FaultInsight: Dynamic Causal Discovery

• FaultInsight is a dynamic causal discovery method that analyzes host metric time series to identify causal paths and root-cause indicators in hyperscale data centers.
• It employs a TCN-based semantic decoupling autoencoder and latent VAR to capture multi-scale temporal dependencies and perform perturbation experiments to quantify causal impacts.
• It achieves up to 20% higher root cause identification accuracy with near real-time GPU analysis while being limited by its single-modal scope and computational complexity.

FaultInsight is a dynamic causal discovery method for host-level fault diagnosis and root cause analysis in hyperscale data centers. It is positioned as a canonical example of the metrics-based causal-discovery line in AIOps: it operates on host metric time series, learns latent temporal dependencies with a TCN-based semantic decoupling autoencoder and a latent VAR decoder, estimates time-varying causal intensity through perturbation experiments on individual metrics, and ranks root-cause indicators with dynamic PageRank. Its outputs are ranked root-cause metrics, causal strength matrices, and propagation timing points, rather than full-stack entity-level diagnoses across hosts, Pods, and services (Hou, 8 Sep 2025).

1. Position in observability-driven root cause analysis

FaultInsight is characterized as a single-modal, metric-based and single-layer method. Its input consists only of host metrics such as CPU, memory, disk I/O, and related time-series indicators. In the reviewed taxonomy of AIOps methods, it stands for the dynamic causal discovery thread, in contrast to multi-modal and cross-level approaches such as HolisticRCA. The practical objective is to identify root-cause indicators, meaning specific metrics whose abnormality triggers downstream abnormalities, and to do so with interpretable causal evidence rather than correlation alone (Hou, 8 Sep 2025).

This scope is narrower than what the same review calls full-stack observability, which spans the resource or infrastructure layer, the container layer, and the service or application layer, together with metrics, logs, and traces. FaultInsight does not ingest logs or traces, does not connect entities across layers, and does not reconstruct propagation chains that traverse host, Pod, and service boundaries. Its causal graph is therefore a graph over host metrics, not a heterogeneous graph over infrastructure and application entities.

The method’s design reflects a specific operational trade-off. By relying only on standard host metrics, it uses signals that are widely available and cheap to collect. A plausible implication is that FaultInsight is easiest to deploy in environments where metric pipelines are mature but log and trace integration is incomplete.

2. Metric representation and preprocessing pipeline

FaultInsight models host observability data as a metric time-series matrix

$X \in \mathbb{R}^{M \times T},$

where $M$ is the number of metrics and $T$ is the number of time steps, with $X_{i,t}$ denoting the value of metric $i$ at time $t$. Before causal analysis, the metric streams are denoised, normalized, and time-aligned so that all metrics share a common temporal grid (Hou, 8 Sep 2025).

The preprocessing stage serves two roles. First, it reduces nuisance variation caused by noise and sampling irregularity. Second, it converts heterogeneous host indicators into a synchronized multivariate signal suitable for temporal representation learning. The review specifically notes noise removal, normalization such as z-score normalization, and temporal alignment as the relevant operations.

Because the method is restricted to host metrics, the preprocessing problem is comparatively homogeneous relative to multi-modal RCA. There is no need to align textual log events or distributed trace spans with the metric matrix. This simplifies data preparation, but it also constrains the method’s causal vocabulary to metric interactions only.

3. TCN-based semantic decoupling autoencoder and latent VAR

FaultInsight uses a Temporal Convolutional Network (TCN) as encoder and a decoder equipped with a latent Vector Autoregression (VAR) model. The encoder consumes multi-metric temporal windows from $X$, applies multi-scale convolution kernels such as kernel sizes 3, 5, and 7 to capture short- and long-term dependencies, and incorporates an attention-based semantic decoupling mechanism to reduce interference among different metrics’ semantics. The encoder output is a latent representation $Z$, in which each metric or metric group is mapped to a latent vector (Hou, 8 Sep 2025).

Temporal evolution in the latent space is modeled as

$Z_t = \sum_{k=1}^{K} A_k Z_{t-k} + \varepsilon_t,$

where $Z_t \in \mathbb{R}^d$ is the latent state at time $M$0, $M$1 are learned VAR coefficient matrices, $M$2 is the VAR order, and $M$3 is residual noise. The decoder uses this latent dynamics together with a decoding network to reconstruct the original time series $M$4, with training driven by reconstruction loss such as

$M$5

This architecture gives FaultInsight two distinct modeling layers. The TCN encoder captures local and multi-scale temporal patterns, while the latent VAR imposes explicit autoregressive structure in latent space. The review presents this combination as the foundation on which later perturbation-based causal discovery is built: the model first learns a predictive latent representation of the normal temporal dependencies among metrics, then uses perturbations to test which dependencies are causally consequential.

4. Chronological perturbation and causal intensity estimation

The central causal-discovery mechanism is a sequence of temporal perturbation experiments. For each metric $M$6, FaultInsight randomly shuffles the time order of metric $M$7’s series while leaving all other metrics unchanged. This operation destroys the temporal structure of that metric while preserving its marginal distribution. The perturbed data are then fed through the trained model, and the change in prediction error for every other metric $M$8 is used to estimate causal influence (Hou, 8 Sep 2025).

