Systems and methods for causality-based multivariate time series anomaly detection

A system for detecting anomalies in a computer system, the system comprising:

• a communication interface that receives training data including multivariate time series variables indicating system anomalies that occurred in the computer system over a period of time;
• a memory storing local estimation models and a joint estimation model and a plurality of processor-executable instructions;
• and
• a processor executing the instructions to perform operations comprising:
• transforming, from the multivariate time series variables into a causal graph comprising a plurality of causal variables having a causal relationship;
• deriving a subset of causal variables having no causal parents in the causal graph from the plurality of causal variables;
• training, for each causal variable outside the derived subset, a respective local estimation neural network model implemented on one or more hardware processors, using the transformed casual graph, wherein the training comprises predicting a first conditional distribution of the respective causal variable conditioned on causal parents of the respective causal variable;
• training, for causal variables that belong to the derived subset, a joint estimation neural network model implemented on the one or more hardware processors, using the transformed causal graph, wherein the training comprises predicting a joint distribution of the causal variables that belong to the derived subset;
• and
• storing, at the memory, updated parameters of the trained local estimation neural network models and the trained joint estimation neural network model for multivariate time series anomaly detection;
• and
• generating, using the trained local estimation neural network models and the trained joint estimation neural network model, a predicted system anomaly in response to a multivariate input depicting operation characteristics of the computer system.