# Anomaly Detection and Root Cause Analysis for Microservice Systems

arXiv: https://arxiv.org/abs/2606.09942 · HTML: https://mlsanity.com/paper/2606.09942/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 193 references that are in the map.
- First posted on arXiv 8 Jun 2026.

## Builds on (most cited first, 9 of 9)

- [An Evaluation of Change Point Detection Algorithms](https://mlsanity.com/paper/2003.06222/) (2020)
- [Constructing Large-Scale Real-World Benchmark Datasets for AIOps](https://mlsanity.com/paper/2208.03938/) (2022)
- [AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges](https://mlsanity.com/paper/2304.04661/) (2023)
- [Adaptive Root Cause Localization for Microservice Systems with Multi-Agent Recursion-of-Thought](https://mlsanity.com/paper/2508.20370/) (2025)
- [PyRCA: A Library for Metric-based Root Cause Analysis](https://mlsanity.com/paper/2306.11417/) (2023)
- [Graph-Free Root Cause Analysis](https://mlsanity.com/paper/2601.21359/) (2026)
- [TVDiag: A Task-oriented and View-invariant Failure Diagnosis Framework with Multimodal Data](https://mlsanity.com/paper/2407.19711/) (2024)
- [Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection](https://mlsanity.com/paper/2509.06911/) (2025)
- [Salesforce CausalAI Library: A Fast and Scalable Framework for Causal Analysis of Time Series and Tabular Data](https://mlsanity.com/paper/2301.10859/) (2023)

## Abstract (arXiv)

Microservice systems are widely used to build cloud applications, yet their complexity makes failures inevitable, degrading user experience and causing economic loss. Automated anomaly detection and root cause analysis (RCA) are now active research areas, but existing techniques share five limitations. First, most treat anomaly detection and RCA separately, assuming anomalies are detected correctly, and falter when detection is imprecise due to noise or delay. Second, they focus on metrics, logs, and traces, leaving event data such as API calls and configuration changes underexplored. Third, many require a given service call graph and cannot diagnose without one. Fourth, the field lacks standardised datasets and evaluation frameworks, so methods are hard to compare fairly. Fifth, although causal inference-based RCA has become dominant, its effectiveness, efficiency, and robustness remain unclear. This thesis addresses these limitations through two groups of contributions. The first introduces methods that exploit observability data both independently and collectively. BARO is an end-to-end anomaly detection and RCA approach for metric data. EventADL is an end-to-end framework for event data. TORAI is a multimodal RCA framework that requires no service call graph. Extensive experiments on real microservice systems demonstrate their effectiveness and robustness. The second group delivers benchmarking datasets, an evaluation framework, and systematic evaluation efforts. RCAEval is a comprehensive benchmark providing ready-to-use datasets and reproducible baselines for future research. A systematic evaluation of existing RCA methods, especially causal inference-based approaches, offers insights that guide future directions. This thesis thereby advances automated anomaly detection and RCA for microservice failures, enabling future research on incident mitigation and remediation.