Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

KPIRoot+: An Efficient Integrated Framework for Anomaly Detection and Root Cause Analysis in Large-Scale Cloud Systems

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that KPIRoot+ can pinpoint root-cause KPIs in cloud systems at an F1 of 0.882 and Hit@10 of 0.946 while running in about 8 seconds, by combining STL/U-Net anomaly detection, Improved SAX similarity, and Granger causality.

desk verdict Useful incremental extension of KPIRoot with credible deployment evidence, but the score combination in Eq. 11 mixes an unbounded F-statistic with a bounded Jaccard coefficient without normalization, and test-set tuning inflates the reported gains. read the letter →

arxiv 2506.04569 v1 pith:CZMZDSIK submitted 2025-06-05 cs.SE

Wenwei Gu , Renyi Zhong , Guangba Yu , Xinying Sun , Jinyang Liu , Yintong Huo , Zhuangbin Chen , Jianping Zhang
show 3 more authors
Jiazhen Gu Yongqiang Yang Michael R. Lyu
This is my paper
classification cs.SE
keywords rootcauselocalizationcloudmonitoringKPIstimeseriesdecompositionanomalydetectionsymbolicaggregateapproximationGrangercausalityU-Netautoencoderproductiondeployment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

KPIRoot+ is the paper's upgraded answer to a practical question: when an aggregated alarm KPI in a large cloud cluster goes abnormal, which individual VM KPIs actually caused it? The paper argues that the previous KPIRoot design failed on two fronts—threshold-based detection missed seasonal and residual anomalies, and SAX downsampling flattened away trend shape—and that replacing both with STL decomposition plus a U-Net autoencoder, and with an Improved SAX that records slope direction, gives more accurate root cause ranking without losing real-time efficiency. A sympathetic reader cares because root cause localization in production clouds has to be both interpretable and fast; the paper reports F1 0.882 and Hit@10 0.946 with an average runtime around 8 seconds on three industrial datasets, and a production deployment that localized ten emerging issues. The claim is an engineering one: a lightweight, explainable pipeline can beat both correlation baselines and graph-neural-network methods at a fraction of their cost.

What carries the argument

The load-bearing mechanism is a pipeline of four modules. First, Seasonal-Trend decomposition using Loess (STL) splits the alarm KPI into trend, seasonality, and remainder components. Second, a U-Net autoencoder—a convolutional autoencoder with skip connections—is trained on sliding-window segments and flags anomalies in each component separately, so trend, seasonal, and residual anomalies can all start a root-cause investigation. Third, Improved SAX (ISAX) down-samples every KPI into symbols whose alphabet index is augmented by the sign of the segment slope, so two segments with the same mean but opposite directions no longer share a symbol; Jaccard similarity over these symbol sequences measures how closely a VM KPI tracks the alarm KPI. Fourth, Granger causality, implemented as an F-test on autoregressions with and without the VM KPI's lagged values, checks temporal precedence. The final correlation score is a weighted sum $\lambda \times \text{Jaccard} + (1-\lambda)\times F$, with $\lambda=0.9$ in the evaluation. The efficiency claim rests on the SAX/ISAX reduction: with representation length $w \approx \sqrt{n}$, similarity analysis costs $O(\sqrt{n})$ and Granger causality costs $O(\sqrt{n} q^3)$, which is how the pipeline keeps its runtime near eight seconds.

What would settle it

Run the pipeline on a labeled dataset where the alarm KPI is generated by a multiplicative or level-dependent seasonal process, so that additive STL is misspecified, or where ground-truth anomaly intervals are provided by independent SRE annotation; if F1 and Hit@10 do not beat KPIRoot's results, or if the ranking changes substantially when the U-Net is retrained with different seeds, the central claim would be contradicted.

Watch

Extended reading notes

Core claim

At its core, the paper claims that the quality of root cause localization is gated by the quality of anomaly segmentation, and that poor segmentation—not poor correlation—was the main weakness of KPIRoot. It models the alarm KPI additively as trend plus seasonality plus residual, detects anomalies in each component with a U-Net autoencoder trained on sliding windows, and uses the union of those detections to define the anomaly interval. Within that interval, each VM KPI is compared with the alarm KPI using Jaccard similarity over an Improved SAX alphabet whose symbols encode both level and slope direction, and scored with a Granger causality F-statistic that checks whether the VM KPI's past values help forecast the alarm KPI. The two scores are combined into a single ranking. The author's central empirical claim is that this pipeline achieves an F1 of 0.882 and Hit@10 of 0.946, outperforming eight state-of-the-art baselines by 2.9% to 35.7% while taking about 8 seconds on average, and that in production it correctly localized ten emerging performance issues.

