N ET C AUSE: Counterfactual Learning for Root Cause Analysis in Large-Scale Networks Fabien Chraim* , Jian Zhang* , Dominik Janzing, Xiang Song, Christos Faloutsos, John Evans
arXiv:2606.13543v1 [cs.NI] 11 Jun 2026
Amazon Web Services, Seattle, Washington, USA Email: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Abstract—Can a learned model capture how faults propagate through a large-scale network and use this knowledge to causally attribute customer impact to its underlying root cause? Existing root cause analysis techniques often rely on static rules, correlation heuristics, or topology-local reasoning, which struggle to generalize in dynamic environments where faults propagate across complex physical and logical dependencies. We present N ET C AUSE, a self-supervised learning-based framework that models network incidents as graph-temporal processes and uses counterfactual simulation to rank candidate root causes. This approach produces an interpretable ranking of root cause hypotheses and integrates naturally with operatordefined mitigation and remediation actions. We train the model on over 1,500 incidents collected over six months from a leading cloud provider’s production network and evaluate it on 31 expert-labeled incidents. N ET C AUSE consistently improves root cause ranking quality in the regime most relevant to operational decision-making, achieving a 16.1% accuracy improvement over a rule-based heuristic baseline. While training is computationally intensive, inference is lightweight, requiring only seconds of GPU runtime per incident (well below typical telemetry collection latencies). Index Terms—Root cause analysis, counterfactual reasoning, graph neural networks, network management.
I. I NTRODUCTION Modern cloud infrastructure operates at unprecedented scale, with millions of interconnected devices spanning data centers, metro networks, and wide-area backbones. When customer-impacting incidents occur, operators must identify root causes amid cascading fault propagation across complex physical and logical topologies in order to remediate underlying failures. Traditional root cause analysis (RCA) approaches rely on manually crafted correlation rules or proximity-based heuristics. These struggle to capture the intricate spatiotemporal dependencies inherent in large-scale network incidents. A central challenge is distinguishing causally related faults from those that merely co-occur in spatial or temporal proximity. This issue is compounded by the sheer volume of telemetry signals and noise generated by modern infrastructure. A network incident typically manifests as a sequence of observable events, such as device faults, link failures, and traffic migrations, that propagate through the system before culminating in customer-visible impact (e.g., packet loss or latency). While temporal precedence and topological proximity provide useful cues, they are insufficient for causal ∗ Equal contributions.
Fig. 1. Example incident subgraph from a production cloud network. Nodes represent network devices and hierarchical aggregations, and edges denote physical and logical relationships (e.g. yellow edges represent layer 3 neighborship; blue edges show metro containment). Customer impact is observed on the two green nodes, corresponding to routers. The underlying root cause is a reachability failure on the red triangular nodes, which correspond to controller devices. These events occur minutes apart and are not topological neighbors; they are separated by two hops through a hierarchical aggregation node. This example illustrates the challenge of RCA in large-scale cloud networks, where causally related signals may be temporally and topologically distant within complex, heterogeneous topologies.
attribution. A fault that occurs early and near the impact may be symptomatic rather than causal, while the true root cause may be temporally or spatially distant. Moreover, multiple independent faults often coexist within large networks, further complicating attribution. To illustrate these challenges, Figure 1 depicts an incident
© 2026 IEEE. This is the author’s preprint version of a paper accepted for publication in the Proceedings of IEEE International Conference on Computer Communications and Networks, 2026. The final version will appear in IEEE Xplore.
subgraph extracted from a production cloud network. Nodes represent network devices and hierarchical aggregations, while edges capture physical and logical relationships. For example, yellow edges shot OSI layer 3 neighborship while blue edges represent the membership of a node in a metro. The subgraph is constructed by expanding a two-hop neighborhood around impact nodes where packet loss was detected (shown as the two larger green nodes). Although the resulting subgraph contains 113 nodes and 868 edges, the customer impact is ultimately caused by a reachability failure affecting only two nodes (highlighted as red triangles). For clarity, we omit additional observations and actions, and compress the temporal evolution of the incident into a single snapshot. In this example, the reachability fault precedes the observed impact and is both topologically and functionally distant: the impact occurs on data-plane routers, while the root cause originates in control-plane components (controllers), separated by two hops through a hierarchical aggregation node. This example illustrates the difficulty of identifying true root causes in large-scale cloud networks, where causally related events may be separated in time, space, and abstraction level, and where simple proximity- or correlation-based reasoning can be misleading. In this paper, we propose N ET C AUSE, a learning-based system for root cause attribution based on counterfactual reasoning 1 . Our key insight is to train a generative model that captures the forward dynamics of fault propagation in network systems, and then leverage this model as a simulator for interventional analysis. Specifically, we learn the conditional distribution P (Xt+1 |Xt , G) where Xt encodes nodelevel fault and action states and G represents the incident subgraph. At inference time, we perform counterfactual simulation by removing candidate faults from historical sequences and rolling the model forward to predict the resulting impact. The divergence between factual and interventional outcomes provides a principled measure of causal influence. This work is motivated by four key objectives for practical RCA in large-scale networks. First, it must be principled, providing causal attribution grounded in counterfactual reasoning rather than correlation alone. Second, it must be adaptive, learning spatiotemporal fault propagation patterns directly from data instead of relying on hand-crafted rules that are brittle under evolving network conditions. Third, it must be effective in realistic operational settings, improving early root cause ranking where only a small number of hypotheses can be acted upon. Finally, it must be feasible at scale, both computationally and operationally: the approach should operate efficiently on incident-specific subgraphs and avoid reliance on large, expert-labeled training datasets, which are prohibitively expensive to obtain in production network environments. 1 Throughout the paper, the term “counterfactual” is used in the wide sense of reasoning about the impact of hypothetical interventions – in contrast to the “ladder of causation” in [1], which strictly distinguishes between interventional (rung 2) and counterfactual (rung 3) causal reasoning.
