Root cause analysis for protection storage devices using causal graphs

Abstract

Embodiments for finding a root cause of an anomaly in a network environment by representing assets in the network environment as respective nodes in a causal graph, wherein the nodes have a measurable quality that can be tracked and arcs between pairs of nodes represent causal relationships between nodes of the node pairs designating source nodes as processes at the top of a hierarchy of tracked processes, and sink nodes as processes at the bottom of the hierarchy and having characteristics of interest in the environment; detecting anomalies in the tracked processes embodied in the sink nodes; traversing the causal graph in a reverse order from a node in which an outlier is detected; and analyzing nodes along the traversal path to identify a node of the highest hierarchy that shows unusual behavior as the root cause.