Bayesian Network-based Casual Structure Learning for Root Cause Analysis of IoT Network Anomalies

Abstract

Since the Internet of Things (IoT) network's expansion has significantly increased the complexity of monitoring and debugging systems, there is an urgent need for abnormality diagnosis to ensure stable system operations. However, traditional anomaly detection methods can only find abnormal activities and are not able to perform root cause analysis (RCA) for possible failures. To address this limitation, we introduce a Bayesian Network-based RCA framework, which performs causal structure and parameter learning, and probabilistic reasoning. This framework detect causes and effects by deploying the Peter-Clark algorithm, and can find the model's parameters (i.e., forward and backwards inference) with Expectation-Maximisation. In this way, we identify how an anomaly transits through the system and uncover root causes. In the feature selection component, one of the main components of the proposed system, SHapley Additive exPlanations (SHAP) and Recursive Feature Elimination methods are employed to reduce model complexity and increase interpretability. We evaluate the framework on the TON-IoT dataset to evaluate diagnostic accuracy and obtain actionable causal insights instead of detection-only baselines. The experimental results reveal that the proposed framework provides a robust diagnosis model with the achieved causal explanations for the anomalies in IoT networks. © 2026 IEEE.