Load-bearing premise

The paper assumes the alarm KPI can be decomposed as trend plus seasonality plus residual, and that anomalies found by the U-Net in those components mark the true anomaly interval; if that decomposition or the trained detector mis-times the interval, every downstream similarity and causality score is computed over the wrong window.

Editorial extensions

If this is right

  • If correct, the anomaly segmentation stage becomes the highest-leverage place to invest in cloud root cause analysis, since both similarity and causality downstream inherit its errors.
  • A root-cause candidate list with Hit@10 around 0.94 and NDCG@10 between 0.79 and 0.84 means engineers only need to inspect the top ten KPIs, shortening mean-time-to-resolution.
  • The $O(\sqrt{n})$ complexity claim implies the approach can scale to thousands of VM KPIs per cluster, not just the 21 to 803 VMs in the evaluated datasets.
  • The production deployment claim—ten issues localized with 100% accuracy and localization time cut from 30 minutes to 5 minutes—suggests the method generalizes to anomaly types beyond the training distribution.
  • Because the method never needs a service dependency graph, it is applicable to VM-isolated cloud clusters where call graphs are unavailable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the U-Net's calibration and retraining stability are not measured, so an obvious extension is to test whether anomaly-segment boundaries shift across training seeds and how much that changes the final ranking.
  • Beyond the paper: the additive STL assumption is likely the fragile point, and a natural test is to compare against multiplicative or trend-free decompositions on KPI families with strong daily or weekly seasonality.
  • Beyond the paper: because ISAX preserves only the sign of the slope, not its magnitude, very fast versus slow ramps inside one window still collapse; encoding slope magnitude or second differences is a direct, untested refinement.
  • Beyond the paper: the same similarity-plus-causality scoring could in principle be lifted to microservice trace metrics, although the paper itself argues that dependency-graph methods are unsuitable in its VM-isolated scenario.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes KPIRoot+, an extension of the earlier KPIRoot framework for root cause localization in large-scale cloud systems. KPIRoot+ first applies STL-based time series decomposition and a U-Net autoencoder to detect anomaly segments in the alarm KPI, then represents VM KPIs with an Improved SAX (ISAX) encoding, and finally combines Jaccard similarity and Granger causality into a per-VM correlation score. The authors evaluate the method on three industrial datasets from a large cloud provider, report anomaly detection F1 scores around 0.89–0.93, root cause localization F1 around 0.871–0.891 and Hit@10 around 0.934–0.967 across datasets, and describe a production deployment experience. The main claimed advantages are higher localization accuracy than eight baselines and an average execution time of about 8 seconds.

Significance. If the central claims hold, this is a practically valuable contribution: the problem is important, the evaluation uses real industrial KPI data, the baseline set is broad, and a production deployment is reported. The paper also ships a public code repository, which is a strength for reproducibility. The decomposition-plus-U-Net extension of KPIRoot is a reasonable direction, and the anomaly detection evaluation is a useful addition. However, several load-bearing issues currently prevent the quantitative claims from being accepted as stated: the abstract's efficiency claim is contradicted by the reported runtimes, the combined score in Eq. (11) mixes bounded and unbounded quantities, and hyperparameters are tuned on the same test datasets used for the headline results.

