## 4 Results
### Saliency Map for Key Feature Identification
The constant increase and subsequent saturation of thread pool utilization coincide with the peak of active dispatches observed earlier, confirming that the increase in requests led to an overload of the available resources, resulting in a system crash. Figure 5: Example anomaly in host xs-604 identified through the “TPC pull success/error” metric. The anomalous observation is represented by the highlighted time window, corresponding to the 5 time steps preceding the anomalous event. Figure 6: Example anomaly—active dispatches with evidence of the peak (red circle) and subsequent system reactivation (blue circle). Once the cause of the anomaly is understood, the previously trained Shallow Network is used, with the anomalous observation being provided as input to obtain a prediction. The prediction correctly indicates that the provided observation is classified as anomalous. By using the Saliency Map technique, it is possible to display a list of the most important features that the network used to detect the anomaly. For this specific case, the three most important metrics for identifying the anomaly are shown, with their corresponding importance represented by the aggregated gradient values, in Table 3. The metrics shown in the table are sorted in descending order, from the most important to the least important. Comparing the table with the analysis of the metrics present in the INFN-CNAF Dashboard carried out earlier, it is immediately clear that the Saliency Map was able to correctly identify the causes of the anomaly. It indeed indicates that the most important metric is \"storm.http.thread-pool.utilization.value\", which measures the thread pool utilization rate, which, as previously shown, steadily increased until reaching 100%, completely saturating the available resources. The second most important metric identified is \"storm.http.handler.dispatches.m1_rate\", which measures the rate of correctly managed dispatches relative to the total incoming dispatches. Like the previous metric, this one also showed a progressive increase until saturation, being a direct cause of the system's overall overload and subsequent crash. As for the \"storm.http.handler.5 xx-responses.m1_rate\" metric, which measures the rate of 5 xx responses (server errors), returned by the Saliency Map as the third most important, it represents an increase in server-side errors due to the inability to handle incoming requests, likely linked to the saturation of the thread pool and the increase in unmanaged dispatches, as an overloaded system cannot properly complete requests, resulting in 5 xx errors. These features are strongly related to each other and jointly influence the anomalous state of the system. Indeed, the increase in thread pool utilization is closely tied to the rise in the rate of correctly managed dispatches, as a growing number of requests to be processed led to an increasingly higher utilization of the thread pool until it reached full saturation. This overload prevented the system from properly handling incoming requests, causing an increase in 5 xx responses, which are server-side errors. In this anomalous scenario, the interdependence between these metrics is evident: the increase in dispatches to be managed saturates the thread pool, and this saturation directly results in the system's inability to complete requests, generating critical errors. \begin{table}
\begin{tabular}{c c} \hline \hline
**Metric** & **Aggregated Gradients** \\ \hline storm.http.thread-pool.utilization.value & 0.000650 \\ storm.http.handler.dispatches.m1\_rate & 0.000631 \\ storm.http.handler.5 xx-responses.m1\_rate & 0.000548 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Example anomaly—the 3 most important metrics for the Shallow Network for classification as an anomaly. Figure 7: Example anomaly—thread pool utilization. The results of the Saliency Map, which identify the anomalous state of the system, are also confirmed by an analysis on the LSTM, although some slightly different features were identified.