Paper deep dive

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability

Roberto Stanzione, Jules Barbe, Magali Parrino, Jérémie Fourmann, Paul Boniol

Year: 2026Venue: arXiv preprintArea: cs.LGType: PreprintEmbeddings: 123

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%

Last extracted: 10/3/2026, 2:19:12 AM

Summary

The paper introduces SHAD (Scality High-dimensional Anomaly Detection benchmark), a novel dataset comprising 215 multivariate, high-dimensional time series from real-world distributed cloud storage systems. Unlike existing benchmarks that focus primarily on detection accuracy, SHAD provides rich semantic annotations and contextual information to support end-to-end evaluation of Time Series Anomaly Detection (TSAD), including explainability and interpretability. The authors benchmark 18 anomaly detectors and evaluate the effectiveness of frozen Large Language Models (LLMs) for interpreting anomalies.

Entities (10)

SHAD · dataset · 98%Scality · organization · 95%Time Series Anomaly Detection · task · 92%Explainability · concept · 90%Interpretability · concept · 90%Scality RING · system · 90%Large Language Models · technology · 88%Exathlon · dataset · 85%NAB · dataset · 85%TSB-AD · dataset · 85%

Relation Signals (6)

SHAD → createdby → Scality

confidence 95% · collected from real-world distributed cloud storage systems operated by Scality

SHAD → supportstask → Time Series Anomaly Detection

confidence 95% · benchmark for Time Series Anomaly Detection, Explainability and Interpretability

SHAD → hasfeature → Explainability

confidence 90% · The proposed dataset includes rich contextual information... evaluate baseline methods for Detection, Explainability, and Interpretability

SHAD → hasfeature → Interpretability

confidence 90% · investigate the effectiveness of frozen LLM baselines in localizing and interpreting anomalies

Large Language Models → usedfor → Interpretability

confidence 88% · investigate the effectiveness of frozen LLM baselines in localizing and interpreting anomalies

Exathlon → comparedto → SHAD

confidence 85% · The Exathlon benchmark [38] partially addresses this... but lacks fine-grained, semantically rich per-dimension annotations

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Time Series Anomaly Detection has received increasing attention, driven by the growing availability of complex time series data. This surge has led to the development of numerous detection methods, as well as a variety of benchmarks aimed at thoroughly evaluating their performance. However, most existing detectors remain largely agnostic to domain context, overlooking explainability and interpretability. One of the main reasons for this gap is that current benchmarks primarily focus on detection accuracy, and only few of them evaluate spatial explainability. Moreover, no benchmark currently provides sufficiently rich semantic annotations to support the generation of human-understandable interpretations of anomalies. To address these limitations, we introduce SHAD (Scality High-dimensional Anomaly Detection benchmark), a fully annotated benchmark composed of 215 multivariate, high-dimensional time series collected from real-world distributed cloud storage systems operated by Scality. The proposed dataset includes rich contextual information, covering three families of anomalies with varying degrees of severity. As further contribution, we provide a foundation for future work by evaluating baseline methods for Detection, Explainability, and Interpretability, covering all stages of a TSAD pipeline. For Detection, we benchmark a wide range of existing anomaly detectors, testing their effectiveness on the proposed real-world dataset. Then, we consider explainability by evaluating whether measuring the contribution of each dimension in the generated anomaly score can provide accurate anomaly attributions. Finally, for interpretability, we investigate the effectiveness of frozen LLM baselines in localizing and interpreting anomalies.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

119,493 characters extracted from source content.

