# Hi-RCA: A Hierarchy Anomaly Diagnosis Framework Based on Causality and Correlation Analysis
## 3 Model
### Anomalous Microservice Locator  
Since a microservice system consists of several microservices with various monitored metrics, we propose a step-by-step diagnosis strategy to decrease the computational burden. In the first module, the _Anomalous Microservice Locator_ needs to find the anomalous microservice among all microservices in the system. However, valuable information is submerged in numerous monitoring data. A microservice has many monitored metrics with various magnitudes, periodicity, etc. Customizing an anomaly evaluator for diverse metrics is unrealistic. In this paper, we design an _Anomalous Microservice Locator_, adopting Kalman filtering [41] and calculating the estimation error to evaluate metrics' abnormality.  
Kalman filtering is used for the following reasons. (1) There exists system noise in the data collection process, causing burrs and fluctuations in normal data, which can be smoothed with Kalman filtering. (2) When the system is in a normal condition, system noise can be regarded as white noise; when an anomaly occurs, anomaly data will exhibit a significant difference from normal data. Therefore, the optimal estimation based on normal data will not be able to fit abnormal points, so we use the estimation error to quantify the metric abnormality.  
**Kalman filtering**[41]. Kalman filtering is an optimal state estimation process applied to a dynamic linear system that involves random perturbations, and it has been widely used in many areas of industrial, even complicated real-time applications.  
Consider a linear system with a state space description  
\[x_{k}=Ax_{k-1}+Bu_{k-1}+\omega_{k-1} \tag{1}\]  
\[Z_{k}=Hx_{k}+v_{k} \tag{2}\]  
where \(A\) and \(B\) are known constant matrices. \(x_{k}\) is the system state, i.e., the estimation variable. \(\omega_{k}\) and \(v_{k}\) are, respectively, unknown system and observation noise sequences. \(Z_{k}\) is the observed sequence. \(H\) is the state observation matrix. Then, the a priori estimation \(\hat{x}_{k^{-}}\) can be derived as  
\[\hat{x}_{k^{-}}=A\hat{x}_{k-1^{-}}+Bu_{k-1} \tag{3}\]  
\[P_{k^{-}}=AP_{k-1}A^{\top}+Q \tag{4}\]  
The optimal estimation (i.e., a posteriori state estimation) of \(x\) is \(\hat{x}_{k}\):  
\[\hat{x}_{k}=\hat{x}_{k^{-}}+K_{k}(z_{k}-H\hat{x}_{k^{-}}) \tag{5}\]  
\[P_{k}=(I-K_{k}H)P_{k^{-}} \tag{6}\]  
\[K_{k}=\frac{P_{k^{-}}H^{\top}}{HP_{k^{-}}H^{T}+R} \tag{7}\]  
where \(P_{k}\) is the estimate (error) covariance matrix, \(K_{k}\) is the Kalman gain, and it represents the ratio of model predicted error and measurement error in the optimal estimation process.  
**Estimation error-based anomaly evaluation.** Given the time window \(T\), for a microservice \(i\), the metric data of its \(j\)th metric (i.e., KPI) is a time series, \(\mathbf{X}_{i,j}^{T}\).  
Figure 1: Hi-RCA anomaly diagnosis procedures.  
At time \(t\), the monitored (observed) value is \(x_{i,j}^{t}\). At each time \(t\), we compute the optimal estimation \(\hat{x}_{i,j}^{t}\). The anomaly severity of \(x_{i,j}^{t}\) is computed as the estimation error between the observed value \(x_{i,j}^{t}\) and the estimated value \(\hat{x}_{i,j}^{t}\):  
\[s_{i,j}^{t}=|\frac{x_{i,j}^{t}-\hat{x}_{i,j}^{t}}{\hat{x}_{i,j}^{t}}| \tag{8}\]  
For a microservice \(i\), its anomaly severity of \(x_{i}^{t}\) is denoted as the summarization of all its KPIs:  
\[s_{i}^{t}=\sum_{j}s_{i,j}^{t} \tag{9}\]  
Then, based on the anomaly score, root cause microservice \(m_{rc}\) is pinpointed as the microservice with the highest anomaly score:  
\[m_{rc}=\operatorname*{arg\,max}_{i}(s_{i}^{t}) \tag{10}\]