Graphical Causal Reasoning for Root Cause Analysis in Cloud Networks
arXiv:2606.13532v1 [cs.NI] 11 Jun 2026
Fabien Chraim [email protected] Amazon Web Services
Dominik Janzing [email protected] Amazon Web Services
Abstract—Cloud-computing relies on large-scale networks which are inherently complex systems. In this paper, we present a novel approach to root cause analysis (RCA) of cloud network incidents, leveraging graph-based causal discovery techniques. Our method addresses the limitations of rule-based automation by introducing a spatiotemporal grouping strategy and an automation ontology to reduce the dimensionality of the problem. We construct a causal graph from binary time series data using bivariate Granger causality and conditional independence tests. For inference, we introduce a probabilistic method that assigns edge-specific conditional probabilities as a function of time lag, allowing for interpretable, time-aware root cause scoring via causal graph traversal. We evaluated the system using a labeled dataset of 35 production incidents from a major cloud provider. The model successfully recalled the correct root cause in 85.7% of incidents and produced an exact match in 74.3%. In production, the deployed system has been used in over 800 real-world incidents, with positive qualitative feedback from network engineers. These results highlight the practicality of a data-driven, causal approach to RCA in dynamic and large-scale operational environments.
I. I NTRODUCTION
John Evans [email protected] Amazon Web Services
strategy and a network automation ontology. The grouping method narrows the causal discovery search space by limiting variable consideration to those that co-occur within spatial and temporal proximity during network incidents. The automation ontology categorizes network layers, components, faults, and actions, providing structure to the data and enabling the model to scale across hyperscale environments. Using six months of incident data from a major cloud provider, we construct a causal graph that captures statistical dependencies and directional interactions between variables. For inference, we develop a probabilistic graph traversal method that scores candidate root causes by aggregating edge-specific conditional probabilities as a function of time lag. This allows the system to reason about causal propagation over time and select root causes with the highest temporal support. We deployed this framework as an API integrated into the cloud provider’s operational tooling. Over a seven-month period, the system was used in more than 800 real-world incidents. To evaluate its accuracy, we conducted a blind assessment on 35 labeled incidents and found that our model recalled the correct root cause in 85.7% of cases (Recall@3), and produced an exact match in 74.3%. These results demonstrate both the practicality and effectiveness of combining causal discovery with probabilistic, time-aware inference for root cause analysis (RCA) at scale.
Modern cloud computing environments are underpinned by large-scale networks, designed with layers of redundancy to withstand failures. Multiple components might degrade or fail without immediately compromising the overall system. Yet, even in these resilient systems, failures are inevitable. When they occur, they generate a variety of causal and symptomatic II. BACKGROUND AND R ELATED W ORK signals, often simultaneously. This makes root cause analysis (defined as the process of determining which cause to address Traditional approaches to RCA in complex systems often first to restore a service) an operational challenge. There is rely on comparing normal and outlier regimes, where a often not a single root cause, but rather a set of interrelated distribution shift or anomaly triggers root cause identification issues [1]. based on deviation from expected behavior. In this setting, Modern hyperscale networks generate vast volumes of RCA techniques typically analyze differences in metrics or operational signals, making management increasingly complex event distributions to locate the source of failure. Some recent and costly. Rule-based automation struggles to scale, often systems structure telemetry data into graphs for interactive failing to capture dynamic, topology-aware interactions. As RCA and are based on statistical similarity and require rich a result, operators must constantly maintain brittle rules and time-series features [2]. escalate unresolved issues to specialists, leading to delays and Causal inference methods like RCD (root cause discovery) increased operational burden. [3] extend the PC (Peter-Clark) algorithm to detect nodes To address these challenges, we propose a graphical causal with shifted conditional distributions, while CIRCA (causal framework for discovery and inference in complex network inference-based RCA) [4] tests for distribution changes across environments. This framework goes beyond rule-based automa- known causal structures. Recent theoretical work such as Li et tion by uncovering underlying causal relationships between al. [5] addresses root cause discovery under linear structural faults, risks, and actions, enabling more accurate and scalable equation models using a single interventional sample against RCA. Central to our approach are a spatiotemporal grouping a background of observational data. Their method (which © 2026 IEEE. This is the author’s preprint version of a paper accepted for publication in the Proceedings of IEEE International Conference on Communications, 2026. The final version will appear in IEEE Xplore.
