Unifying Explainable Anomaly Detection and Root Cause Analysis in Dynamical Systems

2025-02-17

AI Summary

This paper addresses three core challenges—abnormality detection, root cause localization, and anomaly type classification—in dynamic systems modeled by ordinary differential equations (ODEs), distinguishing between propagation anomalies (cross-variable) and local anomalies (single-variable). We propose ICODE, the first *model-intrinsic interpretability* framework for ODE-based time-series modeling: it integrates causal inference into Neural ODEs to jointly perform detection and temporal root cause explanation; theoretically establishes the mapping between ODE parameter perturbations and causal structure changes. Methodologically, ICODE unifies differentiable temporal modeling, causal explanation pathways, and parameter sensitivity analysis. Evaluated across diverse dynamical systems, it achieves significantly improved detection accuracy, pinpoints root causes at both variable-level and fine-grained temporal segments, and attains an F1-score exceeding 0.89 for anomaly type classification.

Technology Category

• Reasoning under Uncertainty: Causality
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Machine Learning: Causal Learning

Application Category

• Graph Algorithms and Modeling for the Web: Algorithms and analysis for heterogeneous, signed, attributed, multi-relational, temporal, higher-order, and annotated Web-related graphs
• User Modeling, Personalization and Recommendation: Explainable and interpretable methods for personalization
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Dynamical systems, prevalent in various scientific and engineering domains, are susceptible to anomalies that can significantly impact their performance and reliability. This paper addresses the critical challenges of anomaly detection, root cause localization, and anomaly type classification in dynamical systems governed by ordinary differential equations (ODEs). We define two categories of anomalies: cyber anomalies, which propagate through interconnected variables, and measurement anomalies, which remain localized to individual variables. To address these challenges, we propose the Interpretable Causality Ordinary Differential Equation (ICODE) Networks, a model-intrinsic explainable learning framework. ICODE leverages Neural ODEs for anomaly detection while employing causality inference through an explanation channel to perform root cause analysis (RCA), elucidating why specific time periods are flagged as anomalous. ICODE is designed to simultaneously perform anomaly detection, RCA, and anomaly type classification within a single, interpretable framework. Our approach is grounded in the hypothesis that anomalies alter the underlying ODEs of the system, manifesting as changes in causal relationships between variables. We provide a theoretical analysis of how perturbations in learned model parameters can be utilized to identify anomalies and their root causes in time series data. Comprehensive experimental evaluations demonstrate the efficacy of ICODE across various dynamical systems, showcasing its ability to accurately detect anomalies, classify their types, and pinpoint their origins.

Problem

• Anomaly detection in dynamical systems
• Root cause analysis of anomalies
• Classification of anomaly types

Innovation

• Neural ODEs for anomaly detection
• Causality inference for root analysis
• Single framework for anomaly tasks