N ET C AUSE meets these objectives by design, and improves exact-match root cause identification by 16.1% over a rulebased heuristic on expert-labeled production incidents. Despite the complexity of counterfactual evaluation, inference remains practical: a sequential CPU-only implementation achieves subminute response times at the 95th percentile, and the approach readily supports parallelization and GPU batching for substantially lower latency. Our contributions are as follows: • Problem Formulation: We formulate network root cause analysis as a causal inference problem over graphtemporal systems, enabling principled causal attribution via interventional simulation. • Model: We develop a generative spatiotemporal model that captures fault propagation dynamics in heterogeneous network graphs without requiring labeled root causes for training. • Metric: We introduce the Total Causal Influence (TCI) metric, which ranks candidate root causes by measuring divergence between factual and interventional outcomes. • Effectiveness: We evaluate our approach on large-scale production data from a leading cloud provider, including an expert-labeled benchmark of real incidents. II. R ELATED W ORK We position N ET C AUSE at the intersection of (i) causal inference and counterfactual reasoning on graph-temporal data, (ii) graph machine learning for learning spatiotemporal dynamics, and (iii) root cause analysis in large-scale networked systems. Collectively, existing approaches address subsets of these challenges, but no single method simultaneously provides all of the capabilities required for practical, incidentlevel causal attribution in large-scale networks. Table I provides a concise summary of these trade-offs. A. Causal inference and counterfactual reasoning on graphs and time series Classical causal inference represents causal structure via directed acyclic graphs and Structural Causal Models (SCMs), where interventions enable counterfactual reasoning and causal attribution [2]. Inferring complete causal graphs and structural equations from data, however, requires strong assumptions and is particularly challenging in highly complex environments such as cloud networks [3]. N ET C AUSE does not aim to recover a global SCM; instead, it learns a forward transition mechanism that can be queried under counterfactual perturbations, yielding a pragmatic notion of causal influence aligned with operational RCA. Several approaches learn graph-structured dynamics from data. Neural Relational Inference (NRI) [4] jointly infers latent interactions and temporal dynamics, but is primarily optimized for forecasting and structure discovery rather than intervention-based attribution. DECI [5] estimates causal effects in longitudinal data via counterfactual outcome modeling, focusing on treatment effect estimation over fixed variables. In contrast, N ET C AUSE assumes a known heterogeneous
C. Root cause analysis in networked and distributed systems RCA has long been studied in network and systems management. Early approaches relied on rule-based correlation and codebooks [11, 12], which are effective for known failure modes but require substantial expert effort and struggle to generalize. More recent data-driven methods apply causal graphs and machine learning to metrics and logs, particularly in microservice systems [13–16]. These approaches demonstrate the value of causal modeling, but they typically operate over service or metric graphs (using metric data from the nonanomalous regime [17]) and focus on dependency discovery and localization rather than explicit simulation of incident dynamics. Graph-based learning has also been applied to RCA as supervised node ranking or classification over KPI graphs [18], which requires labeled data at scale and stable graph structure. Other work combines GNNs with Granger-style causality or fault-tree assumptions in controlled environments [19], limiting applicability to open-ended production networks. Large language models have recently been explored as RCA assistants [20, 21], but primarily support investigation workflows with causal hypotheses that are not transparent [22]. N ET C AUSE differs from prior RCA approaches in three key respects: it models incidents as heterogeneous graph-temporal structures grounded in physical, logical, and hierarchical topology; it learns fault propagation dynamics directly from incident data without requiring large labeled RCA datasets; and it performs attribution via counterfactual simulation, providing an explicit, model-based measure of causal influence. Positioning summary: Table I summarizes how representative RCA approaches trade off causal grounding, scalability, heterogeneity, and operational actionability. By combining learned spatiotemporal simulation with counterfactual
Explicit counterfactual intervention Temporal dynamics Topology-aware modeling Heterogeneous entities/relations No large labeled RCA data needed Low/no upfront expert effort needed Incident-level attribution Direct actionability
✓ ✓ ✓
✓ ✓
✓ ✓ ✓ ✓ ✓ ✓
✓ ✓ ✓ ✓ ✓
✓ ✓
N ET C AUSE
LLM-based [20–22]
✓
✓ ✓
Supervised GNN [5, 18]
Correlation [12]
Capability
Causal Graph [13–16]
B. Graph machine learning for spatiotemporal dynamics and world models Graph neural networks (GNNs) are widely used to model dynamics in interacting systems, where message passing captures how local interactions give rise to global behavior [6–8]. More recent work explores spatiotemporal GNNs and graphbased simulators that learn transition dynamics conditioned on graph structure, enabling multi-step prediction and reasoning over time [9]. Relatedly, world models learn latent dynamics that support prediction and counterfactual reasoning without explicit physical state representations [10]. N ET C AUSE adopts a similar philosophy in the context of network operations, learning a spatiotemporal transition model over sparse fault and action signals grounded in known network topology. Unlike prior work focused on forecasting, control, or planning, N ET C AUSE uses the learned simulator explicitly for incident-level counterfactual analysis, evaluating how predicted impact changes when specific historical fault transitions are removed.
