Foundation-Model-Assisted Time-Series Anomaly Detection with Verifier-Grounded LLM Incident Explanation Agents
Keywords:
Time-Series Anomaly Detection, Time-Series Foundation Model, Numenta Anomaly Benchmark, LLM Agent, Incident Explanation, Verifier, AiopsAbstract
Streaming anomaly detection must identify rare operational failures early without overwhelming responders with false alarms, and the resulting alerts must be explained without inventing unsupported causes. This study evaluates a foundation-model-assisted detection and explanation pipeline on the complete Numenta Anomaly Benchmark (NAB): 58 univariate series, 365,558 observations, 120 labeled timestamps, and 116 anomaly windows. Eight detectors were executed across every series, including robust and forecasting baselines, Isolation Forest, exact re-executions of Windowed Gaussian and Relative Entropy, a globally trained 18,817-parameter patch Transformer, and a fused method named FMA-Fusion. Under the official standard NAB profile, FMA-Fusion obtained 55.07, compared with 53.72 for Relative Entropy and 39.45 for Windowed Gaussian. It detected 80 of 116 windows with precision 0.339, recall 0.690, and event-level F1 0.455. The gain was consistent under the low-false-positive and low-false-negative profiles, although file-bootstrap intervals overlapped and the fusion ablation showed that the PatchFM component did not change the optimized alert set beyond Relative Entropy plus Isolation Forest. A verifier-grounded incident agent then converted 356 measured alerts into 1,068 claim-equivalent explanations. All 10,416 factual checks passed; the verifier rejected all 356 deliberately corrupted explanations and abstained on all 356 incomplete incident cards. The results show that distribution-shift statistics remain highly competitive on heterogeneous streaming data, compact global forecasting representations are useful contextual evidence but are not automatically strong anomaly detectors, and strict evidence contracts can make LLM-facing incident explanations reproducible and factually controlled.
References
[1] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A survey,” ACM Computing Surveys, vol. 41, no. 3, art. 15, pp. 1–58, 2009.
[2] Y. He, Y. Pan, Y. Wang, S. Du, and Q. Xin, “Intelligent fault analysis with AIOps technology,” J. Theory Pract. Eng. Sci., vol. 4, no. 1, pp. 94–100, Feb. 2024, doi: 10.53469/jtpes.2024.04(01).13.
[3] J. Nie and D. Zheng, “Noisy-neighbor-aware VM degradation risk modeling with unsupervised residual fusion,” J. Adv. Comput. Syst., vol. 4, no. 4, pp. 112–123, Apr. 2024, doi: 10.69987/JACS.2024.40409.
[4] A. Lavin and S. Ahmad, “Evaluating real-time anomaly detection algorithms—The Numenta Anomaly Benchmark,” in Proc. IEEE 14th Int. Conf. Machine Learning and Applications (ICMLA), 2015, pp. 38–44.
[5] S. Ahmad, A. Lavin, S. Purdy, and Z. Agha, “Unsupervised real-time anomaly detection for streaming data,” Neurocomputing, vol. 262, pp. 134–147, 2017.
[6] H. Zhang, “Risk-aware budget-constrained auto-bidding under first-price RTB: A distributional constrained deep reinforcement learning framework,” J. Adv. Comput. Syst., vol. 4, no. 6, pp. 30–47, Jun. 2024, doi: 10.69987/JACS.2024.40603.
[7] B. Wang, Y. He, Z. Shui, Q. Xin, and H. Lei, “Predictive optimization of DDoS attack mitigation in distributed systems using machine learning,” Appl. Comput. Eng., vol. 64, no. 1, pp. 89–94, May 2024, doi: 10.54254/2755-2721/64/20241350.
[8] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. 8th IEEE Int. Conf. Data Mining, 2008, pp. 413–422.
[9] S. Guha, N. Mishra, G. Roy, and O. Schrijvers, “Robust random cut forest based anomaly detection on streams,” in Proc. 33rd Int. Conf. Machine Learning, PMLR, vol. 48, 2016, pp. 2712–2721.
[10] C. Wang, K. Viswanathan, L. Choudur, V. Talwar, W. Satterfield, and K. Schwan, “Statistical techniques for online anomaly detection in data centers,” in Proc. IFIP/IEEE Int. Symp. Integrated Network Management, 2011, pp. 385–392.
[11] N. Laptev, S. Amizadeh, and I. Flint, “Generic and scalable framework for automated time-series anomaly detection,” in Proc. 21st ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2015, pp. 1939–1947.
[12] A. Siffer, P.-A. Fouque, A. Termier, and C. Largouët, “Anomaly detection in streams with extreme value theory,” in Proc. 23rd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2017, pp. 1067–1075.
