Root Cause Detection in Complex Systems

• Root Cause Detection is a family of methods that isolate the originating causes of anomalies—such as faulty log lines or malfunctioning microservices—beyond mere anomaly detection.
• These techniques employ diverse methodologies, including causal inference in dynamical systems, graph-based ranking in software repositories, and metric-based assessments in cloud systems.
• Evaluations demonstrate strong top-k localization metrics and reveal operational challenges, highlighting trade-offs between causal precision and practical applicability.

Root Cause Detection (RCD) denotes a family of methods that identify the originating cause of an observed failure or anomaly rather than merely flagging abnormal behavior. In recent work, the “root cause” may be a source variable in a multivariate dynamical system, a subsystem-time intervention, a microservice metric or service, a minimal set of log lines, a deleted code line in a bug-fixing commit, a root-cause category for flaky tests, an entity in a Kubernetes incident graph, or a compact set of aggregated elements in a multidimensional measure. A recurring theme across these formulations is that anomaly detection alone is insufficient because propagation, aggregation, and downstream symptom amplification can obscure the origin of the failure (Sun et al., 17 Feb 2025, Wittkopp et al., 2024, Pham et al., 2024, Kalander, 2022).

1. Conceptual scope and target granularity

Recent RCD work is best understood as a collection of related localization problems whose outputs differ by domain and observability regime.

Setting	Root cause object	Representative output
Dynamical systems	source variable or subsystem-time pair	anomaly type, variable index, or ranked interventions
Microservices and cloud systems	service, metric, module, type, or entity	ranked metrics/services, module/type prediction, or root-cause entity
Logs	minimal set of log lines	top-$n$ chronological candidates
Software repositories and testing	deleted line(s) or cause category	ranked deleted lines or category label
Multidimensional measures	aggregated element set	succinct root cause set

In ODE-governed multivariate time series, the task may jointly require anomaly detection, anomaly type classification, and root-cause variable identification, with the root cause defined as the source variable where the anomaly originates (Sun et al., 17 Feb 2025). In causal microservice diagnosis, a node is a root cause only if it satisfies both an anomaly condition and a fix condition: the node itself is anomalous, and if it had instead taken a usual value, the target anomaly would not have happened (Nagalapatti et al., 2 May 2025). In counterfactual RCA for dynamical systems, the candidate is explicitly localized by subsystem and time point, so the output is a ranked set of subsystem–time interventions (Weilbach et al., 2024). Log-based RCA instead seeks a minimal set of log lines within an investigation window before a known failure (Wittkopp et al., 2024). Repository-centric software RCD ranks deleted lines inside a known bug-fixing commit to identify the root-cause deletion lines whose earlier versions were the bug-introducing code (Zhang et al., 2 May 2025). Quantum software maintenance frames RCD as root-cause classification over nine predefined classes such as Randomness (PRNG), Floating Point Operations, Software Environment, and Network (Sivaloganathan et al., 2024). RiskLoc, by contrast, defines the target as a root cause set of elements in a multidimensional categorical cube that together explain an aggregate KPI anomaly while remaining succinct (Kalander, 2022). Kubernetes incident diagnosis may output both a set of classified candidate root-cause entities and a propagation chain (Kuvshinova et al., 7 Jun 2026).

This diversity implies that RCD is not a single canonical prediction problem. A plausible implication is that the central invariant is not output type but the source-versus-symptom distinction: the root cause is the object whose intervention, replacement, or removal best explains why the failure appeared and how it propagated.

2. Causal-temporal formulations in dynamical systems

A large part of the recent literature formulates RCD through dynamical models in which failures are changes to state evolution rather than isolated outliers. In Interpretable Causality Ordinary Differential Equation Networks, a multivariate system with variables $X(t)=\{x_1(t),\dots,x_p(t)\}$ is modeled as

$\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$

where $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$ is a time-varying dependency matrix. The method distinguishes two anomaly classes: a measurement anomaly corrupts the observed value but does not alter the underlying ODE, whereas a cyber anomaly perturbs the actual ODE state and propagates through dependencies. Root-cause localization is then based on changes in the learned causal matrix $C$ between normal and anomalous regimes, using $S(i)$ for measurement anomalies and $S'(i)$ for cyber anomalies after first classifying the anomaly type with $M(C,C')$ (Sun et al., 17 Feb 2025).