Rule-based [11]
topology and applies counterfactual simulation to rank candidate causes within individual incidents, rather than estimating population-level causal effects.
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
TABLE I N ET C AUSE positioning: C OMPARISON OF RCA APPROACHES ACROSS KEY OPERATIONAL CAPABILITIES .
evaluation over real network topology, N ET C AUSE bridges classical causal reasoning and modern graph learning to enable practical, incident-level root cause attribution in large-scale networks. III. P ROBLEM F ORMULATION We formalize root cause analysis as a causal attribution problem over graph-temporal incident data. Given a customer impact detected by observability systems (e.g., packet loss or elevated latency), our objective is to identify which faults in the incident causally explain the observed impact, enabling targeted mitigation and remediation. We assume access to (i) observability systems that detect impacts and report fault and action signals, and (ii) comprehensive topology data capturing network entities, their physical and logical interconnections, and hierarchical relationships, as is typical in well-monitored cloud networks. More concretely, given an incident represented as a network graph G, with a customer impact observed at time T and a sequence of time-indexed fault transitions and actions preceding the impact, the problem is to identify and rank those transitions in the incident history that causally explain the observed impact. A. Incident Graph Construction and Representation Each incident is initialized from a known impact: a set of impact nodes and a timestamp at which data-plane degradation was observed. We construct a seeded incident subgraph by recursively incorporating spatial neighbors observed within a temporal window prior to impact, following Layer-3 links, optical connections, and hierarchical containment edges. This yields a variable-sized, heterogeneous graph that captures the incident-relevant portion of the system. In large cloud networks, unconstrained topological expansion can introduce many nodes that are unlikely to be causally relevant. To address this, we allow configuration of which device types are included in the incident graph based on the impact modality and its location. For each node in the resulting graph, we extract impact, impairment, and action signals from our observability and automation systems.
Formally, we represent each incident as an undirected heterogeneous graph
Xt
G
(binary node states)
(incident graph)
G = (V, E, τ, ϕ), where V is the set of nodes, E ⊆ V × V is the set of edges, τ : V → Q maps each node to a node type (e.g., device, site, metro), and ϕ : E → R maps each edge to a relationship type (e.g., physical, logical, hierarchical). Nodes in V represent network entities at multiple levels of abstraction (e.g., devices, sites/data centers, metros), while edge types encode interaction and containment relationships such as physical connectivity, logical adjacencies, and hierarchy (device–site, site–metro). The graph structure G is static for the duration of an incident. Temporal evolution is captured through node-level feature matrices {Xt }Tt=0 , where each Xt is a random matrix taking values in {0, 1}|V |×F and represents the latent fault and action state at time t (typically at minute-level resolution). We denote by xt a realized observation of Xt for a specific incident. In our implementation, F = 27, comprising 15 fault dimensions (e.g., device hardware error, link failure, optical degradation) and 12 action dimensions (e.g., traffic drain, maintenance activity, configuration change). B. State Transitions and Causal Attribution We define a state transition as any change in a feature from 0 to 1 at time t: (v, f, t) where xt [v, f ] = 1 and xt−1 [v, f ] = 0. Let S = {(v, f, t)} denote the set of all observed state transitions during an incident. We partition this set into: • Impact set I ⊆ S: Transitions occurring at the final impact time T , representing customer-visible degradation. • Hypothesis set H ⊆ S \ I: Prior transitions potentially responsible for the impact, i.e., H = {(v, f, t) ∈ S | t ≤ T }. For a subset of incidents, we assume access to an expertlabeled ground-truth root cause set r ⊆ H, representing the faults that led to the observed impact. The objective is to predict a candidate set r̂ ⊆ H that explains the impact. We define two correctness criteria: • Weak correctness: r̂ ∩ r ̸= ∅ (at least one true root cause identified). • Strong correctness: r̂ = r (all qualified root causes identified). In our evaluation, we focus on weak correctness, as identifying at least one true root cause is often sufficient to trigger the correct mitigation or remediation action in operational settings. IV. M ETHODOLOGY N ET C AUSE consists of (a) a world model (a generative spatiotemporal model that predicts future node states conditioned on incident structure and history), and (b) a counterfactual simulation procedure that ranks candidate root-cause hypotheses via their induced effect on predicted impact. This design enables scalable learning without reliance on large root-causelabeled datasets.
