## 4 Results
### Saliency Map for Key Feature Identification  
In Anomaly Detection contexts, it is particularly useful not only to be alerted to the onset of a potential anomaly but also to obtain information about the nature of the anomalies within the system and understand the cause of the problem generating them. This type of information can be crucial: being notified of an anomaly and having indications of what is causing it is essential for timely intervention and preventing potential damage or service interruptions. In particular, a domain expert could greatly benefit from receiving insights into the nature of the problem, as they would be able to interpret the system's signals more accurately and quickly and identify the causes of the anomalous behavior. For this purpose, one of the most useful tools is represented by Saliency Maps [55]. These significantly improve the interpretability of machine learning models, particularly neural networks, which are often considered \"black boxes\" due to their complexity and the large number of parameters involved, making it difficult to understand which factors most influence the model's decisions. Saliency Maps overcome this obstacle by providing a representation of the importance of the different features in predicting a specific output. The concept behind Saliency Maps is based on gradient analysis to highlight the importance of features with respect to the model's output. In practice, this involves calculating the gradient of the output with respect to the input, determining how small variations in the features influence the output. For neural networks, this is equivalent to calculating the partial derivative of the output with respect to each input feature, providing a measure of each feature's impact on the prediction. Features with a greater absolute gradient value are considered more relevant, as small variations in these characteristics cause significant changes in the output. Saliency Maps, therefore, help identify the most critical features in the model's prediction, providing a clear representation of what the model focused on to make its decision. It is possible to observe the benefits of this technique in the example case shown in Figure 5, where an anomaly in the WebDAV service is detected using the \"TPC pull success/error\" metric. The anomaly in question was examined by analyzing the metrics displayed on the INFN-CNAF dashboard in order to understand its causes and identify the reason for the detected anomalous behavior. Observing the metrics on the dashboard for the time period associated with the identified anomaly, illustrated in Figure 5, it becomes evident that the anomaly originated from an increase in active dispatch requests to manage, as shown in Figure 6. An increase in active dispatches indicates a rise in the number of requests that the system must assign to various processes or computation nodes for processing. The sudden and consistent increase in these requests gradually saturated the system's resources, preventing it from effectively handling the workload. Consequently, a critical overload occurred, leading to a temporary shutdown, interrupting services and preventing the system from responding correctly to future requests. In Figure 6, the moment when the system reached saturation and caused a crash or temporary shutdown is highlighted with a red circle. This coincides with the last time we received data from the metric measuring the TPC pull success/error requests, shown in Figure 5. A blue circle also highlights the point when the system was restarted and resumed normal operation. This overload is confirmed by observing another metric, namely, the thread pool utilization, as shown in Figure 7. Indeed, the graph clearly shows a gradual and consistent increase in thread pool utilization, starting from about 20% and reaching 100%, indicating full saturation of the available computational resources.