major comments (5)
  1. [Section 3.1 and Eq. (11)] The correlation score is defined as c_i = λ * Jaccard(S_host, S_i) + (1−λ) * F_vm_to_host, but Section 3.1 states that c_i is in [0,1]. Jaccard is bounded in [0,1], whereas the Granger F-statistic in Eq. (10) is unbounded above. With λ=0.9, the term 0.1*F can be comparable to or larger than the maximum attainable similarity contribution, so the ranking is not a scale-invariant weighted combination of the two analyses. The ablation in Table 4 and the sensitivity study in RQ5 do not include a variant that removes or renormalizes the causality term, so the claim that similarity and causality are jointly exploited is not supported by the experiments. Please normalize the causality score (for example, to a p-value, a rank, or an empirical quantile) before combining it with the Jaccard term, and add an ablation that isolates the causality-only and normalized-combination variants.
  2. [Abstract and Section 4.2.4] The abstract claims 'reducing time cost by 34.7%', but the evaluation in RQ4 reports that KPIRoot+ takes 'around 8 seconds' while KPIRoot takes 'around 5 seconds' (Fig. 7 and the accompanying text), which is an increase in execution time, not a reduction. No comparison baseline or dataset subset that would yield a 34.7% reduction is specified. The efficiency contribution should be restated with an explicit comparison (which baseline, which datasets, what percentage) or removed.
  3. [Section 6.2 and RQ5] The hyperparameters λ, w, and the U-Net configuration are selected on the same three datasets used to produce the headline results; Section 6.2 states 'we find the most suitable configurations based on the best results obtained in different parameters', and RQ5 varies λ and w on exactly the datasets reported in Tables 3–4. This means the reported F1, Hit@10, and NDCG values can be optimistically biased by test-set selection. The paper needs a validation protocol, such as a held-out dataset or nested cross-validation, before the quantitative claims can be taken at face value.
  4. [Section 3.3 and Algorithm 1, line 7] The U-Net anomaly detection component is under-specified. The paper does not state the training window length, training set construction, number of epochs, anomaly threshold, or how the per-component outputs AE(τ_host), AE(s_host), and AE(r_host) are combined into the anomaly segment i_anomaly. Since the downstream similarity and causality computations depend on the segment boundaries t_s and t_e, the current description is insufficient for reproducibility and for assessing the risk that a mis-detected segment leads to incorrect root cause candidates.
  5. [Section 1 and Section 4.2.2] The number of baselines is inconsistent: the abstract says 'eight state-of-the-art baselines', while the RQ2 text says 'seven baselines', and Table 3 lists eight methods including the earlier KPIRoot. The claimed improvement range of 2.9%–35.7% is ambiguous unless the set of external baselines and whether KPIRoot is counted are stated precisely.
minor comments (5)
  1. [Section 3.5] The text says 'if a VM KPI undergoes an uprush and causes the alarm KPI to trigger alerts ... then Granger causality exists from the alarm KPI to the VM KPI'; the direction should be from the VM KPI to the alarm KPI, consistent with the F-statistic notation F_vm_to_host.
  2. [Section 1 and Section 5] The deployment date is inconsistent: the introduction says the system was deployed 'since Nov 2022', while the industrial experience section says 'since Aug 2023'. Please reconcile these dates.
  3. [Section 3.4 and Eq. (6)] The ISAX symbol assignment in Eq. (6), s_i = alphabet_{2α − φ_i·l}, uses an index l whose meaning is not defined in this equation; it should be clarified whether l is the SAX breakpoint index or the lag parameter from Eq. (2).
  4. [Section 4.2.5] The text says 'the scale of similarity is typically smaller than that of causality', but λ=0.9 gives the similarity term nine times the weight of the causality term; this sentence appears to contradict the chosen weighting and should be clarified to avoid confusion with the scale mismatch raised in Eq. (11).
  5. [Section 3.3] Eq. (3) uses the notation τ_t_host, s_t_host, and r_t_host, but the text later refers to 'seasonal' rather than 'periodic'; using consistent terminology for the seasonal component would improve readability.

Circularity Check

1 steps flagged · score 6.0 of 10

Reported accuracy is partly a fitted result because lambda and w are selected on the same test datasets; the method equations themselves are otherwise non-circular.

  1. fitted input called prediction [Section 6.2 (Threats to Validity), with RQ5 in Section 4.2.5]
    "For parameter settings, as our algorithm KPIRoot has few parameters, we find the most suitable configurations based on the best results obtained in different parameters."

