Argos: Agentic Time-Series Anomaly Detection with Autonomous Rule Generation via Large Language Models

2025-01-24

AI Summary

To address the poor interpretability, verification difficulty, and deployment challenges of time-series anomaly detection in cloud services, this paper proposes a large language model (LLM)-based multi-agent rule generation system. Our approach innovatively adopts **interpretable logical rules as an intermediate representation**, establishing an agent-driven detection paradigm that integrates rule modeling, multi-agent collaboration, and a low-overhead online inference engine—enabling end-to-end fully automated, zero-error, high-accuracy anomaly detection. Evaluated on public benchmarks and Microsoft’s internal production datasets, our method achieves F1-score improvements of 9.5% and 28.3%, respectively, significantly outperforming existing state-of-the-art methods. Crucially, it ensures full traceability of detection processes, reproducibility of generated rules, and verifiability of decisions—thereby effectively supporting observability requirements in cloud infrastructure.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Machine Learning: Large Multimodal Models (LMMs)
• Multiagent Systems: Modeling other Agents

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

Observability in cloud infrastructure is critical for service providers, driving the widespread adoption of anomaly detection systems for monitoring metrics. However, existing systems often struggle to simultaneously achieve explainability, reproducibility, and autonomy, which are three indispensable properties for production use. We introduce Argos, an agentic system for detecting time-series anomalies in cloud infrastructure by leveraging large language models (LLMs). Argos proposes to use explainable and reproducible anomaly rules as intermediate representation and employs LLMs to autonomously generate such rules. The system will efficiently train error-free and accuracy-guaranteed anomaly rules through multiple collaborative agents and deploy the trained rules for low-cost online anomaly detection. Through evaluation results, we demonstrate that Argos outperforms state-of-the-art methods, increasing $F_1$ scores by up to $9.5%$ and $28.3%$ on public anomaly detection datasets and an internal dataset collected from Microsoft, respectively.

Problem

• Anomaly Detection
• Time Series Data
• Cloud Services

Innovation

• Intelligent System
• Anomaly Detection
• Large Language Model