Feature Embeddings (fault/action types)
Spatial Encoder (R-GCN ×L) hetero message passing
Fusion: spatial embedding + feature skip
Temporal Encoder (RNN / GRU) per-node history
Decoder logits for X̂t+1
X̂t+1 (predicted next state)
Fig. 2. N ET C AUSE generative spatiotemporal model architecture. At each timestep t, the model consumes binary node states Xt and the incident graph G. Feature embeddings provide a learned representation of fault/action types. A relational GCN performs heterogeneous message passing over G to produce spatial embeddings, which are combined (via a skip connection) with embedded features and processed by a temporal encoder to model per-node dynamics. A decoder outputs logits for the next state X̂t+1 .
A. Generative Spatiotemporal Model The goal of the generative model is to predict the nextstep state of each node from current states, conditioned on the incident graph: x̂t+1 = fθ (x0:t , G), the output x̂t+1 denotes per-node logits (or probabilities) for the next-step binary state. The architecture comprises four components (Figure 2): Feature Embeddings. We introduce learnable embeddings for each fault and action type. Each of the F features is associated with a trainable vector, which is combined with the raw binary features to provide a more expressive input representation. Spatial Encoder. We use a Relational Graph Convolutional Network (R-GCN) to propagate information across the heterogeneous incident graph. R-GCN enables the model to learn distinct propagation patterns for physical, logical, and hierarchical relationships. We stack multiple spatial layers to allow information flow across multiple hops. The final spatial layer produces feature-wise state transitions (using an activation function) to be used in subsequent temporal encoding. Temporal Encoder. We apply a recurrent neural network (RNN) independently to each node’s history (with shared parameters across nodes) to capture temporal dependencies.
We also use a skip connection that injects the embedded node features directly into the temporal encoder alongside the spatial embedding, improving gradient flow and model stability. Decoder. The decoder produces per-node logits for the binary features of xt+1 , and the model is trained using binary cross-entropy with positive-class weighting to address severe sparsity. Training Procedure. We train with teacher forcing, feeding the observed state xt as input to predict x̂t+1 (instead of using the previous prediction), and apply multi-step unrolling to capture longer-range propagation. Loss Function. We optimize the model using binary crossentropy with logits, applied to the predicted and observed nextstep states. To address the severe class imbalance inherent in sparse fault and action signals, we apply positive-class weighting, which increases the penalty for false negatives relative to false positives. B. Counterfactual Simulation and Causal Attribution At inference time, the trained world model serves as a simulator of incident evolution under alternative historical assumptions. For each candidate hypothesis η = (v, f, tη ) ∈ H, we construct a counterfactual sequence in which all observed events are held except the hypothesized fault transition2 : xcf = x \ {xv,f,tη = 1}.
are ranked by TCI to produce a prioritized list. Computing TCI requires evaluating counterfactual rollouts for each hypothesis. For an incident with |H| hypotheses, T timesteps, and |V | nodes, the computational complexity is O(|H| · T · |V |). In practice, this is tractable because (i) the generative model produces predictions for all nodes/features in a single forward pass per timestep, (ii) incidents are sparse, and (iii) counterfactual simulations can be batched and parallelized on GPUs. V. E XPERIMENTAL S ETUP A. Training Data To train the generative spatiotemporal model, we extract 1,500 operational incidents from the production network of a leading cloud provider. Incidents are seeded from detected packet-loss impacts across multiple metropolitan regions over a six-month period, covering a diverse set of network topologies, traffic patterns, and failure modes. For each detected impact, we construct an incident-specific subgraph using the procedure described in Section III-A, incorporating physical, logical, and hierarchical relationships among network entities. The resulting incident graphs vary in size and structure, reflecting the localized scope of individual incidents. Model training follows the procedure described in Section IV-A. Additional details on hyperparameter selection and training stability are provided in the Appendix. B. Evaluation Benchmark
We roll the model forward from tη to the impact time T , T producing predicted interventional states {x̂cf t }t=tη . Hypotheses that causally contribute to the incident are expected to induce larger deviations between factual and counterfactual predictions. We define the Total Causal Influence (TCI) as the cumulative divergence between factual and counterfactual predictions over the remaining evolution of the incident:
To evaluate root cause attribution performance, we construct a benchmark of 31 incident graphs labeled with ground-truth root causes based on post-incident troubleshooting reports and expert assessment by network engineers. These labels identify the faults that were determined to have directly caused the observed customer impact. On average, each labeled incident contains 5.4 ground-truth root causes and 67.25 observed fault and action transitions T X X that constitute candidate hypotheses. This corresponds to an TCI(η) = w(t) D x̂t , x̂cf t , average root cause proportion of 9.5%, indicating that fewer t=tη v ′ ∈V than one in ten observed signals is causally responsible for where D(·, ·) is a divergence measure (in our implementation, the impact. This imbalance reflects realistic operational conwe use the absolute difference in first-order Markov log- ditions, where many signals are present but only a small subset likelihood assigned to the two realizations, though alternatives is relevant for diagnosis. Table II summarizes the distribution of labeled incidents by such as total variation distance or F1-based divergence are root cause category. While most incidents are associated with a possible), and w(t) is a temporal weighting function allowing single category, some involve multiple valid root causes (e.g., us to emphasize effects at different time scales (we chose an a control-plane error accompanied by a hardware packet error). exponential weighting function to more heavily weight signals Link-related issues are the most prevalent category, accounting closer to the impact time). for over one-third of incidents, which is expected given D x̂t , x̂cf = log pθ (xt | x0:t−1 , G) − log pθ (xt | xcf t 0:t−1 , G) . the scale of optical infrastructure and routine maintenance activities in large cloud networks. Candidates with TCI below a configurable threshold are discarded as unlikely root causes, and the remaining hypotheses C. Baseline Methods 2 Here we assume that there are no hidden common causes that influence both present and past states of the system. This assumption of unconfoundedness of the dynamics is required to conclude that the interventional probability of Xt+1 , given hypothetical changes of Xt coincides with the observational probability, given Xt .