[13] K. Hundman, V. Constantinou, C. Laporte, I. Colwell, and T. Soderstrom, “Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding,” in Proc. 24th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2018, pp. 387–395.
[14] Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, “Robust anomaly detection for multivariate time series through stochastic recurrent neural network,” in Proc. 25th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2019, pp. 2828–2837.
[15] J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga, “USAD: UnSupervised anomaly detection on multivariate time series,” in Proc. 26th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2020, pp. 3395–3404.
[16] Q. Xin, Z. Xu, L. Guo, F. Zhao, and B. Wu, “IoT traffic classification and anomaly detection method based on deep autoencoders,” Appl. Comput. Eng., vol. 69, no. 1, pp. 64–70, Jul. 2024, doi: 10.54254/2755-2721/69/20241511.
[17] J. Xu, H. Wu, J. Wang, and M. Long, “Anomaly Transformer: Time series anomaly detection with association discrepancy,” in Int. Conf. Learning Representations, 2022.
[18] S. Tuli, G. Casale, and N. R. Jennings, “TranAD: Deep Transformer networks for anomaly detection in multivariate time series data,” Proc. VLDB Endowment, vol. 15, no. 6, pp. 1201–1214, 2022.
[19] H. Zhang, “DriftGuard: Multi-signal drift early warning and safe re-training/rollback for CTR/CVR models,” J. Adv. Comput. Syst., vol. 3, no. 7, pp. 24–40, Jul. 2023, doi: 10.69987/JACS.2023.30703.
[20] A. Vaswani et al., “Attention is all you need,” in Advances in Neural Information Processing Systems, vol. 30, 2017, pp. 5998–6008.
[21] H. Zhou et al., “Informer: Beyond efficient Transformer for long sequence time-series forecasting,” Proc. AAAI Conf. Artificial Intelligence, vol. 35, no. 12, pp. 11106–11115, 2021.
[22] H. Wu, J. Xu, J. Wang, and M. Long, “Autoformer: Decomposition Transformers with auto-correlation for long-term series forecasting,” in Advances in Neural Information Processing Systems, vol. 34, 2021, pp. 22419–22430.
[23] T. Zhou, Z. Ma, Q. Wen, X. Wang, L. Sun, and R. Jin, “FEDformer: Frequency enhanced decomposed Transformer for long-term series forecasting,” in Proc. 39th Int. Conf. Machine Learning, PMLR, vol. 162, 2022, pp. 27268–27286.
[24] Y. Nie, N. H. Nguyen, P. Sinthong, and J. Kalagnanam, “A time series is worth 64 words: Long-term forecasting with Transformers,” in Int. Conf. Learning Representations, 2023.
[25] H. Wu, T. Hu, Y. Liu, H. Zhou, J. Wang, and M. Long, “TimesNet: Temporal 2D-variation modeling for general time series analysis,” in Int. Conf. Learning Representations, 2023.
[26] T. Zhou, P. Niu, X. Wang, L. Sun, and R. Jin, “One fits all: Power general time series analysis by pretrained LM,” in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 43322–43355.
[27] K. Rasul et al., “Lag-Llama: Towards foundation models for probabilistic time series forecasting,” arXiv:2310.08278, 2023.
[28] Z. Zhong, M. Zheng, H. Mai, J. Zhao, and X. Liu, “Cancer image classification based on DenseNet model,” J. Phys.: Conf. Ser., vol. 1651, no. 1, Art. no. 012143, Nov. 2020, doi: 10.1088/1742-6596/1651/1/012143.
[29] Z. Ling, Q. Xin, Y. Lin, G. Su, and Z. Shui, “Optimization of autonomous driving image detection based on RFAConv and triplet attention,” Appl. Comput. Eng., vol. 77, no. 1, pp. 210–217, Jul. 2024, doi: 10.54254/2755-2721/77/2024MA0067.
[30] M. T. Ribeiro, S. Singh, and C. Guestrin, “‘Why should I trust you?’: Explaining the predictions of any classifier,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2016, pp. 1135–1144.
[31] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Advances in Neural Information Processing Systems, vol. 30, 2017, pp. 4765–4774.
[32] J. Nie and D. Zheng, “Ambiguity-aware HDFS log anomaly detection with retrieval-augmented failure narratives and selective refusal,” J. Adv. Comput. Syst., vol. 3, no. 1, pp. 66–80, Jan. 2023, doi: 10.69987/JACS.2023.30105.
[33] J. Wei et al., “Chain-of-thought prompting elicits reasoning in large language models,” in Advances in Neural Information Processing Systems, vol. 35, 2022, pp. 24824–24837.
[34] S. Yao et al., “ReAct: Synergizing reasoning and acting in language models,” in Int. Conf. Learning Representations, 2023.
