## 4 Case Study
Since the SMAP and MSL datasets contain multiple entities, each with corresponding training and testing data, we train and test each entity separately. Figure 7 shows the visualization of a subset of variables from the SMAP dataset (D-1). Figure 8 shows the visualization of a subset of variables from the MSL dataset (F-5). As in Figure 6, the red regions in the figure are labeled as anomalies. We employ the commonly used F1-score as the benchmark for evaluating model performance. To assess the efficacy of our proposed model, we compared it with state-of-the-art models including Recurrent Neural Networks-Autoencoder (RNN-AE), LSTM-AE, LSTM-WMCs-AE, and Bi-LSTM-AE. The construction and parameters of all models are kept consistent with our proposed model. Additionally, we conducted extensive performance comparisons using different threshold values, with \(\alpha\) ranging from 0 to 0.1 in increments of 0.01. To further assess the suitability of our proposed model for diverse requirements, we experimented with various time window sizes. This approach aims to determine the scenarios in which our model demonstrates significant advantages. Figure 6: Visualization of a portion of the training data and one of the test datasets. For the SKAB dataset, we performed these comparisons as described above. However, for the other two datasets, due to space constraints, we selected the optimal time window size after multiple adjustments and compared the model's performance at \(\alpha\) values of 0.01, 0.05, and 0.1. The calculation of F1-score is expressed using the following equations:  
\[\text{Precision}=\frac{TP}{TP+FP} \tag{13}\]  
\[\text{Recall}=\frac{TP}{TP+FN} \tag{14}\]  
\[\text{F1-Score}=2\times\frac{\text{Precision}\times\text{Recall}}{\text{ Precision}+\text{Recall}} \tag{15}\]  
Here, TP (True Positive) refers to the count of accurately identified anomalies, TN (True Negative) refers to the count of correctly identified normal events, FP (False Positive) indicates the count of normal events that were inaccurately diagnosed as anomalies, while FN (False Negative) denotes the count of anomalies that were incorrectly identified as anomalies. Figure 8: Visualization of a subset of variables from the MSL dataset (F-5). Figure 7: Visualization of a subset of variables from the SMAP dataset (D-1). normal events. Using Equations (13)-(15), we computed the performance of each model under various \(\alpha\) values and time window sizes. Figure 9 illustrates the comparison of model performance across different time window sizes on the SKAB dataset. Table 2 presents the comparisons of model performance for four entities from the SMAP dataset. Table 3 shows the performance of the model on the MSL dataset. In this context, the varying \(\alpha\) values determine the sensitivity thresholds for anomaly detection. To assess the feasibility of the proposed anomaly detection model in real-world scenarios, we conducted comparative experiments to evaluate the training time and detection time of various models across different datasets. Figure 10 illustrates the training time of each model for different datasets, while Figure 11 presents the time required for anomaly detection. Notably, our model utilizes a time window of size \((t\times m)\) as input, meaning that an increase in the number of time points within a time window \((t)\) or the number of variables in the data \((m)\) inevitably increases computational complexity. This, in turn, necessitates longer training and fitting times. For example, in the SKAB dataset, when the time window size \((t)\) is increased to 40, the training time for our proposed model is considerably longer than that of the baseline model. Although it increases complexity, it results in superior performance compared to the baseline model. Figure 9: F1-score comparison for different window size (t) values and \(\alpha\). (**a**)–(**c**) represent window size (t) = 5 for 3 test datasets, (**d**)–(**f**) represent window size (t) = 25 and (**g**)–(**i**) represent window size (t) = 40.