Screen Broadly, Diagnose in Context: Hierarchical Time Series Anomaly Detection

Time series anomaly detection is essential to the reliability of cloud services, Internet of Things systems, and communication networks. Although many existing methods are sensitive to changes in data, statistical deviation alone does not establish whether a change reflects a genuine operational anomaly or benign variation. This gap between numerical sensitivity and operational meaning remains a key obstacle to industrial deployment. Large language models can incorporate operational semantics, but directly interpreting large volumes of numerical time-series data remains challenging. We introduce VeraTS, a hierarchical framework that addresses this gap through two complementary stages. The first, Time Series Perception for Signal Detection, screens broadly for candidate deviations while preserving event coverage on labeled development data. The second, Expert System for Semantic Judgment, translates operator policies into explicit rules for harmful direction and persistence, then deterministically verifies candidate deviations against these rules. We evaluate VeraTS with supplied policy programs on operational KPI series from backbone-link monitoring data. The frozen screen overlaps all evaluation events. VeraTS achieves state-of-the-art average anomaly detection performance on backbone links and the best results on nearly all evaluated datasets, with experiments validating its robustness and practical deployability.