[35] S. Zhou, Z. Li, and E. Wang, “Evidence-grounded RAG for tokenized trade receivable disclosure QA under U.S. capital market standards,” J. Adv. Comput. Syst., vol. 3, no. 7, pp. 41–57, Jul. 2023, doi: 10.69987/JACS.2023.30704.
[36] T. Schick et al., “Toolformer: Language models can teach themselves to use tools,” in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 68539–68551.
[37] Y. Li, “Findable then explainable: Retrieval–summary integration for code intelligence on a lightweight CodeSearchNet subset,” J. Adv. Comput. Syst., vol. 4, no. 7, pp. 65–82, Jul. 2024, doi: 10.69987/JACS.2024.40706.
[38] L. Ouyang et al., “Training language models to follow instructions with human feedback,” in Advances in Neural Information Processing Systems, vol. 35, 2022, pp. 27730–27744.
[39] Z. S. Zhong, R. Ma, and H. Zhao, “Human-uncertainty distillation for calibrated vision models on CIFAR-10H,” J. Adv. Comput. Syst., vol. 3, no. 2, pp. 77–89, Feb. 2023, doi: 10.69987/JACS.2023.30206.
[40] N. Tatbul, T. J. Lee, S. Zdonik, M. Alam, and J. Gottschlich, “Precision and recall for time series,” in Advances in Neural Information Processing Systems, vol. 31, 2018, pp. 1924–1934.
[41] Y. Wang, S. Du, Q. Xin, Y. He, and W. Qian, “Autonomous driving system driven by artificial intelligence perception fusion,” Acad. J. Sci. Technol., vol. 9, no. 2, pp. 193–198, Feb. 2024, doi: 10.54097/e0b9ak47.
[42] Z. S. Zhong and S. Ling, “Improved theoretical guarantee for rank aggregation via spectral method,” Inf. Inference: J. IMA, vol. 13, no. 3, Art. no. iaae020, Sep. 2024, doi: 10.1093/imaiai/iaae020.
[43] K. Xu, H. Zhou, H. Zheng, M. Zhu, and Q. Xin, “Intelligent classification and personalized recommendation of e-commerce products based on machine learning,” Appl. Comput. Eng., vol. 64, no. 1, pp. 147–153, May 2024, doi: 10.54254/2755-2721/64/20241365.
[44] S. Zhou, Z. Li, and E. Wang, “Long-document RAG for contractual and insurance clause analysis in receivables RWA structures,” J. Adv. Comput. Syst., vol. 4, no. 8, pp. 88–104, Aug. 2024, doi: 10.69987/JACS.2024.40810.
[45] Q. Xin, R. Song, Z. Wang, Z. Xu, and F. Zhao, “Enhancing bank credit risk management using the C5.0 decision tree algorithm,” J. Comput. Technol. Appl. Math., vol. 1, no. 4, pp. 100–107, Nov. 2024, doi: 10.5281/zenodo.14032041.
[46] Z. S. Zhong and S. Ling, “Uncertainty quantification of spectral estimator and MLE for orthogonal group synchronization,” arXiv:2408.05944, Aug. 2024, doi: 10.48550/arXiv.2408.05944.
[47] J. Wang, Q. Xin, Y. Liu, J. Wang, and T. Yang, “Predicting enterprise marketing decision making with intelligent data-driven approaches,” J. Ind. Eng. Appl. Sci., vol. 2, no. 3, pp. 12–19, Jun. 2024, doi: 10.5281/zenodo.11357252.
[48] A. G. S. Raj, H. Zhang, V. Abhyankar, S. Mukerjee, E. Zhang, J. Williams, R. Halverson, and J. M. Patel, “Impact of bilingual CS education on student learning and engagement in a data structures course,” in Proc. 19th Koli Calling Int. Conf. Computing Education Research, 2019, pp. 1–10, doi: 10.1145/3364510.3364518.
[49] J. Chen, J. Xiong, Y. Wang, Q. Xin, and H. Zhou, “Implementation of an AI-based MRD evaluation and prediction model for multiple myeloma,” Front. Comput. Intell. Syst., vol. 6, no. 3, pp. 127–131, Jan. 2024, doi: 10.54097/zJ4MnbWW.
[50] T. Yang, Q. Xin, X. Zhan, S. Zhuang, and H. Li, “Enhancing financial services through big data and AI-driven customer insights and risk analysis,” J. Knowl. Learn. Sci. Technol., vol. 3, no. 3, pp. 53–62, Jul. 2024, doi: 10.60087/jklst.vol3.n3.p53-62.
Downloads
Published
Issue
Section
License
Copyright (c) 2024 Lei Xu, Christopher Brooks, Xin Liu, Kelly Simmons, Bo Sun (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
Creative Commons Attribution 4.0 International (CC BY 4.0).
This work is licensed under a 