    The paper's headline claim of 0.882 F1 and 0.946 Hit@10 is evaluated on the three industrial datasets after choosing hyperparameters w and lambda that maximize performance on those same datasets. Section 6.2 explicitly admits the configurations are selected by 'the best results obtained in different parameters,' and RQ5 searches over w and lambda on the same three datasets to optimize performance. Therefore the reported 'prediction' on Datasets A, B, and C is not an independent out-of-sample result; it is a selection over the test data. The central accuracy claim is thus partly a fitted parameter renamed as a prediction, even though the underlying equations are not defined in terms of the ground-truth labels.

full rationale

The core methodological pipeline is self-contained: STL decomposition (Eq. 3), U-Net anomaly scoring, ISAX representation, Jaccard similarity (Eq. 7), and Granger causality (Eq. 10) are all computed from the input KPIs without reference to the labeled root causes. The self-citations to KPIRoot are used as a baseline and as motivation, not as evidence for the new method's accuracy. The scale mismatch in Eq. 11, where an unbounded F-statistic is added to a bounded Jaccard coefficient while claiming c_i in [0,1], is a correctness and robustness concern rather than a circularity, because the ranking is still a well-defined function of the inputs once that inconsistency is acknowledged. The production deployment report is self-reported but is external to the mathematical derivation. The only significant circular element is the test-set hyperparameter selection, which makes the headline accuracy numbers partly a fitted result rather than a fresh prediction. For that reason the score is 6 rather than 0, but the method's derivation is not fully circular.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new entities or physical quantities. Its free parameters are the combination weight, downsampling window, SAX alphabet size, and undisclosed U-Net settings, all of which affect the reported accuracy. The key axioms are the additive decomposition of KPIs, the causal interpretation of Granger causality, the Gaussian assumption for SAX, and the assumed behavioral signature of root causes.

free parameters (4)
  • lambda (λ) = 0.9
    Combination weight between Jaccard similarity and Granger causality score (Eq. 11); tuned on test datasets.
  • PAA window size (w) = ≈ sqrt(n)
    Number of segments in the symbolic representation; sensitivity analysis in Figure 8a shows performance varies with w.
  • SAX alphabet size (alpha)
    Number of symbols in SAX/ISAX; an example uses alpha=9, but the value used in experiments is not specified.
  • U-Net hyperparameters
    Architecture details, sliding window size, and training epochs are not disclosed, but they affect anomaly detection performance.
assumptions (4)
  • domain assumption The KPI time series is an additive sum of trend, seasonal, and residual components (Eq. 3).
    The method assumes this decomposition holds for the host alarm KPI and that anomalies in any component are meaningful.
  • domain assumption Granger causality from a VM KPI to the alarm KPI indicates the VM is a cause, not merely a predictor, of the alarm.
    Granger causality is a statistical predictive test, not true causal discovery; the method treats it as a causal indicator.
  • domain assumption Normalized KPI values follow approximately a Gaussian distribution, so SAX breakpoints can be set by Gaussian quantiles.
    This is the standard SAX assumption (Lin et al., 2003), but real industrial KPIs can be skewed or multimodal.
  • domain assumption Root cause VMs show a KPI pattern similar to the alarm KPI and that pattern precedes the alarm.
    The similarity and causality design is based on this behavioral signature, as illustrated in the motivating example.

how reviews work

0 comments
Cite this review

Pith. "Pith review of KPIRoot+: An Efficient Integrated Framework for Anomaly Detection and Root Cause Analysis in Large-Scale Cloud Systems." pith.science (2026). https://pith.science/paper/CZMZDSIK

@misc{pith2026250604569,
  author       = {Pith},
  title        = {Pith review of: KPIRoot+: An Efficient Integrated Framework for Anomaly Detection and Root Cause Analysis in Large-Scale Cloud Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CZMZDSIK}},
  note         = {Machine review of arXiv:2506.04569}
}
read the original abstract

To ensure the reliability of cloud systems, their performance is monitored using KPIs (key performance indicators). When issues arise, root cause localization identifies KPIs responsible for service degradation, aiding in quick diagnosis and resolution. Traditional methods rely on similarity calculations, which can be ineffective in complex, interdependent cloud environments. While deep learning-based approaches model these dependencies better, they often face challenges such as high computational demands and lack of interpretability. To address these issues, KPIRoot is proposed as an efficient method combining similarity and causality analysis. It uses symbolic aggregate approximation for compact KPI representation, improving analysis efficiency. However, deployment in Cloud H revealed two drawbacks: 1) threshold-based anomaly detection misses some performance anomalies, and 2) SAX representation fails to capture intricate variation trends. KPIRoot+ addresses these limitations, outperforming eight state-of-the-art baselines by 2.9% to 35.7%, while reducing time cost by 34.7%. We also share our experience deploying KPIRoot in a large-scale cloud provider's production environment.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Larger Is Not Always Better: Exploring Small Open-source Language Models in Logging Statement Generation

    cs.SE 2025-05 conditional novelty 6.0 of 10

    A fine-tuned 14B small open-source model with LoRA and RAG outperforms larger proprietary LLMs on automated Java logging statement generation in AL-Bench point estimates.

