{
  "schema_version": "0.1.0",
  "record_type": "research-topic",
  "topic_id": "root-cause-analysis",
  "label": "Root-Cause Analysis",
  "title": "Systems Root-Cause Analysis Research",
  "description": "Research papers on root-cause analysis for performance, latency, resource, tracing, and distributed-systems failures.",
  "introduction": "This topic collects methods that move from an observed anomaly to a ranked or explained cause. The records cover dependency graphs, spectrum-based localization, critical-path evidence, statistical debugging, profiling, and cross-layer traces for identifying the resources, services, functions, or interactions responsible for a failure or slowdown.",
  "aliases": [
    "root cause analysis",
    "RCA",
    "performance root-cause localization"
  ],
  "search_terms": [
    "root-cause analysis",
    "RCA",
    "fault localization",
    "performance diagnosis",
    "latency culprit ranking"
  ],
  "related_topics": [
    "performance-analysis",
    "latency-analysis",
    "observability",
    "dependency-graphs",
    "system-tracing"
  ],
  "canonical_url": "https://threadslab.org/research-publications/topics/root-cause-analysis.html",
  "paper_count": 19,
  "papers": [
    {
      "paper_id": "care-context-aware-root-cause-identification",
      "title": "CARE: Context Aware Root Cause Identification Using Distributed Traces and Profiling Metrics",
      "year": 2026,
      "authors": [
        "Mahsa Panahandeh",
        "Naser Ezzati-Jivan",
        "Abdelwahab Hamou-Lhadj",
        "James Miller"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/care-context-aware-root-cause-identification/",
      "canonical_source_url": "https://doi.org/10.1109/TSE.2025.3645143",
      "core_contribution": "CARE combines distributed traces and profiling metrics with graph- and spectrum-based analysis to localize performance root causes in microservices.",
      "tags": [
        "system-tracing",
        "microservices",
        "root-cause-analysis",
        "latency-analysis"
      ],
      "keywords": [
        "distributed traces",
        "profiling metrics",
        "context-aware RCA",
        "microservice diagnosis",
        "TrainTicket",
        "spectrum-based fault localization",
        "PageRank",
        "China Mobile Zhejiang"
      ]
    },
    {
      "paper_id": "dtracomp-distributed-trace-comparison",
      "title": "DTraComp: Comparing distributed execution traces for understanding intermittent latency sources",
      "year": 2026,
      "authors": [
        "Maryam Ekhlasi",
        "Fatemeh Faraji Daneshgar",
        "Michel Dagenais",
        "Maxime Lamothe",
        "Naser Ezzati-Jivan",
        "Matthew Khouzam"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/dtracomp-distributed-trace-comparison/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112990",
      "core_contribution": "DTraComp is an open-source Eclipse Trace Compass framework that compares groups of distributed requests and attributes span time to user-space, kernel, thread-state, and system-call evidence.",
      "tags": [
        "system-tracing",
        "kernel-tracing",
        "trace-analysis",
        "trace-visualization",
        "latency-analysis",
        "root-cause-analysis",
        "microservices",
        "lttng"
      ],
      "keywords": [
        "DTraComp",
        "distributed trace comparison",
        "OpenTracing",
        "LTTng",
        "LTTng-UST",
        "Eclipse Trace Compass",
        "differential flame graph",
        "span-state attribution",
        "system-call attribution",
        "Waited CPU",
        "Waited Blocked",
        "HotROD",
        "TiDB",
        "Apache Cassandra",
        "Eclipse Theia",
        "JFreeChart",
        "Jaeger",
        "microservice performance"
      ]
    },
    {
      "paper_id": "lmat-adaptive-tracing-language-models",
      "title": "LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models",
      "year": 2026,
      "authors": [
        "Kasra Darvishi",
        "Morteza Noferesti",
        "Yuvraj Sehgal",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/lmat-adaptive-tracing-language-models/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112890",
      "core_contribution": "LMAT combines multi-task language models for kernel-event and event-duration prediction with online change detection, lightweight error-vector root-cause analysis, and adaptive tracing control.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "llm-assisted-analysis",
        "observability",
        "anomaly-detection",
        "root-cause-analysis",
        "trace-reduction"
      ],
