Cluster-LLM: Adaptive Real-Time Time-Series Anomaly Detection Using LLMs

Time-series anomaly detection plays a vital role in industrial monitoring, finance, and cybersecurity. However, existing methods often suffer from limited labeled data, poor generalization, and high detection latency. In this paper, we propose Cluster-LLM, an unsupervised anomaly detection method that combines time-series clustering with large language models (LLMs). The method captures temporal pattern shifts through clustering and leverages chain-of-thought (CoT) prompting to guide the LLM in inferring adaptive baselines. A confidenceweighted mechanism is introduced to enable real-time detection.Experiments conducted on the KPI and Yahoo benchmark datasets demonstrate that Cluster-LLM achieves a precision of 0.985 and 0.885 respectively, while reducing detection latency to 283s and 23s, substantially outperforming several unsupervised baselines. In addition, it maintains competitive F1-scores of 0.642 (KPI) and 0.537 (Yahoo) despite being entirely unsupervised. These results highlight the potential of LLMs in real-time timeseries anomaly detection.