Reference graph

Works this paper leans on

61 extracted references · 58 canonical work pages · cited by 1 Pith paper

  1. [1]

    In: Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp 682--694

    Agarwal S, Chakraborty S, Garg S, et al (2023) Outage-watch: Early prediction of outages using extreme event regularizer. In: Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp 682--694

    work page 2023

  2. [2]

    In: Proceedings of the 13th ACM SIGKDD international conference on Knowledge discovery and data mining, pp 66--75

    Arnold A, Liu Y, Abe N (2007) Temporal causal modeling with graphical granger methods. In: Proceedings of the 13th ACM SIGKDD international conference on Knowledge discovery and data mining, pp 66--75

    work page 2007

  3. [3]

    Concurrency and Computation: Practice and Experience 24(13):1397--1420

    Beloglazov A, Buyya R (2012) Optimal online deterministic algorithms and adaptive heuristics for energy and performance efficient dynamic consolidation of virtual machines in cloud data centers. Concurrency and Computation: Practice and Experience 24(13):1397--1420

    work page 2012

  4. [4]

    In: Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp 93--104

    Breunig MM, Kriegel HP, Ng RT, et al (2000) Lof: identifying density-based local outliers. In: Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp 93--104

    work page 2000

  5. [5]

    Information and Software Technology 153:107083

    Chen Y, Xu D, Chen N, et al (2023) Frl-mfpg: Propagation-aware fault root cause location for microservice intelligent operation and maintenance. Information and Software Technology 153:107083

    work page 2023

  6. [6]

    In: Proceedings of the 44th International Conference on Software Engineering, pp 61--72

    Chen Z, Liu J, Su Y, et al (2022) Adaptive performance anomaly detection for online service systems via pattern sketching. In: Proceedings of the 44th International Conference on Software Engineering, pp 61--72

    work page 2022

  7. [7]

    arXiv preprint arXiv:230404661

    Cheng Q, Sahoo D, Saha A, et al (2023) Ai for it operations (aiops) on cloud platforms: Reviews, opportunities and challenges. arXiv preprint arXiv:230404661

    work page 2023

  8. [8]

    In: Proceedings of the 26th Symposium on Operating Systems Principles, pp 153--167

    Cortez E, Bonde A, Muzio A, et al (2017) Resource central: Understanding and predicting workloads for improved resource management in large cloud platforms. In: Proceedings of the 26th Symposium on Operating Systems Principles, pp 153--167

    work page 2017

Show all 61 references
  1. [9]

    In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp 292--303

    Gu J, Luo C, Qin S, et al (2020) Efficient incident identification from multi-dimensional issue reports via meta-heuristic search. In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering...

    2020

  2. [10]

    ACM Transactions on Software Engineering and Methodology

    Gu W, Liu J, Chen Z, et al (2024 a ) Identifying performance issues in cloud service systems based on relational-temporal features. ACM Transactions on Software Engineering and Methodology

    2024

  3. [11]

    In: 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE), IEEE, pp 403--414

    Gu W, Sun X, Liu J, et al (2024 b ) Kpiroot: Efficient monitoring metric-based root cause localization in large-scale cloud systems. In: 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE), IEEE, pp 403--414

    2024

  4. [12]

    In: Knowledge Science, Engineering and Management: 4th International Conference, KSEM 2010, Belfast, Northern Ireland, UK, September 1-3, 2010

    Guo C, Li H, Pan D (2010) An improved piecewise aggregate approximation based on statistical features for time series mining. In: Knowledge Science, Engineering and Management: 4th International Conference, KSEM 2010, Belfast, Northern Ireland, UK, September 1-3, 2010. Proceed...