For metric $M$9 at time $T$0, the causal intensity is defined as

$T$1

If scrambling metric $T$2 significantly worsens the prediction of metric $T$3, FaultInsight interprets $T$4 as a likely cause of changes in $T$5. Larger values of $T$6 indicate stronger estimated causal effect. Aggregating these values over time yields a causal intensity matrix $T$7, whose entry $T$8 summarizes the causal impact of metric $T$9 on metric $X_{i,t}$0.

The method then interprets $X_{i,t}$1 as a directed weighted graph whose nodes are metrics and whose edge weights are causal strengths. A dynamic PageRank procedure is applied to this graph in order to rank metrics as root-cause indicators. The review notes the standard PageRank form

$X_{i,t}$2

with $X_{i,t}$3 a row-normalized adjacency matrix derived from $X_{i,t}$4, $X_{i,t}$5 a damping factor, and $X_{i,t}$6 a personalization vector, while also noting that FaultInsight’s own parameter settings for dynamic PageRank are not well documented. The end product is a ranked list of root-cause metrics together with causal strength matrices and estimated propagation times.

This interpretability is metric-centric. FaultInsight explains failures as causal chains among host metrics and provides explicit propagation timing points. It does not directly localize faulty services or Pods, and it does not fuse causal cues from logs or traces.

5. Empirical profile and reported strengths

FaultInsight is described as strong in causal interpretability, accuracy, and practicality. Its interpretability derives from explicit causal strength matrices and propagation timing outputs. Its practicality derives from using readily available metrics only, yielding low deployment cost, and from GPU acceleration that supports near real-time analysis. The reviewed assessment also states that FaultInsight achieves 15–20% higher root cause identification accuracy than Granger causality and VAR-based methods, and that its experiments include multiple baselines and ablations (Hou, 8 Sep 2025).

When re-evaluated as a baseline in a full-stack observability study on an enterprise production dataset, FaultInsight attains Entity F1 = 77.1%, Fault type Macro-F1 = 79.5%, Causal chain accuracy = 68.3%, and Inference latency = 4.5 s. In that evaluation, it uses only the metric portions of the datasets, including the enterprise production dataset with 2,000 servers, 10,000 Pods, 300 services, 30 metric types, 500M logs, 8M traces, and 150 real faults. The same study also evaluates FaultInsight on the Alibaba Cluster Trace Dataset V2 and the AIOps Challenge 2023 dataset, again restricting it to metric data.

These results should be interpreted carefully. The stronger qualitative claims—causal strength matrices, propagation timing, low deployment cost, and near real-time GPU execution—describe the method in its intended host-metric setting. The entity-level F1 and fault-type Macro-F1 figures come from a later full-stack benchmark where FaultInsight is used as a baseline outside its native single-layer scope.

6. Limitations, comparative position, and subsequent extensions

The reviewed literature identifies four main limitations. First, FaultInsight uses a single data source, namely metrics only, so it ignores error messages and call-latency paths contained in logs and traces. Second, it has a single-layer scope, limited to hosts, so it cannot directly handle Pod scheduling issues, service timeouts, or other application-level failures. Third, its perturbation procedure has high computational complexity, and the review states that metric dimensions above 100 become problematic. Fourth, it has insufficient robustness in the presence of hidden variables, unmonitored resource contention, missing metrics, and noisy data, all of which can bias causal estimates (Hou, 8 Sep 2025).

These limitations define its comparative position relative to HolisticRCA. FaultInsight offers explicit temporal causality modeling through the TCN encoder, latent VAR, perturbation-based inference, causal intensity matrix, and dynamic PageRank. HolisticRCA, by contrast, is described as multi-modal and cross-level, using metrics, logs, and traces together with heterogeneous graphs, Graph Attention Networks, and mask learning, but it lacks explicit temporal causality modeling. The review summarizes this complementarity succinctly: FaultInsight has great temporal causality, poor multimodal/cross-level coverage, whereas HolisticRCA has great multimodal/cross-level coverage, poor temporal causality.

This contrast motivates later frameworks such as KylinRCA, which explicitly combine FaultInsight’s temporal causal discovery with multi-modal, cross-level graph reasoning. In that later formulation, the same causal-intensity equation is retained but extended with segmented perturbations and applied to multiple layers; causal edges are then embedded into a larger heterogeneous graph for entity localization and type classification. The future directions associated with this line of work include integrating multi-modal data, extending causal discovery from single hosts to host–Pod–service chains, using metric clustering and incremental causal computation for efficiency, validating causal links with topology knowledge and interventions, incorporating LLMs for richer diagnostic explanations, and moving from post-hoc diagnosis toward predictive RCA.

Within that trajectory, FaultInsight remains a narrowly focused but technically distinctive method: a host-metric, dynamic causal discovery system whose main contribution is to make temporal causal structure explicit in metric-based RCA, while leaving cross-modal and cross-level reasoning to subsequent frameworks.