## 4 Discussion
(**e**) High UCR- but low F1 score indicates the correct detection of the true anomaly by the highest anomaly score but a bad threshold value leading to an increased number of false positives. (**f**) Low AUC ROC, F1- and UCR scores indicate an insufficient anomaly score not detecting the true anomaly. The best results in terms of F1 score and UCR score are obtained by MDI and MERLIN, with MERLIN having a slightly higher F1 score and MDI scoring slightly higher in terms of UCR score. The differences between these two methods are around 0.02. This difference in F1 score is likely due to the different methods used to choose the threshold. Both methods return a score only for the detected anomalous sequences, but MDI either requires the number of anomalies to be returned or may return a score for up to every subsequence. In order to not give MDI an advantage over its competitors, the latter option was chosen and a threshold was determined using the POT method instead of the minimum anomaly score, as was the case for MERLIN. This makes MDI more prone to detecting false positives in the described setup compared to MERLIN, which only returns the subsequences that have been detected as anomalous. RRCF performs poorly in terms of F1 score and UCR score, which may be due to its mechanism for isolating single points and its focus on point anomalies. Among the deep-learning methods, GANF demonstrates the best performance. GANF achieves the highest scores for all three metrics and detects the largest variety of anomaly types. The results for AE and TranAD are mixed. AE has a higher AUC ROC and UCR score, but it only detects two different anomaly types with a UCR score above 0.5. TranAD, in contrast, has a slightly higher F1 score when compared to AE and detects three different anomaly types. Despite the low results for RRCF, the classical machine-learning methods show superior performance compared to the deep-learning methods when aggregating the results by method class, as shown in Figure 5. This difference is particularly notable in the F1 score. One assumption might be that these methods perform better in unsupervised settings that do not require a training phase. However, this is contradicted by the RRCF results. In terms of runtime, MERLIN has the longest average processing time of 291 s per time series. This runtime is mainly determined by the discord discovery algorithm that is called for every subsequence length \(L_{i}\in\{L_{min},\ldots,L_{max}\}\). The complexity of this algorithm is quadratic with respect to the size of the set of potential discords, which is determined in the candidate selection phase. However, for small candidate sets produced by a \"good\" choice for the parameter \(r\)[11], the complexity becomes effectively linear. As MERLIN starts with the highest possible value for \(r\) and decreases it, it is unlikely to encounter a case in which a small \(r\) value causes the candidate subset to become too large. On the other hand,  
Figure 11: Two different reasons for low F1 scores—**(a)** shows a result from MDI, **(b)** shows a result from TranAD. **(a)** Low F1 score caused by false positive results due to the length of the correct detected anomaly. **(b)** Low F1 score caused by false positive results due to a poor threshold. Figure 12: Two different reasons for low F1 scores. Both results are from RRCF. **(a)** The anomaly is detected slightly after the ground truth label but within the 100 time steps tolerance for short anomalies in the UCR score. **(b)** The detected anomaly is shorter than the ground truth label causing false negatives in the computation of the F1 score. MDI uses a subsequence proposal technique based on [PERSON]'s \(T^{2}\) method [31], which selects interesting subsequences based on point anomaly scores rather than performing full scans of the data. In addition to these differences in candidate subsequence selection, the specific implementations of the algorithms also have a significant impact on their runtime.