      "keywords": [
        "adaptive tracing",
        "LTTng",
        "kernel events",
        "system-call sequences",
        "event-duration modeling",
        "language models",
        "LSTM",
        "BERT",
        "multi-task learning",
        "HDBSCAN",
        "change detection",
        "root-cause analysis",
        "Apache",
        "Sock Shop",
        "OpenTelemetry",
        "Prometheus",
        "stress-ng",
        "trace reduction",
        "trace overhead"
      ]
    },
    {
      "paper_id": "rethinking-performance-debugging-from-optimization-to-collaborative-reasoning",
      "title": "Rethinking Performance Debugging: From Optimization to Collaborative Reasoning",
      "year": 2026,
      "authors": [
        "Mahsa Panahandeh",
        "Naser Ezzati-Jivan",
        "Abdelwahab Hamou-Lhadj"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/rethinking-performance-debugging-from-optimization-to-collaborative-reasoning/",
      "canonical_source_url": "https://doi.org/10.1145/3803437.3805578",
      "core_contribution": "The paper reframes performance debugging as collaborative reasoning over multiple evidence-grounded hypotheses rather than optimization for one supposedly best explanation.",
      "tags": [
        "performance-analysis",
        "microservices",
        "llm-assisted-analysis",
        "root-cause-analysis",
        "observability"
      ],
      "keywords": [
        "performance debugging",
        "collaborative reasoning",
        "AgentDebug",
        "Reasoning Surface",
        "hypothesis generation",
        "hypothesis critique",
        "hypothesis curation",
        "Gemini 2.5 Flash",
        "CART",
        "DeLag",
        "Train-Ticket",
        "E-Shopper",
        "fault injection",
        "RPC latency",
        "Pareto-optimal hypotheses"
      ]
    },
    {
      "paper_id": "hybridrca-critical-path-aware-tracing",
      "title": "HybridRCA: Lightweight Critical-Path-Aware Hybrid Tracing for Root-Cause Analysis in Production Microservices",
      "year": 2025,
      "authors": [
        "Maryam Ekhlasi",
        "Arnaud Fiorini",
        "Michel R. Dagenais",
        "Naser Ezzati-Jivan",
        "Maxime Lamothe"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/hybridrca-critical-path-aware-tracing/",
      "canonical_source_url": "https://doi.org/10.1109/icsme64153.2025.00056",
      "core_contribution": "HybridRCA combines critical-path-aware span analysis with targeted kernel metrics to reduce production trace volume while preserving root-cause localization evidence.",
      "tags": [
        "system-tracing",
        "microservices",
        "root-cause-analysis",
        "latency-analysis"
      ],
      "keywords": [
        "critical path",
        "hybrid tracing",
        "production microservices",
        "LTTng",
        "OpenTracing",
        "Personalized PageRank",
        "weighted spectrum-based fault localization",
        "HotROD",
        "TrainTicket",
        "OnlineBoutique",
        "TiDB",
        "SysBench",
        "kernel-level storage"
      ]
    },
    {
      "paper_id": "context-aware-root-cause-localization-in-distributed-traces-using-social-network-analysis-work-i",
      "title": "Context-aware Root Cause Localization in Distributed Traces Using Social Network Analysis (Work In Progress paper)",
      "year": 2024,
      "authors": [
        "Mahsa Panahandeh",
        "Naser Ezzati-Jivan",
        "Abdelwahab Hamou-Lhadj",
        "James Miller"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/context-aware-root-cause-localization-in-distributed-traces-using-social-network-analysis-work-i/",
      "canonical_source_url": "https://doi.org/10.1145/3629527.3651426",
      "core_contribution": "The work-in-progress paper combines service-call graph context, social-network analysis, and spectrum-based fault localization to rank distributed-trace root causes.",
      "tags": [
        "root-cause-analysis",
        "microservices",
        "social-network-analysis",
        "anomaly-detection",
        "performance-analysis"
      ],
      "keywords": [
        "context-aware RCA",
        "service-call graph",
        "distributed traces",
        "service communities",
        "Louvain",
        "PageRank",
        "Jaccard distance",
        "Ochiai",
        "CPU stress",
        "network delay",
        "network loss",
        "AIOps Challenge 2020"
      ]
    },
    {
      "paper_id": "efficient-unsupervised-latency-culprit-ranking",
      "title": "Efficient Unsupervised Latency Culprit Ranking in Distributed Traces with GNN and Critical Path Analysis",