We compare N ET C AUSE against three baseline methods that reflect common operational heuristics used in network troubleshooting. All baselines operate on the same incident graphs and candidate hypothesis sets.
Root Cause Category
Count
LinkIssue Congestion HardwarePacketError StateUpdate ReachabilityError ProtocolError Rebuild ReturnToService ControlPlaneError TABLE II
13 6 5 3 2 1 1 1 1
D ISTRIBUTION OF ROOT CAUSE CATEGORIES ACROSS 31 LABELED INCIDENTS .
Temporal Proximity. Hypotheses are ranked by temporal proximity to the impact, prioritizing faults that occurred closest in time to the observed customer degradation. This baseline captures the common intuition that recent events are more likely to be causal. Spatial Proximity. Hypotheses are ranked by graph distance to impact nodes, computed using weighted shortest paths over the incident graph. Edge weights reflect relationship types (physical, logical, hierarchical). This baseline captures the intuition that faults topologically closer to the impact location are more likely to be responsible. Rule-Based Heuristic. We implement a composite scoring function inspired by operator practice, combining temporal, spatial, and event-type signals: score = 0.1 · dnorm + 0.6 · tnorm + 0.3 · sevent , where dnorm is normalized graph distance, tnorm is normalized time difference from impact (clipped at one hour), and sevent is a severity score assigned based on fault type using operatorprovided guidelines. Lower scores indicate higher likelihood of being a root cause. D. Evaluation Metrics Each method produces a ranked list of candidate hypotheses for each incident. We evaluate performance using the following metrics, where k denotes the number of top-ranked hypotheses considered. We cap k at 5, as larger candidate sets provide diminishing practical value for operators and automation systems. Exact Match Accuracy. The fraction of incidents for which the top-ranked hypothesis matches at least one ground-truth root cause, following the Weak Correctness criterion defined in Section III-B. This metric reflects automation readiness, where only the highest-confidence diagnosis is acted upon. Hits@k. The fraction of incidents for which at least one ground-truth root cause appears among the top-k ranked hypotheses. This metric captures whether a method is able to surface a correct explanation within a small candidate set, regardless of ordering. Precision@k. The fraction of hypotheses in the top-k rankings that correspond to ground-truth root causes, averaged across incidents. This measures the purity of the ranked list.
Fig. 3. N ET C AUSE wins at exact match accuracy. We achieve 35.5% accuracy in identifying a correct root cause as the top-ranked hypothesis.
Recall@k. The fraction of ground-truth root causes recovered within the top-k ranked hypotheses, averaged across incidents. This measures coverage of relevant causes. For recall and precision, we normalize by min(k, |ri |) for each incident i, where |ri | is the number of ground-truth root causes, ensuring fair comparison across incidents with varying label counts. Only exact root cause matches are considered correct; correlated but downstream signals are not counted. For the last three metrics, we also compute the confidence interval at one standard deviation using a nonparametric bootstrap method with 1,000 samples. VI. R ESULTS We evaluate N ET C AUSE on 31 expert-labeled production incidents and compare against the three baseline methods discussed earlier. Figures 3–6 summarize the results. A. Exact Match Accuracy Figure 3 shows that N ET C AUSE achieves an exact match accuracy of 35.5% (11 out of 31 incidents), representing a 16.1 percentage point absolute improvement and an 82% relative improvement over the rule-based heuristic. This result highlights improved automation readiness: in more than onethird of incidents, the top-ranked hypothesis produced by N ET C AUSE directly identifies a true root cause. In contrast, the spatial and temporal proximity baselines perform poorly on this metric, achieving 6.5% and 0.0% accuracy, respectively. This confirms that neither temporal recency nor topological proximity alone is sufficient for reliable root cause attribution. B. Hits@k Figure 4 reports Hits@k, measuring whether at least one correct root cause appears among the top-k hypotheses for each incident. As expected, performance improves with increasing k for all methods. At k = 2, N ET C AUSE achieves Hits@2 of 41.9%, outperforming the rule-based heuristic
Fig. 4. N ET C AUSE wins almost always: Hits@k showing the fraction of incidents with at least one correct root cause in the top-k ranked hypotheses. N ET C AUSE in purple.
