# On the Fly Detection of Root Causes from Observed Data with Application to IT Systems

arXiv: https://arxiv.org/abs/2402.06500 · HTML: https://mlsanity.com/paper/2402.06500/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 25 references that are in the map.
- First posted on arXiv 9 Feb 2024.

## Builds on (most cited first, 6 of 6)

- [Detecting causal associations in large nonlinear time series datasets](https://mlsanity.com/paper/1702.07007/) (2017)
- [Causal structure based root cause analysis of outliers](https://mlsanity.com/paper/1912.02724/) (2019)
- [Causal Inference-Based Root Cause Analysis for Online Service Systems with Intervention Recognition](https://mlsanity.com/paper/2206.05871/) (2022)
- [Why did the distribution change?](https://mlsanity.com/paper/2102.13384/) (2021)
- [Root Cause Identification for Collective Anomalies in Time Series given an Acyclic Summary Causal Graph with Loops](https://mlsanity.com/paper/2303.04038/) (2023)
- [Case Studies of Causal Discovery from IT Monitoring Time Series](https://mlsanity.com/paper/2307.15678/) (2023)

## Built on by (most cited first, 2 of 2)

- [EvoCause: LLM-Guided Evolution of Causal Graphs for Root Cause Analysis](https://mlsanity.com/paper/2607.27290/) (2026)
- [Root cause analysis via difference graph discovery from linear time-series data](https://mlsanity.com/paper/2608.21117/) (2026)

## Abstract (arXiv)

This paper introduces a new structural causal model tailored for representing threshold-based IT systems and presents a new algorithm designed to rapidly detect root causes of anomalies in such systems. When root causes are not causally related, the method is proven to be correct; while an extension is proposed based on the intervention of an agent to relax this assumption. Our algorithm and its agent-based extension leverage causal discovery from offline data and engage in subgraph traversal when encountering new anomalies in online data. Our extensive experiments demonstrate the superior performance of our methods, even when applied to data generated from alternative structural causal models or real IT monitoring data.