      "year": 2024,
      "authors": [
        "Mahsa Panahandeh",
        "Naser Ezzati-Jivan",
        "Abdelwahab Hamou-Lhadj",
        "James Miller"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/efficient-unsupervised-latency-culprit-ranking/",
      "canonical_source_url": "https://doi.org/10.1145/3629527.3651841",
      "core_contribution": "The paper combines an unsupervised GraphSAGE model with critical-path-specific latency profiles to detect anomalous requests and rank likely microservice culprits without labelled training data.",
      "tags": [
        "microservices",
        "graph-neural-networks",
        "latency-analysis",
        "root-cause-analysis",
        "trace-analysis"
      ],
      "keywords": [
        "latency culprit ranking",
        "distributed traces",
        "GraphSAGE",
        "graph neural networks",
        "critical path",
        "FIRM dataset",
        "service invocation graph",
        "unsupervised anomaly detection",
        "Top-k ranking"
      ]
    },
    {
      "paper_id": "toward-adaptive-tracing-language-models",
      "title": "Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models",
      "year": 2024,
      "authors": [
        "Kasra Darvishi",
        "Morteza Noferesti",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/toward-adaptive-tracing-language-models/",
      "canonical_source_url": "https://doi.org/10.1145/3639476.3639778",
      "core_contribution": "The paper proposes an adaptive tracing loop that combines language-model prediction of kernel-event sequences and event durations with change detection and root-cause analysis, so detailed tracing is activated only around significant behavior shifts.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "llm-assisted-analysis",
        "observability",
        "anomaly-detection",
        "root-cause-analysis",
        "trace-reduction"
      ],
      "keywords": [
        "adaptive tracing",
        "LTTng",
        "kernel events",
        "system-call sequences",
        "event-duration modeling",
        "language models",
        "LSTM",
        "BERT",
        "multi-task learning",
        "change detection",
        "root-cause analysis",
        "Apache2",
        "trace reduction",
        "trace overhead"
      ]
    },
    {
      "paper_id": "altoom-out-of-memory-root-cause",
      "title": "AltOOM: A Data-driven Out of Memory Root Cause Identification Strategy",
      "year": 2023,
      "authors": [
        "Pranjal Chakraborty",
        "Naser Ezzati-Jivan",
        "Vahid Azhari",
        "François Tetreault"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/altoom-out-of-memory-root-cause/",
      "canonical_source_url": "https://doi.org/10.1109/bigdata59044.2023.10386937",
      "core_contribution": "AltOOM combines early memory-pressure forecasting with selective process-level profiling to identify the process most responsible for an impending out-of-memory event.",
      "tags": [
        "resource-analysis",
        "root-cause-analysis",
        "system-tracing",
        "predictive-monitoring"
      ],
      "keywords": [
        "out-of-memory",
        "OOM diagnosis",
        "data-driven RCA",
        "resource analysis",
        "memory pressure forecasting",
        "process-level profiling",
        "Perf",
        "sar"
      ]
    },
    {
      "paper_id": "pasd-statistical-debugging-kernel-events",
      "title": "PASD: A Performance Analysis Approach Through the Statistical Debugging of Kernel Events",
      "year": 2023,
      "authors": [
        "Mohammed Adib Khan",
        "Morteza Noferesti",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/pasd-statistical-debugging-kernel-events/",
      "canonical_source_url": "https://doi.org/10.1109/scam59687.2023.00025",
      "core_contribution": "PASD uses Linux kernel-event traces, Perf call stacks, and statistical debugging to rank functions associated with performance problems without application-source instrumentation.",
      "tags": [
        "kernel-tracing",
        "performance-analysis",
        "root-cause-analysis",
        "anomaly-detection"
      ],
      "keywords": [
        "statistical debugging",
        "Linux kernel tracepoints",
        "Perf",
        "perf record",
        "call stacks",
        "sched_switch",
        "Firefox",
        "Coreutils",
        "ls",
        "Bug 1637586",
        "Bug 1565019",
        "function suspect ranking"
      ]
    },
    {
      "paper_id": "execution-trace-model-verification-multicore",
      "title": "Execution trace-based model verification to analyze multicore and real-time systems",