Fig. 5. Precision@k showing the fraction of top-k hypotheses that correspond to ground-truth root causes, averaged across incidents. N ET C AUSE in purple.
(35.5%). At k = 3 and k = 4, N ET C AUSE and the heuristic method exhibit similar performance and are joined by the spatial baseline, indicating that spatial proximity becomes increasingly informative when larger candidate sets are considered. At k = 5, both N ET C AUSE and the spatial baseline successfully surface a correct root cause in 17 incidents (54.8%), while the rule-based heuristic does so in 15 incidents (48.4%). The temporal baseline reaches only 25.8%. C. Precision@k Figure 5 shows that N ET C AUSE achieves higher precision at small values of k compared to the other methods. At k = 2, N ET C AUSE attains a precision of 35.5%, indicating that approximately one-third of the hypotheses presented to operators are correct on average. For larger values of k, N ET C AUSE and the rule-based heuristic exhibit similar precision. At k = 5, both methods achieve precision of approximately 45%. This trend reflects a trade-off between recall and precision: as k increases, more correct hypotheses are surfaced, but at the cost of introducing additional non-causal signals. D. Recall@k Figure 6 presents Recall@k. N ET C AUSE outperforms baseline methods at k = 2, recovering approximately 25% of all ground-truth root causes, compared to 20% for the rulebased heuristic. At larger values of k, N ET C AUSE and the heuristic method converge, each recovering approximately 40% of root causes by k = 5. The spatial and temporal baselines underperform across all values of k. VII. D ISCUSSION The results highlight a consistent pattern across evaluation metrics: N ET C AUSE provides its strongest gains at small values of k, particularly for top-ranked predictions. In terms of exact match accuracy and performance at k ∈ {1, 2}, N ET C AUSE substantially outperforms temporal, spatial, and
Fig. 6. Recall@k showing the fraction of ground-truth root causes recovered within the top-k ranked hypotheses. N ET C AUSE in purple.
rule-based baselines. This indicates that counterfactual reasoning over learned graph-temporal dynamics improves the quality of hypothesis ranking when only a small number of diagnostic actions can be taken. In operational settings, this regime is especially important, as automation systems and oncall engineers typically act on one or two high-confidence hypotheses rather than exploring long candidate lists. At the same time, N ET C AUSE does not dominate all baselines across all values of k. For larger candidate sets (k ≥ 3), the rule-based heuristic and spatial proximity baseline achieve comparable performance. This convergence is expected: as more hypotheses are considered, simple heuristics based on temporal and topological proximity increasingly capture at least one causally relevant signal. These baselines effectively exploit strong priors that are broadly valid in network incidents, even if they lack principled causal grounding. Several factors likely contribute to the observed performance gap between N ET C AUSE and the baselines not widening further. First, both the training corpus (1,500 incidents) and the labeled evaluation benchmark (31 incidents) are relatively
small by the standards of deep learning. In this regime, model performance is sensitive to data composition, and removing or adding a small number of incidents can noticeably affect aggregate metrics. We expect that scaling the training set to several thousand additional incidents would improve the robustness and ranking accuracy of the learned generative model. Second, the input data itself is noisy and incomplete. The fault and action signals used by N ET C AUSE are not raw representations of network state, but outputs of observability systems designed to manage alert volume through thresholds, suppression rules, and timing constraints. As a result, these signals may be delayed, suppressed, or only indirectly related to the true underlying cause. In some cases, the true root cause may not be explicitly observable at all. During labeling, we selected the most upstream signal available in the causal chain, but this may still reflect a proxy rather than the originating failure. These limitations affect all evaluated methods and constrain the achievable performance ceiling. Despite these factors, the results indicate that N ET C AUSE offers meaningful advantages over rule-based and heuristic approaches in realistic operational settings. While heuristic methods remain effective for many simple and recurring incidents, they become increasingly brittle as incident complexity grows and failure modes evolve. In contrast, N ET C AUSE learns fault propagation patterns directly from data and evaluates candidate causes through counterfactual simulation, reducing reliance on manual rule specification and improving robustness in complex, multi-fault scenarios. Importantly, N ET C AUSE complements rather than replaces existing RCA techniques. It improves early root cause ranking and provides principled causal attribution, while still benefiting from simple temporal and topological priors when broader exploration is possible. This makes it a practical component for production network operations and automated remediation workflows. N ET C AUSE is also computationally feasible for deployment. Inference achieves sub-30 second latency at the 95th percentile using a sequential CPU-only