    2010

  5. [13]

    Pattern Analysis and Applications 19:111--127

    He X, Shao C, Xiong Y (2016) A non-parametric symbolic approximate representation for long time series. Pattern Analysis and Applications 19:111--127

    2016

  6. [14]

    In: Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, pp 1--12

    Huang T, Chen P, Zhang J, et al (2022) A transferable time series forecasting service using deep transformer model for online systems. In: Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, pp 1--12

    2022

  7. [15]

    In: 2021 International Conference on Technological Advancements and Innovations (ICTAI), IEEE, pp 268--273

    Kaushik P, Rao AM, Singh DP, et al (2021) Cloud computing and comparison based on service and performance between amazon aws, microsoft azure, and google cloud. In: 2021 International Conference on Technological Advancements and Innovations (ICTAI), IEEE, pp 268--273

    2021

  8. [16]

    In: Proceedings of the 46th International Conference on Software Engineering: Software Engineering in Practice, pp 369--380

    Kuang J, Liu J, Huang J, et al (2024) Knowledge-aware alert aggregation in large-scale cloud systems: a hybrid approach. In: Proceedings of the 46th International Conference on Software Engineering: Software Engineering in Practice, pp 369--380

    2024

  9. [17]

    IET networks 8(2):79--99

    Latah M, Toker L (2019) Artificial intelligence enabled software-defined networking: a comprehensive overview. IET networks 8(2):79--99

    2019

  10. [18]

    In: Proceedings of the 8th ACM SIGMOD workshop on Research issues in data mining and knowledge discovery, pp 2--11

    Lin J, Keogh E, Lonardi S, et al (2003) A symbolic representation of time series, with implications for streaming algorithms. In: Proceedings of the 8th ACM SIGMOD workshop on Research issues in data mining and knowledge discovery, pp 2--11

    2003

  11. [19]

    In: Proceedings of the 38th International Conference on Software Engineering, pp 214--224

    Lin Q, Lou JG, Zhang H, et al (2016 a ) idice: problem identification for emerging issues. In: Proceedings of the 38th International Conference on Software Engineering, pp 214--224

    2016

  12. [20]

    In: Proceedings of the 38th International Conference on Software Engineering Companion, pp 102--111

    Lin Q, Zhang H, Lou JG, et al (2016 b ) Log clustering based problem identification for online service systems. In: Proceedings of the 38th International Conference on Software Engineering Companion, pp 102--111

    2016

  13. [21]

    In: Proceedings of the 2018 26th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering, pp 480--490

    Lin Q, Hsieh K, Dang Y, et al (2018) Predicting node failure in cloud service systems. In: Proceedings of the 2018 26th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering, pp 480--490

    2018

  14. [22]

    In: 2008 eighth ieee international conference on data mining (ICDM), IEEE, pp 413--422

    Liu FT, Ting KM, Zhou ZH (2008) Isolation forest. In: 2008 eighth ieee international conference on data mining (ICDM), IEEE, pp 413--422

    2008

  15. [23]

    IEEE Transactions on Cloud Computing 6(4):1191--1202

    Liu J, Wang S, Zhou A, et al (2016) Using proactive fault-tolerance approach to enhance cloud service reliability. IEEE Transactions on Cloud Computing 6(4):1191--1202

    2016

  16. [24]

    arXiv preprint arXiv:230209520

    Liu J, He S, Chen Z, et al (2023) Incident-aware duplicate ticket aggregation for cloud systems. arXiv preprint arXiv:230209520

    2023

  17. [25]

    IEEE Transactions on Dependable and Secure Computing 19(5):3087--3100

    Ma M, Lin W, Pan D, et al (2021) Servicerank: Root cause identification of anomaly in large-scale microservice architectures. IEEE Transactions on Dependable and Secure Computing 19(5):3087--3100

    2021

  18. [26]

    In: 2018 IEEE 11th International Conference on Software Testing, Verification and Validation (ICST), IEEE, pp 262--273

    Mariani L, Monni C, Pezz \'e M, et al (2018) Localizing faults in cloud systems. In: 2018 IEEE 11th International Conference on Software Testing, Verification and Validation (ICST), IEEE, pp 262--273

    2018

  19. [27]

    Journal of Systems and Software 161:110464

    Mariani L, Pezz \`e M, Riganelli O, et al (2020) Predicting failures in multi-tier distributed systems. Journal of Systems and Software 161:110464

    2020

  20. [28]

