# Anomaly detection and root cause analysis

ARIMA is widely used for anomaly detection on time-series data e.g. stock price prediction. ARIMA assumes that future value of a variable (stock price in our case) is dependent on its previous values. When we do root cause analysis of a detected anomaly, there can be numerous reasons e.g. russia-ukraine war. I have 2 questions:

1. Isn't the assumption of ARIMA invalidated because stock price is also dependent on other factors such as war
2. Which models can I use to do the Root-cause analysis and how? If there's an existing article, I'm happy to read on it. I could not find anything meaningful related to "Root cause analysis of a detected anomaly"
• For "root cause" try the keyword Diagnosis/diagnostics. Apr 20 at 11:53
• The formulation of root cause may be overly strict. Looking for factors that contribute might be more fruitful. And not that in general, Causal Analysis (what caused what, from data) is extremely difficult Apr 20 at 11:55
• I found a video where similar thing is happening. I want to understand how these guys are finding root cause at youtu.be/0frTKMakaOs?t=371 Apr 21 at 18:10
• In that video they have engineered relevant univariate metrics (or KPIs as they call them), that are also understandable to a human. What they likely do in order to to highlight the most relevant ones, is to compute the ones that changed the most in the anomalous period. This is probably quite useful for diagnostics - but it is far removed still from "root cause" Apr 21 at 19:54
• oh I see. Then, relevant ones can be easily found by calculating the variance of other KPIs during the period of anomaly. I guess I was complicating the issue by thinking of complex algorithms such as Pearson coefficient for root case. I have 2 questions 1. they have thumbs up and down both at the issue level and the chart level. Do you know how that might be implmented in the background youtu.be/0frTKMakaOs?t=439 ? 2. How did you conclude they were using univariate? IMO, they are using multivariate time-series because onboaring failures can depend on several factors. Thanks! Apr 22 at 3:09