Counterfactual-based RCA for dynamical systems uses a dynamic structural causal model

$$Y_t^j = Y_{t-1}^j + f^j(Y^{PA(j)}_{t-1},Y_{t-1}^j)+N_t^j$$

and asks whether the observed failure would still have occurred if subsystem $j$ at time $X(t)=\{x_1(t),\dots,x_p(t)\}$0 had behaved normally. The method allows interventions on the exogenous disturbance $X(t)=\{x_1(t),\dots,x_p(t)\}$1 and on the structural equation $X(t)=\{x_1(t),\dots,x_p(t)\}$2, and reports that more root causes are identified when intervention is performed on the structural equation and the external influence, compared to an intervention on the external influence only. The ranking score is an efficient approximation to a Shapley value over node-time interventions (Weilbach et al., 2024). A related industrial proof of concept uses Dynamic Causal Bayesian Networks and the Point of Incipient Failure (PIF), defined as the earliest time

$X(t)=\{x_1(t),\dots,x_p(t)\}$3

where $X(t)=\{x_1(t),\dots,x_p(t)\}$4 is the modeled failure probability. Candidate paths are ranked at $X(t)=\{x_1(t),\dots,x_p(t)\}$5, and counterfactual recourse is used to ask whether changing a variable at the PIF would have prevented the failure signal (Trilla et al., 2024).

These formulations share a strong temporal claim: the decisive evidence for a root cause lies near the onset of abnormal evolution, not merely at the final failure state. This suggests that time-localized causal comparison—whether via $X(t)=\{x_1(t),\dots,x_p(t)\}$6, subsystem-time counterfactuals, or PIF-centered recourse—is one of the clearest ways to separate an origin from its propagated effects.

3. System operations, microservices, and cloud-native RCD

In distributed systems and microservices, recent work spans metric-only pipelines, explicit causal-graph methods, graph-agnostic mechanism tests, and knowledge-driven operational frameworks. BARO couples anomaly detection and RCA in a metric-based microservice setting. It applies Multivariate Bayesian Online Change Point Detection to Latency and Errors metrics, uses the first detected change point $X(t)=\{x_1(t),\dots,x_p(t)\}$7 as the anomaly time, and then ranks all metrics by a robust deviation score based on median and interquartile range: $X(t)=\{x_1(t),\dots,x_p(t)\}$8 The metric ranking is then mapped to root-cause services, and the method is explicitly designed to be less sensitive to imperfect anomaly timing than mean/std-based baselines (Pham et al., 2024).

CORAL turns causal-graph-based RCA into an online process. It first detects trigger points with MSSA plus CUSUM, then incrementally updates a causal DAG by disentangling state-invariant and state-dependent information, and finally localizes root causes with network propagation on the updated graph. The online RCA process stops when both the graph structure and the ranked root-cause list converge (Wang et al., 2023). IDI addresses a different failure mode of SCM-based diagnosis: prior fix-based methods assess the fix condition through counterfactuals inferred from an SCM queried on anomalous, out-of-distribution inputs. IDI preserves the anomaly-plus-fix definition of root cause but replaces counterfactual abduction with in-distribution interventions, ranking candidates or subsets through expected target-anomaly reduction and Shapley values over the candidate set $X(t)=\{x_1(t),\dots,x_p(t)\}$9 (Nagalapatti et al., 2 May 2025). StableRCA removes the need for a globally known causal graph by estimating local Markov boundaries and testing for conditional mechanism shifts,

$\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$0

with the final ranking score given by Relative Risk Variation

$\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$1

Its theoretical result states that intervention targets are identified with probability converging exponentially in sample size under faithful Markov boundary recovery and non-degenerate mechanism shifts (Lin et al., 4 Jun 2026).

