Division of labor in CPS anomaly detection

Abstract

Anomaly detection in multivariate time series is critical for ensuring the reliability of cyber-physical systems (CPS). We propose a two-stage framework that combines advanced anomaly detection models with large language models (LLMs) to provide robust detection and interpretable explanations. In the first stage, a self-supervised ensemble of temporal and spatiotemporal models identifies anomalies based on reconstruction errors. In the second stage, LLMs generate natural language explanations for these anomalies, making results accessible to domain experts. To address LLM limitations such as hallucination and instruction adherence, we design structured prompts that provide focused context, anomaly details, and clear guidelines. This framework emphasizes a division of labor between detection models, LLMs, data scientists, and users. We validate the approach using data from a search-and-rescue cruiser, showcasing its ability to detect diverse anomalies and provide interpretable outputs. This work bridges advanced machine learning with practical CPS applications, offering a path towards a user-friendly approach to anomaly detection.Vo