# Hi-RCA: A Hierarchy Anomaly Diagnosis Framework Based on Causality and Correlation Analysis
## 4 Experiment
### Discussion  
In this subsection, we first discuss the performance impact of experiment parameters in Hi-RCA, and then analyze the overhead and limitations of Hi-RCA.  
**Parameters.** In Hi-RCA, there are two main parameters: time window length \(l\) of Kalman filtering in the _Anomalous Microservice Locator_ and anomaly threshold \(\alpha\) in the CPG construction process. For time window length \(l\), which denotes the data length used in Kalman filtering, we observe the _PR@1_, _PR@2_, and _PR@3_ precision of all datasets with increasing \(l\) from 10 min to 60 min. As shown in Figure 4, the longer the data length we use, the lower the precision of the root cause microservice localization. The reason is that with the data length increasing, Kalman filtering tends to fit the data distribution on long-time data, which may contain bigger noise, which decreases the diagnosis performance. In Hi-RCA, we set \(l\) as 10, i.e., data length of 10 min, which is easy to realize in practical systems.  
For the threshold of anomaly propagation, i.e., \(\alpha\), we observe the _PR@1_, _PR@2_, and _PR@3_ precision of all datasets with increasing \(\alpha\) from 0.5 to 0.98. As shown in Figure 5a, we present location performance with \(\alpha\) ranging from 0.5 to 0.9. It can be observed that the precision of diagnosis does not increase with the threshold increasing, because a small threshold will select many normal relations as the anomaly propagation, which decreases the location performance. As shown in Figure 5b, we present location performance with \(\alpha\) ranging from 0.9 to 0.98. It can be observed that the precision of diagnosis decreases as the threshold increases, because a larger threshold denotes a stricter definition of anomaly propagation, which may miss the true anomaly propagation. In Hi-RCA, we set \(\alpha\) as 0.9, which may not be suitable for other microservice systems. In other systems, the threshold can be set as the maximum score obtained from normal data.  
**Overhead.** Since the _Anomalous Microservice Locator_ processes all of the metric data, while the _Anomalous Reason Diagn_ only analyzes anomalous metrics of the root cause microservice, the overhead of Hi-RCA is mostly caused by Kalman filtering, which is the main algorithm in the _Anomalous Microservice Locator_. From [50], the complexity of a single application of Kalman filtering is denoted as \(O(p^{2.4}+q^{2})\), where \(p\) is the dimension of observation, which is 10 in Hi-RCA; \(q\) is the number of states, which is 1 in the one-dimensional time series. The factor 2.4 comes from matrix inversion. In the _Anomalous Microservice Locator_, all of the microservices' monitored metrics are processed. Therefore, the total complexity is \(M*N*O(p^{2.4}+q^{2})\), where \(M\) is the number of microservices in the system, and \(N\) is the number of monitored metrics. For large-scale systems, Hi-RCA can be implemented with other anomaly detection methods to narrow the anomaly scope and shorten the evaluation time.  
**Limitations.** In the _Anomalous Microservice Locator_, we adopt a Kalman filtering to quantify microservice anomaly, based on two assumptions. (1) Metrics come from a linear system and (2) data noise obeys the Gaussian distribution. Although these are not strong assumptions, there may exist other systems that do not satisfy the above assumptions. In the _Anomalous Reason Diagnoser_, we transfer the anomaly metric classification as the intervention recognition task; owing to the complex relationship of metrics, we only choose four meta-metrics, and we consider expanding the causal graph in our future work.