Other operational systems shift emphasis from pure inference to evidence integration and auditability. CloudRCA fuses KPI anomalies, semantic log patterns, and CMDB topology in a Knowledge-informed Hierarchical Bayesian Network whose three layers are metric/log-pattern nodes, module nodes, and root-cause type nodes; inference returns a root-cause module and type rather than only a suspicious metric or service (Zhang et al., 2021). ARCAS organizes diagnosis as a constellation of Auto-TSGs expressed in a YAML DSL, runs them in parallel over telemetry and incident context, and uses an LLM to prioritize findings and actions (Demarne et al., 2024). Graph Traversal Agent represents a Kubernetes incident as a typed evidence graph $\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$2, traverses it with bounded breadth-first search under read-only tools, and validates proposed root-cause entities in a separate stage (Kuvshinova et al., 7 Jun 2026). OpsCortex separates derivation from explanation: the root cause is computed deterministically from a runtime-inferred dependency graph and the first threshold-crossing time,

$\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$3

while an LLM is used only to explain, confirm, and recommend (Seedat, 18 Jun 2026).

A common methodological tension is visible here. Some systems seek stricter causal semantics through intervention, conditional invariance, or DAG updates; others prioritize bounded search, operational memory, or executable expert knowledge. This suggests that in production settings, RCD often becomes a hybrid discipline combining causal localization, evidence engineering, and workflow control.

4. Evidence representations and scoring operators

Across domains, RCD methods differ less in whether they rank candidates than in what evidence they rank and how they normalize propagation. LogRCA treats RCA as Positive-Unlabeled learning over failure windows. Logs outside investigation windows form the positive class $\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$4, logs inside windows form the noisy unknown class $\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$5, and a transformer encoder outputs a vector $\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$6 for each line. The root-cause score is the Euclidean norm,

$\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$7

and the system returns the top-$\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$8 lines in chronological order. The method explicitly seeks a minimal set of contextually and temporally related log lines rather than isolated anomalies (Wittkopp et al., 2024).

RiskLoc operates on aggregated measures rather than raw streams. For each leaf element $\frac{dX(t)}{dt}=\Phi_\theta(X(t))X(t)+b,$9, it computes the deviation score

$\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$0

splits leaves into abnormal and normal partitions, assigns linear distance-based weights, and scores a candidate aggregated element with

$\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$1

Here $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$2 measures weighted abnormal mass and $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$3 penalizes violations of the generalized ripple effect. Root causes are extracted greedily until the abnormal behavior is sufficiently explained (Kalander, 2022).

Temporal State Alignment addresses a metric-only setting where anomalous time series are misaligned and scale-heterogeneous. Each series is treated as an observation from an underlying process with hidden states estimated by Kalman smoothing; the unexplained residual process is then discretized into ordered latent states and aligned with DTW. The dynamic causality index

$\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$4

compares the best shifted alignment cost to the zero-shift alignment cost. Low values indicate stronger evidence that one anomalous state sequence is a lagged version of another, so the relevant cluster is more likely to contain the root cause (Chakraborty et al., 2020).

These score constructions illustrate a broad RCD pattern: ranking is usually performed after transforming raw evidence into a domain-specific invariant. In different settings, the invariant is a causal matrix change, a robust post-change deviation, a conditional mechanism shift, a latent-state trajectory, or a ripple-consistent aggregation pattern. A plausible implication is that successful RCD depends as much on the right representation of propagation as on the final ranking rule.

5. Software-centric RCD

Software engineering work uses materially different root-cause objects from operations or control systems. RC-Detection studies bug-fixing commits and defines the target as root-cause deletion lines. It builds a graph over changed code lines using control-flow, data-dependency, call, class-member-reference, and line-mapping edges; converts the heterogeneous graph into a homogeneous one with type IDs; embeds lines with CodeBERT; applies a two-layer RGCN with num_bases = 30; and ranks deleted nodes with RankNet trained using Focal Loss. The task is explicitly a commit-local learning-to-rank problem over deleted lines rather than ordinary line classification (Zhang et al., 2 May 2025).

