AI-Driven Root Cause Analysis of Production Incidents in Microservice-Based Cloud Applications

Abstract

Production incidents in microservice-based cloud applications are difficult to diagnose because user-visible failures emerge from interactions among services, infrastructure, networks, deployment changes, and human operating practices. The same initiating fault may produce different symptoms across releases, while a single symptom may have several plausible causes. Existing artificial-intelligence approaches have made substantial progress: anomaly detection, service-dependency graphs, causal discovery, multimodal telemetry fusion, and large language models have each advanced the field along different fronts. Yet the literature remains fragmented. Many methods are evaluated on a small number of systems or fault types; reported performance depends on telemetry completeness and the definition of “root cause”; causal graphs may encode temporal association rather than interventionally valid causation; and rank-only recommendations can promote automation bias during time-pressured incident response. This paper synthesizes research on metrics-, log-, trace-, graph-, causal-, multimodal-, and language-model-based diagnosis and proposes HITL-CausalFusion, an uncertainty-aware, human-in-the-loop framework for production root cause analysis. The framework aligns heterogeneous telemetry and change events, learns modality-specific representations, and constrains temporal causal discovery with observed topology. It then ranks candidate causes using anomaly, propagation, counterfactual, and prior-knowledge evidence, and produces calibrated explanations with an explicit abstention mechanism. A rigorous evaluation protocol is specified across RCAEval, DeathStarBench-derived testbeds, OpenRCA, and controlled fault injection, using localization accuracy, ranking quality, calibration, robustness, latency, and operational utility. A complementary human study measures diagnostic correctness, time to a defensible hypothesis, workload, trust calibration, and unsafe reliance. The central argument is that publishable progress in AI-driven incident diagnosis should be judged not only by top-k localization, but by causal validity, transfer robustness, evidence traceability, calibrated uncertainty, and appropriate human reliance. The proposed framework and protocol provide a falsifiable foundation for such evaluation without overstating the maturity of autonomous root cause analysis.