Expand or collapse full text

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability. Roberto Stanzione Inria, ENS, CNRS, PSL Paris, France Jules Barbe Scality Paris, France Magali Parrino Inria, ENS, CNRS, PSL, EDF Paris, France Jérémie Fourmann Scality Paris, France Paul Boniol Inria, ENS, CNRS, PSL Paris, France Abstract Time Series Anomaly Detection (TSAD) has received increasing attention, driven by the growing availability of complex time series data. This surge has led to the development of numerous detection methods, as well as a variety of benchmarks aimed at thoroughly evaluating their performance. However, most existing detectors remain largely agnostic to domain context, overlooking explainability and inter- pretability. One of the main reasons for this gap is that current benchmarks primarily focus on detection accuracy, and only few of them evaluate spatial explainability. Moreover, no benchmark currently provides sufficiently rich semantic annotations to support the generation of human-understandable interpretations of anomalies. To address these limitations, we introduce SHAD (ScalityHigh-dimensionalAnomaly Detection benchmark), a fully annotated benchmark composed of 215 multivariate, high-dimensional time series collected from real-world distributed cloud storage systems operated by Scality. The proposed dataset includes rich contextual in- formation, covering three families of anomalies with varying degrees of severity. As further contribution, we provide a foundation for future work by evaluating baseline methods for Detection, Explainability, and Interpretability, covering all stages of a TSAD pipeline. For Detection, we benchmark a wide range of existing anomaly detectors, testing their effectiveness on the proposed real-world dataset. Then, we consider explainability by evaluating whether measuring the contribution of each dimension in the generated anomaly score can provide accurate anomaly attributions. Finally, for interpretability, we investigate the effectiveness of frozen LLM baselines in localizing and interpreting anomalies, paving the way for future research towards interpretable and explainable TSAD. 1 Introduction The adoption of sensing solutions has enabled the collection of large amounts of time series [65], whose analysis is increasingly important across multiple domains [11,22,28]. In this context, time series anomaly detection (TSAD) aims to identify patterns that deviate from normal behavior [16], and has attracted significant attention over the years [91,7,27]. This has driven the introduction of several benchmarks [67,6] which, however, focus on accuracy-oriented evaluation and overlook interpretability and explainability. As a result, existing benchmarks lack rich semantic annotations, limiting the ability to assess whether models can meaningfully explain and interpret anomalies. The Exathlon benchmark [38] partially addresses this by providing root cause and effect intervals, but 40th Conference on Neural Information Processing Systems (NeurIPS 2026). Track on Evaluations and Datasets. arXiv:2610.01168v1 [cs.LG] 1 Oct 2026 푇푖푚푒 풜 ! 풜 " 푡 풜 ! 푡 풜 " 푑 풜 " 푑 풜 ! (a)Example of time seriesinSHAD 12 dimensions among 171 in total 푇 (%) 푇 (!) 푇 (") 푇 (') 푇 (() 푇 ()) 푇 (*) 푇 (+) 푇 (,) 푇 (-) 푇 (!%) 푇 (!!) (b) Annotations inSHAD Store1-g2disk01- disk_read_bytes Metric Name NVMedata disk, where object data is stored (Bytes/s) Disk read throughput Metric Info Annotations for 푇 ("") Store3-ssd02- disk_io_time_seconds Metric Name SSD used for S3 metadata and small object storage (s/s) Fraction of time spent on I/O (1=saturated) Metric Info DurationDegradationSensors 푇 (%) , 푇 (!) , 푇 (") , 푇 (') 1hNA Annotations for 푇 ($) Anom. presence Yes Anom.CategoryAsynchronous Detection Label: 0,1 . Explanation Label: 0,1 /×. ... Two asynchronous anomalies: (풜 " ): 1 Storage Node killed on Store 1 at time 푡 풜 " = 9:00 for 푑 풜 " =1 hour 30 minutes (풜 ! ): 2 Storage Node killed on Store 3 at time 푡 풜 ! = 14:00 for 푑 풜 ! =1 hour Textual Exaplanation Criticality High Type Storage Node DurationDegradation Sensors 1.5h NA 푇 (") , 푇 ($) , 푇 (%) , 푇 (&') , 푇 (&&) Figure 1: Example of SHAD’s contextual knowledge (Asynchronous Storage Node Failure). still uses coarse-grained anomaly types without explicit mappings to system components and lacks fine-grained, semantically rich per-dimension annotations. Thus, while the surge of LLMs is leading the definition of interpretable solutions [33,107,109], researchers highlight that the scarcity of time series data enriched with textual context forces them to rely on synthetic data [96], hindering a proper, real-world evaluation of the proposed approaches. As mentioned in [96]: "However, research [...] for time series understanding and reasoning remains limited, primar- ily due to the scarcity of high-quality datasets that align time series with textual information". To address this gap, we introduce SHAD (ScalityHigh-dimensionalAnomalyDetection benchmark), a benchmark built from Scality RING distributed storage platform. SHAD includes both normal and anomalous series, with curated anomalies affecting different architectural layers. The dataset comprises215high-dimensional time series with per-dimension labels and detailed documentation (see Figure 1) describing anomaly type, affected components, and severity. Our public repository 1 also contains a detailed documentation of each of the 171 dimensions characterizing the series, enabling explicit mapping of each sensor to system components and roles. This level of semantic richness enables, for the first time, the evaluation of a complete TSAD pipeline, i.e., detection, explanation, interpretation. To summarize, the contributions of this paper are as follows: (i) we propose a novel benchmark composed of 215 high-dimensionality time series, with both nominal and anomalous behaviour, which includes rich per-dimension annotations and labels; (i) we evaluate the anomaly detection performance of18anomaly detectors on the proposed benchmark; (i) we analyze spatial explainability by measuring the contribution of each component in the detected anomaly, and (iv) we evaluate the capability of zero-shot LLM baselines in localizing and explaining the anomalies. 2 Background and Related Work In this section, we provide an overview of TSAD approaches by considering detection, explainability, and interpretability. Then, we summarize existing benchmarks, as well as their limitations. Notations. A multivariate time seriesT ∈R (D,n) is defined as a sequence ofnobservations acrossDdimensions, writtenT = [T (0) ,T (1) ,...,T (D−1) ], whereT (i) = [T (i) 0 ,T (i) 1 ,...,T (i) n−1 ] represents thei-th dimension ofT. For instance, Figure 1 depicts a multivariate time seriesT composed of12dimensions. Given a time seriesTand an anomaly detectorD, the detector outputs an anomaly score sequence S T = [s 0 ,s 1 ,...,s n−1 ]. Time Series Anomaly Detection.As illustrated in Figure 2(a), the objective of anomaly detection is to temporally locate anomalies, independently of which dimension caused it. Anomaly detectors can be grouped into the following categories. Distance-based methods identify anomalous subsequences by comparing them against their nearest neighbors in the series or in a reference set [42,55,102,52]. 1 https://github.com/scality/shad/blob/main/README.md 2 ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' ! (") ! ($) ! (%) ! (&) +"#$,("-, .-,*'"/0*"-, ) $ ,) % at * ' is explained by: ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' ! ! and ! " , at " # , are two simultaneous but independentanomalies occuring in # (%) and # " ,# ' respectively ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' 4,-#567 &.-'$ & ( Threshold8 Detecting ) $ ,) % (a) Detection(b) Explanation(c) Interpretation 푇 (") 푇 ($) 푇 (%) 푇 (&) 푆푒푟푖푒푠 푇 풜 $ 풜 % 푡 풜 (a) Detection ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' ! (") ! ($) ! (%) ! (&) +"#$,("-, .-,*'"/0*"-, ) $ ,) % at * ' is explained by: ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' ! ! and ! " , at " # , are two simultaneous but independentanomalies occuring in # (%) and # " ,# ' respectively ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' 4,-#567 &.-'$ & ( Threshold8 Detecting ) $ ,) % (a) Detection(b) Explanation(c) Interpretation 푇 (") 푇 ($) 푇 (%) 푇 (&) 푆푒푟푖푒푠 푇 풜 $ 풜 % 푡 풜 (b) Explanation ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' ! (") ! ($) ! (%) ! (&) +"#$,("-, .-,*'"/0*"-, ) $ ,) % at * ' is explained by: ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' ! ! and ! " , at " # , are two simultaneous but independentanomalies occuring in # (%) and # " ,# ' respectively ! (") ! ($) ! (%) ! (&) !"#$ &$'"$( ! ) $ ) % * ' 4,-#567 &.-'$ & ( Threshold8 Detecting ) $ ,) % (a) Detection(b) Explanation(c) Interpretation 푇 (") 푇 ($) 푇 (%) 푇 (&) 푆푒푟푖푒푠 푇 풜 $ 풜 % 푡 풜 (c) Interpretation Figure 2: Time series anomaly (a) Detection, (b) Explanation, and (c) Interpretation. Density-based methods instead detect anomalous behaviors by estimating how isolated observations or subsequences are in a representation space [7,14,53,27]. Finally, prediction-based methods (fore- casting [95] or reconstruction-based [80]) estimate expected temporal behavior and use prediction error as the anomaly signal. Despite the large availability of anomaly detectors, most of them remain agnostic, therefore, achieving interpretability on a given domain is not straightforward. Interpretable and Explainable Anomaly Detection. The concerns about the black-box nature of deep-learning based approaches have led to efforts to make model behaviours more transparent and human-understandable [35]. Such studies usually refer to the notions of interpretability and explainability. However, these two terms are often used interchangeably, without a clear distinction. Thus, we now define these concepts as they are used throughout this paper, by providing informal definitions (illustrated in Figure 2(a,b)), as they inherently relate to human understanding. Explainability: We define explainability as the ability of a model to provide spatially grounded attributions that highlight which components of the input contribute to the detected anomaly. Explainable time series anomaly detection methods are broadly divided into intrinsically explainable models and model-agnostic approaches [38]. The former build human-understandable representa- tions (e.g., decision trees) directly from data [59], while the latter decouple explanations from the underlying model [70]. In TSAD, forecasting and reconstruction methods [95,80] are inherently explainable. Among model-agnostic techniques, some rely on input perturbations to observe changes in model outputs [48]. LIME [70] explains individual predictions via a local surrogate model learned through weighted linear regression, while Anchors [71] extends this idea using logical rules. Other methods assign feature importance scores [13,82]. Among these, SHAP [57] is based on Shapley values [92], and has been extended to time series [62]. In [51] the authors propose DuoGAT, a TSAD approach based on a directed and weighted graph structure, and provide an explainability approach by hierarchically tracking critical time points to provide time-oriented reasoning. Finally, global explanation approaches approximate models with explainable ones [26,23] or extract decision rules [44, 48, 21]. Interpretability: We define interpretability as the ability to produce a human-understandable interpretation of the nature and context of anomalies. Interpretable approaches remain relatively limited. MacroBase [12] helps users focus on relevant portions of high-volume data streams, providing interpretable insights based on key attributes recur- rence. In the biomedical domain, Boubekki et al. [18] propose a method for interpreting models for ECG analysis through time-localized clustering of internal representations. Their approach associates temporally localized patterns with clinically meaningful conditions, supporting the interpretation of what the detected abnormal patterns represent. Advances in large language models (LLMs) offer a promising direction, enabling context-rich interpretations by leveraging model outputs and auxiliary information [40]. While many works use LLMs for anomaly detection itself [39,88,69], others explore their role in human-understandable data analysis [97,63]. LLMs have also been applied to integrate time series with external textual context, improving prediction and decision- making [45,47], while agent-based and tool-augmented frameworks enhance reasoning and root cause analysis [90,108]. Among existing proposals [33,107], only a few support multimodal data [109,96]. Among these, ChatTS [96] is a recent multimodal LLM capable of reasoning over 3 multivariate time series and enables natural language interaction to interpret patterns, relationships, and anomalies. Existing Benchmarks. Research in TSAD has introduced numerous datasets (see Ap- pendix A.2), reviewed in several surveys [67,75,83,54], all highlighting the lack of a one-size-fits-all detector.This motivates the development of benchmarks (Table 1) with heterogeneous datasets. NAB [50] focuses on real-time anomaly detection in streaming data, while TODS [46] considers five anomaly types. TimeEval [75] collects real and synthetic, univariate and multivariate datasets with point and sequence anomalies. Time- SeAD [87] introduces a recall-consistent metric accounting for temporal correlations and bench- marks 28 deep learning methods, whereas Experimental-TSAD [103] compares 17 SOTA Table 1: Comparison of TSAD benchmarks Benchmark DatasetEvaluation Multi.Ann.Desc.ADExpl.Interp. NAB [50]×✓× Exathlon [38]✓×✓× TODS [46]✓×✓× TimeEval [75] ✓×✓× TSB-UAD [67]×✓× TimeSeAD [87]✓×✓× Exp-TSAD [103]✓×✓× TSB-AD [54] ✓×✓× TAB [68]✓×✓× SHAD (ours)✓ Ann.: per-dimension labels Desc.: per-dimension description AD: evaluation of anomaly detection performance methods using both point and range- based metrics. TSB-UAD [67] pro- vides a comprehensive benchmark for univariate TSAD with real and synthetic data. Exathlon [38] targets explainable anomaly detection in high-dimensional time series. To improve benchmark rep- resentativeness, TSB-AD [54] introduces a large-scale curated dataset and incorpo- rates foundation model–based methods. Finally, TAB [68] offers a recent large- scale comparison across 44 anomaly de- tection approaches. Limitations of Existing Benchmarks. Despite the available benchmarks, there are several limitations that need to be addressed: L1 (Lack of end-to-end benchmarks): existing benchmarks mainly focus on anomaly detection itself, thoroughly evaluating the detectors’ accuracy but overlooking explainability and interpretability, which are critical parts of a TSAD pipeline. L2 (Lack of fine-grained anomaly labels): existing benchmarks only provide binary labels indicating whether an anomaly is present at a given time step, without specifying which dimension or sensor is affected, nor characterizing the nature of the anomaly itself. L3 (Lack of contextual knowledge): existing benchmarks do not include rich semantic annotations and contextual information, hindering the generation of human-readable anomaly interpretations. Objectives and Research Questions. In response to these gaps we propose a real-world, high- dimensional curated dataset with rich anomaly descriptions and and fine-grained documentation. We also include an experimental evaluation designed to answer the following research questions: RQ1 (Detection): How do current state-of-the-art time series anomaly detection methods perform on a real-world, high-dimensional benchmark, and how do they compare in terms of effectiveness? RQ2 (Explanation): Can TSAD methods achieve explainability through dimension-level attribution? RQ3 (Interpretation): Can frozen LLM models provide accurate anomaly interpretations? 3 SHAD: Our Proposed Benchmark This section describes the system architecture underlying SHAD, the experiment design and anomaly simulation methodology, as well as specific dataset characteristics and labelling schema. System Overview. To generate the datasets in SHAD, we deployed an experimental framework on Scality Ring, which is a distributed object storage system in which data placement is governed by a Distributed Hash Table (DHT) implemented via the Chord protocol [79]. In this architecture, software-defined storage nodes are responsible for specific segments of the keyspace and handle read and write operations for objects whose hashes fall within their assigned ranges. All clusters used to generate the dataset share a common topology (depicted in Figure 12 in the Appendix). Each deployment consists of a supervisor server responsible for management, monitoring, and orchestration 4 푇푖푚푒 푇 (") 푇 ($) 푇 (%) 푇 (&) 풜 푡 풜 푇 (") 푇 ($) 푇 (%) 푇 (&) 푇푖푚푒 풜 $ 풜 % 푡 풜 푇 (") 푇 ($) 푇 (%) 푇 (&) 푇푖푚푒 풜 $ 풜 % 푡 풜 ! 