assumes linearly related continuous data) uses permutation- statistical independences by ⊥ ⊥, we say that B Granger causes based Cholesky decomposition to identify the intervened A whenever At ̸⊥ ⊥ Bpast(t) |Apast(t) . In section IV-A below, we will describe our data in more variable in a high-dimensional setting and is motivated by gene expression analysis. However, these methods assume clear detail. For now, we mention that it is event-based since we pre/post-failure segmentation and lack time-aware modeling. derive it from existing automation systems running on the Microservice-focused approaches like CausalRCA [6] and network (alerts, workflow steps, etc.). This data is therefore BARO [7] use deep generative models and Bayesian change binary in nature: at a time t, a variable A takes a value of 1 if point detection respectively, but face scalability challenges its underlying event occurred, and a value of 0 otherwise. We and don’t model lagged effects. DCD-FG (differentiable causal are therefore looking for predictors on our binary timeseries. discovery of factor graphs) [8] targets scale using differentiable We employ logistic regression for this task. To test whether B optimization over low-rank DAGs, but assumes global low-rank Granger causes A, we define a restricted model using the A structure unsuitable for heterogeneous network environments. variable alone, and a second, unrestricted model using both A Counterfactual approaches [9], [10] require well-characterized and B causal models difficult to obtain in dynamic infrastructure. In contrast, our method assumes only binary anomaly P (At = 1) log = α0 + α1 Apast(t) indicators over time (e.g., fault present or not), and operates 1 − P (At = 1) entirely within the anomalous regime, without needing a (Restricted Model) baseline of "normal" data. We learn a causal graph over P (At = 1) = β0 + β1 Apast(t) + β2 Bpast(t) log these binary indicators and perform inference directly on this 1 − P (At = 1) structure. To our knowledge, this scenario which uses long (Unrestricted Model) discretized binary histories of outlier signals without relying Once the restricted and unrestricted models are fitted, we are on normal-vs-anomaly comparison, is not well represented in ready to test whether the addition of B significantly improves the RCA literature. the predictive power over A. From the models, we extract The closest work [11] uses probabilistic reasoning over the log likelihoods (LLrestricted and LLunrestricted ) and the knowledge graphs from troubleshooting documents, but lacks degrees of freedom (DoFrestricted and DoFunrestricted ). We temporal propagation modeling and direct causal structure define the likelihood ratio statistic as λ = −2×(LLrestricted − discovery. Our work differs by integrating graph-based causal LL ). We also take the difference in degrees of unrestricted discovery with spatiotemporal grouping and network automafreedom to prepare for a significance test under the χ2 tion ontology for hyperscale environments. We construct causal graphs directly from binary time series using Granger causality distribution: k = DoFunrestricted − DoFrestricted . To test whether the goodness of fit difference is significant and conditional independence tests, introducing probabilistic inunder that distribution, we derive the p-value for the test as ference with edge-specific conditional probabilities as functions follows. of time lag for interpretable, scalable, time-aware reasoning. p-value = 1 − Fχ2k (λ) (1) III. M ODEL -BASED AUTOMATION A PPROACH Our approach to automated network operations relies on a causal graph which captures the cause-effect relationship between our variables. To extract this graph, we first apply Granger causality [12] between variable pairs, then further refine the graph with conditional independence tests applied to variable triplets. In this section we explore the mathematical framework behind our approach. A. Bivariate Granger Causality For a pair of variables (A, B) we are interested in answering the question: does B cause A? Since our observations come as timeseries which show correlations across timestamps, the core of our approach will be Granger causality [12], the standard method for causal timeseries analysis. If the observations from A := (At )t∈Z and B := (Bt )t∈Z are not subjected to hidden common causes, B has a causal influence on A whenever the past of B helps in predicting A from its own past (see chapter 10 of [13] for conditions that guarantee that Granger causality finds all causal relations). Denoting the past observations as Bpast(t) := Bt−1 , Bt−2 , ..., and conditional
