# Hi-RCA: A Hierarchy Anomaly Diagnosis Framework Based on Causality and Correlation Analysis
## 3 Model
### Anomalous Reason Diagroser
Under the Faithfulness assumption, \(X_{k}\) is intervened iff \(X_{k}\) no longer follows the distribution defined by \(\mathbf{pa(X_{k})}\), i.e., \(X_{k}\in\mathbf{M}\Leftrightarrow P_{\mathbf{m}}(x_{k}|\mathbf{pa(x_{k})})\
eq\mathbf{L_{1}}(x _{k}|\mathbf{pa(x_{k})})\)._  
**Intervention recognition-based anomaly detection. ** Since the observation data and the intervention data come from two different distributions, instead of comparing two distributions directly, the intervention recognition criterion is reformulated as hypothesis testing, because it is difficult to obtain the complete distribution of the anomaly data. Similar to [44], we use regression-based hypothesis testing to recognize the abnormal metrics. Those metrics that no longer obey the normal distribution are identified as anomalous metrics, i.e., \(x_{k}^{t}\
sim L_{1}(x_{i}^{t}|\mathbf{pa}^{(t)}(x_{k}))\). The regression model is used to calculate the expected distribution \(\mathbf{L_{1}}(x_{i}^{t}|\mathbf{pa}^{(t)}(x_{k}))\). We train a regression model for each variable using the normal data, as the proxy fitting of the structural equation. We calculate the residual of the regression value and observed value \(x_{k}^{t}\). We assume the residual follows the normal distribution \(N(\mu_{\varepsilon,k},\sigma_{\varepsilon,k})\). Metric \(x_{k}\) is abnormal if its residual is out of the normal distribution. In order to perform efficient dependency construction from complex relationships, Hi-RCA selects four meta-metrics to model and monitor dependent changes in causality between metrics: workload, CPU utilization, memory utilization, and file system (fs) utilization. The procedures of intervention are presented in Figure 2. As shown in Figure 2, we model the causal relationship between four meta-metrics; directed arrows denote the causal relationships, and the dotted line indicates potential causation. In Figure 2, we present an example where the CPU node is intervened, then its causation changes, i.e., it does not obey the distribution given its parent (workload) and generates new causations to the fs node and memory node. Then, the CPU node is recognized as the intervened node, i.e., anomalous node. Based on the intervened nodes, we construct the anomaly knowledge graph for root cause localization. **Construction of anomaly knowledge graph (AKG). ** Based on the intervention recognition task, we expand the causal graph \(G\) into the anomaly knowledge graph (AKG). Assume the anomalous set \(\mathcal{O}\) is recognized as the intervened nodes. For each node \(o\), the graph skeleton \(H\) is the intervened results, as shown in Figure 2. Then, we expand \(H\) into an AKG based on two rules. (1) For the same metric type, anomaly propagates from the utilization group into the failure group. (2) For different metric types, anomaly  
Figure 2: The processes of intervention recognition and anomaly knowledge graph construction. (**a**,**b**) show the process of intervention recognition. (**c**,**d**) present the construction of an anomaly knowledge graph. propagates from the parent node's failure group into the child node's utilization group. Figure 2d presents an example of AKG. **CPG-based anomaly diagnosis**. Since there exist various anomalies with different anomaly symptoms, we diagnose the root cause based on CPG, not the causality graph owing to the following reasons. (1) The anomaly period is uncertain; under a short anomaly period, it is unable to obtain the anomaly distribution, or use the existing causal inference techniques to discover the metric causation. (2) Correlation is another type of metric association that can characterize diverse anomaly symptoms. Specifically, we divide one type of metric into two groups: resource utilization and the failure group. For example, CPU-related metrics are divided into CPU usage groups and CPU failure groups. Based on the anomalous data, we generate CPG, and the correlation between groups is denoted as the maximum average correlation.