Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Argos: Agentic Time-Series Anomaly Detection with Autonomous Rule Generation via Large Language Models

Yile Gu, Yifan Xiong, Jonathan Mace, Yuting Jiang, Yigong Hu, Baris Kasikci, Peng Cheng

TL;DR

Argos tackles the triad of explainability, reproducibility, and autonomy in cloud time-series anomaly detection by training executable anomaly rules generated autonomously by LLMs. It combines an agent-based rule-generation loop (Detection, Repair, Review) with a model-fusion framework to guarantee accuracy, and employs top-$k$ rule selection for efficiency. Across KPI, Yahoo, and a Microsoft internal dataset, Argos outperforms state-of-the-art baselines in $F_1$ while delivering significantly faster inference and modest training costs. The approach offers practical benefits for production reliability by enabling explainable rules with deterministic performance and autonomous adaptation to distribution shifts.

Abstract

Observability in cloud infrastructure is critical for service providers, driving the widespread adoption of anomaly detection systems for monitoring metrics. However, existing systems often struggle to simultaneously achieve explainability, reproducibility, and autonomy, which are three indispensable properties for production use. We introduce Argos, an agentic system for detecting time-series anomalies in cloud infrastructure by leveraging large language models (LLMs). Argos proposes to use explainable and reproducible anomaly rules as intermediate representation and employs LLMs to autonomously generate such rules. The system will efficiently train error-free and accuracy-guaranteed anomaly rules through multiple collaborative agents and deploy the trained rules for low-cost online anomaly detection. Through evaluation results, we demonstrate that Argos outperforms state-of-the-art methods, increasing $F_1$ scores by up to $9.5\%$ and $28.3\%$ on public anomaly detection datasets and an internal dataset collected from Microsoft, respectively.

Argos: Agentic Time-Series Anomaly Detection with Autonomous Rule Generation via Large Language Models

TL;DR

Argos tackles the triad of explainability, reproducibility, and autonomy in cloud time-series anomaly detection by training executable anomaly rules generated autonomously by LLMs. It combines an agent-based rule-generation loop (Detection, Repair, Review) with a model-fusion framework to guarantee accuracy, and employs top- rule selection for efficiency. Across KPI, Yahoo, and a Microsoft internal dataset, Argos outperforms state-of-the-art baselines in while delivering significantly faster inference and modest training costs. The approach offers practical benefits for production reliability by enabling explainable rules with deterministic performance and autonomous adaptation to distribution shifts.

Abstract

Observability in cloud infrastructure is critical for service providers, driving the widespread adoption of anomaly detection systems for monitoring metrics. However, existing systems often struggle to simultaneously achieve explainability, reproducibility, and autonomy, which are three indispensable properties for production use. We introduce Argos, an agentic system for detecting time-series anomalies in cloud infrastructure by leveraging large language models (LLMs). Argos proposes to use explainable and reproducible anomaly rules as intermediate representation and employs LLMs to autonomously generate such rules. The system will efficiently train error-free and accuracy-guaranteed anomaly rules through multiple collaborative agents and deploy the trained rules for low-cost online anomaly detection. Through evaluation results, we demonstrate that Argos outperforms state-of-the-art methods, increasing scores by up to and on public anomaly detection datasets and an internal dataset collected from Microsoft, respectively.
Paper Structure (28 sections, 1 equation, 14 figures, 6 tables, 1 algorithm)

This paper contains 28 sections, 1 equation, 14 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Motivation and Challenges
  3. Why Existing Methods Fall Short?
  4. How LLMs can Help in Rule Generation?
  5. Opportunities and Challenges in Applying LLMs
  6. System Design
  7. Overview
  8. Autonomous Rules Generation
  9. Correctness and Accuracy Improvement via Feedback Loops
  10. Accuracy Guarantee via Model Fusion
  11. Efficiency Enhancement
  12. Implementation
  13. Data Preprocessing
  14. Data Selection
  15. Evaluation
  16. ...and 13 more sections

Figures (14)

  • Figure 1: GPU utilization and memory usage metrics for a distributed model training on 256 A100 GPUs, where a hang issue occurred in NCCL since the job launched.
  • Figure 2: Two example metrics from the KPI dataset, where the blue line shows the metric data and the orange crosses represents the anomalies.
  • Figure 3: An example rule written by human and implemented in Python, modified from Resin.
  • Figure 4: Analysis of prior methods on the KPI dataset metric da403.
  • Figure 5: Anomaly rules and code generated by LLM.
  • ...and 9 more figures