This test is designed to ensure that, even though the unrestricted model may have more degrees of freedom, its goodness of fit has to be significantly better than the restricted model. Significance in this case can be determined by setting a threshold on the p-value of equation 1 (commonly 0.05 [14]). Practically speaking, if we find that our p-value is below this threshold, we can add a causal edge from B to A, signifying that B may Granger cause A. We repeat this procedure for all pairs of variables and obtain an initial causal graph. B. Conditional Independence While the pairwise evaluation provides an initial approximation of the causal graph, it is limited in its ability to capture more complex dependencies within a system. For instance, it can mistake indirect links as direct ones, which misguides the reconstruction of the causal pathway. To better understand the causal pathways and refine the graph, a more comprehensive triplet analysis is necessary. This involves assessing conditional independence, which helps to uncover indirect effects and mediation relationships that are otherwise hidden in pairwise comparisons, leading to a more nuanced and accurate representation of the underlying causal structure.
Observations To this end, we propose the following steps. After having (metrics, traces, identified an arbitrary ancestor B of our target variable A log streams) (i.e., a variable influencing A directly or indirectly), we search for a third variable C which is an ancestor of B. To tell determine determine cause whether the influence of C on A is direct or mediated by cause Risks Faults B, we test Cpast(t) ⊥ ⊥ At |Bpast(t) . If this is the case, we cause assume that the three variables C, B, A are linked by the causal remediate/cause remediate/cause DAG C → B → A, otherwise, both B and C are parents of A. In these considerations we have implicitly assumed Actions that the triplet A, B, C is causally sufficient, which collides slightly with our knowledge that they are heavily linked to the Fig. 1: Automation Ontology: Observations (metrics, traces, remaining variables. We also excluded the case where one of log streams) determine risks and faults. Risks can materialize the variables in the triple is a common cause of the others. into faults, and faults can generate risks. Actions can remediate Further, we are assuming that the causal “summary graph” or cause both faults and risks. [15] (i.e. the graph modelling each time series as a node) is acyclic on A, B, C. We also exclude instantaneous influence. To adapt this ontology for network automation, we defined Otherwise the above conditional independence tests cannot 14 fault categories (e.g., hardware errors, control plane issues, necessarily distinguish between direct and indirect effects. Then packet loss), 11 action categories (e.g., device replacement, we can have At ̸⊥ ⊥ Cpast(t) |Bpast(t) even when B influences traffic engineering), and grouped over 800 alerts and 10,000 A via B, as one can easily check using d-separation in causal workflow steps accordingly. Bayesian networks [16]. All three assumptions are certainly Topological information plays a key role: faults propagate oversimplifications, but without them the causal analysis would across multiple hops in both physical and logical topologies. not scale to our large environment. We get some support for our Cloud networks replicate layered architectures (e.g., 3-tier Clos assumptions by observing multiple conditional independences [17], [18]) across geographies, grouping devices by role. We in the data (section IV), which could not be the case if the model this structure using 185 layers, treating the layer as a violations would be too severe. dimension in the variable space. This yields 185 × (14 + 1 + 11) = 4, 810 binary variables, where each (layer, variable) pair IV. C AUSAL D ISCOVERY AT S CALE is distinct and indicates the presence or absence of some fault, Applying the machine learning framework from Section III risk or action. Although the layer-based abstraction reduces to cloud networks is challenging due to the sheer scale and complexity, brute-force causal discovery over 4,8102 variable complexity: millions of devices and thousands of signal types pairs remains intractable. The necessary pruning approach is result in an unmanageably large variable space. Exhaustive described next. causal reasoning over all combinations is computationally infeasible. To address this, we introduce an automation ontology B. Incident Creation with Spatiotemporal Grouping to simplify the space, and a spatiotemporal grouping strategy In large-scale cloud networks, where automation fails to to control combinatorial growth. detect or remediate an issue, escalated events are generated
