# A Causal Approach to Detecting Multivariate Time-series Anomalies and Root Causes

arXiv: https://arxiv.org/abs/2206.15033 · HTML: https://mlsanity.com/paper/2206.15033/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 56 references that are in the map.
- First posted on arXiv 30 Jun 2022.

## Builds on (most cited first, 13 of 13)

- [Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding](https://mlsanity.com/paper/1802.04431/) (2018)
- [A Multimodal Anomaly Detector for Robot-Assisted Feeding Using an LSTM-based Variational Autoencoder](https://mlsanity.com/paper/1711.00614/) (2017)
- [A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data](https://mlsanity.com/paper/1811.08055/) (2018)
- [Causal Inference and Causal Explanation with Background Knowledge](https://mlsanity.com/paper/1302.4972/) (2013)
- [Multivariate Time-series Anomaly Detection via Graph Attention Network](https://mlsanity.com/paper/2009.02040/) (2020)
- [Time-Series Anomaly Detection Service at Microsoft](https://mlsanity.com/paper/1906.03821/) (2019)
- [Learning Equivalence Classes of Bayesian Networks Structures](https://mlsanity.com/paper/1302.3566/) (2013)
- [Anomaly Detection and Failure Root Cause Analysis in (Micro)Service-Based Cloud Applications: A Survey](https://mlsanity.com/paper/2105.12378/) (2021)
- [Graph-Augmented Normalizing Flows for Anomaly Detection of Multiple Time Series](https://mlsanity.com/paper/2202.07857/) (2022)
- [Autoregressive Convolutional Neural Networks for Asynchronous Time Series](https://mlsanity.com/paper/1703.04122/) (2017)
- [Choosing Between Methods of Combining p-values](https://mlsanity.com/paper/1707.06897/) (2017)
- [The Kernel Mixture Network: A Nonparametric Method for Conditional Density Estimation of Continuous Random Variables](https://mlsanity.com/paper/1705.07111/) (2017)
- [Localizing Faults in Cloud Systems](https://mlsanity.com/paper/1803.00356/) (2018)

## Built on by (most cited first, 8 of 8)

- [RealTCD: Temporal Causal Discovery from Interventional Data with Large Language Model](https://mlsanity.com/paper/2404.14786/) (2024)
- [On Root Cause Localization and Anomaly Mitigation through Causal Inference](https://mlsanity.com/paper/2212.04031/) (2022)
- [Open Challenges in Time Series Anomaly Detection: An Industry Perspective](https://mlsanity.com/paper/2502.05392/) (2025)
- [Robust Root Cause Diagnosis using In-Distribution Interventions](https://mlsanity.com/paper/2505.00930/) (2025)
- [Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures](https://mlsanity.com/paper/2507.14387/) (2025)
- [PORCA: Root Cause Analysis with Partially Observed Data](https://mlsanity.com/paper/2407.05869/) (2024)
- [CaPulse: Detecting Anomalies by Tuning in to the Causal Rhythms of Time Series](https://mlsanity.com/paper/2508.04630/) (2025)
- [Industrial-Grade Time-Dependent Counterfactual Root Cause Analysis through the Unanticipated Point of Incipient Failure: a Proof of Concept](https://mlsanity.com/paper/2407.11056/) (2024)

## Abstract (arXiv)

Detecting anomalies and the corresponding root causes in multivariate time series plays an important role in monitoring the behaviors of various real-world systems, e.g., IT system operations or manufacturing industry. Previous anomaly detection approaches model the joint distribution without considering the underlying mechanism of multivariate time series, making them computationally hungry and hard to identify root causes. In this paper, we formulate the anomaly detection problem from a causal perspective and view anomalies as instances that do not follow the regular causal mechanism to generate the multivariate data. We then propose a causality-based framework for detecting anomalies and root causes. It first learns the causal structure from data and then infers whether an instance is an anomaly relative to the local causal mechanism whose conditional distribution can be directly estimated from data. In light of the modularity property of causal systems (the causal processes to generate different variables are irrelevant modules), the original problem is divided into a series of separate, simpler, and low-dimensional anomaly detection problems so that where an anomaly happens (root causes) can be directly identified. We evaluate our approach with both simulated and public datasets as well as a case study on real-world AIOps applications, showing its efficacy, robustness, and practical feasibility.