implementation, which is well within operational constraints given minute-level telemetry. Because counterfactual simulations are independent, inference can be parallelized via batching or GPU execution to further reduce latency (sub-second). Limitations and sensitivity: Our approach relies on several assumptions and design choices that may affect performance in practice. First, evaluation is conducted on a relatively small set of 31 expert-labeled incidents, which introduces statistical variability in aggregate metrics; we partially address this by reporting confidence intervals, but larger labeled benchmarks would provide stronger validation. Second, the counterfactual attribution mechanism assumes approximate unconfoundedness of the observed dynamics; in real deployments, unobserved factors or delayed signals may violate this assumption and affect attribution accuracy. Third, the effectiveness of the TCI metric depends on the fidelity of the learned generative model and the choice of temporal weighting
function; while we use an exponential weighting to emphasize signals near the impact, alternative choices may yield different rankings. Empirically, we observe that performance is stable for moderate weighting parameters ([0.1, 1.0]), with degradation only at larger values, suggesting that the method is not overly sensitive to the exact choice of temporal weighting within a reasonable range. Finally, our formulation focuses on 0 → 1 state transitions, which simplifies modeling but does not explicitly capture recovery dynamics; while challenging from a telemetry point-of-view, extending the model to also reason over fault resolution (1 → 0) is a promising direction for future work. VIII. C ONCLUSION We presented N ET C AUSE, a learning-based framework for root cause analysis in large-scale networked systems that combines graph-temporal modeling with counterfactual simulation. Our method is designed to meet four key requirements for practical RCA in modern cloud networks, as we discussed earlier: Principled, Adaptive, Effective and Feasible at scale. Our evaluation on expert-labeled production incidents shows that N ET C AUSE improves the quality of root cause ranking in the regime most relevant to automation and operational decision-making. When only a small number of hypotheses can be acted upon, N ET C AUSE achieves stronger early ranking and more reliable top-1 and top-2 predictions than heuristic baselines. At larger candidate set sizes, performance converges with heuristic methods, reflecting the continued usefulness of simple temporal and topological priors when broader exploration is possible. Beyond empirical gains, N ET C AUSE offers a complementary path forward for network operations. Rule-based and heuristic approaches remain effective for many simple and recurring incidents but become increasingly brittle as system complexity grows. By learning propagation dynamics and validating candidate causes through counterfactual evaluation, N ET C AUSE reduces manual maintenance burden while preserving interpretability and actionability. Taken together, these results suggest that counterfactual reasoning over learned graph-temporal models is a promising foundation for scalable, data-driven, and actionable root cause analysis in large-scale network management and automation. R EFERENCES [1] J. Pearl and D. Mackenzie, The book of why: the new science of cause and effect. Basic books, 2018. [2] J. Pearl, Causality: models, reasoning, and inference. Cambridge University Press, 2009. [3] F. Montagna, A. A. Mastakouri, E. Eulig, N. Noceti, L. Rosasco, D. Janzing, B. Aragam, and F. Locatello, “Assumption violations in causal discovery and the robustness of score matching,” in Thirtyseventh Conference on Neural Information Processing Systems, 2023. [Online]. Available: https://openreview.net/forum?id=IyTArtpuCK [4] T. Kipf, E. Fetaya, K.-C. Wang, M. Welling, and R. Zemel, “Neural relational inference for interacting systems,” in International conference on machine learning. Pmlr, 2018, pp. 2688–2697. [5] I. Bica, A. M. Alaa, J. Jordon, and M. Van Der Schaar, “Estimating counterfactual treatment outcomes over time through adversarially balanced representations,” 2020.
[6] J. Gilmer, S. S. Schoenholz, P. F. Riley, O. Vinyals, and G. E. Dahl, “Neural message passing for quantum chemistry,” in International conference on machine learning. Pmlr, 2017, pp. 1263–1272. [7] Y. Li, R. Yu, C. Shahabi, and Y. Liu, “Diffusion convolutional recurrent neural network: Data-driven traffic forecasting,” arXiv preprint arXiv:1707.01926, 2017. [8] B. A. Prakash, J. Vreeken, and C. Faloutsos, “Spotting culprits in epidemics: How many and which ones?” in 2012 IEEE 12th international conference on data mining. IEEE, 2012, pp. 11–20. [9] S. Zhao, H. Chen, and J. Zhao, “A physical-information-flow-constrained temporal graph neural network-based simulator for granular materials,” Computer Methods in Applied Mechanics and Engineering, vol. 433, p. 117536, 2025. [10] D. Ha and J. Schmidhuber, “World models,” in NeurIPS, 2018. [11] S. Kliger, S. Yemini, Y. Yemini, D. Ohsie, and S. Stolfo, “A coding approach to event correlation,” in International Symposium on Integrated Network Management. Springer, 1995, pp. 266–277. [12] S. A. Yemini, S. Kliger, E. Mozes, Y. Yemini, and D. Ohsie, “High speed and robust event correlation,” IEEE communications Magazine, vol. 34, no. 5, pp. 82–90, 1996. [13] R. Xin, P. Chen, and