🤖 AI Summary
Causal discovery from binary alarm sequences in large-scale systems remains challenging due to the joint requirements of computational efficiency, sparse dependency modeling, and semantic capture of state transitions.
Method: This paper proposes the first causal inference framework specifically designed for binary anomaly data. It introduces a sparse causal testing mechanism based on an improved Granger causality test, integrating flag-sequence feature encoding, adaptive graph-structure learning, and dynamic edge pruning.
Contribution/Results: The framework explicitly models both the state-transition semantics and extreme sparsity inherent in binary data—novelty not addressed by prior work. By combining link compression with accuracy-aware pruning, it achieves scalable yet precise causal discovery. Evaluated on the CMS detector readout box system and IT monitoring datasets, it significantly reduces computational overhead while improving causal F1-score by a medium margin, thereby enabling effective real-time root-cause diagnosis.
📝 Abstract
Extracting anomaly causality facilitates diagnostics once monitoring systems detect system faults. Identifying anomaly causes in large systems involves investigating a more extensive set of monitoring variables across multiple subsystems. However, learning causal graphs comes with a significant computational burden that restrains the applicability of most existing methods in real-time and large-scale deployments. In addition, modern monitoring applications for large systems often generate large amounts of binary alarm flags, and the distinct characteristics of binary anomaly data -- the meaning of state transition and data sparsity -- challenge existing causality learning mechanisms. This study proposes an anomaly causal discovery approach (AnomalyCD), addressing the accuracy and computational challenges of generating causal graphs from binary flag data sets. The AnomalyCD framework presents several strategies, such as anomaly flag characteristics incorporating causality testing, sparse data and link compression, and edge pruning adjustment approaches. We validate the performance of this framework on two datasets: monitoring sensor data of the readout-box system of the Compact Muon Solenoid experiment at CERN, and a public data set for information technology monitoring. The results demonstrate the considerable reduction of the computation overhead and moderate enhancement of the accuracy of temporal causal discovery on binary anomaly data sets.