## 3 Proposed Method  
In this section, we introduce our proposed model that uses the combination of Bi-LSTM-WMCs and AE to detect anomalies based on the analysis of multivariate time series data. We first provide the overview of our proposed model based on the three steps of data preprocessing, the Bi-LSTM-WMCs-AE model, and anomaly detection. We also provide a detailed description of the algorithm our model uses in terms of training and testing phases. Step 1 : Data Preprocessing  
Similar to models based on traditional LSTM, our proposed model requires transforming the original input data into a format suitable for processing by LSTM units, specifically multiple time windows. Typically, a complete multivariate time series is represented as a 2D array comprising \(n\)\(m\)-dimensional vectors, where \(n\) represents the total number of time points, and \(m\) denotes the number of variables in the time series. Since LSTM models  
Figure 2: A working memory connection for LSTM structure. process data in multiple time windows, each represented as a 2D array, the number of time points in a single window, referred to as the window size ((\(t\)), determines the time steps the model considers for decision-making. To preprocess the data, a sliding window approach with a fixed size \((t\times m)\) is applied, shifting the window by one time point at each step. This process transforms the original 2D array into \((n-t+1)\) stacked 2D arrays, each with dimensions \((t\times m)\), representing the sequence of time windows. Figure 3 illustrates the details of the data preprocessing workflow. Step 2: Online Training  
In this step, the traditional LSTM units in the Bi-LSTM-AE network, a model widely employed in existing studies, are replaced with bidirectional LSTM-WMC units to enhance the ability to capture temporal dependencies in multivariate time series data. The Autoencoder comprises an encoder and a decoder, each consisting of two layers. The outer layer contains 64 Bi-LSTM-WMC units, while the inner layer includes half as many units as the outer layer. The decoder reconstructs the input data, and the model is trained by minimizing the reconstruction error between the original input and its reconstruction. Upon completing the training, the reconstruction errors of the training data are calculated and used to establish the threshold for anomaly detection in subsequent steps. Figure 4 illustrates the general flow of our proposed model. Figure 5 illustrates the details of Bi-LSTM-WMCs cell in the model. Step 3: Offline Detection  
In this study, \"normal\" events are defined as patterns or behaviors in the data that reflect expected or typical operational conditions, while \"anomalies\" are deviations from these patterns, potentially indicating faults, errors, or unexpected behaviors. The definitions of \"normal\" and \"anomalies\" are dataset-specific. A detailed explanation of what constitutes \"normal\" and \"anomalies\" will be provided when each dataset is introduced. Figure 3: Example of data pre-processing divided into time windows. The red squares indicate the sliding windows applied during the preprocessing step. An observation that deviates from the majority of the data might be referred to as an anomaly [29]. Prior to the anomaly detection phase, a threshold for distinguishing between normal and anomalous instances must first be established. Similar to traditional AE-based approaches, we use the absolute difference between the input data and the reconstructed data as the reconstruction error. However, it is important to note that since we are dealing with multivariate time series data, both the input and the reconstructed output of our model are three-dimensional arrays, where each time window is represented as a two-dimensional array. Each time point in the original dataset appears in multiple time windows. Therefore, to calculate the final reconstruction error for each time point, we sum all reconstruction errors for that time point and divide by the total number of time windows in which that time point appears.