NetCause: Counterfactual Learning for Root Cause Analysis in Large-Scale Networks

A self-supervised graph-temporal framework that ranks root causes via counterfactual simulation, trained on 1,500+ production incidents and evaluated on 31 expert-labeled cases.

Fabien Chraim; Jian Zhang; Dominik Janzing; Xiang Song; Christos Faloutsos; John Evans· 2026· DOI 10.48550/arXiv.2606.13543

The core problem

Root cause analysis (RCA) in large-scale networks remains a critical challenge due to the dynamic and complex nature of fault propagation across physical and logical dependencies. Existing techniques often rely on static rules, correlation heuristics, or topology-local reasoning, which struggle to generalize in environments where faults cascade through interdependent systems. The paper introduces NetCause, a self-supervised learning-based framework that addresses these limitations by modeling network incidents as graph-temporal processes and employing counterfactual simulation to rank candidate root causes. The goal is to produce an interpretable ranking of root cause hypotheses that integrates naturally with operator-defined mitigation and remediation actions. The authors train NetCause on over 1,500 incidents collected over six months from a leading cloud provider's production network and evaluate it on 31 expert-labeled incidents. The key research question is whether a learned model can capture fault propagation patterns and causally attribute customer impact to underlying root causes, thereby improving operational decision-making.

The authors evaluate NetCause on 31 expert-labeled incidents from a leading cloud provider's production network. The primary metric is root cause ranking quality, measured by accuracy in identifying the correct root cause among top candidates. NetCause achieves a 16.1% accuracy improvement over a rule-based heuristic baseline. This improvement is particularly significant in the regime most relevant to operational decision-making, where rapid and accurate root cause identification is critical. The paper reports that training is computationally intensive, but inference is efficient, requiring only seconds of GPU runtime per incident. This efficiency ensures that NetCause can be deployed in real-time operational settings without introducing delays beyond typical telemetry collection latencies. The results demonstrate that the counterfactual simulation approach effectively captures fault propagation and causal attribution, outperforming static and correlation-based methods.

Root cause analysis (RCA) in large-scale networks remains a critical challenge due to the dynamic and complex nature of fault propagation across physical and logical dependencies. Existing techniques often rely on static rules, correlation heuristics, or topology-local reasoning, which struggle to generalize in environments where faults cascade through interdependent systems. The paper introduces NetCause, a self-supervised learning-based framework that addresses these limitations by modeling network incidents as graph-temporal processes and employing counterfactual simulation to rank candidate root causes. The goal is to produce an interpretable ranking of root cause hypotheses that integrates naturally with operator-defined mitigation and remediation actions. The authors train NetCause on over 1,500 incidents collected over six months from a leading cloud provider's production network and evaluate it on 31 expert-labeled incidents. The key research question is whether a learned model can capture fault propagation patterns and causally attribute customer impact to underlying root causes, thereby improving operational decision-making.

NetCause operates in two phases: training and inference. During training, the model learns from historical incident data represented as graph-temporal processes. Each incident is modeled as a sequence of graph snapshots, where nodes represent network entities (e.g., routers, links, services) and edges represent dependencies. The model employs a self-supervised learning objective to capture fault propagation dynamics without requiring explicit labels for every incident. Counterfactual simulation is then used to generate alternative scenarios by perturbing the graph and observing the resulting impact, allowing the model to rank candidate root causes based on their causal contribution to the observed incident.

The findings suggest that modeling network incidents as graph-temporal processes and leveraging counterfactual simulation can significantly enhance root cause analysis in large-scale networks. The 16.1% accuracy improvement over a rule-based heuristic baseline indicates that learned causal representations are more effective than static rules or correlation heuristics, especially in dynamic environments where faults propagate across complex dependencies. The interpretable ranking of root cause hypotheses allows operators to understand and trust the model's recommendations, facilitating integration with mitigation and remediation actions. However, the approach has limitations: training requires substantial computational resources, and the model's performance depends on the quality and quantity of historical incident data. The evaluation on 31 expert-labeled incidents, while promising, is relatively small, and further validation on larger and more diverse datasets is needed. Additionally, the self-supervised learning objective may not capture all nuances of fault propagation, particularly for rare or novel failure modes. Future work could explore transfer learning to reduce training costs and incorporate operator feedback to refine rankings. Overall, NetCause represents a promising step toward causally grounded, interpretable RCA in production networks.

CS practitioners and researchers

Opening member content…