푡 풜 " 푇 (") 푇 ($) 푇 (%) 푇 (&) 푇푖푚푒 푡 풜 푡 풜 −훿 풜 (a) Single Anomaly(b) Simultaneous Anomaly(c) Asynchronous Anomaly(d) Degradation Anomaly Disk Server Storage Node (10 time series) (11 time series) (16 time series) (17 time series) (0 time series) (14 time series) (11 time series) (11 time series) (16 time series) (0 time series) (26 time series) (0 time series) Normality (83time series)Anomalies (132 time series) SHADbenchmark (215 time series) 풜 Figure 3: Overview of our proposed benchmark SHAD. of the experimental framework, along with three storage servers. Each storage server is equipped with four disks dedicated to data, two disks for metadata, and one disk hosting the operating system. On each storage server, six software storage nodes participate in the DHT, alongside a single S3 connector that manages client-facing object traffic and dispatches requests to the appropriate storage nodes. Telemetry generated by all components is collected and organized into 171 metrics. A comprehensive description of all metrics is provided in Appendix B. Experiment Design. Our experiment framework runs one specific baseline workload consistent across all experiments. The workload runs uninterrupted for 18 hours with a one-minute telemetry ingestion interval, yielding 1000–1050 data points per experiment. The workload generates GET- heavy (i.e., dominated by object retrieval requests) mixed S3 traffic via the warp benchmarking tool, using 16 concurrent workers, 15k initial objects at experiment start, 100KiB max randomized object size, and an S3 operation distribution of approximately 95%GET, 4%STAT, 0.8%PUT, and 0.4% DELETEby weight. All experiments are conducted on top of this baseline workload, which simulates a representative workload of a typical storage cluster serving read-heavy object retrieval. The experimental framework enables the controlled simulation of anomalies that affect otherwise nominal system traffic. All anomalous events are defined by their trigger time, their total duration, their targeted components, and extra failure-specific parameters. SHAD includes 3 general anomalies: server failures, disk failures, and storage node failures (see Figure 3). (i) Disk failures are triggered by instantly severing a server’s connection with the targeted data disk(s). Single disk failures target one disk on a specific server. Simultaneous failures target multiple disks at once, while Asynchronous failures target multiple disks at different timestamps. For the latter, we further distinguish three sub-patterns: cascading failures occur in close succession with substantial temporal overlap; rolling failures are spaced further apart with partial overlap; independent failures are fully separated with no overlap. Disk failures are fixed by rebinding the target’s device driver to its server. The impact of disk failures can vary from minimal to high depending on the number of disks targeted; despite the compact topology, RING’s distributed architecture is resilient to disk anomalies by design. Therefore, multi-disk failure scenarios produce stronger signals. (i) Server failures are triggered by tampering with the target server’s network interface. Single server failures drop all inbound traffic from the rest of the cluster, and are bound to a certain duration. This simulates a complete network partition, as would occur during a switch failure or a severe network misconfiguration. Asynchronous failures target multiple servers at different timestamps, and, like disk failures, are categorized in cascading, rolling, independent. Degradation failures progressively increase latency and packet loss between the target server and the rest of the cluster, following either a linear ramp or staged discrete steps. This simulates progressive network deterioration, such as a slowly failing network interface or increasing link congestion. Server failures are fixed by reversing network changes and returning the server to its nominal state. Server failures have a strong impact on the rest of the cluster and thus heavily influence metrics across the entire system. Notice that Simultaneous server failures are excluded as they would essentially render the cluster non-functional. (i) Storage node failures are triggered by instantly killing the process(es) corresponding to a configurable number of software nodes on the targeted storage server. They simulate software-level crashes which, while relatively rare, can occur in edge case scenarios. Storage node failures have 5 (c) Storage NodeFailure(Asynchronous) 12 dimensions among 171 in total 풜 ! 풜 " 푇 ($) 푇 (!) 푇 (") 푇 (&) 푇 (') 푇 (() 푇 ()) 푇 (*) 푇 (+) 푇 (,) 푇 (!$) 푇 (!!) 풜 ! 풜 " 푇 ($) 푇 (!) 푇 (") 푇 (&) 푇 (') 푇 (() 푇 ()) 푇 (*) 푇 (+) 푇 (,) 푇 (!$) 푇 (!!) (b) Disk Failure(Simultaneous) 12 dimensions among 171 in total 푇 ($) 푇 (!) 푇 (") 푇 (&) 푇 (') 푇 (() 푇 ()) 푇 (*) 푇 (+) 푇 (,) 푇 (!$) 푇 (!!) 풜 " (a) Server Failure(Single,Degradation) 12 dimensions among 171 in total 1 Storage Node killed on Store 1 at time 9:00 for 1 hour 30 minutes 2 Storage Node killed on Store 3 at time 14:00 for 1 hour Disk failure on store3 g1disk02 at time 15:30 for 55m Disk failure on store2 on g2disk01 at time 15:30 for 45m Gradual degradation on store 2 at time 3:00 for 2h, where delay and loss jump to 1ms and 0.5% at 3% of the anomaly duration, and 4ms and 3% at 50%. Figure 4: Sample of time series for each of the 3 main anomaly types in SHAD. the same typology as disk failures, occurring as Single, Simultaneous, or Asynchronous failures with cascading, rolling, and independent sub-patterns. Storage Node failures have an additional parameter corresponding to the number of random nodes (from 1 to 3) killed on each targeted server per event. Storage node failures are fixed by restarting the process corresponding to each failed node, after which the RING will run background tasks until the targeted servers are back in their nominal state. The impact of storage node failures is typically the smallest out of the three types of anomalies, because the DHT efficiently redistributes the failed nodes’ work across the remaining live nodes. A visual example of the anomalies described above is shown in Figure 4, along with a textual explanation of the anomalies involved. Although our experiments were conducted on a specific system, the considered anomalies are not platform-specific. Failures such as disk loss, network partitions, and software crashes are common across distributed storage systems. Parameters for each anomaly, such as time, duration, and subsequent anomaly-specific variables, were chosen with the goal of ensuring broad coverage across timeline and failure configurations. Across all anomaly types, failure onset times span across the full 18-hour experiment (from 30 minutes to 16.5 hours); durations range from 1 minute to over 9 hours, and target components are evenly distributed across the 3 storage servers (see Table 15 in the Appendix). Time Series ID(type str) anomaly_presence(type Boolean) anomaly_type(i.e., Disk, Server, Storage Node) criticality(i.e., None, Low, Medium, High) Anomalies(type list) Store(type str) Disk(type None or str) Sensors(list of str) Duration(type int) category(i.e., Single, Simult., Asynch., Degrad.) Degradation(None or int) Textual_explanation(type str) dimension 푻 (풊) Metric_info(type str) Metric_name(type str) Other dimensions... Figure 5: SHAD’s annotations Dataset Characteristics. SHAD contains 215 multi- variate time series, whose composition is detailed in Figure 3. Each series contains∼1021data points, which were sampled with a 1-minute resolution across 171 features (listed in Appendix B). The anomalies are annotated by Scality experts, who su- pervised each planned experiment, ensuring that the injected failure type, timing, and affected components were accurately recorded and consistently reflected in the released metadata. Anomalies are labeled on two layers: Top-level labeling assigns one binary value per time point, corresponding to whether an anomaly is ongoing and aligning with the format of existing benchmarks [54]. Dimension-level labeling similarly flags anomalies per time point, but only to the dimensions corresponding to the root cause com- ponents they directly target. In addition, to support interpretability and explainability studies, each time series in SHAD is accompanied by a structured XML annotation (see Figure 5), with both global and fine-grained information. For each series, we provide whether an anomaly is present, its criticality, and its category, along with a textual explanation. Then, fine-grained per-dimension annotations include a textual explanation and, in case of anomalies, failure-specific parameters, also incorporating the set of other dimensions involved by the same anomaly, allowing for linking related anomalous behaviors and reconstructing the full system-level event. To our knowledge, no existing TSAD benchmark provides comparable semantic annotations, while SHAD enables new forms of evaluation for both explainability and interpretability. 6 LLMs The time series for store1-g1disk01- disk_usage_ratio shows a sharp and sustained spike indicating abnormal disk usage, suggesting a potential disk failure with high criticality... Yes Disk Failure [50,75] High store1-g1disk01-disk_usage_ratio Context Questionnaire anomaly_presence: Yes/No dimension_localization: dimension_name time_localization: [Start/End] anomaly_type: None/Disk/Storage/Server anomaly_criticality: None/Low/Medium/High intepretation: open answer Representation Supervision anomaly: yes location: store1 anomaly: yes Unsupervised (3) Prompt Template (4) LLM Call mistral-large-3 claude-sonnet-4-6gemini-2.5-flash (2) TS representation (1) Input Time Series The time series [...] many dimensions exhibit spikes, indicating sudden bursts of activity. This is especially noticeable in disk operations (read/write), network bytes (in/out), and I/O operations. 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09 0.070 0.075 0.080 0.085 0.090 0.095 0.100 0.105 0.005 0.010 0.015 0.020 0.025 0.030 0.035 4 5 6 7 8 2.0 2.5 3.0 3.5 4.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.5 1.0 1.5 2.0 2.5 3.0 3.5 0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 0.0 0.2 0.4 0.6 0.8 1.0 1.2 0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 0.0 0.2 0.4 0.6 0.8 1.0 1.2 0102450001024500010245000102450001024500010245000102450001024500 store1-g1disk01-disk_usage_ratio Multi-Panel Image HistMode5: -0.099 Standard Dev: 0.002 Mean: 0.006 Per-Dimension Catch 22 FeaturesGlobal Image Description (5) LLM Answer Llama 4grok Figure 6: Overview of the evaluation for interpretability. 4 Experimental Evaluation on SHAD We now discuss the experiments aimed at addressing our research questions. For RQ1 (Detection), we assess the effectiveness of 18 state-of-the-art detection methods covering a wide range of Time Series Anomaly Detection processes (see Table 17 in Appendix E for the full list) on SHAD. Both Semi-Supervised (trained on nominal data) and Unsupervised approaches are included, using the optimized hyperparameters from the TSB-AD benchmark [54]. Performance is evaluated using VUS- PR (a robust, threshold-independent metric) with a 25-point buffer [66,17]. For RQ2 (Explanation): we evaluate the contribution of each dimension in the final anomaly score for the top performing method of each supervision category. We evaluate their performance using the NDCG metric [89], since this metric rewards well ranked features diagnosis. For RQ3 (Interpretation), we evaluate the ability of frozen LLMs to interpret anomalies using a single call. Each time series is provided to the LLM under different representations: (i) Catch22 features [56] for each dimension; (i) a multi-panel image with one subplot per dimension; and (i) a natural language description of the time series image generated by the same LLM 2 . The LLM is prompted with a structured questionnaire (Figure 6) to: (i) detect anomaly presence, (i) identify at least one affected dimension, (i) localize the anomaly in time, (iv) classify it, and (v) assess its severity. We consider F1-score for classification tasks (presence, type, severity) and accuracy for localization tasks, averaged over 5 runs. We compare five LLMs (listed in Figure 6), and we also performed an additional evaluation with models from the same family (i.e., Mistral) with different capacities to evaluate whether the LLM size has an impact on interpretability. Finally, LLM experiments are repeated under two supervision levels to simulate an end-to-end TSAD pipeline that covers all three stages (detection, explanation, interpretation). In particular, we simulate the availability of an always correct anomaly detector (i.e., level 1 , which provides the LLM with information about anomaly presence), and the availability of an always correct anomaly explainer (i.e., level 2 , which provides the LLM with information about anomaly presence and the affected system components). 4.1 RQ1: Time Series Anomaly Detection Figure 7 (a) and (b) present the VUS-PR performance of respectively Semi-Supervised and Unsu- pervised approaches on SHAD, ordered per median performance (full line). A first observation is that the top Semi-Supervised methods significantly outperform the Unsupervised ones, with the notable exception of KMAD which is on par with the top-5 Semi-Supervised. This is expected, as the Semi-Supervised methods were trained on the 83 nominal time series, providing a large enough training set for deep learning methods to outperform the more classical approaches, concordant with the conclusions of [9]. The critical difference diagram in Figure 7 (c) provides consistent observation, as the top ranked methods in median performance, highlighted in bold colors, belong to a primary clique indicating no statistically significant difference between them, despite their different learning paradigms. Specifically, the top-performing semi-supervised methods (OA, USAD, AE and CNN) 2 We also considered ChatTS [96] for descriptions, but it supports only up to 30 time series at the time of writing. 7 KMAD PCA CBLOF KNN HBOS LOF IF RPCA Forecasting Reconstruction PredictionDensity Cluster Proximity Distribution Tree Encoding Distance AE USAD OA CNN LSTM SVM MCD FITS TN AT 1.0 0.8 0.6 0.4 0.2 0.0 VUS - PR 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 RPCA AT IF TN LOF HBOS KNN FITS CBLOF USAD OA KMAD AE CNN SVM MCD LSTM PCA OA AE LSTM KMAD CNN USAD Simultaneous Disk 1.0 0.8 0.2 0.4 0.6 (a) Semi-SupervisedPerformances (b) UnsupervisedPerformances (c) Critical DifferenceDiagram (훼=0.05) (d) MeanVUS-PR per Anomaly Type for Top 6 Methods Figure 7: Anomaly Detection on SHAD are joined by the unsupervised KMAD under a single horizontal bar, confirming that KMAD is statis- tically competitive with the best semi-supervised approaches atα = 0.05. Figure 7 (d) takes a closer look at the best performing methods, providing their mean performance on the different anomaly types existing in SHAD. A first observation is that the behavior of these methods is consistent within their process-centric categorization: OA, AE and USAD, which are Reconstruction-based methods, have a different spider-plot than CNN and LSTM, which are Prediction-based. Furthermore, these Semi-Supervised methods have a significantly distinct performance than KMAD, which is Unsu- pervised. More specifically, this figure highlights the different paradigms taken by each supervision modes. While the semi-supervised methods (OA, USAD, AE, CNN, LSTM) generally offer higher precision on subtle anomalies, the unsupervised KMAD exhibits superior robustness in detecting system-wide network events. Indeed, "small impact" failures such as the Single Snode or Single Disk failures, as described in Section 3, produce faint signals that only the Semi-Supervised methods manage to detect, as these low effects can be overlooked as noise by Unsupervised approaches. However, this learning is detrimental when faced with system-wide events, such as Asynchronous server or Single Server failures. When those event occur, with a majority of the metrics shifting to never seen data, DNN models may get lost, whereas Unsupervised approaches, such as KMAD, that rely on a global view of the data, will detect such a clear shift happening. These results show that SHAD benchmark remains non-trivial in Anomaly Detection, as no type of method manages to be exhaustively accurate on each anomaly type. 4.2 RQ2: Time Series Anomaly Explanation (a) NDGC Performance 0.6 0.5 0.4 0.3 0.2 0.1 0.0 NDCG CNN OA KMAD Simultaneous Disk 0.2 0.4 0.6 (b) NDCG per AnomalyType OA KMAD CNN RandomBaseline Figure 8: Basic Explainability Results Beyond anomaly detection accuracy, we also evaluate the native capacity of the best perform- ing methods to accurately localize the anoma- lies across the feature space. We select three representative methods: OA (Semi-Supervised, Reconstruction-based), CNN (Semi-Supervised, Prediction-based) and KMAD (Unsupervised, Clustering-based), and derive their feature-wise scores. Results in Figure 8 (a) reveal a striking observation: despite their strong detection per- formance, the methods exhibit behavior nearly indistinguishable from a random baseline in term of dimension localization. This highlights that good detection accuracy does not inherently translate into diagnostic utility, and internal scoring mechanisms of these methods are not natively designed for feature attribution. The granular analysis on the anomaly type in Figure 8 (b) confirms this observation. The worst results (Single Disk, Simultaneous Disk and Asynchronous Disk) have a 8 Figure 9: Results for the interpretability experiment. For Presence, Type, and Criticality we consider the F1-score, while for Dimension and Time Localization we report the accuracy. low dimensional contamination rate (respectively 4, 12 and 12 dimensions contaminated on average) while the best localized anomalies, Simultaneous SNode, have on average 140 anomalous dimensions. The inherent diversity and complexity of SHAD establish it as a non-trivial explainability testing ground that cannot be addressed with simple dimension contribution analysis. 