# NetCause: Counterfactual Learning for Root Cause Analysis in Large-Scale Networks

arXiv: https://arxiv.org/abs/2606.13543 · HTML: https://mlsanity.com/paper/2606.13543/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 26 references that are in the map.
- First posted on arXiv 11 Jun 2026.

## Builds on (most cited first, 11 of 11)

- [Neural Message Passing for Quantum Chemistry](https://mlsanity.com/paper/1704.01212/) (2017)
- [World Models](https://mlsanity.com/paper/1803.10122/) (2018)
- [Neural Relational Inference for Interacting Systems](https://mlsanity.com/paper/1802.04687/) (2018)
- [Estimating Counterfactual Treatment Outcomes over Time Through Adversarially Balanced Representations](https://mlsanity.com/paper/2002.04083/) (2020)
- [Automatic Root Cause Analysis via Large Language Models for Cloud Incidents](https://mlsanity.com/paper/2305.15778/) (2023)
- [Causal structure based root cause analysis of outliers](https://mlsanity.com/paper/1912.02724/) (2019)
- [Exploring LLM-based Agents for Root Cause Analysis](https://mlsanity.com/paper/2403.04123/) (2024)
- [Assumption violations in causal discovery and the robustness of score matching](https://mlsanity.com/paper/2310.13387/) (2023)
- [CausalRCA: Causal Inference based Precise Fine-grained Root Cause Localization for Microservice Applications](https://mlsanity.com/paper/2209.02500/) (2022)
- [Root Cause Analysis of Outliers with Missing Structural Knowledge](https://mlsanity.com/paper/2406.05014/) (2024)
- [The PetShop Dataset -- Finding Causes of Performance Issues across Microservices](https://mlsanity.com/paper/2311.04806/) (2023)

## Abstract (arXiv)

Can a learned model capture how faults propagate through a large-scale network and use this knowledge to causally attribute customer impact to its underlying root cause? Existing root cause analysis techniques often rely on static rules, correlation heuristics, or topology-local reasoning, which struggle to generalize in dynamic environments where faults propagate across complex physical and logical dependencies. We present NetCause, a self-supervised learning-based framework that models network incidents as graph-temporal processes and uses counterfactual simulation to rank candidate root causes. This approach produces an interpretable ranking of root cause hypotheses and integrates naturally with operator-defined mitigation and remediation actions. We train the model on over 1,500 incidents collected over six months from a leading cloud provider's production network and evaluate it on 31 expert-labeled incidents. NetCause consistently improves root cause ranking quality in the regime most relevant to operational decision-making, achieving a 16.1% accuracy improvement over a rule-based heuristic baseline. While training is computationally intensive, inference is lightweight, requiring only seconds of GPU runtime per incident (well below typical telemetry collection latencies).