for manual intervention. These escalations require operators to diagnose and resolve the issue, often without a full The automation ontology presented here is designed to understanding of the context that led to the event. simplify and enhance the management of both large- and smallTo reconstruct incident context, we group signals spatiotemscale computer networks. Its modular structure and focus on porally. Starting from the affected locations, we collect faults, capturing causal relationships between observations, faults, risks, and actions within X hops and a Y -minute window risks, and actions allow for generalization to a wide variety of (these are configurable parameters spanning local topology and complex systems (e.g., service-oriented architectures). time). This defines an incident: the unit we aim to diagnose. Figure 1 shows a graphical representation of the elements Some collected signals may be unrelated, and X, Y must of the ontology as nodes, and their relationships as edges. In balance capturing relevant context while minimizing noise. We many computer systems, observations consist of metrics, traces, exclude raw metrics, traces, and logs, which are summarized and log streams, which can be used to detect faults and assess in the signal data and are difficult to scale. risks via threshold-based or anomaly detection mechanisms. Not only does this method allow us to gather the full context Actions, such as deployments and configuration changes, enable needed for accurate diagnosis and RCA, but it also helps reduce operators to mitigate or remediate these faults and risks. the size of the variable space in two ways: a) we merge signals However, these same actions can inadvertently introduce new which map to the same layer and ontological category together, faults or risks when they contain bugs or trigger unexpected and b) we only need to test combinations of variables that conditions. The self-loop on the ‘Faults’ node illustrates the occur within the same incident, rather than across the entire cascading nature of faults within complex systems. network. A. Automation Ontology for Network Operations
C. Causal Graph
V. P ROBABILISTIC ROOT C AUSE I NFERENCE VIA C AUSAL PATH L IKELIHOOD
We collected a dataset of escalated network events from In this section, we introduce a principled probabilistic January to June 2024. After spatiotemporal grouping and ontology mapping, we extracted 25,474 incidents yielding inference method for RCA based on traversal of the learned 76,595 variable pairs for bivariate Granger analysis (Section causal graph. The approach leverages time-lagged conditional III-A). This substantial reduction in the number of possible probabilities and a likelihood scoring mechanism to evaluate combinations is achieved by eliminating pairs which did not candidate root causes. occur in any incident. This produced 1,681 causal edges (2.19%), which expanded to 1,989 edges after conditional A. Extracting Time-Lagged Conditional Probabilities independence tests (Section III-B). We allowed bidirectional Once the causal structure of the graph has been learned edges to account for timing inaccuracies and missing signals via pairwise and triplet analysis (Section III), we compute a which may be the true root cause. time-dependent conditional probability function for each edge In figure 2, we show a subset of our causal graph that is in the graph. Specifically, for an edge B → A, we define: relevant to a single network layer (excluding edges to and from PB→A (∆t) = P (A = 1 | B = 1, ∆t = tA − tB ) (2) adjacent layers). Many of the causal relationships discovered align with domain knowledge. For instance, hardware errors This function is estimated empirically by computing the (hw_errors) on network routers do in fact cause both dataplane frequency of co-occurrence of events B and A at different