4.3 RQ3: Time Series Anomaly Interpretation Comparison with different representations. Figure 9(a) reports the performance of LLMs across different input representations for the interpretability task. Overall, results are very low, highlighting the difficulty of interpreting high-dimensional real-world time series. For anomaly presence (1 ), most of the LLMs always predicted an anomaly regardless of the representation, suggesting that irregular patterns and high-dimensionality lead the models to interpret variability as anomalies. This led to very similar average results across all models (0.48, 0.47, 0.43 for Descriptions, Images, and Catch22, resp.). For anomaly type, performance remains poor, with the best F1-score from Images (21%), followed by Catch22 (19%) and descriptions (14%), and a noticeable bias toward Disk Failures. The anomaly criticality task (3) is even more challenging, with a maximum of 16%(Images), showing the inability to assess severity without contextual knowledge. Dimension localization ( 4 ) is among the hardest tasks, with near-zero accuracy (1%,2%,1%for Catch22, Images, and descriptions), reflecting the difficulty of identifying anomalous dimensions in large multivariate data. For time localization (5), results are slightly better but still low (7%,7%, 2%for Images, Catch22, and Descriptions). Overall, all the results highlighted the complexity of interpreting time series using LLMs without any type of supervision. While the results are generally low, providing Images was the best option for three tasks (2,3,4) and the second best option for the others, suggesting that visual representations provide a slightly clearer overview of the series. Comparison with different LLMs. Figure 9(a) compares the performance of 5 LLMs for each representation across the five tasks. For anomaly presence ( 1 ), almost all models behaved identically (≈ 47%across all representations), showing a strong bias towards anomalies. The only exception was Grok (especially with the Catch22 representation) which, in contrast, judged most series as normal. This is consistent with recent evidence that Grok exhibits a distinctive behavioral profile compared to other frontier LLMs [105]. For anomaly type and criticality (2, 3 ) the best LLM is Claude (0.23and0.19, resp.), while Grok was the best for dimension localization (4), but with only 4% of accuracy. Finally, Claude was the best model for time localization (5 ), with 12%. Overall, all the models showed very similar behaviours (we provide the full results in Appendix E), showing that interpreting anomalies is a significant challenge. Adding supervison. We evaluate LLM performance under two supervision levels, simulating the interpretability step when detection and explanation outputs are available. Figure 9(b) reports results across all models and representations. For clarity, we omit tasks directly answered by supervision 9 Figure 10: Interpretability results with the same model family (Mistral large/medium/small). (accuracy= 1.0). With level 1 (i.e., anomaly presence), performance consistently improves for dimension and time localization (4,5), with average gains of7.2%and7.9%. Although results remain low, this indicates that additional information can help characterize anomalies. For other tasks, trends are inconsistent, with negligible variation (below0.2%). With level 2 (i.e., anomaly presence + affected components), further improvements are observed for time localization (5) (+14.4%) and anomaly type (2) (+4.7%), while anomaly criticality shows negligible change. Overall, although combining detection and explanation signals improves performance, zero-shot LLMs remain unable to reliably characterize anomalies, highlighting the need for domain-specific solutions. Zero-shot, single-call LLMs cannot properly interpret SHAD’s anomalies. Adding information from detection and explanation provides some benefits, but challenges still remain, suggesting the need for tailored, domain-specific solutions. Comparison with smaller LLMs. Figure 10(a) compares the performance of Mistral Large, Medium, and Small. With Mistral Medium, we observe a significant drop when using Catch22, likely due to the difficulty of reasoning over many statistical features across high-dimensional data. In contrast, performance with Images remains stable and even improves on time localization ( 5 ) (14%vs. 7%). Results with Image Descriptions are nearly identical to the largest model. With Mistral Small, performance generally drops, highlighting its limited capacity to handle both high-dimensional statistical features and richer multimodal inputs, leading to consistently lower results across tasks. 5 Conclusion and Future directions We proposed SHAD, a novel end-to-end benchmark composed of real-world, high-dimensional time series, that covers all the steps in TSAD pipelines (detection, explanation, and interpretation). SHAD includes both normal and anomalous series, with anomalies affecting different components and severity levels, and provides per-dimension labels along with rich textual annotations for each dimension and anomaly. Our experimental evaluation concluded that (i) SOTA anomaly detection approaches are accurate but not perfect for all anomalies in SHAD, (i) Explanability on SHAD cannot be natively solved with existing TSAD methods, and (i) frozen LLMs are not able to provide correct interpretations of anomalies. Finally, SHAD enables new research directions: in detection, studying robustness when directly affected metrics are removed; in explainability, rigorously assessing variable contributions via per-dimension labels and developing dedicated explainability methods trained on SHAD’s annotations, rather than relying on native detector attribution scores; and in interpretability, investigating how reliable dimension-level explanations can be provided as structured, semantically enriched context to LLMs, enabling the generation of human-understandable anomaly interpretations grounded in both data and semantics. 10 Acknowledgments and Disclosure of Funding The authors are grateful to the CLEPS infrastructure from the Inria of Paris for providing resources and support. References [1] Iops. http://iops.ai/dataset_detail/?id=10. [2]Metro.https://w.kaggle.com/datasets/pooriamst/ metro-interstate-traffic-volume. [3] Tao. http://pmel.noaa.gov/. [4]A. Abdulaal, Z. Liu, and T. Lancewicki. Practical approach to asynchronous multivariate time series anomaly detection and localization. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining, pages 2485–2494, 2021. [5] C. C. Aggarwal. Outlier Analysis. Springer, 2015. [6]S. Ahmad, A. Lavin, S. Purdy, and Z. Agha. Unsupervised real-time anomaly detection for streaming data. Neurocomputing, 262:134–147, 2017. [7]J. Antoni and P. Borghesani. A statistical methodology for the design of condition indicators. Mechanical Systems and Signal Processing, 114:290–327, 2019. doi: 10.1016/j.ymssp.2018. 05.012. [8]J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga. Usad: Unsupervised anomaly detection on multivariate time series. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD ’20, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781450379984. [9]J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga. Do deep neural networks contribute to multivariate time series anomaly detection? Pattern Recognit., 132:108945, 2022. doi: 10.1016/J.PATCOG.2022.108945. URLhttps://doi.org/10.1016/j.patcog. 2022.108945. [10]M. Bachlin, M. Plotnik, D. Roggen, I. Maidan, J. M. Hausdorff, N. Giladi, and G. Troster. Wearable assistant for parkinson’s disease patients with the freezing of gait symptom. IEEE Transactions on Information Technology in Biomedicine, 14(2):436–446, 2009. [11]J. Bai and S. Ng. Forecasting economic time series using targeted predictors. Journal of Econometrics, 146(2), 2008. [12]P. Bailis, E. Gan, S. Madden, D. Narayanan, K. Rong, and S. Suri. Macrobase: Prioritizing at- tention in fast data. In Proceedings of the 2017 ACM International Conference on Management of Data, pages 541–556, 2017. [13] L. Bertossi, J. Li, M. Schleich, D. Suciu, and Z. Vagena. Causality-based explanation of classification outcomes. In Proceedings of the Fourth International Workshop on Data Management for End-to-End Machine Learning, pages 1–10, 2020. [14]P. Boniol and T. Palpanas. Series2graph: Graph-based subsequence anomaly detection for time series. Proc. VLDB Endow., 13(12):1921–1934, 2020. [15]P. Boniol, J. Paparrizos, T. Palpanas, and M. J. Franklin. Sand: Streaming subsequence anomaly detection. Proc. VLDB Endow., 14(10):1717–1729, 2021. [16] P. Boniol, Q. Liu, M. Huang, T. Palpanas, and J. Paparrizos. Dive into time-series anomaly detection: A decade review. arXiv preprint arXiv:2412.20512, 2024. [17]P. Boniol, A. K. Krishna, M. Bruel, Q. Liu, M. Huang, T. Palpanas, R. S. Tsay, A. Elmore, M. J. Franklin, and J. Paparrizos. Vus: effective and efficient accuracy measures for time-series anomaly detection. arXiv preprint arXiv:2502.13318, 2025. 11 [18]A. Boubekki, K. Patlatzoglou, J. Barker, H. Aggour, F. S. Ng, and A. H. Ribeiro. Explain- ing deep learning for ecg using time-localized clusters. IEEE Transactions on Biomedical Engineering, 2026. [19] M. M. Breunig, H.-P. Kriegel, R. T. Ng, and J. Sander. Lof: identifying density-based local outliers. SIGMOD Rec., 29(2):93–104, May 2000. ISSN 0163-5808. doi: 10.1145/335191. 335388. [20]L. M. Candanedo and V. Feldheim. Accurate occupancy detection of an office room from light, temperature, humidity and co2 measurements using statistical learning models. Energy and buildings, 112:28–39, 2016. [21] H. Chen, W. Guo, W. Bao, M. Cui, X. Wang, and Q. Zhao. A novel interpretable decision rule extracting method for deep reinforcement learning-based energy management in building complexes. Energy and Buildings, 334:115514, 2025. [22]B. Dadashova, X. Li, S. Turner, and P. Koeneman. Multivariate time series analysis of traffic congestion measures in urban areas as they relate to socioeconomic indicators. Socio-Economic Planning Sciences, 75, 2021. [23] H. Dong, B. Liu, D. Ye, and G. Liu. Interpretability as approximation: Understanding black-box models by decision boundary. Electronics, 13(22):4339, 2024. [24]P. Filonov, A. Lavrentyev, and A. Vorontsov. Multivariate industrial time series with cyber- attack simulation: Fault detection using an lstm-based predictive data model. arXiv preprint arXiv:1612.06676, 2016. [25] P. Fleith. Controlled anomalies time series (cats) dataset. Solenix Engineering GmbH, 2023. [26]N. Frosst and G. Hinton. Distilling a neural network into a soft decision tree. arXiv preprint arXiv:1711.09784, 2017. [27]Y. Gao, J. Lin, and C. Brif. Ensemble grammar induction for detecting anomalies in time series. In Proceedings of the 23rd International Conference on Extending Database Technology, EDBT 2020, Copenhagen, Denmark, March 30 - April 02,2020, pages 85–96, 2020. doi: 10.5441/002/EDBT.2020.09. [28]S. Ghassempour, F. Girosi, and A. Maeder. Clustering multivariate time series using hidden markov models. IJERPH, 11(3), 2014. [29]J. Goh, S. Adepu, K. N. Junejo, and A. Mathur. A dataset to support research in the de- sign of secure water treatment systems. In International conference on critical information infrastructures security, pages 88–99. Springer, 2016. [30]A. L. Goldberger, L. A. Amaral, L. Glass, J. M. Hausdorff, P. C. Ivanov, R. G. Mark, J. E. Mietus, G. B. Moody, C.-K. Peng, and H. E. Stanley. Physiobank, physiotoolkit, and physionet: components of a new research resource for complex physiologic signals. circulation, 101(23): e215–e220, 2000. [31] M. Goldstein and A. R. Dengel. Histogram-based outlier score (hbos): A fast unsupervised anomaly detection algorithm. 2012. [32]S. D. Greenwald, R. S. Patil, and R. G. Mark. Improved detection and classification of arrhythmias in noise-corrupted electrocardiograms using contextual information. IEEE, 1990. [33]N. Gruver, M. Finzi, S. Qiu, and A. G. Wilson. Large language models are zero-shot time series forecasters. Advances in neural information processing systems, 36:19622–19635, 2023. [34]Z. He, X. Xu, and S. Deng.Discovering cluster-based local outliers.Pattern Recognition Letters, 24(9-10):1641–1650, 2003.ISSN 0167-8655.doi: 10.1016/ S0167-8655(03)00003-5. URLhttps://w.sciencedirect.com/science/article/ pii/S0167865503000035. [35] A. Heuillet, F. Couthouis, and N. Díaz-Rodríguez. Explainability in deep reinforcement learning. Knowledge-Based Systems, 214:106685, 2021. 12 [36]K. Hundman, V. Constantinou, C. Laporte, I. Colwell, and T. Soderstrom. Detecting spacecraft anomalies using lstms and nonparametric dynamic thresholding. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pages 387– 395, 2018. [37] A. Ihler, J. Hutchins, and P. Smyth. Adaptive event detection with time-varying poisson processes. In Proceedings of the 12th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD ’06, page 207–216, New York, NY, USA, 2006. Association for Computing Machinery. ISBN 1595933395. doi: 10.1145/1150402.1150428. URL https://doi.org/10.1145/1150402.1150428. [38] V. Jacob, F. Song, A. Stiegler, B. Rad, Y. Diao, and N. Tatbul. Exathlon: A benchmark for explainable anomaly detection over time series. arXiv preprint arXiv:2010.05073, 2020. [39] M. Jin, S. Wang, L. Ma, Z. Chu, J. Y. Zhang, X. Shi, P.-Y. Chen, Y. Liang, Y.-F. Li, S. Pan, et al. Time-llm: Time series forecasting by reprogramming large language models. arXiv preprint arXiv:2310.01728, 2023. [40] M. Jin, Y. Zhang, W. Chen, K. Zhang, Y. Liang, B. Yang, J. Wang, S. Pan, and Q. Wen. Position: What can large language models tell us about time series analysis. In Forty-first international conference on machine learning, 2024. [41]E. Keogh, J. Lin, S.-H. Lee, and H. V. Herle. Finding the most unusual time series subsequence: algorithms and applications. Knowledge and Information Systems, 11(1):1–27, 2007. [42]E. Keogh, S. Lonardi, C. A. Ratanamahatana, L. Wei, S.-H. Lee, and J. Handley. Compression- based data mining of sequential data. Data Mining and Knowledge Discovery, 14(1):99–129, 2007. [43]E. M. Knorr and R. T. Ng. Algorithms for mining distance-based outliers in large datasets. In Proceedings of the 24rd International Conference on Very Large Data Bases, VLDB ’98, page 392–403, San Francisco, CA, USA, 1998. Morgan Kaufmann Publishers Inc. ISBN 1558605665. [44]M. Kopp, T. Pevn ` y, and M. Hole ˇ na. Anomaly explanation with random forests. Expert Systems with Applications, 149:113187, 2020. [45]L. J. Kurisinkel, P. Mishra, and Y. Zhang. Text2timeseries: Enhancing financial forecasting through time series prediction updates with event-driven insights from large language models. arXiv preprint arXiv:2407.03689, 2024. [46]K.-H. Lai, D. Zha, J. Xu, Y. Zhao, G. Wang, and X. Hu. Revisiting time series outlier detection: Definitions and benchmarks. In Thirty-fifth conference on neural information processing systems datasets and benchmarks track (round 1), 2021. [47] S. Lai, Z. Xu, W. Zhang, H. Liu, and H. Xiong. Llmlight: Large language models as traffic signal control agents. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, pages 2335–2346, 2025. [48]H. Lakkaraju, S. H. Bach, and J. Leskovec. Interpretable decision sets: A joint framework for description and prediction. