## 5 Case Study
### Parametric Causality Inference and Anomaly Detection on a Real Satellite Telemetry Dataset
#### 5.2.4 Results and Discussion  
Figures 12-15 show the multi-tier thresholds setting and anomaly detection result of the four target parameters using DCDSPOT. Table 5 shows the precision, recall, F1-score, and running time of DCDSPOT and the baseline methods. Our method and similarity-based methods and other statistical model-based methods. It can be concluded that the recall and F1-score of the DCDSPOT method are significantly higher than those of the baseline methods of 3\(\sigma\), LOF, OCSVM, Isolation Forest, biSPOT, and biDSPOT. However, DCDSPOT takes a longer running time compared with them. The reason why DCDSPOT has a higher recall rate (lower false negative rate) is that it fully considers all other factors in the telemetry system that have a significant impact on target detection parameters. Moreover, our method determines anomalies by taking the propagation effects of anomalous data patterns into consideration. For example, items 3371-4431 of parameter D are anomalies, but it is difficult to detect them merely based on the data of the target parameter (which can be achieved by setting lower risk parameters, but there will be many false positives). However, these anomalies can be determined by analyzing D and D's weighted source parameter. All in all, by setting multiple thresholds \begin{table}
\begin{tabular}{c c c} \hline \hline
**Target Parameter** & **Source Parameters** & **Maximum Causal Time Lags** \\ \hline A & B, M, S & 1,1,1 \\ B & A, M, S & 5,3,5 \\ C & F, I, T & 1,3,1 \\ D & A, Q, S & 4,1,1 \\ E & B, O & 5,1 \\ F & C & 1 \\ G & C, F & 5,3 \\ I & B, F, S, T & 2,5,2,1 \\ J & N & 1 \\ M & A, F & 1,3 \\ O & A, E, M, Q & 2,1,4,4 \\ P & A, E, O & 1,2,5 \\ Q & D, O, S & 1,2,1 \\ R & H & 1 \\ S & A, B, M & 2,1,2 \\ T & C, F, I & 1,1,1 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Target parameters and corresponding source parameters with maximum causal time lags. and comprehensively analyzing the weighted source parameters and target parameter, DCDSPOT can effectively reduce false positives and false negatives. Our method and prediction model-based methods. Anomaly detection based on prediction models has lower precision and recall than our method, which is mainly due to the error of the prediction models. In addition, they are more time-consuming because a good prediction model requires multiple epoch of iterations. Another shortcoming of anomaly detection methods based on prediction model is that they may learn anomalous patterns after encountering anomalies with a long duration, which makes the model no longer sensitive to anomalies (see the anomaly detection of parameter T). By contrast, DCDSPOT has higher recall and F1-score than anomaly detection methods based on prediction models, and it can better identify long sequential anomalies. Precision of our method. Compared with some baseline methods, DCDSPOT has lower precision. The reason is that in order to reduce false negatives as much as possible, the multi-tier risk parameters need to be set lower, which will inevitably lead to more false positives (lower precision). However, the degree of recall improvement is much higher than that of precision reduction, so the F1-score is improved significantly. The F1-score is a comprehensive metric of anomaly detection, and it is also the metric we pay more attention to. Comparison of detection time complexity using PWM and MLE. Furthermore, to improve the performance of time complexity of DCDSPOT, we replace Grimshaw trick based MLE with PWM to estimate the parameters of GPD and to set the thresholds. It can be seen from Table 6 that the detection performance of DCDSPOT using PWM and DCDSPOT using MLE is not much different, but that the running time is shortened by 4-5 times, which proves that the method we proposed is efficient in reducing time complexity. Figure 12: Thresholds setting and detection result of B by DCDSPOT.