Anomaly and causality detection

A computer-implemented method comprising:

• receiving time-series data including a first time series and a second time series;
• performing anomaly detection on the time-series data to detect anomalies using an anomaly detection model;
• detecting a causal relationship between a first measure of the time-series data and a second measure of the time-series data, wherein the detecting comprises:
• grouping the anomalies by measure to generate anomaly groups, wherein anomalies in the first time series that relate to the first measure are grouped together with anomalies in the second time series that relate to the first measure and anomalies in the first time series that relate to the second measure are grouped together with anomalies in the second time series that relate to the second measure;
• scoring the anomaly groups;
• inferring causal relationships between measures of the anomaly groups to generate a causal data structure;
• and
• attributing anomalies that relate to the first measure to anomalies that relate to the second measure using the causal data structure;
• and
• outputting a result of the detections detecting a causal relationship between the first measure of the time-series data and the second measure of the time-series data.

A system comprising:

• one or more electronic devices to implement an anomaly and causality detection service in a multi-tenant provider network, the anomaly and causality detection service including instructions that upon execution by one or more processors cause the anomaly and causality detection service to:
• receive time-series data including a first time series and a second time series;
• perform anomaly detection on the time-series data to detect anomalies using an anomaly detection model;
• detect a causal relationship between a first measure of the time-series data and a second measure of the time-series data, wherein the detecting comprises:
• grouping the anomalies by measure to generate anomaly groups, wherein anomalies in the first time series that relate to the first measure are grouped together with anomalies in the second time series that relate to the first measure and anomalies in the first time series that relate to the second measure are grouped together with anomalies in the second time series that relate to the second measure;
• scoring the anomaly groups;
• inferring causal relationships between measures of the anomaly groups to generate a causal data structure;
• and
• attributing anomalies that relate to the first measure to anomalies that relate to the second measure using the causal data structure;
• and
• output a result of the detecting a causal relationship between the first measure of the time-series data and the second measure of the time-series data.