      "year": 2022,
      "authors": [
        "Raphaël Beamonte",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/execution-trace-model-verification-multicore/",
      "canonical_source_url": "https://doi.org/10.1002/cpe.6974",
      "core_contribution": "The paper combines model-based quantitative constraints with user-space and kernel execution traces to automatically identify likely causes of real-time and multicore constraint violations.",
      "tags": [
        "system-tracing",
        "kernel-tracing",
        "multicore-systems",
        "trace-analysis",
        "root-cause-analysis",
        "lttng"
      ],
      "keywords": [
        "model-based constraints",
        "execution tracing",
        "user-space traces",
        "kernel traces",
        "LTTng",
        "LTTng-UST",
        "Common Trace Format",
        "Trace Compass",
        "reservoir sampling",
        "critical-path analysis",
        "JACK2",
        "cyclictest",
        "priority inversion",
        "CPUTop"
      ]
    },
    {
      "paper_id": "automated-cause-analysis-latency-outliers",
      "title": "Automated Cause Analysis of Latency Outliers Using System-Level Dependency Graphs",
      "year": 2021,
      "authors": [
        "Sneh Patel",
        "Brendan Park",
        "Naser Ezzati-Jivan",
        "Quentin Fournier"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/automated-cause-analysis-latency-outliers/",
      "canonical_source_url": "https://doi.org/10.1109/QRS54544.2021.00054",
      "core_contribution": "The paper combines system-level dependency graphs with automated outlier detection to localize likely causes of latency anomalies.",
      "tags": [
        "system-tracing",
        "latency-analysis",
        "root-cause-analysis",
        "dependency-graphs"
      ],
      "keywords": [
        "latency outliers",
        "system-level traces",
        "dependency graphs",
        "density-based models",
        "z-score",
        "production diagnosis"
      ]
    },
    {
      "paper_id": "debugging-performance-degradation-distributed-requests",
      "title": "Debugging of Performance Degradation in Distributed Requests Handling Using Multilevel Trace Analysis",
      "year": 2021,
      "authors": [
        "Naser Ezzati-Jivan",
        "Houssem Daoud",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/debugging-performance-degradation-distributed-requests/",
      "canonical_source_url": "https://doi.org/10.1155/2021/8478076",
      "core_contribution": "The paper correlates LTTng traces from user space through kernel, storage, network, and multiple hosts in a disk-backed state model, enabling top-down diagnosis of distributed request latency.",
      "tags": [
        "system-tracing",
        "microservices",
        "performance-analysis",
        "root-cause-analysis",
        "trace-analysis"
      ],
      "keywords": [
        "distributed requests",
        "multilevel trace analysis",
        "LTTng",
        "Apache",
        "PHP",
        "MariaDB",
        "State History Tree",
        "cache hit ratio",
        "disk contention",
        "ApacheBench",
        "Trace Compass"
      ]
    },
    {
      "paper_id": "depgraph",
      "title": "DepGraph: Localizing Performance Bottlenecks in Multi-Core Applications Using Waiting Dependency Graphs and Software Tracing",
      "year": 2020,
      "authors": [
        "Naser Ezzati-Jivan",
        "Quentin Fournier",
        "Michel R. Dagenais",
        "Abdelwahab Hamou-Lhadj"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/depgraph/",
      "canonical_source_url": "https://doi.org/10.1109/SCAM51674.2020.00022",
      "core_contribution": "DepGraph uses system-level tracing to expose the waiting dependencies that divide a task's execution time across threads and hardware resources.",
      "tags": [
        "kernel-tracing",
        "performance-analysis",
        "root-cause-analysis",
        "multicore-systems"
      ],
      "keywords": [
        "waiting dependency graph",
        "system-level tracing",
        "blocking dependencies",
        "performance bottlenecks",
        "thread-resource interactions"
      ]
    },
    {
      "paper_id": "multilevel-trace-lock-contention",
      "title": "Multi-Level Execution Trace Based Lock Contention Analysis",
      "year": 2020,
      "authors": [
        "Majid Rezazadeh",
        "Naser Ezzati-Jivan",
        "Evan Galea",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multilevel-trace-lock-contention/",
      "canonical_source_url": "https://doi.org/10.1109/issrew51248.2020.00068",
