Achieving Counterfactual Explanation for Sequence Anomaly Detection (CFDet)

CFDet: Counterfactual Explanation for Sequence Anomaly Detection

We propose CFDet, a framework that explains sequence anomaly detection by identifying anomalous entries through a counterfactual perspective. CFDet highlights the minimal changes needed to convert an anomalous sequence into a normal one, offering clear and fine-grained explanations of model decisions. Evaluations on BGL, Thunderbird, and CERT datasets show that CFDet achieves high-fidelity explanations and consistently outperforms attention-based, Shapley value, and gradient-based baselines in detecting anomalous entries.