Z. Zhao, “Causalrca: Causal inference based precise fine-grained root cause localization for microservice applications,” Journal of Systems and Software, vol. 203, p. 111724, 2023. [14] K. Budhathoki, L. Minorics, P. Bloebaum, and D. Janzing, “Causal structure-based root cause analysis of outliers,” in Proceedings of the 39th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, K. Chaudhuri, S. Jegelka, L. Song, C. Szepesvari, G. Niu, and S. Sabato, Eds., vol. 162. PMLR, 17–23 Jul 2022, pp. 2357–2369. [15] M. Hardt, W. Orchard, P. Blöbaum, S. Kasiviswanathan, and E. Kirschbaum, “The petshop dataset – finding causes of performance issues across microservices,” CLeaR, 2023. [16] L. Zheng, Z. Chen, J. He, and H. Chen, “Mulan: multi-modal causal structure learning and root cause analysis for microservice systems,” in Proceedings of the ACM Web Conference 2024, 2024, pp. 4107–4116. [17] W. R. Orchard, N. Okati, S. H. G. Mejia, P. Blöbaum, and D. Janzing, “Root cause analysis of outliers with missing structural knowledge,” in The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [Online]. Available: https://openreview.net/forum?id=7Nxq4RQApu [18] C.-C. Yen, W. Sun, H. Purmehdi, W. Park, K. R. Deshmukh, N. Thakrar, O. Nassef, and A. Jacobs, “Graph neural network based root cause analysis using multivariate time-series kpis for wireless networks.” in NOMS, vol. 2022, 2022, pp. 1–7. [19] Y. Liu and B. Jafarpour, “Graph attention network with granger causality map for fault detection and root cause diagnosis,” Computers & Chemical Engineering, vol. 180, p. 108453, 2024. [20] Y. Chen, H. Xie, M. Ma, Y. Kang, X. Gao, L. Shi, Y. Cao, X. Gao, H. Fan, M. Wen et al., “Automatic root cause analysis via large language models for cloud incidents,” in Proceedings of the Nineteenth European Conference on Computer Systems, 2024, pp. 674–688. [21] D. Roy, X. Zhang, R. Bhave, C. Bansal, P. Las-Casas, R. Fonseca, and S. Rajmohan, “Exploring llm-based agents for root cause analysis,” in Companion proceedings of the 32nd ACM international conference on the foundations of software engineering, 2024, pp. 208–219. [22] C. Liu, X. Xie, X. Zhang, and Y. Cui, “Large language models for networking: Workflow, advances and challenges,” IEEE Network, 2024.
A PPENDIX A. Model Details: R-GCN Spatial Encoder For completeness, we provide the Relational Graph Convolutional Network (R-GCN) update used in the spatial encoder. (l) Let hv ∈ Rd denote the hidden representation of node v at layer l, and let Nm (v) denote the set of neighbors of v under edge type m ∈ M . A standard R-GCN layer computes: X X 1 (l) , h(l+1) = σ W (l) h(l) + W0 h(l) v v cv,m m u m∈M u∈Nm (v)
(l)
where Wm ∈ Rd×d are relation-specific weight matrices, (l) W0 ∈ Rd×d is a self-loop weight matrix, σ(·) is a nonlinear activation, and cv,m is a normalization constant (e.g., cv,m = |Nm (v)|). Stacking L such layers enables multi-hop propagation across the heterogeneous incident graph. B. Model Architecture and Hyperparameter Optimization We conducted extensive hyperparameter optimization to identify architectures that generalize well to unseen incidents. Our search space included: • Number of R-GCN layers (hops): {1, 2, 3, 4} • Hidden dimension: {8, 16, 32, 64, 128, 256, 512} • Number of RNN layers: {1, 2, 4, 8} • RNN type: {RNN, LSTM, GRU} • Positive class weight: {0.5, 1.0, 1.5, 2.0, 2.5, 10, 50, 100} Key findings from our optimization: 1) Compact models generalize better. Smaller hidden dimensions (8-16) and fewer RNN layers (1) consistently outperformed larger architectures. This suggests that the fault propagation patterns in our data are relatively lowdimensional and that overparameterization leads to overfitting. 2) Low positive class weights are optimal. Weights of 0.52.0 achieved the best F1 scores, indicating that aggressive upweighting of rare events degrades performance. This likely reflects the fact that not all positive examples are equally informative. 3) Moderate spatial depth is sufficient. While 4-hop RGCN models showed better overall performance and generalization, 2-hop models achieved higher peak F1 scores on some incidents. We selected 4 hops as the default to balance generalization and peak performance. 4) Simple RNN outperforms LSTM/GRU. Vanilla RNN cells performed comparably or better than gated variants, suggesting that the temporal dependencies in our data do not require complex gating mechanisms. 5) Bidirectional graphs are critical. Adding reverse edges for hierarchical relationships improved F1 scores substantially (from 0.5 to 0.87). Our final architecture uses: 4 R-GCN layers, hidden dimension 16, 1 RNN layer, vanilla RNN cells, positive weight 0.5, bidirectional graph schema, feature embeddings with Xavier initialization, and skip connections. C. Time Bucketization of Incident Graph Node features are represented as sparse binary time series, recording only state transitions to avoid redundant time steps. This results in irregular temporal sampling where consecutive observations may be separated by varying intervals. To handle this, we discretize time into non-uniform buckets centered around the impact time, with finer resolution near the impact. This reflects the empirical observation that temporal proximity is a strong cue for fault propagation while reducing data dimensionality and model size. The choices of node and edge types, and time bucketization capture some of our assumptions and biases that we impose on the model.