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1675–1684, 2016. [49]N. Laptev, S. Amizadeh, and Y. Billawala. S5-a labeled anomaly detection dataset, version 1.0 (16m). URL https://webscope. sandbox. yahoo. com/catalog. php, 2015. [50]A. Lavin and S. Ahmad. Evaluating real-time anomaly detection algorithms–the numenta anomaly benchmark. In 2015 IEEE 14th international conference on machine learning and applications (ICMLA), pages 38–44. IEEE, 2015. [51]J. Lee, B. Park, and D.-K. Chae. Duogat: Dual time-oriented graph attention networks for accurate, efficient and explainable anomaly detection on time-series. In Proceedings of the 32nd ACM international conference on information and knowledge management, pages 1188–1197, 2023. 13 [52]M. Linardi, Y. Zhu, T. Palpanas, and E. Keogh. Matrix profile goes mad: variable-length motif and discord discovery in data series. arXiv preprint arXiv:2008.13447, 2020. [53]F. T. Liu, K. M. Ting, and Z.-H. Zhou. Isolation forest. In 2008 eighth ieee international conference on data mining, pages 413–422. IEEE, 2008. [54]Q. Liu and J. Paparrizos. The elephant in the room: Towards a reliable time-series anomaly detection benchmark. Advances in Neural Information Processing Systems, 37:108231–108261, 2024. [55]Y. Liu, X. Chen, F. Wang, and J. Yin. Efficient detection of discords for time series stream. In Asia-Pacific Web Conference, pages 629–634. Springer, 2009. [56]C. H. Lubba, S. S. Sethi, P. Knaute, S. R. Schultz, B. D. Fulcher, and N. S. Jones. catch22: Canonical time-series characteristics. arXiv preprint arXiv:1901.10200, 2019. [57] S. M. Lundberg and S.-I. Lee. A unified approach to interpreting model predictions. Advances in neural information processing systems, 30, 2017. [58]P. Malhotra, L. Vig, G. M. Shroff, and P. Agarwal. Long short term memory networks for anomaly detection in time series. In The European Symposium on Artificial Neural Networks, 2015. [59] C. Molnar. Interpretable machine learning. Lulu. com, 2020. [60]S. Moritz, F. Rehbach, S. Chandrasekaran, M. Rebolledo, and T. Bartz-Beielstein. Gecco industrial challenge 2018 dataset: A water quality dataset for the ‘internet of things: Online anomaly detection for drinking water quality’competition at the genetic and evolutionary computation conference 2018, kyoto, japan. Kyoto, Japan, 2018. [61] M. Munir, S. A. Siddiqui, A. Dengel, and S. Ahmed. Deepant: A deep learning approach for unsupervised anomaly detection in time series. IEEE access, 7:1991–2005, 2018. [62] A. Nayebi, S. Tipirneni, C. K. Reddy, B. Foreman, and V. Subbian. Windowshap: An efficient framework for explaining time-series classifiers based on shapley values. Journal of biomedical informatics, 144:104438, 2023. [63]J. Oh, G. Lee, S. Bae, J.-m. Kwon, and E. Choi. Ecg-qa: A comprehensive question answering dataset combined with electrocardiogram. Advances in Neural Information Processing Systems, 36:66277–66288, 2023. [64]R. Paffenroth, K. Kay, and L. Servi. Robust pca for anomaly detection in cyber networks. arXiv preprint arXiv:1801.01571, 2018. [65] T. Palpanas. Data series management: The road to big sequence analytics. ACM SIGMOD Record, 44(2):47–52, 2015. [66]J. Paparrizos, P. Boniol, T. Palpanas, R. S. Tsay, A. J. Elmore, and M. J. Franklin. Volume under the surface: A new accuracy evaluation measure for time-series anomaly detection. Proc. VLDB Endow., 15(11):2774–2787, 2022. [67]J. Paparrizos, Y. Kang, P. Boniol, R. S. Tsay, T. Palpanas, and M. J. Franklin. Tsb-uad: An end-to-end benchmark suite for univariate time-series anomaly detection. Proc. VLDB Endow., 15(8):1697–1711, 2022. [68] X. Qiu, Z. Li, W. Qiu, S. Hu, L. Zhou, X. Wu, Z. Li, C. Guo, A. Zhou, Z. Sheng, et al. Tab: Uni- fied benchmarking of time series anomaly detection methods. arXiv preprint arXiv:2506.18046, 2025. [69]K. Rasul, A. Ashok, A. R. Williams, H. Ghonia, R. Bhagwatkar, A. Khorasani, M. J. D. Bayazi, G. Adamopoulos, R. Riachi, N. Hassen, et al. Lag-llama: Towards foundation models for probabilistic time series forecasting. arXiv preprint arXiv:2310.08278, 2023. 14 [70]M. T. Ribeiro, S. Singh, and C. Guestrin. " why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135–1144, 2016. [71] M. T. Ribeiro, S. Singh, and C. Guestrin. Anchors: High-precision model-agnostic explana- tions. In Proceedings of the AAAI conference on artificial intelligence, volume 32, 2018. [72]D. Roggen, A. Calatroni, M. Rossi, T. Holleczek, K. Förster, G. Tröster, P. Lukowicz, D. Ban- nach, G. Pirkl, A. Ferscha, et al. Collecting complex activity datasets in highly rich networked sensor environments. In 2010 Seventh international conference on networked sensing systems (INSS), pages 233–240. IEEE, 2010. [73]P. J. Rousseeuw. Least median of squares regression. Journal of the American Statistical Association, 79(388):871–880, 1984. doi: 10.1080/01621459.1984.10477105. [74]M. Sakurada and T. Yairi. Anomaly detection using autoencoders with nonlinear dimensionality reduction. In Proceedings of the MLSDA 2014 2nd workshop on machine learning for sensory data analysis, pages 4–11, 2014. [75] S. Schmidl, P. Wenig, and T. Papenbrock. Anomaly detection in time series: a comprehensive evaluation. 2022. [76] B. Schölkopf, R. C. Williamson, A. Smola, J. Shawe-Taylor, and J. Platt. Support vector method for novelty detection. Advances in neural information processing systems, 12, 1999. [77]I. Sharafaldin, A. H. Lashkari, A. A. Ghorbani, et al. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp, 1(2018):108–116, 2018. [78]H. Si, J. Li, C. Pei, H. Cui, J. Yang, Y. Sun, S. Zhang, J. Li, H. Zhang, J. Han, et al. Timeseriesbench: An industrial-grade benchmark for time series anomaly detection models. In 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE), pages 61–72. IEEE, 2024. [79]I. Stoica, R. Morris, D. Liben-Nowell, D. R. Karger, M. F. Kaashoek, F. Dabek, and H. Balakr- ishnan. Chord: a scalable peer-to-peer lookup protocol for internet applications. IEEE/ACM Transactions on networking, 11(1):17–32, 2003. [80]Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun, and D. Pei. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD ’19, page 2828–2837, 2019. ISBN 9781450362016. doi: 10.1145/3292500.3330672. [81] Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun, and D. Pei. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 2828–2837, 2019. [82] M. Sundararajan, A. Taly, and Q. Yan. Axiomatic attribution for deep networks. In Interna- tional conference on machine learning, pages 3319–3328. PMLR, 2017. [83]E. Sylligardos, P. Boniol, J. Paparrizos, P. Trahanias, and T. Palpanas. Choose wisely: An extensive evaluation of model selection for anomaly detection in time series. Proceedings of the VLDB Endowment, 16(11):3418–3432, 2023. [84]M. Thill, W. Konen, and T. Bäck. Markusthill/mgab: The mackey–glass anomaly benchmark. version v1. 0.0. zenodo, 2020. [85]L. Tran, L. Fan, and C. Shahabi. Distance-based outlier detection in data streams. Proceedings of the VLDB Endowment, 9(12):1089–1100, 2016. [86]A. von Birgelen and O. Niggemann. Anomaly detection and localization for cyber-physical production systems with self-organizing maps. In IMPROVE-Innovative Modelling Approaches for Production Systems to Raise Validatable Efficiency: Intelligent Methods for the Factory of the Future, pages 55–71. Springer, 2018. 15 [87]D. Wagner, T. Michels, F. C. Schulz, A. Nair, M. Rudolph, and M. Kloft. Timesead: Bench- marking deep multivariate time-series anomaly detection. Transactions on Machine Learning Research, 2023. [88]X. Wang, M. Feng, J. Qiu, J. Gu, and J. Zhao. From news to forecast: Integrating event analysis in llm-based time series forecasting with reflection. Advances in Neural Information Processing Systems, 37:58118–58153, 2024. [89]Y. Wang, L. Wang, Y. Li, D. He, and T.-Y. Liu. A theoretical analysis of ndcg type ranking measures. In S. Shalev-Shwartz and I. Steinwart, editors, Proceedings of the 26th Annual Conference on Learning Theory, volume 30 of Proceedings of Machine Learning Research, pages 25–54, Princeton, NJ, USA, 12–14 Jun 2013. PMLR. URLhttps://proceedings. mlr.press/v30/Wang13.html. [90]Z. Wang, Z. Liu, Y. Zhang, A. Zhong, J. Wang, F. Yin, L. Fan, L. Wu, and Q. Wen. Rcagent: Cloud root cause analysis by autonomous agents with tool-augmented large language models. In Proceedings of the 33rd ACM international conference on information and knowledge management, pages 4966–4974, 2024. [91]P. Wenig and T. Papenbrock. Series2graph++: Distributed detection of correlation anomalies in multivariate time series. In International Conference on Big Data Analytics and Knowledge Discovery, pages 225–230. Springer, 2024. [92]E. Winter. The shapley value. Handbook of game theory with economic applications, 3: 2025–2054, 2002. [93]H. Wu, T. Hu, Y. Liu, H. Zhou, J. Wang, and M. Long. Timesnet: Temporal 2d-variation modeling for general time series analysis. arXiv preprint arXiv:2210.02186, 2022. [94]R. Wu and E. J. Keogh. Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress. IEEE transactions on knowledge and data engineering, 35 (3):2421–2429, 2021. [95]W. Wu, L. He, W. Lin, Y. Su, Y. Cui, C. Maple, and S. Jarvis. Developing an unsupervised real-time anomaly detection scheme for time series with multi-seasonality. IEEE Transactions on Knowledge and Data Engineering, 34(9):4147–4160, Sept. 2022. ISSN 2326-3865. doi: 10.1109/tkde.2020.3035685. URL http://dx.doi.org/10.1109/TKDE.2020.3035685. [96]Z. Xie, Z. Li, X. He, L. Xu, X. Wen, T. Zhang, J. Chen, R. Shi, and D. Pei. Chatts: Aligning time series with llms via synthetic data for enhanced understanding and reasoning. arXiv preprint arXiv:2412.03104, 2024. [97]T. Xing, L. Garcia, F. Cerutti, L. Kaplan, A. Preece, and M. Srivastava. Deepsqa: Understand- ing sensor data via question answering. In Proceedings of the International Conference on Internet-of-Things Design and Implementation, pages 106–118, 2021. [98]J. Xu, H. Wu, J. Wang, and M. Long. Anomaly transformer: Time series anomaly detection with association discrepancy. arXiv preprint arXiv:2110.02642, 2021. [99]Z. Xu, A. Zeng, and Q. Xu. Fits: Modeling time series with10kparameters. arXiv preprint arXiv:2307.03756, 2023. [100]T. Yairi, Y. Kato, and K. Hori. Fault detection by mining association rules from house-keeping data. In proceedings of the 6th International Symposium on Artificial Intelligence, Robotics and Automation in Space, volume 18, page 21. Citeseer, 2001. [101]Y. Yao, A. Sharma, L. Golubchik, and R. Govindan. Online anomaly detection for sensor systems: A simple and efficient approach. Performance Evaluation, 67(11):1059–1075, 2010. [102]C.-C. M. Yeh, Y. Zhu, L. Ulanova, N. Begum, Y. Ding, H. A. Dau, D. F. Silva, A. Mueen, and E. Keogh. Matrix profile i: all pairs similarity joins for time series: a unifying view that includes motifs, discords and shapelets. In 2016 IEEE 16th international conference on data mining (ICDM), pages 1317–1322. Ieee, 2016. 16 [103]A. Zhang, S. Deng, D. Cui, Y. Yuan, and G. Wang. An experimental evaluation of anomaly detection in time series. Proceedings of the VLDB Endowment, 17(3):483–496, 2023. [104]H. Zhang, Y. Diao, and A. Meliou. Exstream: Explaining anomalies in event stream monitoring. In Proceedings of the 20th international conference on extending database technology (EDBT), 2017. [105]J. Zhang, H. Sleight, A. Peng, J. Schulman, and E. Durmus. Stress-testing model specs reveals character differences among language models. arXiv preprint arXiv:2510.07686, 2025. [106]S. Zhang, Z. Zhong, D. Li, Q. Fan, Y. Sun, M. Zhu, Y. Zhang, D. Pei, J. Sun, Y. Liu, et al. Efficient kpi anomaly detection through transfer learning for large-scale web services. IEEE Journal on Selected Areas in Communications, 40(8):2440–2455, 2022. [107]T. Zhou, P. Niu, L. Sun, R. Jin, et al. One fits all: Power general time series analysis by pretrained lm. Advances in neural information processing systems, 36:43322–43355, 2023. [108]X. Zhou, G. Li, Z. Sun, Z. Liu, W. Chen, J. Wu, J. Liu, R. Feng, and G. Zeng. D-bot: Database diagnosis system using large language models. arXiv preprint arXiv:2312.01454, 2023. [109] J. Zhuang, L. Yan, Z. Zhang, R. Wang, J. Zhang, and Y. Gu. See it, think it, sorted: Large mul- timodal models are few-shot time series anomaly analyzers. arXiv preprint arXiv:2411.02465, 2024. 17 Appendices A Related Work19 A.1 Existing benchmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 A.2 TSAD Datasets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 A.3 Interpretability and Explainability . . . . . . . . . . . . . . . . . . . . . . . . . .19 B Metric Catalog21 C Experiment Registry23 C.1 Baseline Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24 C.2 Disk Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25 C.3 Server Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26 C.4 Storage Node Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28 D Technical Details29 D.1 System Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29 D.2 Implementation Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29 E Experimental Evaluation Details32 E.1 Anomaly Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32 E.2 Prompt Template example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 E.3 Computing resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 E.4 Complete Reults tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34 F Limitations35 G Broader Impacts36 18 A Related Work A.1 Existing benchmarks Existing Benchmarks: How do we evaluate time series anomaly detection? Research in TSAD has led to the introduction of numerous datasets (see Table 2), which have been considered in multiple surveys [67,75,83,54], consistently highlighting the absence of a one-size-fits-all anomaly detector. Consequently, efforts have aimed to establish benchmarks, whose main characteristics are detailed in Table 1, incorporating multiple datasets from various domains for comprehensive evaluation. NAB [50] provides 58 labeled real-world and artificial time series, and primarily focuses on real-time anomaly detection for streaming data. It comprises diverse domains such as AWS server metrics, online advertisement clicking rates, real-time traffic data, and a collection of Twitter mentions of large publicly-traded companies. TODS [46] refines synthetic criterion and includes five anomaly scenarios categorized as point-global, pattern-contextual, pattern-shapelet, pattern- seasonal, and pattern-trend. TimeEval [75] comprises a collection of datasets (both real/synthetic and univariate/multivariate) with point and sequence anomalies. In addition, this benchmark has been filtered such that there is no time series that has a normal/abnormal ratio above0.1, and that at least one method performs more than 0.8 AUC-ROC for each time series. TimeSeAD [87] analyzed widely used multivariate datasets and introduced a recall-consistent evaluation metric that accounts for temporal correlations, benchmarking 28 deep-learning based methods, while Experimental- TSAD [103] compared 17 state-of-the-art anomaly detection methods using both point-based and range-based metrics across various data sizes, anomaly rates, feature dimensions, and temporal patterns. TSB-UAD [67] is a comprehensive benchmark designed for evaluating univariate TSAD, including real-world and synthetic datasets. Exathlon [38] is proposed for explainable anomaly detection over high-dimensional time series data. It is constructed based on real data traces from an Apache Spark cluster, and was designed to address the pitfalls of previous benchmarks [94]. It features a single anomalies per series, which in most cases is artificially. Aiming at addressing the challenge of designing truly representative benchmarks, TSB-AD [54] introduced the first large-scale, heterogeneous, and meticulously curated dataset, also incorporating latest advances in foundation model-based methods, highlighting their potential for TSAD. Finally, TAB [68] is a recent and comprehensive benchmark that provides an extensive algorithmic comparison, including 19 statistical methods, 18 neural network–based approaches, and 7 foundation model–based methods. A.2 TSAD Datasets Table 2 lists the datasets for time series anomaly detection currently available in the literature. For each one, we report the key characteristics, including the number of available time series and their average lenght and dimensionality, the type of anomalies, and the domain from which they belong. A.3 Interpretability and Explainability Interpretable and Explainable Anomaly Detection. Explainable machine learning techniques can be broadly categorized into intrinsically explainable models and model-agnostic approaches [38]. The former category focuses on building a human-readable representation (e.g. decision trees) from data [59], while the latter separate explanations from the ML model [70]. From the perspective of anomaly detection