packet loss (packet_loss) and control plane issues. Additionally, time lags ∆t using the training dataset. We discretize time state updates can lead to link issues such as flapping or into one-minute bins and estimate P B→A (∆t) for a horizon downtime. However, some discovered edges contradict domain of 20 minutes. In Section V-C, we illustrate examples of such knowledge. For example, link issues are shown as causes conditional probability functions. of hardware errors, which is incorrect: they are typically consequences. This misdirection may result from maturity B. Root Cause Inference by Maximum Path Likelihood timers in our detectors (meaning that signals are intentionally To determine the most likely root cause for a given incident, delayed to account for transient effects/noise in the metrics). we consider each signal in the incident as a candidate root Furthermore, the graph is incomplete; for example, hardware cause r. For each candidate r, we perform a traversal of the packet errors (e.g., ingress errors on a link) are known to cause causal graph to identify all directed paths from r to the impact dataplane packet loss, but this causal relationship is missing, variable y (incidents are generated with the impact variable as likely due to insufficient data. Another key observation is that the entry point). the graph contains cycles, meaning it is not a directed acyclic Each path π = r → v1 → · · · → y is assigned a likelihood graph (DAG). The question remains: can this graph still be score based on the product of conditional probabilities along used for effective RCA? its edges. Let ∆tuv = tv − tu be the time lag between two activated variables u and v on the path. Then the path likelihood is: Y L(π) = Pu→v (∆tuv ) (3) (u→v)∈π
If v is unobserved but u occurred, we conservatively apply a small constant ϵ to the edge likelihood. Since a candidate root cause may have multiple paths to the impact variable, we assign it the maximum path likelihood: L∗ (r) = max L(π) π∈Πr
(4)
where Πr is the set of all paths from r to y. We compute L∗ (r) for all root cause candidates r, and rank them by decreasing likelihood. The root causing algorithm returns the top-3 candidates whose maximum path likelihoods exceed a threshold θ. C. Visualizing Conditional Probability Functions
Fig. 2: Subset of the learned causal graph for a particular network layer.
To build intuition about the conditional probability functions PB→A (∆t), we present two examples in figure 3. Each plot shows the estimated probability of A occurring at a given time lag ∆t after B, over a 20-minute horizon. These examples illustrate how certain types of network events tend to co-occur
(a) Conditional probability of link issue given control plane error, in two different network layers.
To validate the system’s accuracy, we conducted a blind evaluation with network engineers using a labeled dataset of 35 high-impact, low-frequency incidents that bypass existing rule-based automation and escalate to expert operators. Our probabilistic inference method correctly recalled the root cause in 30 out of 35 cases (85.7%) and provided an exact match in 26 cases (74.3%). In this case, we use recall@3 which is the proportion of incidents where the ground-truth root cause appears among the top 3 ranked predictions returned by the model. To contextualize these results, we compared them against a rule-based approach designed by expert network engineers, along with three intuitive baselines relying on purely temporal or spatial heuristics (see figure 4). The rule-based approach produced 17 exact matches (48.6%) and correctly recalled the root cause (i.e., with other similarly scored signals) in 22 cases (62.8%). • Selecting the first signal in the incident yielded 12 exact matches (34.3%). • Selecting the last signal (immediately preceding impact) resulted in 21 exact matches (60%). • Selecting the signal nearest to the impact location in terms of network hops produced 9 exact matches (25.7%) and correctly recalled the root cause (i.e., within the same position) in 18 cases (51.4%).
•
(b) Conditional probability of packet loss given link issue, in two different network layers.
Fig. 3: Example conditional probability functions PB→A (∆t) extracted from historical incidents. (a) Control plane errors in one layer increasing the likelihood of link issues in another. (b) Link issues increasing the likelihood of packet loss.