    In: Seventh IEEE International Conference on Data Mining (ICDM 2007), IEEE, pp 601--606

    Minnen D, Isbell C, Essa I, et al (2007) Detecting subdimensional motifs: An efficient algorithm for generalized multivariate pattern discovery. In: Seventh IEEE International Conference on Data Mining (ICDM 2007), IEEE, pp 601--606

    2007

  21. [29]

    Applied Sciences 10(6):2166

    Qiu J, Du Q, Yin K, et al (2020) A causality mining and knowledge graph based method of root cause diagnosis for performance anomaly in cloud applications. Applied Sciences 10(6):2166

    2020

  22. [30]

    J Off Stat 6:3--73

    RB C (1990) Stl: A seasonal-trend decomposition procedure based on loess. J Off Stat 6:3--73

    1990

  23. [31]

    In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp 3009--3017

    Ren H, Xu B, Wang Y, et al (2019) Time-series anomaly detection service at microsoft. In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp 3009--3017

    2019

  24. [32]

    Ronneberger O, Fischer P, Brox T (2015) U-net: Convolutional networks for biomedical image segmentation. In: Medical image computing and computer-assisted intervention--MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III 18, Sp...

    2015

  25. [33]

    In: 2013 IEEE 13th international conference on data mining, IEEE, pp 1175--1180

    Senin P, Malinchik S (2013) Sax-vsm: Interpretable time series classification using sax and vector space model. In: 2013 IEEE 13th international conference on data mining, IEEE, pp 1175--1180

    2013

  26. [34]

    ACM Computing Surveys

    Sharma Y, Bhamare D, Sastry N, et al (2023) Sla management in intent-driven service management systems: A taxonomy and future directions. ACM Computing Surveys

    2023

  27. [35]

    Annual Review of Statistics and Its Application 9:289--319

    Shojaie A, Fox EB (2022) Granger causality: A review and recent advances. Annual Review of Statistics and Its Application 9:289--319

    2022

  28. [36]

    IEEE Engineering Management Review

    Singh S, Batheri R, Dias J (2023) Predictive analytics: How to improve availability of manufacturing equipment in automotive firms. IEEE Engineering Management Review

    2023

  29. [37]

    ACM Computing Surveys (CSUR) 55(3):1--39

    Soldani J, Brogi A (2022) Anomaly detection and failure root cause analysis in (micro) service-based cloud applications: A survey. ACM Computing Surveys (CSUR) 55(3):1--39

    2022

  30. [38]

    In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp 2828--2837

    Su Y, Zhao Y, Niu C, et al (2019 a ) Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp 2828--2837

    2019

  31. [39]

    In: Proceedings of the International Symposium on Quality of Service, pp 1--10

    Su Y, Zhao Y, Xia W, et al (2019 b ) Coflux: robustly correlating kpis by fluctuations for service troubleshooting. In: Proceedings of the International Symposium on Quality of Service, pp 1--10

    2019

  32. [40]

    IEEE Transactions on Services Computing

    Tuli S, Gill SS, Garraghan P, et al (2021) Start: Straggler prediction and mitigation for cloud computing environments using encoder lstm networks. IEEE Transactions on Services Computing

    2021

  33. [41]

    arXiv preprint arXiv:230201987

    Wang D, Chen Z, Ni J, et al (2023 a ) Hierarchical graph neural networks for causal discovery and root cause localization. arXiv preprint arXiv:230201987

    2023

  34. [42]

    Proceedings of the VLDB Endowment 12(12):1942--1945

    Wang H, Nguyen P, Li J, et al (2019) Grano: Interactive graph-based root cause analysis for cloud-native distributed data platform. Proceedings of the VLDB Endowment 12(12):1942--1945

    2019

  35. [43]

    In: Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp 5116--5125

    Wang L, Zhang C, Ding R, et al (2023 b ) Root cause analysis for microservice systems via hierarchical reinforcement learning from human feedback. In: Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp 5116--5125

    2023

  36. [44]

    In: 2010 24th IEEE international conference on advanced information networking and applications, IEEE, pp 446--452

    Wickremasinghe B, Calheiros RN, Buyya R (2010) Cloudanalyst: A cloudsim-based visual modeller for analysing cloud computing environments and applications. In: 2010 24th IEEE international conference on advanced information networking and applications, IEEE, pp 446--452

