System, method, and computer program for automatic root cause analysis

Abstract

A system, method, and computer program product are provided for automatic root cause analysis. In operation, a root cause analysis system identifies at least one event associated with one or more records for which to perform a root cause analysis. The root cause analysis system performs a root cause analysis of the event by automatically generating a decision tree based on all records in the current time-window such that each leaf in the decision tree represents the probabilities for class labels of a target variable and each branch in the decision tree represents a feature that leads to a corresponding class label probability. The root cause analysis system automatically generates the decision tree by automatically selecting at each step the feature that maximizes information gain based on a current subset of data. The root cause analysis system then classifies which conditioned feature is a causal factor and which is a root cause of the event by using a conditional entropy equation on each branch leading to the tree leaf. The root cause analysis is repeatedly performed on sequential time-window sets of records gathered, per a sufficiently small time window for near-real-time root cause detection, yet sufficiently large records set for statistical significance.