within specific temporal windows, and how this timing is influenced by the network layer context. In figure 3a, we observe that control plane errors tend to precede link issues with a characteristic lag of 6 to 10 minutes. Outside this time window, the likelihood of co-occurrence drops significantly, suggesting that such pairs should not be interpreted as causally connected when observed outside the typical lag range. In contrast, figure 3b shows that link issues are most strongly associated with packet loss in the first two minutes following the fault. This indicates a tighter, faster Fig. 4: A comparison of exact match match accuracy by method. coupling between these event types. Unlike the temporal baselines, our method incorporates both These empirical patterns provide concrete support for the temporal and spatial reasoning. And unlike the spatial baseline, time-lagged conditional probabilities used in our inference which can suffer from ties or local ambiguity, our approach method. By capturing both the strength and timing of causal consistently delivers higher precision and recall. These results relationships, they enable the system to distinguish meaningful demonstrate that probabilistic inference over a causal graph temporal patterns from coincidental co-occurrences, and to provides a significantly more reliable and actionable foundation reason more effectively about causality during RCA. for automated RCA in large-scale network environments. VI. P ERFORMANCE IN AN O PERATIONAL E NVIRONMENT Operationally, the model has been used in over 800 realWe deployed our model as part of a root cause analysis world incidents over a seven-month period. Engineers provided API used by network engineers in production at a major cloud ratings on a 5-star scale for 48 incidents. Of these, 19 incidents provider. This API integrates with the internal ticketing system received 5-star ratings (indicating a correct and complete root and, upon receiving an incident, performs a spatio-temporal cause), and 25 received at least 3 stars (partially correct but context search, maps signals to ontology concepts, and runs the useful). These results reinforce the practical utility of the probabilistic causal inference method described in Section V system and its ability to guide effective triage in high-pressure to generate root cause hypotheses. environments.
A detailed analysis of the low-rated incidents revealed limitations in our spatial modeling approach. While the spatial simplifications introduced in Section IV-A successfully removed unnecessary location-specific complexity, they also resulted in excessive information compression. Consequently, the model often equated signals that are inherently different, such as distinguishing faults occurring on the same device from those occurring on sibling or neighboring devices within the same layer. Furthermore, the model struggled with incorporating certain types of signals that could not be scoped to a specific device within a network layer. For example, reachability or route signals scoped to network endpoints and path signals scoped to a sequence of locations on the network remain unsupported. Addressing these limitations is critical for improving the model’s performance. Future work will focus on refining the spatial representation to better capture the nuances of fault and signal relationships, particularly in complex network topologies. Nevertheless, these evaluation results and the fact that the model was used in hundreds of incidents are a testament to viability of data-driven, causal reasoning methods for automated RCA in complex, real-time operational settings. VII. D ISCUSSION AND F UTURE W ORK In this paper, we presented a scalable and interpretable approach to RCA for large-scale network environments, grounded in graph-based causal discovery. By combining spatiotemporal grouping with a network automation-specific ontology, we made causal analysis tractable in settings involving tens of thousands of variables across heterogeneous infrastructure layers. Our discovery process integrates bivariate Granger causality and conditional independence tests to construct a causal graph that captures directional relationships between faults, risks, and actions. To support practical root cause inference, we introduced a probabilistic method that scores paths through the causal graph using edge-specific conditional probabilities as a function of time lag. This enables the system to reason over observed incident timelines, highlighting candidate root causes based on how well they temporally and structurally explain the impact. We validated our framework on six months of incident data from a major cloud provider. In a labeled evaluation of 35 real-world incidents, the model recalled the correct root cause in 85.7% of cases and provided an exact match in 74.3% (a 25.7% absolute percentage point improvement over rule-based methods). In production, the system was used in over 800 incidents demonstrating its operational relevance and usability. While effective, our method has some limitations. In particular, the spatial modeling abstractions (designed for scalability) can lead to information loss when distinguishing between local versus neighboring faults, or when handling metrics scoped to network paths and endpoints. Addressing these challenges is a key direction for future work. Additional opportunities include incorporating explicit temporal constraints into the discovery process and exploring GNN-based models that can learn spatiotemporal structure more flexibly.