Quantum software maintenance frames RCD as a second-stage diagnosis problem after flaky-test detection. The root-cause taxonomy has nine classes: Randomness (PRNG), Floating Point Operations, Software Environment, Multi-threading, Visualization, Unhandled Exceptions, Network, Unordered Collection, and Others. The best reported result for RQ3 is GPT-4o with partial report context $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$5 and method-level pre-fix code $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$6, reaching F1 $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$7, MCC $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$8, and Recall $\Phi_\theta(X(t))\in\mathbb{R}^{p\times p}$9 on 44 observations. The paper also states that randomness is the most common cause of quantum flakiness (Sivaloganathan et al., 2024).

These software-centric formulations are notably different from runtime RCA. RC-Detection is offline, history-based, and commit-centric; the quantum flaky-test setting is taxonomy-based and issue-centric. This suggests that “root cause” in software RCD is often a reconstruction problem over repositories and reports rather than an online localization problem over propagating telemetry.

6. Evaluation regimes, limitations, and methodological tensions

Recent evaluations show strong performance within their own target regimes. ICODE reports superior Top-$C$0 root-cause localization on simulated 20-variable ODE systems and states that it outperforms RootClam and CausalRCA across Lotka–Volterra, Lorenz-96, and reaction-diffusion settings (Sun et al., 17 Feb 2025). LogRCA is evaluated on 44.3 million log lines with 80 expert-labeled failures and achieves 93.5% quality among the top-10 returned candidates, with full top-50 root-cause coverage in 65 of 80 cases (Wittkopp et al., 2024). RC-Detection improves over NEURAL-SZZ by 4.107% on Recall@1, 5.113% on Recall@2, 4.289% on Recall@3, and 24.536% on MFR (Zhang et al., 2 May 2025). BARO reports Avg@5 values of 0.86, 0.95, and 0.81 for root-cause services on Online Boutique, Sock Shop, and Train Ticket respectively (Pham et al., 2024). StableRCA reports the best performance in 4/5 synthetic graph-corruption settings and strong Top-1 results on ProRCA, SockShop, CausalChambers, CausalMan, and RCAEval (Lin et al., 4 Jun 2026).

At the same time, the literature is explicit about important limitations. Several methods rely on synthetic or proof-of-concept evaluation only: ICODE is validated on simulated ODE systems, and the PIF-based industrial method is positioned as a proof of concept at TRL 3 (Sun et al., 17 Feb 2025, Trilla et al., 2024). Some methods require structural assumptions that are strong in practice: ODE form, known DAGs, causal sufficiency, faithful Markov boundary recovery, or one-cause-per-path conditions (Nagalapatti et al., 2 May 2025, Lin et al., 4 Jun 2026). Others require additional fitting on anomalous data, which constrains online use, as in ICODE’s need to estimate $C$1 from the anomalous period (Sun et al., 17 Feb 2025). Graph Traversal Agent explicitly qualifies its strongest retained gains as benchmark-coupled, concentrated on ChaosMesh scenarios where the benchmark ground-truth root cause is the injected fault object already present in the evidence graph, and it makes no production-readiness or mean-time-to-repair claim (Kuvshinova et al., 7 Jun 2026). ARCAS demonstrates operational adoption and mitigation value but does not report standard RCA precision/recall or top-$C$2 localization metrics (Demarne et al., 2024). RC-Detection notes inconsistencies between the stated aggregate counts and the dataset table, and the quantum flaky-test study states that RQ3 involves multi-label classification while not specifying the annotation procedure clearly enough to verify label cardinality (Zhang et al., 2 May 2025, Sivaloganathan et al., 2024).

A central controversy runs through many of these works: whether RCD should be defined by abnormality, by causal intervention, by topology-aware propagation, or by operational usefulness. The evidence in papers supports a narrower consensus. Root cause detection is not equivalent to anomaly detection; it is the task of isolating the source whose intervention, mechanism change, or evidence chain best explains the downstream failure. How that source is represented—and how strongly the explanation is causal, operational, or benchmark-coupled—remains domain dependent. This suggests that future progress will depend not only on better localization algorithms, but also on sharper target definitions, stronger out-of-distribution evaluation, and clearer separation between benchmark-visible artifacts and genuinely hidden operational causes.