Large Language Models can Deliver Accurate and Interpretable Time Series Anomaly Detection

Time series anomaly detection (TSAD) plays a crucial role in various industrial applications. Traditional deep learning TSAD models require extensive training data and operate as black boxes, lacking interpretability for detected anomalies. To address these challenges, we propose LLMAD, a novel TSAD method that employs Large Language Models (LLMs) to deliver accurate and interpretable TSAD results. LLMAD applies in-context anomaly detection by retrieving both positive and negative similar time series segments, significantly enhancing LLMs’ effectiveness. Furthermore, LLMAD employs the Anomaly Detection Chain-of-Thought approach to mimic expert logic for its decision-making process. This further enhances its performance and enables LLMAD to provide explanations for their detections through versatile perspectives.

Experiments conducted on both offline datasets and through online deployment on a large-scale cloud system at Microsoft indicate that our LLMAD achieves detection performance comparable to state-of-the-art deep learning methods. Additionally, LLMAD offers human-readable interpretability for detections at a reasonable cost, significantly reducing engineers’ effort.