  In recent years there has been significant progress in time series anomaly
detection. However, after detecting an (perhaps tentative) anomaly, can we
explain it? Such explanations would be useful to triage anomalies. For example,
in an oil refinery, should we respond to an anomaly by dispatching a hydraulic
engineer, or an intern to replace the battery on a sensor? There have been some
parallel efforts to explain anomalies, however many proposed techniques produce
explanations that are indirect, and often seem more complex than the anomaly
they seek to explain. Our review of the literature/checklists/user-manuals used
by frontline practitioners in various domains reveals an interesting
near-universal commonality. Most practitioners discuss, explain and report
anomalies in the following format: The anomaly would be like normal data A, if
not for the corruption B. The reader will appreciate that is a type of
counterfactual explanation. In this work we introduce a domain agnostic
counterfactual explanation technique to produce explanations for time series
anomalies. As we will show, our method can produce both visual and text-based
explanations that are objectively correct, intuitive and in many circumstances,
directly actionable.
