Interpretable Anomaly Explanation in Distributed Traces Using Causal Graphs and Counterfactual Ranking

Abstract

Modern microservice platforms increasingly rely on distributed tracing to observe end-to-end behavior across heterogeneous components, runtimes, and networks. While anomaly detection over traces has matured, operators still face a gap between detecting that a trace is abnormal and understanding why it is abnormal in a way that is both actionable and stable under noise, sampling, and instrumentation drift. This paper develops a technically grounded approach for interpretable anomaly explanation in distributed traces by combining causal graphs with counterfactual ranking. The central idea is to lift raw trace events into a causal representation that distinguishes correlation from plausible influence paths, then to generate explanation candidates as minimal interventions whose predicted counterfactual effect reduces abnormality. The method unifies structural causal models over trace-derived variables, graph-constrained representation learning for node and edge attributes, and a ranking objective that trades off explanatory power, intervention cost, and robustness. The approach supports backprop-friendly scoring for learning components, while retaining explicit causal semantics for explanation. It further addresses distributed execution mechanics, storage internals, and complexity constraints typical of high-cardinality trace streams. Error analysis is provided for approximate query execution and sketch-based feature aggregation, and multi-objective optimization is used to navigate Pareto trade-offs among latency overhead, explanation fidelity, and operational cost. Evaluation methodology is specified to enable reproducible benchmarking across services, workloads, and failure modes.