Abstract
Recent studies have shown the ability of large language models to perform avariety of tasks, including time series forecasting. The flexible nature ofthese models allows them to be used for many applications. In this paper, wepresent a novel study of large language models used for the challenging task oftime series anomaly detection. This problem entails two aspects novel for LLMs:the need for the model to identify part of the input sequence (or multipleparts) as anomalous; and the need for it to work with time series data ratherthan the traditional text input. We introduce sigllm, a framework for timeseries anomaly detection using large language models. Our framework includes atime-series-to-text conversion module, as well as end-to-end pipelines thatprompt language models to perform time series anomaly detection. We investigatetwo paradigms for testing the abilities of large language models to perform thedetection task. First, we present a prompt-based detection method that directlyasks a language model to indicate which elements of the input are anomalies.Second, we leverage the forecasting capability of a large language model toguide the anomaly detection process. We evaluated our framework on 11 datasetsspanning various sources and 10 pipelines. We show that the forecasting methodsignificantly outperformed the prompting method in all 11 datasets with respectto the F1 score. Moreover, while large language models are capable of findinganomalies, state-of-the-art deep learning models are still superior inperformance, achieving results 30% better than large language models.