approaches, all forecasting/reconstruction methods [95,80] are inherently explainable. Among model-agnostic approaches, several methods are based on perturbing the inputs and observing the response of the classifier [48]. LIME [70] explains individual predictions by learning a local surrogate model that approximates the original model in the neighborhood of a given instance, using a weighted linear regression formulation. This framework was extended by Anchors [71], which replaces the linear model with logical rules. Other approaches assign a numerical score to each feature [13,82], indicating its importance in the classification of each instance. Among these, SHAP [57] provides a theoretically grounded measure of feature importance based on Shapley values [92], and has been recently extended to support time series data [62]. Other approaches focus on providing global explanations, approximating deep-learning classifiers with explainable models [26, 23] or by learning decision rules [44, 48, 21]. In the context of anomaly detection, the literature on interpretable approaches is rather limited. Among existing methods, MacroBase [12] supports the user by prioritizing their attention on specific 19 Table 2: Summary characteristics of 30 datasets NameCategoryDimensionAvg Dim# of time seriesAvg LengthDomain UCR [94]P&SI125067818.7Multiple Yahoo [49] P&SI13671560.2Web Service IOPS [1]SI15872792.3IT/Web Services MGAB [84]SI11097777.8Synthetic WSD [106] SI121017444.5IT/Web Services SED [15] SI1623332.3Sensor NEK [78] P&SI1481073.0IT/Web Services Stock [85]P&SI19015000.0Financial Power [41] SI1135040.0Facility SensorScope [101]SI12327038.4Environmental Dodgers [37]SI1150400.0Traffic Daphnet [10] SM91738774.0Human Activity CATSv2 [25] SM1710240000.0Sensor SWaT [29] SM594207457.5Sensor LTDB [30]SM27100000.0Medical TAO [3] P&SM34510000.0Aerospace MITDB [30]SM248336153.8Medical MSL [36] SM55273119.4Aerospace SMAP [36] SM25547855.9Aerospace SMD [81] SM382825466.4IT/Web Services SVDB [32]SM278207122.6Medical OPP [72]SM2482417426.75Human Activity GHL [24]SM1948199001.0Environmental Genesis [86]SM18116220.0Sensor PSM [4]P&SM251217624.0Facility CreditCard [77]P&SM291284807.0Financial GECCO [60]SM91138521.0Sensor SMD [81]SM382825300.7Facility Occupancy [20]SM526208.5Environmental Metro [2]SM5148204.0Traffic I: Univariate; M: Multivariate // P: Point; S: Subsequence The statistics are based on the datasets downloaded during the writing of this article. portions of high-volume data streams and by providing interpretable insights based on the relative recurrence of key attributes. On the other hand, EXstream [104] finds interpretations to distinguish the normal and anomalous periods given as input by the user. Recent advances in large language models (LLMs) represent a promising research direction in this area, enabling the generation of context-rich insights by leveraging model outputs and/or auxiliary information [40]. While many approaches focused on using LLMs for the anomaly detection task itself [39,88,69], other have started to explore their usefulness in providing human-understandable data analysis [97,63]. In particular, recent years have witnessed the introduction of several Time Series Question Answering (TSQA) systems in domains such as healthcare and sensor analytics [97,63], where natural language interfaces are used to query and interpret raw temporal signals. LLMs have also been explored for integrating time series with external textual context, enabling more informed predictions and decision-making [45,47]. Agent-based and tool-augmented frameworks further enhance autonomous reasoning and support root cause analysis [90,108]. While several LLM-based approaches have been proposed [33,107], only few of them supports multimodal data [109,96]. Among these, ChatTS [96] is a recent multimodal LLM (MLLM) that can perform both reasoning and understanding on time series. It directly takes multivariate time series as input and enables natural language interaction for interpreting patterns, relationships, and anomalies within the data. 20 B Metric Catalog Tables 3–9 provide the complete catalog of all 171 dimensions in the dataset, grouped by hi- erarchy level.Server-level metrics (Table 7) are replicated across all three storage servers with the naming conventionserver-metric(e.g.,store1-cpu_usage_ratio), yielding 19 × 3 = 57columns. Device-level metrics (Table 9) followserver-device-metric (e.g.,store1-g1disk01-disk_read_bytes), with 7 devices per server and 4 metrics per device, yielding 4× 7× 3 = 84 columns. Platform-level metrics include telemetry from the supervisor server, which also hosts the experiment framework. Its contribution is negligible and consistent across all experiments. Table 3: Platform-level metrics (17 dimensions, cluster-wide aggregates). MetricUnitDescription cpu_usage_ratioratio [0,1]Fraction of CPU time not idle, averaged across all servers. cpu_load_ratioratio [≥0]CPU load average normalized by CPU count across all servers. Can exceed 1.0 when the run queue exceeds CPU count. memory_usage_ratioratio [0,1]Fraction of total used memory, averaged across all servers. network_in_bytesbytes/sTotal incoming network throughput across all interfaces on all servers. network_out_bytesbytes/sTotal outgoing network throughput across all interfaces on all servers. objects_countcountNumber of objects stored on the RING, including replicas. objects_unique_countcountNumber of unique logical objects, deduplicated regardless of replica count. objects_missing_countcountNumber of objects with missing or out-of-service chunks. capacity_disk_unique_tbTBTotal stored data of unique objects before replication (logical data size). capacity_disk_stored_tbTBTotal stored data including all replicas. capacity_disk_used_tbTBActual disk space consumed, including storage overhead beyond object data. capacity_disk_available_tbTBFree disk space on the RING. capacity_disk_total_tbTBTotal physical disk capacity. Static unless disks are removed. disk_read_bytesbytes/sTotal disk read throughput summed across all disks. disk_write_bytesbytes/sTotal disk write throughput summed across all disks. disk_io_time_secondss/s [0,1]Fraction of time spent on I/O, averaged across all disks. disk_errors_countcountNumber of disk errors across all disks. Always zero in this dataset. Table 5: S3-level metrics (13 dimensions, aggregated across storage servers). MetricUnitDescription s3_errors_5xxerrors/sRate of HTTP 5x server errors across all S3 services. s3_request_get_operationsops/sGET request rate. s3_request_post_operationsops/sPOST request rate. Near-constant (no multipart uploads in the nominal workload). s3_request_put_operationsops/sPUT request rate. s3_request_delete_operationsops/sDELETE request rate. s3_request_head_operationsops/sHEAD (metadata lookup) request rate. s3_throughput_in_bytesbytes/sClient-to-S3 data rate. s3_throughput_out_bytesbytes/sS3-to-client data rate. Dominates throughput_in in the GET-heavy workload. s3_request_get_latencyseconds95th percentile GET request duration. s3_request_post_latencyseconds95th percentile POST request duration. Near-constant. s3_request_put_latencyseconds95th percentile PUT request duration. s3_request_delete_latencyseconds95th percentile DELETE request duration. s3_request_head_latencyseconds95th percentile HEAD request duration. 21 Table 7: Server-level metrics (19 unique metrics×3 servers = 57 dimensions). Column names follow the pattern store1,2,3-metric. MetricUnitDescription cpu_usage_ratioratio [0,1]Fraction of CPU time not idle for this server. cpu_load_ratioratio [≥0]CPU load average normalized by CPU count. Can exceed 1.0. memory_usage_ratioratio [0,1]Fraction of total used memory. network_in_bytesbytes/sAll incoming network throughput (S3, RING inter-node, monitoring). network_out_bytesbytes/sAll outgoing network throughput. operations_sentops/sRate of internal RING operations sent to other servers. operations_receivedops/sRate of internal RING operations received from other servers. latency_sent_millisecondsmsAverage round-trip time for outbound RING operations. latency_received_millisecondsmsAverage processing time for inbound RING operations. throughput_sent_bytesbytes/sData payload sent via RING operations. throughput_received_bytesbytes/sData payload received via RING operations. errors_senterrors/sRate of failed outbound RING operations. errors_receivederrors/sRate of failed inbound RING operations. rebuild_scanned_taskstasks/sRate of rebuild scanning (reconstructs missing replicas). rebuild_rebuilt_taskstasks/sRate of chunks actually rebuilt. repair_scanned_taskstasks/sRate of repair scanning (fixes integrity issues). repair_repaired_taskstasks/sRate of chunks actually repaired. balance_scanned_taskstasks/sRate of balance scanning (redistributes data for even usage). balance_balanced_taskstasks/sRate of chunks actually rebalanced. Table 9: Device-level metrics (4 metrics×7 devices×3 servers = 84 dimensions). Column names followstore1,2,3-device-metric. Each server has 4 NVMe data disks (g1disk01, g1disk02,g2disk01,g2disk02), 2 metadata SSDs (ssd01,ssd02), and 1 OS root disk (root). Data disks are the targets of disk failure anomalies. MetricUnitDescription disk_read_bytesbytes/sDisk read throughput. disk_write_bytesbytes/sDisk write throughput. disk_io_time_secondss/s [0,1]Fraction of time spent on I/O. Approaching 1.0 implies saturation. disk_usage_ratioratio [0,1]Disk space utilization. Figure 11 displays all 171 dimensions for a specific disk failure experiments (id=1773767292) with the anomaly period highlighted. 22 0246810121416 Experiment time (hours) Figure 11: Full 171 dimensions of an asynchronous, cascading disk failure experiment. Red vertical lines denote the full anomalous event, from the first disk failure onset to the last completed fix. C Experiment Registry In this section we provide the complete registry of all 215 experiments in the dataset, grouped by anomaly type. The Details column summarizes key anomaly configuration parameters (onset time, duration, target components, etc.). The Notes column contains additional comments on the experiment, including any experimental artifacts that occured. Namely, permanent disk loss indicates 23 the target disk could not be successfully recovered and stayed offline for the remainder of the experiment; server metric loss indicates issues with the target’s server telemetry due to software crashes; unplanned crash indicates the target server could not be restarted automatically at anomaly remediation time. rerun of ID indicates the experiment is a rerun of an experiment containing artifacts; the resulting time series from such experiment and its rerun are therefore very different. Experiment details use a compact notation summarized below. • Disk references follow the patternsN /disk, wheresNis the storage server number (1–3) and disk is the NVMe device name (e.g. g2disk01). Multiple disks are joined with +. •Timing is given asonset(time from experiment start to fault injection) anddur(fault duration). When every disk or node shares the same onset and duration, these appear once at the end of the entry; when they differ, the compact form@onset /duris appended to each individual fault. Faults within a non-simultaneous entry are separated by semicolons. • Asynchronous patterns are prefixed with one of three labels: cascading (failures start close together and mostly overlap), rolling (sequential with partial overlap), or independent (no temporal overlap). •Server degradation entries list eithermax delay / lossfor linear ramps, or a sequence ofdelay /loss @pct %stages for gradual (staircase) profiles. Delay is the added network latency; loss is the packet-drop percentage. Stage percentages refer to elapsed fractions of the full anomaly duration. •Software node (snode) counts are written assN : k snode(s), indicating k software storage nodes killed on server N. When durations differ per server, they appear inline after the snode count. C.1 Baseline Experiments The nominal baseline is an 18 h GET-heavy mixed-traffic workload generated bywarpwith 16 concurrent workers, 15 000 initial S3 objects of up to 100 KiB (randomized), and a fixed operation distribution (GET 95%, PUT 0.8%, STAT 4%, DELETE 0.4%). All anomalous experiments listed in subsequent tables run on top of this same nominal workload. Table 11: Nominal workload experiments (83 runs, no injected anomalies). IDDetailsNotes 177325139318h, 16 workers, 15k objects≤100KiB, GET 95% / PUT 0.8% / STAT 4% / DEL 0.4% 1773251399— ibid — 1773343560— ibid — 1773343565— ibid — 1773343568— ibid — 1773521107— ibid — 1773521116— ibid — 1773521128— ibid — 1773521135— ibid — 1773521150— ibid — 1773521156— ibid — 1773680909— ibid — 1780480777— ibid — 1780480782— ibid — 1780480787— ibid — 1780650581— ibid — 1780650584— ibid — 1780650586— ibid — 1780908507— ibid — 1780908509— ibid — 1780908511— ibid — 1781007723— ibid — 1781007725— ibid — 1781007727— ibid — 1781079773— ibid — 1781079775— ibid — 1781079777— ibid — 1781185330— ibid — 1781185333— ibid — 1781185335— ibid — 24 IDDetailsNotes 1781256852— ibid — 1781256854— ibid — 1781256856— ibid — 1781514760— ibid — 1781514764— ibid — 1781514767— ibid — 1781621786— ibid — 1781621789— ibid — 1781621793— ibid — 1781697075— ibid — 1781697078— ibid — 1781697081— ibid — 1781790629— ibid — 1781790631— ibid — 1781790633— ibid — 1781871082— ibid — 1781871084— ibid — 1781871086— ibid — 1782129149— ibid — 1782129152— ibid — 1782129154— ibid — 1782209424— ibid — 1782209429— ibid — 1782209437— ibid — 1782290038— ibid — 1782290044— ibid — 1782290047— ibid — 1782391919— ibid — 1782391921— ibid — 1782391924— ibid — 1782463369— ibid — 1782463371— ibid — 1782463373— ibid — 1782725684— ibid — 1782725686— ibid — 1782725688— ibid — 1782814250— ibid — 1782822554— ibid — 1782900715— ibid — 1782900776— ibid — 1782900741— ibid — 1782993286— ibid — 1782993287— ibid — 1782993289— ibid — 1783068960— ibid — 1783068962— ibid — 1783068964— ibid — 1783326897— ibid — 1783326899— ibid — 1783326902— ibid — 1783513609— ibid — 1783513611— ibid — 1783513612— ibid — C.2 Disk Failures Disk failure experiments simulate the loss of one or more NVMe data disks (g1disk01,g1disk02, g2disk01,g2disk02) on the storage servers. Three subtypes are distinguished: single disk failures affect exactly one disk; simultaneous failures take multiple disks offline at the same instant; asyn- chrnonous failures spread across time and are further categorized as cascading (failures start close together and mostly overlap), rolling (sequential with partial overlap), or independent (no temporal overlap). In several simultaneous experiments one or more disks were not successfully recovered after the planned fix and remained offline for the remainder of the experiment; these are noted as “permanent loss.” Subsequent experiments are run with a 10-minute staggered disk recovery strategy on the same server to avoid those events. Two of the experiments with permanent disk loss were rerun with this fix in effect. Experiments with permanent disk loss still produce perfectly labeled data; they simply contain much longer local anomalies. 