# Hi-RCA: A Hierarchy Anomaly Diagnosis Framework Based on Causality and Correlation Analysis
## 1 Introduction  
Microservice architecture (MSA) has been widely adopted in domains such as the Internet of Things [1] and mobile and cloud [2] services for its scalability, flexibility, and resilience. MSA decomposes an application into small-scale and single-function microservices which cooperate through lightweight intercommunication [3]. Hence, an MSA-based system contains numerous components and processes, with complex structures and dynamic interactions, where diagnosing anomalies is particularly important. With the aid of monitoring tools and anomaly detection techniques, a large number of system measurements, such as hardware resource consumption, can be observed. Based on such measurements (i.e., metric data), several meaningful methods have been proposed to pinpoint the anomaly culprit. A common method is to construct the relationship graph of metrics, and pinpoint the root cause metric through the random walking algorithm on the dependency graph [4; 5; 6; 7]. However, automatic diagnosis of root causes from the observed data is difficult owing to the following challenges. * _Limitation by anomaly data volume._ Most of the existing research adopts causal inference techniques to obtain the variables' causality, which requires sufficient length of the anomaly data. However, in real situations, the anomaly duration is an uncontrollable variable. When anomaly data do not satisfy the requirements of causal inference methods, untrusted pseudo-causality will arise, which limits, or even worsens, the diagnosis performance. * _Over-simplification of metric relationships._ Since the relationship between diverse monitored metrics is complex, causation and correlation exist simultaneously. Existingresearch oversimplifies the metric relationship either as causation or correlation. In fact, correlation does not imply causation. * _Lack of diagnosing interpretability._ Under multiple anomaly types and anomaly cascading, anomaly symptoms are diverse; hence, interpretability for the diagnosis results is important. Anomaly diagnosis requires not only locating the root cause, but also explaining the logic behind anomaly symptoms. For example, a CPU hog occurs at a microservice, causing both CPU metrics and memory metrics to increase. Without the explanation of anomaly symptoms, i.e., the original CPU anomaly propagates to memory, engineers may not trust the diagnosis results, because memory can also be a possible cause. To address the above challenges, we propose a hierarchy framework, named Hi-RCA. Hi-RCA consists of two diagnosis phases. In the first phase, it pinpoints the anomalous microservice, using the Kalman filtering approach to quantify the microservice abnormality based on the self-contrastive evaluation. In the second phase, it designs a hierarchy-diagnosing method that analyzes the metric causation and correlation separately. Firstly, Hi-RCA transfers the anomaly detection into the causal inference, i.e., the intervention recognition task. Secondly, it constructs the directed anomaly propagation graph based on the metric correlation and anomaly propagation characteristics. The reason for the anomaly is located based on the propagation graph comparison. Therefore, Hi-RCA not only pinpoints the reason for the anomaly, but also infers a directed anomaly propagation graph, to explain the anomaly symptoms. Experimental results show that Hi-RCA has high diagnostic precision in 164 anomaly cases involving different anomaly types. For top three precision, compared to the best baseline, its accuracy improvement ranges from 5%\(\sim\)38% in different datasets. Our contribution can be summarized as follows. * We propose a general anomaly evaluator using Kalman filtering, which requires no expert knowledge and is general for various metrics with different characteristics. * We use the intervention recognition task to identify anomalous metrics, to avoid the causal inference performance being limited by anomaly data distribution, which utilizes the causation change in metrics for accurate anomaly diagnosis.