      "core_contribution": "The paper extends critical-path analysis across kernel and user-space lock events so contention from futexes, spinlocks, semaphores, and other synchronization mechanisms can be diagnosed without recompiling the application.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "root-cause-analysis"
      ],
      "keywords": [
        "lock contention",
        "multi-level execution traces",
        "LTTng 2.10",
        "Trace Compass 4",
        "LD_PRELOAD",
        "Pthreads",
        "futex",
        "spinlock",
        "semaphore",
        "critical path",
        "state system",
        "Apache",
        "OPcache"
      ]
    },
    {
      "paper_id": "automatic-cause-detection-web-applications",
      "title": "Automatic Cause Detection of Performance Problems in Web Applications",
      "year": 2019,
      "authors": [
        "Quentin Fournier",
        "Naser Ezzati-Jivan",
        "Daniel Aloise",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/automatic-cause-detection-web-applications/",
      "canonical_source_url": "https://doi.org/10.1109/ISSREW.2019.00102",
      "core_contribution": "The paper presents a tracing and analysis pipeline that detects slow web requests and groups them by internal execution behavior to expose likely causes.",
      "tags": [
        "kernel-tracing",
        "web-performance",
        "anomaly-detection",
        "root-cause-analysis"
      ],
      "keywords": [
        "web requests",
        "user-space tracing",
        "kernel-space tracing",
        "outlier detection",
        "behavior clustering",
        "PHP cache contention"
      ]
    },
    {
      "paper_id": "heterogeneous-debugging-dynamic-tracing",
      "title": "Efficient Large-Scale Heterogeneous Debugging Using Dynamic Tracing",
      "year": 2019,
      "authors": [
        "Didier Nadeau",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/heterogeneous-debugging-dynamic-tracing/",
      "canonical_source_url": "https://doi.org/10.1016/j.sysarc.2019.02.016",
      "core_contribution": "The paper redesigns GDB dynamic tracing around LTTng-UST and scalable trace views so multi-threaded CPU/GPU debugging remains usable on heterogeneous many-core systems.",
      "tags": [
        "system-tracing",
        "trace-analysis",
        "performance-analysis",
        "root-cause-analysis"
      ],
      "keywords": [
        "heterogeneous systems",
        "dynamic tracing",
        "large-scale debugging",
        "debugging efficiency",
        "GDB",
        "LTTng-UST",
        "Trace Compass",
        "ROCm-GDB",
        "GPU debugging",
        "pbzip2"
      ]
    },
    {
      "paper_id": "high-latency-cause-detection-multilevel-analysis",
      "title": "High latency cause detection using multilevel dynamic analysis",
      "year": 2018,
      "authors": [
        "Naser Ezzati-Jivan",
        "Genevieve Bastien",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/high-latency-cause-detection-multilevel-analysis/",
      "canonical_source_url": "https://doi.org/10.1109/SYSCON.2018.8369613",
      "core_contribution": "The paper correlates PHP user-space events with LTTng kernel events in a unified multilevel model to explain high-latency web requests.",
      "tags": [
        "system-tracing",
        "latency-analysis",
        "root-cause-analysis",
        "performance-analysis"
      ],
      "keywords": [
        "high latency",
        "dynamic analysis",
        "multilevel analysis",
        "latency causes",
        "LTTng",
        "LTTng-UST",
        "Trace Compass",
        "OPcache contention"
      ]
    },
    {
      "paper_id": "intrusion-response-systems-survey-taxonomy",
      "title": "Intrusion Response Systems: Survey and Taxonomy",
      "year": 2012,
      "authors": [
        "Alireza Shameli-Sendi",
        "Naser Ezzati-Jivan",
        "Masoume Jabbarifar",
        "Michel Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/intrusion-response-systems-survey-taxonomy/",
      "canonical_source_url": "https://publications.polymtl.ca/14629/",
      "core_contribution": "This survey organizes intrusion-response systems around automation, response cost, decision evaluation, adjustment, execution, attack paths, and risk assessment.",
      "tags": [
        "anomaly-detection",
        "root-cause-analysis",
        "observability"
      ],
      "keywords": [
        "intrusion response systems",
        "response cost",
        "automated response",
        "NIDS",
        "HIDS",
        "IDMEF",
        "adaptive response",
        "retroactive response",
        "attack paths",
        "risk assessment"
      ]
    }
  ]
}