## 4 Performance Metrics for Anomaly and Attack Detection
where  
* \(TP\)--correctly detected anomaly (\(y_{t}=1,\overset{\wedge}{y_{t}}=1\));
* \(FP\)--false detected anomaly (\(y_{t}=0,\overset{\wedge}{y_{t}}=1\));
* \(TN\)--correctly assigned norm (\(y_{t}=0,\overset{\wedge}{y_{t}}=0\));
* \(FN\)--false assigned norm (\(y_{t}=1,\overset{\wedge}{y_{t}}=0\)). Point-adjusted (PA) calculation approachThe calculation of the performance metrics is implemented using the corrected labels. If at least one observation of an anomalous segment is detected correctly, all other observations of the segment are also considered to be correctly detected, even if they were not detected [28; 49]. Observations outside the true anomaly segment are processed as usual. It can be specified as follows:  
\[\overset{\wedge}{y_{t}}=\left\{ \begin{array}{ll}1,&\text{if }A(x_{t})>\delta \text{ or }\exists A(x_{t}>\delta),\,x_{t},x_{t}^{\prime}\in S_{m},\\ 0,&\text{otherwise}.\end{array} \right.\]  
The metrics are calculated considering the corrected labels in the dataset:  
\[P_{pa}=\frac{TP_{pa}}{TP_{pa}+FP_{pa}},\hskip 28.452756 ptR_{pa}=\frac{TP_{pa}}{ TP_{pa}+FN_{pa}},\hskip 28.452756 ptF1_{pa}=2\times\frac{P_{pa}\times R_{pa}}{P_{pa}+R_{pa}},\]  
This idea is represented in Figure 4.  
Revised point-adjusted (RPA, event-wise) calculation approachThe calculation of metrics is implemented using time windows of records [50]. If any point at the anomaly window is labelled as anomalous, then one true positive result is fixed. If the anomalies were not labelled, then one false negative result is fixed. Any predicted anomalies outside the anomaly windows are considered false positives. This can be specified as follows:  
\[P_{rpa}=\frac{TP_{rpa}}{TP_{rpa}+FP_{rpa}},\hskip 28.452756 ptR_{pa}=\frac{TP_{ rpa}}{TP_{rpa}+FN_{rpa}},\hskip 28.452756 ptF1_{pa}=2\times\frac{P_{rpa}\times R_{ rpa}}{P_{rpa}+R_{rpa}},\]  
where  
* \(TP_{rpa}\)--any part of the predicted anomaly sequence intersects with a sequence that actually has an anomaly;
* \(FN_{rpa}\)--if no sequence that is predicted to be anomalous intersects with a real anomalous sequence;
* \(FP_{rpa}\)--all predicted anomalous sequences that do not intersect with any really anomalous sequence. This idea is represented in Figure 5.  
Figure 4: True, corrected, and predicted labels in case of the PA approach to metrics calculation. Another metric is the composite \(F1\) score [50]. For this metric, precision is considered as \(P\) (by the number of points), and recall is calculated as \(R_{rpa}\) (by the number of segments):  
\[F1_{c}=2\times\frac{P\times R_{rpa}}{P+R_{rpa}}.\]  
This idea is represented in Figure 6.  
_Conclusions._ There are various approaches to the calculation of metrics for performance evaluation of the machine learning models. In addition to the classical way of calculating through \(TP\), \(TN\), \(FN\), and \(FP\), researchers present options with adjusted indicators. This is aimed at improving the quality of anomaly detection in a large amount of data, or at reducing the number of false positives. In this case, the choice of metrics strongly depends on the detection problem being solved. To select the appropriate approach to calculation, additional experiments are required: the authors plan to implement and compare all the described metrics in future experiments with anomaly detection methods.