25 Table 12: Disk failure experiments (38 runs). IDDetailsNotes Single Disk Failures 1773343796s1/g2disk01, onset 3h30m, dur 1h30m 1773343802s3/g2disk02, onset 6h, dur 35m 1773343833s3/g1disk02, onset 7h15m, dur 2h30m 1773343804s1/g2disk01, onset 10h, dur 10m 1773343837s1/g2disk02, onset 8h45m, dur 3h15m 1773603342s2/g2disk01, onset 9h30m, dur 20m 1773603348s1/g1disk01, onset 10h15m, dur 4h 1773603351s1/g2disk01, onset 11h, dur 50m 1773603363s2/g2disk01, onset 12h30m, dur 1h10m 1773603383s3/g1disk02, onset 14h30m, dur 2h Simultaneous Multiple Disk Failures 1773429303s1/g1disk01 + s2/g2disk01, onset 5h, dur 45m 1773429328s3/g1disk01 + s3/g2disk02 (same server), onset 12h, dur 3h30mg1disk01 permanent loss 1773429369s1/g2disk02 + s2/g1disk01 + s3/g2disk01, onset 10h, dur 1h30m 1773429404s1/g1disk01 + s1/g1disk02 + s2/g2disk01 + s3/g1disk02, onset 7h30m, dur 30ms1/g1disk01 permanent loss 1773680793s2/g1disk02 + s3/g2disk01, onset 8h, dur 2h 1773680834s1/g2disk01 + s1/g2disk02, onset 14h, dur 1hs1/g2disk02 permanent loss 1773680847s1/g1disk01 + s1/g2disk01 + s2/g2disk02, onset 3h, dur 2hs1/g2disk01 permanent loss 1773680864s2/g1disk02 + s3/g1disk01 + s3/g2disk02, onset 15h, dur 45ms3/g1disk01 permanent loss 1773680884s1/g1disk02 + s1/g2disk01 + s3/g1disk01 + s3/g2disk02, onset 6h, dur 1h15m s1/g2disk01 + s3/g2disk02 per- manent loss 1773680896s1/g2disk02 + s2/g1disk01 + s2/g2disk01 + s3/g1disk02, onset 11h, dur 3hs2/g2disk01 permanent loss 1773767900s3/g1disk01 3h30m + s3/g2disk02 3h40m, onset 12hrerun of 1773429328 1773768006 s1/g1disk02 1h15m + s1/g2disk01 1h25m + s3/g1disk01 1h15m + s3/g2disk02 1h25m, onset 6h rerun of 1773680884 1775270767s1/g1disk01 1h + s1/g1disk02 1h10m, onset 13h30m 1775270771s1/g1disk02 1h50m + s1/g2disk02 2h + s2/g1disk01 1h50m, onset 3h30m 1775270774s2/g2disk01 45m + s3/g1disk02 55m + s3/g2disk01 50m, onset 15h30m 1775270776 s1/g2disk01 35m + s1/g2disk02 45m + s2/g1disk02 35m + s3/g2disk01 40m, onset 7h 1775270779 s1/g1disk02 2h50m + s2/g2disk02 3h + s2/g1disk02 2h50m + s3/g1disk01 3h10m, onset 11h30m Asynchronous Multiple Disk Failures 1773429559cascading: s1/g1disk01 @6h/1h; s2/g2disk01 @6h15m/50m 1773429588 cascading: s1/g1disk01 @4h/40m; s2/g1disk02 @4h8m/30m; s3/g2disk01 @4h20m/55m s1/g1disk01 permanent loss 1773429647independent: s1/g2disk02 @9h/1h30m; s3/g1disk01 @12h/2h 1773429670rolling:s1/g2disk01@8h/3h;s2/g1disk01@10h/2h;s2/g2disk02 @11h30m/1h15m; s3/g1disk02 @12h15m/1h 1773767292 cascading: s2/g2disk01 @13h/1h30m; s2/g1disk02 @13h10m/1h; s3/g2disk02 @13h25m/1h 1773767367rolling: s1/g1disk02 @5h/2h; s3/g2disk01 @6h30m/1h30m 1773767388 rolling: s1/g2disk01 @2h/1h30m; s3/g1disk01 @3h/1h; s2/g2disk02 @3h30m/2h; s1/g1disk01 @4h15m/1h30m 1773767435independent: s3/g2disk02 @3h/45m; s2/g1disk01 @15h/1h 1773767461independent:s1/g2disk01 @2h/1h;s2/g2disk02 @7h/2h;s3/g1disk02 @14h/1h30m 1773767785independent: s2/g1disk02 @1h30m/30m; s1/g2disk01 @5h/1h15m; s3/g1disk01 @10h/45m; s3/g2disk02 @15h/2h 1775167457cascading: s3/g2disk01 @10h/1h15m; s1/g1disk02 @10h12m/45m C.3 Server Failures Server failure experiments simulate the loss / degradation of an entire storage server. Because the warp S3 load balancer distributes requests across all three servers in round-robin, losing one server reduces overall throughput proportionally and changes the traffic shape seen by the remaining servers. Single instant failures drop all network traffic on the target server. Asynchronous instant failures apply the same mechanism to multiple servers at different times within a single experiment (two servers cannot be killed simultaneously). Degradation experiments inject progressive network impairment in two ways: linear ramps delay and packet loss smoothly from zero to configured maximums over the anomaly duration, while gradual applies them in discrete stages at configured percentages of the anomaly duration, creating a staircase pattern. Two experiments (1773946658and1773946737) experienced unplanned server crashes during execution, where the targeted server failed unpredictably due to stress caused by the anomaly and 26 had to be manually reset after a much longer duration. Both were subsequently re-run with shorter, controlled durations, and therefore very different telemetry profiles. Table 13: Server failure experiments (48 runs). IDDetailsNotes Single Server Failures 1773946658store 1, onset 6h, dur 9h45munplanned crash 1774026192store 1, onset 6h, dur 20mrerun of 1773946658 1774026217store 2, onset 10h, dur 15m 1774132105store 3, onset 3h, dur 5m 1774132113store 2, onset 14h, dur 1m 1774587691store 2, onset 7h, dur 25m 1774587733store 1, onset 30m, dur 8m 1775087951store 2, onset 5h, dur 22m 1775087960store 3, onset 11h, dur 18m 1775087966store 3, onset 16h, dur 3m 1775087972store 1, onset 1h30m, dur 12m Asynchronous Instant Server Failures 1773946737s1 @4h/30m; s2 @10h/5h27munplanned crash on s2 1774026232s1 @4h/30m; s2 @10h/25mrerun of 1773946737 1774026246s1 @3h/20m; s2 @8h/15m; s3 @14h/5m 1774132120s1 @2h/10m; s3 @7h/15m 1774132127s2 @6h/5m; s3 @13h/3m 1774587774s2 @4h/12m; s2 @11h/20m 1775087979s1 @5h/10m; s1 @14h30m/15m 1775087985s3 @2h30m/15m; s1 @12h/10m 1775087991s1 @8h/7m; s3 @15h/18m 1775087997s2 @1h/5m; s3 @6h30m/20m; s1 @13h/12m 1775167468s3 @9h30m/6m; s2 @16h/14m Server Degradation — Linear 1774026280store 1, onset 6h, dur 2h, max 500ms delay / 15% loss 1774132137store 2, onset 4h, dur 1h30m, max 200ms delay / 8% loss 1774132147store 1, onset 10h, dur 4h, max 750ms delay / 20% loss 1774291956store 3, onset 5h, dur 2h, max 15ms delay / 4% loss 1774291974store 2, onset 7h, dur 3h, max 40ms delay / 10% loss 1774479145store 1, onset 2h, dur 1h, max 2ms delay / 1% loss 1774479151store 2, onset 5h, dur 2h30m, max 4ms delay / 3% loss 1774479157store 3, onset 11h, dur 1h30m, max 5ms delay / 5% loss 1774479161store 1, onset 8h, dur 3h30m, max 3ms delay / 2% loss 1774586951store 3, onset 2h, dur 5h, max 1.5ms delay / 0.8% loss 1774586961store 1, onset 6h, dur 4h30m, max 0.8ms delay / 1% loss 1775270764store 2, onset 5h, dur 3h, max 0.8ms delay / 0% loss Server Degradation — Gradual 1774026259store 1, onset 6h, dur 2h: 100ms/5% @25%, 300ms/10% @50%, 800ms/20% @75% 1774026268store 2, onset 8h, dur 3h: 50ms/2% @20%, 150ms/12% @40%, 400ms/12% @60%, 1s/25% @80% 1774132154store 3, onset 4h, dur 1h30m: 150ms/5% @33%, 500ms/15% @66% 1774132163 store 2, onset 10h, dur 4h: 20ms/1% @10%, 80ms/3% @30%, 200ms/8% @50%, 500ms/15% @70%, 1s/30% @90% 1774291987 store 1, onset 3h, dur 2h30m: 3ms/0.5% @2%, 5ms/1.5% @25%, 7ms/3% @55%, 10ms/5% @85% 1774292005store 3, onset 9h, dur 3h: 5ms/1% @3%, 20ms/4% @35%, 35ms/7% @70% 1774478710store 2, onset 3h, dur 2h: 1ms/0.5% @3%, 4ms/3% @50% 1774478725store 3, onset 6h, dur 1h: 1ms/0.3% @2%, 3ms/1.5% @35%, 5ms/4% @70% 1774478736store 1, onset 12h, dur 2h30m: 1ms/0.5% @3%, 2ms/1% @25%, 3ms/2.5% @55%, 5ms/5% @80% 1774478743store 2, onset 5h, dur 3h: 0.2ms/0.2% @2%, 0.8ms/0.8% @20%, 1.2ms/1.5% @40%, 1.4ms/3% @65%, 1.6ms/4.5% @90% 1774586933store 2, onset 10h, dur 4h: 0.3ms/0.1% @3%, 0.5ms/0.25% @35%, 0.7ms/0.4% @70% 1774586939 store 3, onset 7h, dur 6h: 0.1ms/0.05% @2%, 0.7ms/0.1% @25%, 0.5ms/0.15% @55%, 0.8ms/0.2% @85% 1775270759store 1, onset 4h, dur 2h: 0.1ms/0.1% @3%, 0.3ms/0.3% @40%, 0.5ms/0.5% @75% 1775270761store 3, onset 9h, dur 4h: 0.3ms/0.2% @3%, 0.7ms/0.5% @30%, 0.2ms/0.1% @55%, 0.5ms/0.4% @80% 27 C.4 Storage Node Failures Software/storage node (snode) experiments kill a configurable number of the 6 software storage nodes running on a single server. The same three subtypes as disk failures are used: single failures kill snodes on one server; simultaneous failures kill snodes on multiple servers at the same time; asynchronous failures spread across servers over time, categorized as cascading (overlapping onset), rolling (sequential with partial overlap), or independent (no temporal overlap). 16 of the 46 snode experiments were affected by a software bug caused by the anomaly, affecting the targeted server’s telemetry agent and causing it to discard other server level metrics. Those experiments as well as their reruns are included, as the bug created a fully different telemetry profile for each affected time series. Table 14: Storage node failure experiments (46 runs). IDDetailsNotes Single-Server Software Node Failures 17746561691 snode on s1, onset 6h, dur 1hserver metric loss 17746561741 snode on s2, onset 9h, dur 1h30mserver metric loss 17746561802 snodes on s1, onset 5h, dur 45mserver metric loss 17746561832 snodes on s3, onset 8h, dur 1hserver metric loss 17747643693 snodes on s2, onset 2h, dur 30mserver metric loss 17747644323 snodes on s3, onset 14h, dur 45mserver metric loss 17748449481 snode on s1, onset 6h, dur 1hrerun of 1774656169 17748449581 snode on s2, onset 9h, dur 1h30mrerun of 1774656174 17748449632 snodes on s1, onset 5h, dur 45mrerun of 1774656180 17748449692 snodes on s3, onset 8h, dur 1hrerun of 1774656183 17749365913 snodes on s2, onset 2h, dur 30mrerun of 1774764369 17749365993 snodes on s3, onset 14h, dur 45mrerun of 1774764432 17750213661 snode on s3, onset 16h, dur 20m 17750213751 snode on s1, onset 3h, dur 15m 17751674813 snodes on s1, onset 7h30m, dur 35m 17751674842 snodes on s2, onset 12h, dur 50m Simultaneous Multi-Server Software Node Failures 1774656573s1: 1 snode + s2: 1 snode, onset 13h, dur 1hserver metric loss 1774656577s1: 1 snode + s2: 2 snodes, onset 7h, dur 45mserver metric loss 1774764331s1: 1 snode 20m + s2: 1 snode 25m + s3: 1 snode 30m, onset 10hserver metric loss 1774764358s1: 2 snodes + s3: 2 snodes, onset 15h, dur 15mserver metric loss 1774844979s1: 1 snode + s2: 1 snode, onset 13h, dur 1hrerun of 1774656573 1774844985s1: 1 snode + s2: 2 snodes, onset 7h, dur 45mrerun of 1774656577 1774936575s1: 1 snode 20m + s2: 1 snode 25m + s3: 1 snode 30m, onset 10hrerun of 1774764331 1774936581s1: 2 snodes + s3: 2 snodes, onset 15h, dur 15mrerun of 1774764358 1775021334s2: 1 snode + s3: 1 snode, onset 3h30m, dur 20m 1775021343s1: 1 snode + s3: 1 snode, onset 11h30m, dur 15m 1775021351s1: 2 snodes + s2: 1 snode + s3: 2 snodes, onset 6h, dur 20m 1775021360s2: 2 snodes 25m + s3: 1 snode 30m, onset 16h30m 1775167475s2: 3 snodes 25m + s3: 1 snode 30m, onset 14h 1775167478s1: 1 snode + s3: 2 snodes, onset 4h, dur 40m Non-Simultaneous Multi-Server Software Node Failures 1774656607cascading: s1 2 snodes @3h30m/1h; s2 1 snode @4h/1hserver metric loss 1774656595independent: s1 1 snode @5h/1h; s3 2 snodes @11h/1h30mserver metric loss 1774764255cascading: s1 1 snode @3h/1h30m; s2 2 snodes @3h45m/1h; s3 1 snode @4h15m/35m server metric loss 1774764269independent: s2 3 snodes @4h/45m; s3 2 snodes @13h/1h10mserver metric loss 1774764282rolling: s1 1 snode @9h/1h30m; s2 1 snode @11h/1h20m; s3 2 snodes @14h/1hserver metric loss 1774764299rolling: s1 2 snodes @2h/1h30m; s2 3 snodes @3h30m/1h; s3 1 snode @5h/2h; s1 1 snode @12h/1h server metric loss 1774844991cascading: s1 2 snodes @3h30m/1h; s2 1 snode @4h/1hrerun of 1774656607 1774844998independent: s1 1 snode @5h/1h; s3 2 snodes @11h/1h30mrerun of 1774656595 1774936535cascading: s1 1 snode @3h/1h30m; s2 2 snodes @3h45m/1h; s3 1 snode @4h15m/35m rerun of 1774764255 1774936551independent: s2 3 snodes @4h/45m; s3 2 snodes @13h/1h10mrerun of 1774764269 1774936559rolling: s1 1 snode @9h/1h30m; s2 1 snode @11h/1h20m; s3 2 snodes @14h/1hrerun of 1774764282 1774936567rolling: s1 2 snodes @2h/1h30m; s2 3 snodes @3h30m/1h; s3 1 snode @5h/2h; s1 1 snode @12h/1h rerun of 1774764299 1775021320cascading: s3 1 snode @12h/1h; s1 2 snodes @12h45m/45m 1775021329rolling: s2 1 snode @5h/20m; s3 1 snode @6h/15m; s1 1 snode @7h/25m 1775167464independent: s1 2 snodes @2h30m/40m; s2 1 snode @15h/1h 1775167472rolling: s3 1 snode @8h/1h; s1 2 snodes @8h30m/45m 28 D Technical Details D.1 System Details The cluster topology shared by all experimental deployments is illustrated in Figure 12. Each cluster runs RING 9.5.0.5 on top of Rocky Linux 9.5 with 3 storage servers and one supervisor server. Each storage server is equipped with four 10 GB NVMe data disks and two 5 GB SSDs for metadata, in addition to one OS disk. Client S3 traffic generated by warp on the supervisor enters each storage server through its S3 connector service. The connector parses S3 API calls, performs metadata lookups, and dispatches data operations to the appropriate storage nodes via the DHT. Warp distributes client requests to all three servers in round-robin, before further load balancing is done at the connector level. The RING’s data placement in each storage server is governed by an implementation of the Chord protocol [79], a peer-to-peer distributed hash table in which object keys are hashed and mapped onto a logical ring of identifiers. Each of the 18 software storage nodes (6 per server) owns a contiguous arc of this keyspace and is responsible for storing all objects whose hashes fall within its range. Chord ensures that when a node joins or leaves the ring, only the keyspace segments adjacent to it are affected, as the protocol redistributes the affected key ranges to their new owners efficiently. Therefore, when storage nodes are killed, or servers are isolated, the remaining nodes absorb the orphaned keyspace segments and continue serving requests. Objects are protected via replication or erasure coding depending on size, with replicas placed on distinct storage nodes across different servers for durability. Three categories of background tasks run continuously and are directly relevant to the anomaly experiments: rebuild detects missing replicas or chunks (e.g., after a disk or node failure) and reconstructs them onto healthy disks; repair scans for data integrity issues and fixes them from surviving copies; and rebalance redistributes data when disk usage becomes uneven, typically after a recovery event. These tasks run at low intensity during nominal operation and ramp up after failure events, producing visible signatures in the per-server task-rate metrics (see Table 7). Supervisor Storage Server 1 S3 Connector Storage Nodes N1N2N3 N4N5N6 Storage Disks D1D2 D3 D4 S1S2OS DataMeta Storage Server 2 S3 Connector Storage Nodes N1N2N3 N4N5N6 Storage Disks D1D2 D3 D4 S1S2OS DataMeta Storage Server 3 S3 Connector Storage Nodes N1N2N3 N4N5N6 Storage Disks D1D2 D3 D4 S1S2OS DataMeta DHTDHT Platform 17 S3 13 Server 19×3 Device 4×7×3 = 171 total Figure 12: Experiment cluster topology. The metric hierarchy on the right shows all four telemetry levels and their dimension counts, totaling 171 features. D.2 Implementation Details Baseline workload generation: S3 client traffic is generated bywarpv1.0.8 3 , an open-source S3 benchmarking tool. Warp runs on the supervisor server and distributes requests to all three storage servers via round-robin host selection (--host-select roundrobin). The tool is invoked in stress mode (--stress) to discard output for long-running experiments, and object sizes are randomized within the configured range (--obj.randsize). An important consequence of the 3 https://github.com/minio/warp 29 round-robin distribution is that, when a storage server becomes unreachable during a server failure experiment, approximately one-third of all S3 requests are dropped by the client, producing a visible and proportional throughput reduction across the cluster. Disk failure injection: Disk failures are triggered by fully detaching the target NVMe disk from the operating system. The framework resolves the disk’s mount point to its underlying block device and PCI bus address, then performs a lazy unmount and unbinds the NVMe driver via the kernel’s sysfsinterface. This removes the block device entirely, simulating physical hardware loss rather than merely blocking I/O. Recovery rebinds the NVMe driver, waits for the device to reappear, marks the disk as out-of-service via the platform’s disk management utility, wipes its partition signatures, and initiates a RING-level disk replacement. The RING then begins background rebuild tasks to reconstruct the lost replicas on healthy disks. In a subset of simultaneous disk failure experiments, the replacement procedure failed silently and the target disk remained permanently offline for the rest of the experiment. These “permanent disk loss” cases are annotated in the experiment registry (Appendix C, Table 12) and represent a realistic failure mode. To mitigate this in other experiments, a staggered recovery strategy was adopted, where disks on the same server are fixed with slight time offsets to reduce contention during the replacement procedure. Server failure injection: All server failure modes use Linuxtc(traffic control) with thenetem network emulation module to manipulate network traffic at the kernel level. SSH and ARP traffic is explicitly exempted from impairment throughout, preserving the experiment framework’s remote management access to the target server. In instant mode, all non-SSH traffic is subjected to 100% packet loss, effectively isolating the server from the rest of the cluster. In linear degradation mode, network delay and packet loss are gradually ramped from zero to their configured maximum values over the anomaly duration. In gradual (staged) degradation mode, delay and packet loss are applied in discrete steps at configured percentage milestones of the anomaly duration, producing a staircase pattern. Recovery reverses all network impairments and restores the kernel’s default queueing disciplines. Two server failure experiments experienced genuine unplanned server crashes caused by the stress of the injected anomaly, requiring manual recovery after a much longer outage than planned. Both were subsequently re-run with shorter, controlled durations. The original and re-run experiments are both included in the dataset and annotated in the experiment registry (Appendix C, Table 13). Storage node failure injection: Storage node failures target individual software processes on a given server. The experiment framework randomly selects the configured number of targets (1–3 out of the 6 running per server) and terminates them withSIGABRT(signal 6), producing a core dump that mimics a real application crash. Recovery restarts each killed node via the platform’s process management wrapper, after which the RING initiates background rebuild and repair tasks to restore the node’s data. A key distinction from server failures is that the storage server itself remains reachable: its remaining storage nodes continue to handle requests normally, and only the DHT keyspace segments owned by the killed nodes become temporarily unavailable while the Chord protocol redistributes their workload. 