Despite these limitations, our approach represents a significant step forward in automated network management, offering a scalable and data-driven alternative to traditional rule-based systems. The framework’s ability to discover meaningful causal relationships and provide actionable RCA in a production environment demonstrates its potential to improve network reliability and reduce operational costs in large-scale cloud networks. R EFERENCES [1] Richard I Cook. How complex systems fail. Cognitive Technologies Laboratory, University of Chicago. Chicago IL, pages 64–118, 1998. [2] Michaela Hardt, William R. Orchard, Patrick Blöbaum, Shiva Kasiviswanathan, and Elke Kirschbaum. The petshop dataset – finding causes of performance issues across microservices, 2024. [3] Azam Ikram, Sarthak Chakraborty, Subrata Mitra, Shiv Saini, Saurabh Bagchi, and Murat Kocaoglu. Root cause analysis of failures in microservices through causal discovery. Advances in Neural Information Processing Systems, 35:31158–31170, 2022. [4] Muxuan Li, Zheng Li, Ke Yin, Xiaoyan Nie, Weiqiang Zhang, Kaige Sui, and Dan Pei. Causal inference-based root cause analysis for online service systems with intervention recognition. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 3230–3240. ACM, 2022. [5] Jinzhou Li, Benjamin B. Chu, Ines F. Scheller, Julien Gagneur, and Marloes H. Maathuis. Root cause discovery via permutations and cholesky decomposition, 2025. [6] Ruofan Xin, Pinjia Chen, and Zhen Zhao. Causalrca: Causal inference based precise fine-grained root cause localization for microservice applications. Journal of Systems and Software, 203:111724, 2023. [7] Long Pham, Huy Ha, and He Zhang. Baro: Robust root cause analysis for microservices via multivariate bayesian online change point detection. Proceedings of the ACM on Software Engineering, 1(FSE):2214–2237, 2024. [8] Romain Lopez, Jan-Christian Hütter, Jonathan K Pritchard, and Aviv Regev. Large-scale differentiable causal discovery of factor graphs. In Advances in Neural Information Processing Systems, volume 35, pages 14739–14754, 2022. [9] Kailash Budhathoki, Lenon Minorics, Patrick Bloebaum, and Dominik Janzing. Causal structure-based root cause analysis of outliers. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato, editors, Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pages 2357–2369. PMLR, 17–23 Jul 2022. [10] Nastaran Okati, Sergio Hernan Garrido Mejia, William Roy Orchard, Patrick Blöbaum, and Dominik Janzing. Root cause analysis of outliers with missing structural knowledge, 2024. [11] Erik Aumayr, MingXue Wang, and Anne-Marie Bosneag. Probabilistic knowledge-graph based workflow recommender for network management automation. In 2019 IEEE 20th International Symposium on" A World of Wireless, Mobile and Multimedia Networks"(WoWMoM), pages 1–7. IEEE, 2019. [12] Clive WJ Granger. Investigating causal relations by econometric models and cross-spectral methods. Econometrica: journal of the Econometric Society, pages 424–438, 1969. [13] J. Peters, D. Janzing, and B. Schölkopf. Elements of Causal Inference – Foundations and Learning Algorithms. MIT Press, 2017. [14] Giovanni Di Leo and Francesco Sardanelli. Statistical significance: p value, 0.05 threshold, and applications to radiomics—reasons for a conservative approach. European radiology experimental, 4:1–8, 2020. [15] Jonas Peters, Dominik Janzing, and Bernhard Schölkopf. Causal inference on time series using restricted structural equation models. In C.J. Burges, L. Bottou, M. Welling, Z. Ghahramani, and K.Q. Weinberger, editors, Advances in Neural Information Processing Systems, volume 26. Curran Associates, Inc., 2013. [16] J. Pearl. Causality. Cambridge University Press, 2000. [17] Charles Clos. A study of non-blocking switching networks. Bell System Technical Journal, 32(2):406–424, 1953. [18] John L Hennessy and David A Patterson. Computer architecture: a quantitative approach. Morgan kaufmann, 2017.