{X}\). The _do-operator do\((\mathbf{m})\)_ means fixing variable \(M\) to the given values \(\mathbf{m}\), which is defined as an intervention [43]. \(P(\mathbf{X}|do(\mathbf{m}))\) denotes the probability distribution over \(\mathbf{X}\) under the intervention to \(M\). If we want to answer the question layer \(i\), we need knowledge at layer \(i\) or higher. We model the causal relations among meta-metrics using the structural causal model (SCM) [43]. An SCM model consists of a set of structural equations  
\[x_{k}=f_{k}(\mathbf{p}\mathbf{a}(X_{k}),\mathbf{n}_{k}) \tag{11}\]  
where \(x_{k}\in\mathbf{X}\) and \(\mathbf{p}\mathbf{a}(X_{k})\in\mathbf{X}\), \(\mathbf{n}_{k}\) denotes unobserved variables \(\mathbf{U}_{k},U_{i}\cap\mathbf{X}=\emptyset\). We define the graph encoded by the SCM as \(\mathbf{G}=\mathbf{(V,E)}\), where \(E=\{X_{j}\to X_{k}|X_{v}\in\mathbf{p}\mathbf{a}(X_{k})\}\) is the set of directed causal edges. \(\mathbf{Ch}(X_{k})=\{X_{v}|X_{k}\in\mathbf{p}\mathbf{a}(X_{v})\}\) is the children of \(X_{k}\). In this paper, the root cause analysis problem is mapping to the intervention recognition problem. Normal data obey the observation distribution. The anomaly occurring in the microservice system is mapped into an unexpected intervention. Data with anomalies come from the intervention distribution. Hence, the intervention recognition task is formulated as [44]. **Definition 1**. : _(Intervention Recognition, IR). For a given SCM \(\mathbf{M}\), let \(\mathbf{L_{1}}\) be the observational distribution of \(\mathbf{M}\) and \(P_{m}=P(\mathbf{X}|do(\mathbf{m}))\) be the interventional distribution of a certain intervention \(do(\mathbf{m})\). Intervention recognition is to find \(\mathbf{m}\) based on \(\mathbf{L_{1}}\) and \(P_{m}\)._  
**Theorem 1**. : _(Intervention Recognition Criterion) Let \(\mathbf{G}\) be a CBN and \(\mathbf{pa(X_{k})}\) be the parents of \(X_{k}\) in \(\mathbf{G}\).