Suppose there are sensors which supply numerical metrics. If a metric goes above or below a healthy threshold, an event (alert) is raised. Metrics depend on each other in one way or another (we can learn the dependencies via ML algorithms) so when the system is in alerting state only one or a few metrics will be a root cause and all others will be simply consequences.
We can assume there is enough historical metric data available, to learn dependencies but there are just a few historical malfunctions. Also, when malfunction happens there is no one to tell what was the root cause, the algorithm should learn how to detect root causes by itself.
Which algorithms can be used to detect the root cause events in the situation above? Are there any papers available on the subject?