16 early storage node experiments were affected by a telemetry agent bug: killing a storage node process caused an unhandled connection error in the server’s local telemetry agent, which disrupted metric collection for all services on the affected server. The agent was subsequently patched, and the experiments were re-run. Both versions are included in the dataset, as they produce distinct telemetry signatures, and are annotated accordingly in the experiment registry (Appendix C, Table 14). Experiment setup:Internally, experiments are defined declaratively as YAML configuration files specifying the workload parameters and a timeline of fault injection events, each with an absolute time offset from experiment start, a configured duration and subsequent anomaly-specific parameters. A distribution of anomaly parameter coverage across all experiments can be found in Table 15. The orchestrator schedules each timeline event at its specified offset from experiment start. Anomalies are automatically reversed after their configured duration. Experiments end after the baseline workload has been running for exactly 18 hours. 30 Table 15: Anomaly parameters coverage in SHAD. C/R/I denotes cascading, rolling, and independent subtypes, respectively. Type (Subtype)OnsetDurationParameters Nominal–18 hnormal behaviour Single disk3.5–14.5 h10–240 min3 servers, 4 disk types Simult. disk3–15.5 h30–215 min2-4 disks, 1-3 servers Async. disk (C/R/I)1.5–15 h30–180 min2-4 events per exp. Single server0.5–16 h1–25 min∗3 servers Async. server1–16 h3–30 min∗2-3 events, same-server Degradation (Lin/Grad)2–12 h1–6 hdelay 0.5–1000 ms, loss 0-30 Single Snode2–16 h15–90 min1–3 Snodes, 3 servers% Simult. Snode3.5–16.5 h15–60 min2–5 Snodes, 2–3 servers Async. Snode (C/R/I)2–15 h15–120 min2–4 events per exp. ∗ Both anomaly types exclude 2 unpredictable server failures with much longer duration than average; (585 min) for Instant and (327 min) for Async. 31 E Experimental Evaluation Details E.1 Anomaly Detection Table 17: List of anomaly detectors used in the experiments. Legend refers to the name used for detectors in Figure 7. NameLegend SupervisionCategoryDescription AutoEncoder [74]AESPrediction-basedProjects data to the lower-dimensional latent space and then reconstruct it through the encoding-decoding phase, where anomalies are typically characterized by evident reconstruction deviations. OmniAnomaly [80]OASPrediction-based Stochastic recurrent neural network, which captures the normal patterns of time series by learning their robust representations with key techniques such as stochastic variable connection and planar normalizing flow, recon- structs input data by the representations, and use the reconstruction probabilities to determine anomalies. USAD [8]USADSPrediction-basedbased on adversely trained autoencoders, and the anomaly score is the combination of discriminator and reconstruction loss. CNN [61]CNNSPrediction-basedEmploys Convolutional Neural Network (CNN) to pre- dict the next time stamp on the defined horizon and then compare the difference with the original value. LSTM [58]LSTMSPrediction-based Utilizes Long Short-Term Memory (LSTM) networks to model the relationship between current and preceding time series data, detecting anomalies through discrepan- cies between predicted and actual values. OCSVM [76]SVMSDensity-based Fits the dataset to find the normal data’s boundary by maximizing the margin between the origin and the normal samples. TimesNet [93]TNSPrediction-based A general time series analysis model with applications in forecasting, classification, and anomaly detection. It features TimesBlock, which can discover the multi- periodicity adaptively and extract the complex temporal variations from transformed 2D tensors by a parameter- efficient inception block. FITS [99]FITSSPrediction-based Lightweight model that operates on the principle that time series can be manipulated through interpolation in the complex frequency domain. MCD [73]MCDSDensity-based Based on minimum covariance determinant, which seeks to find a subset of all the sequences to estimate the mean and covariance matrix of the subset with minimal deter- minant. Subsequently, Mahalanobis distance is utilized to calculate the distance from sub-sequences to the mean, which is regarded as the anomaly score. Anomaly Transformer [98]ATSPrediction-based Utilizes the ‘Anomaly-Attention’ mechanism to compute the association discrepancy. KMeansAD [100]KMADUDistance-basedcalculates the anomaly scores for each sub-sequence by measuring the distance to the centroid of its assigned cluster, as determined by the k-means algorithm. PCA [5]PCAUDensity-based Projects data to a lower-dimensional hyperplane, with significant deviation from this plane indicating potential outliers. CBLOF [34]CBLOFUDistance-basedCluster-based LOF, which calculates the anomaly score by first assigning samples to clusters, and then using the distance among clusters as anomaly scores. KNN [43]KNNUDistance-basedProduces the anomaly score of the input instance as the distance to its k-th nearest neighbor. HBOS [31]HBOSUDensity-basedConstructs a histogram for the data and uses the inverse of the height of the bin as the anomaly score of the data point. LOF [19]LOFUDistance-basedCalculates the anomaly score by comparing local density with that of its neighbors. IsolationForest [53]IFUDensity-basedIsolates anomalies using random partitioning of the data space. The core assumption is that anomalies are easier to isolate, requiring fewer random splits. Therefore, in- stances that require fewer partitions are more likely to be anomalous. Robust PCA [64]RPCAUDensity-based Built upon PCA, identifies anomalies by recovering the principal matrix. S=Semi-Supervised U=Unsupervised 32 Template Example (i) Context You are an expert in time series analysis. The following data represents a multivariate time series related to a cloud storage system. Each key corresponds to one dimension of the dataset and contains its statistical features. Your task is to answer the given questions by analyzing the statistical features. (i) TS Representation The time series [...] many dimensions exhibit spikes, indicating sudden bursts of activity. This is especially noticeable in disk operations (read/write), network bytes (in/out), and I/O operations. 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09 0.070 0.075 0.080 0.085 0.090 0.095 0.100 0.105 0.005 0.010 0.015 0.020 0.025 0.030 0.035 4 5 6 7 8 2.0 2.5 3.0 3.5 4.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.5 1.0 1.5 2.0 2.5 3.0 3.5 0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 0.0 0.2 0.4 0.6 0.8 1.0 1.2 0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 0.0 0.2 0.4 0.6 0.8 1.0 1.2 0102450001024500010245000102450001024500010245000102450001024500 store1-g1disk01-disk_usage_ratio Multi-Panel Image HistMode5: -0.099 Standard Dev: 0.002 Mean: 0.006 Per-Dimension Catch 22 FeaturesGlobal Image Description (iv) Questionnaire 1 - Does the multivariate time series contain anomalies? Options [Yes/No] 2 - If an anomaly is present, name a single dimension in which you have found the anomaly. Otherwhise reply None. 3 - If an anomaly is present, give a single numeric time instant range [start,end] in which the anomaly is present. Otherwhise reply None. 4 - If an anomaly is present, choose its type. Options: [Disk Failure/Server Failure/Software/ Node Failure/None] 5 - If an anomaly is present, choose its criticality. Options [Low/Medium/High/None] Briefly explain your previous answers. Figure 13: Prompt template overview Table 17 shows the list of anomaly detectors used for the experimental evaluation in Section 4.1. This pool of detectors is comprehensive and heterogeneous, and can be categorized according to the level of supervision (semi-supervised or unsupervised) or according to the underlying methodology (prediction-based, density-based, distance-based). E.2 Prompt Template example Figure 13 summarizes the prompt template used for the interpretability study. The prompt is composed of three main elements: a (i) short description of the context and the task (the Figure shows the one used for Catch22), (i) the provided representation, and (i) the questionnaire. In addition, the LLM is asked to motivate its answers. The full prompts, available on our repository, also includes some formatting instructions to ensure the proper parsing of the LLM’s answers. E.3 Computing resources E.3.1 Anomaly Detection Figure 14 reports the average time taken to obtain the anomaly score on a time series of the SHAD dataset. For Semi Supervised methods (in bold in the Figure) we report both the training time and the inference time. One major observation is that, understandingly, most of the Unsupervised methods are significantly faster than Semi-Supervised ones, as they have no training needed. Hence, with 33 Time [s] 10 2 10 1 10 0 10 −1 10 −2 LOF KNN HBOS CBLOF KMAD PCA IF RPCA OA USAD AE CNN TN LSTM AT FITS SVM MCD Inference Training Figure 14: Average Inference and Training Time on a Time Series for Each Method regard to the performances described in Section 4.1, KMAD appears as the best trade-off between performance and computational efficiency. Non-deterministic methods were run five times, and the results reported are the average VUS-PR of those runs. The slowest method, FITS, takes a day ton run on the whole dataset. We conduct our experiments on a high-performance compute cluster with a heterogeneous config- uration. The compute nodes feature a variety of architectures, including AMD EPYC (Zen 2/3) and Intel Xeon (Broadwell/Cascade Lake) processors, ranging from 16 to 64 physical cores. For GPU-accelerated methods, nodes are equipped with NVIDIA RTX 6000/8000 (24GB/48GB) or NVIDIA A100 (80GB) GPUs. All nodes operate on CentOS 7.9 (64-bit). E.3.2 Interpretability For the interpretability experiments, we rely on a large language model accessed via API. As inference is performed remotely, execution times are primarily influenced by network latency and the service response time, rather than local computational resources. In general, the average execution time of the full interpretability pipeline on a single dataset is 90 seconds for Catch22, 8 seconds for Images, and 14 seconds for Image Descriptions. These timings may vary depending on external factors such as API load and network conditions, but provide a reasonable estimate of the computational overhead associated with LLM-based interpretation in our setting. E.4 Complete Reults tables Table 19 reports a more stratified visualization of the explainability results of the top performing detectors (CNN, KMeansAd, and OmniAnomaly) across the different anomaly types. The results are also compared with the ones obtained with a random baseline. Overall, the results confirm the observation made in the main paper, i.e., that the number of affected dimensions can influence the intrinsic difficulty of the localization task. This is evident for highly localized anomalies (e.g., Single Disk). It is also noticeable that the NDCG values of the detectors are close to a random prediction, highlighting the complexity of the proposed dataset. Table 20 reports the average performance of each model across all representations, ranking them for each task. As it is possible to see, all models showed similar behaviours. Nevertheless, it is possible to notice that Claude was the best overall model, outperforming the others in 3 tasks (anomaly criticality, temporal localization, and anomaly type) and resulting the second-best one for anomaly presence. Table 21 reports the average gain provided by each level of supervision, averaged across all models and representations. As it is possible to see, the best improvements concerns dimension localization and temporal localization. 34 Table 19: Explainability results of top performing detectors and a random baseline for each anomaly type. The table also reports the average number of dimension affected by each anomaly type. Anomaly TypeAvg. Anomalous Dim. CNN KmeansAD OmniAnomaly Rand. Single Disk40.000.000.000.02 Single Server470.270.160.170.26 Single Node470.240.180.290.26 Simultaneous Disk120.050.110.000.08 Simultaneous Node100.70.570.460.600.57 Asynchronous Disk11.270.020.070.000.05 Asynchronous Server940.270.230.180.27 Asynchronous Node114.560.380.350.420.40 Server Degradation470.270.250.240.26 Table 20: Model ranking by task. The performance is averaged across the three different representa- tions (i.e., Catch 22, Images, and Descriptions). TaskModel Performance Anomaly CriticalityClaude0.196400 Anomaly CriticalityGemini0.158063 Anomaly CriticalityLlama0.149613 Anomaly CriticalityMistral0.147306 Anomaly CriticalityGrok0.134204 Dimension LocalizationGrok0.047685 Dimension LocalizationMistral0.018056 Dimension LocalizationLlama0.008796 Dimension LocalizationGemini0.006481 Dimension LocalizationClaude0.005556 Anomaly PresenceGemini0.493165 Anomaly PresenceClaude0.478134 Anomaly PresenceMistral0.478134 Anomaly PresenceLlama0.476784 Anomaly PresenceGrok0.407620 Temporal LocalizationClaude0.119444 Temporal LocalizationGrok0.047685 Temporal LocalizationGemini0.047222 Temporal LocalizationMistral0.031481 Temporal LocalizationLlama0.030556 Anomaly TypeClaude0.235674 Anomaly TypeGemini0.219983 Anomaly TypeMistral0.183540 Anomaly TypeLlama0.176381 Anomaly TypeGrok0.101414 F Limitations One of the limitations of SHAD is that each time series considers one type of anomalies, thereby not providing series with mixed failures (e.g. a server failure followed by a disk failure). Moreover, SHAD currently focuses on a single industrial distributed storage system. This design choice was made to prioritize annotation quality and reliability through close collaboration with domain experts, at the cost of reduced system heterogeneity. Extending the benchmark to additional storage systems and application domains is an important direction for future work, although it requires access to real 35 Table 21: Mean gain by supervision level and task. Supervision TaskMean Gain Level 1Anomaly Criticality0.0128 Level 2Anomaly Criticality-0.0078 Level 1Dimension Localization0.0719 Level 2Dimension LocalizationN.A. (trivial) Level 1Anomaly PresenceN.A. (trivial) Level 2Anomaly PresenceN.A. (trivial) Level 1Temporal Localization0.0793 Level 2Temporal Localization0.1446 Level 1Anomaly Type0.0218 Level 2Anomaly Type0.0477 infrastructures and substantial annotation effort. For the explainability experiment, we considered a traditional explainability method to understand whether simple dimension score attribution could be used to correctly identify anomalous dimensions. The evaluation of more refined strategies, which proved to be necessary in light of the results, is therefore left as future development. In addition, for evaluating interpretability, we provide a simple baseline consisting in a single-call solution. While more refined strategies (e.g., per-dimension analysis, advanced prompting, or multi-stage reasoning) or tailored approaches (e.g., ChatTS) can be used, the purpose of our experiments is to establish a simple baseline from which future work on LLM-based anomaly interpretation can build. G Broader Impacts SHAD provides a comprehensive benchmark for time series anomaly detection, explanation, and interpretation on real-world, high-dimensional telemetry data from cloud storage systems. By en- abling rigorous and reproducible evaluation of detection, explainability, and interpretability methods, SHAD can contribute to the development of more reliable and transparent monitoring systems. This may improve the robustness and availability of critical digital infrastructures (e.g., cloud services), leading to reduced downtime, better resource utilization, and improved user experience. Furthermore, the inclusion of per-dimension anomaly labels and rich textual annotations facilitates research on interpretable machine learning, helping practitioners better understand system failures and supporting faster debugging and root-cause analysis. This can reduce operational costs and lower the barrier to adopting advanced anomaly detection techniques in industry. At the same time, models developed and evaluated exclusively using SHAD may exhibit limited generalization if applied to domains with substantially different characteristics, and anomaly detection systems may still produce false positives or missed detections in practice. Additionally, advances in system observability could, in certain contexts, be leveraged to infer sensitive operational patterns or to design strategies that evade detection. These considerations depend on specific deployment settings and highlight the importance of careful evaluation, domain-specific validation, and responsible use. 36

Instant research discovery