    2010

  37. [45]

    In: Proceedings of the 2018 world wide web conference, pp 187--196

    Xu H, Chen W, Zhao N, et al (2018) Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications. In: Proceedings of the 2018 world wide web conference, pp 187--196

    2018

  38. [46]

    In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp 4310--4320

    Yan S, Shan C, Yang W, et al (2022) Cmmd: Cross-metric multi-dimensional root cause analysis. In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp 4310--4320

    2022

  39. [47]

    In: 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), IEEE, pp 653--665

    Yang T, Shen J, Su Y, et al (2021) Aid: efficient prediction of aggregated intensity of dependency in large-scale cloud systems. In: 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), IEEE, pp 653--665

    2021

  40. [48]

    IEEE Transactions on Parallel and Distributed Systems 28(5):1271--1284

    Yin J, Zhao X, Tang Y, et al (2016) Cloudscout: A non-intrusive approach to service dependency discovery. IEEE Transactions on Parallel and Distributed Systems 28(5):1271--1284

    2016

  41. [49]

    In: Proceedings of the 46th IEEE/ACM International Conference on Software Engineering, pp 1--13

    Yu B, Yao J, Fu Q, et al (2024) Deep learning or classical machine learning? an empirical study on log-based anomaly detection. In: Proceedings of the 46th IEEE/ACM International Conference on Software Engineering, pp 1--13

    2024

  42. [50]

    In: Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp 553--565

    Yu G, Chen P, Li Y, et al (2023) Nezha: Interpretable fine-grained root causes analysis for microservices on multi-modal observability data. In: Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering,...

    2023

  43. [51]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp 14993--15002

    Zhang J, Wu W, Huang Jt, et al (2022) Improving adversarial transferability via neuron attribution-based attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp 14993--15002

    2022

  44. [52]

    In: Proceedings of the AAAI Conference on Artificial Intelligence, pp 7142--7150

    Zhang J, Gu W, Huang Y, et al (2024) Curvature-invariant adversarial attacks for 3d point clouds. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp 7142--7150

    2024

  45. [53]

    In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp 3948--3958

    Zhang X, Du C, Li Y, et al (2021) Halo: Hierarchy-aware fault localization for cloud systems. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp 3948--3958

    2021

  46. [54]

    ACM Transactions on Software Engineering and Methodology (TOSEM) 30(3):1--33

    Zhao G, Hassan S, Zou Y, et al (2021) Predicting performance anomalies in software systems at run-time. ACM Transactions on Software Engineering and Methodology (TOSEM) 30(3):1--33

    2021

  47. [55]

    In: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, IEEE, pp 1882--1890

    Zhao N, Zhu J, Liu R, et al (2019) Label-less: A semi-automatic labelling tool for kpi anomalies. In: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, IEEE, pp 1882--1890

    2019

  48. [56]

    In: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Software Engineering in Practice, pp 162--171

    Zhao N, Chen J, Peng X, et al (2020 a ) Understanding and handling alert storm for online service systems. In: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Software Engineering in Practice, pp 162--171

    2020

  49. [57]

    In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp 315--326

    Zhao N, Chen J, Wang Z, et al (2020 b ) Real-time incident prediction for online service systems. In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp 315--326

    2020

  50. [58]

    Journal of Computer Security 21(4):533--559

    Zhou F, Goel M, Desnoyers P, et al (2013) Scheduler vulnerabilities and coordinated attacks in cloud computing. Journal of Computer Security 21(4):533--559

    2013

  51. [59]

    In: International conference on learning representations

    Zong B, Song Q, Min MR, et al (2018) Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In: International conference on learning representations

    2018

  52. [60]

    , " * write output.state after.block = add.period write newline

    ENTRY address archive author booktitle chapter doi edition editor eid eprint howpublished institution journal key keywords month note number organization pages publisher school series title type url volume year archivePrefix primaryClass adsurl adsnote version label extra.labe...

  53. [61]

    write newline

    " write newline "" before.all 'output.state := FUNCTION add.period duplicate empty 'skip "." * add.blank if FUNCTION if.digit duplicate "0" = swap duplicate "1" = swap duplicate "2" = swap duplicate "3" = swap duplicate "4" = swap duplicate "5" = swap duplicate "6" = swap dupl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.