## 4 Example
### Telemetry Data Anomaly Detection Experiment
#### 4.3.2 Discussion of Experimental Results  
Before we delve into the discussion, we would first like to introduce some specifics of the threshold-based method. The method, currently widely adopted for anomaly detection in spacecraft ground management, is based on setting thresholds for each telemetry parameter. It is only when a parameter surpasses its threshold that the anomaly detection system can identify an anomaly. Presently, a substantial amount of telemetry data are stored in the database, with many anomalies still unknown to the management personnel. Spacecraft management staff regularly clean and check the data, typically discovering anomalies only after they have occurred for a certain duration. The currently adopted threshold-based method considers that the system has a total of six modes, namely three-axis stable earth flight mode, yaw maneuver flight mode, earth-to-yaw mode, yaw-to-earth mode, orbit control mode, and anomaly. The threshold-based method defines the maximum and minimum values for each telemetry parameter in the five normal modes, excluding the anomaly. It conducts anomaly detection based on the upper and lower limits of telemetry parameters in each mode. Although this method is simple and efficient, many anomalies do not cause telemetry signals to exceed their limits when they occur. We applied a clustering algorithm to further subdivide the data of these five normal modes, extracting over 300 sets of feature data. This approach allows us to further refine the data distribution under each mode compared to the few data modes divided by the  
Figure 18: Clustering result visualization example. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Metric** & **Threshold-Based Method** & **Method in This Paper** \\ \hline Precision & 65\% & 95\% \\ Correctly Identified & 39 & 57 \\ False Alarms & 17 & 1 \\ Missed Alarms & 4 & 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Detection result comparison. original threshold method. Consequently, the accuracy of our anomaly detection algorithm has been further improved. Of note, 16 false alarms were generated using the threshold method. This occurred because management staff attempted to increase the sensitivity of the old threshold-based detection method by narrowing the threshold range based on their manual monitoring experience. However, they overlooked the sudden changes in some telemetry parameters during spacecraft equipment mode switches or under certain special modes, as shown in the Figure 19. After summarizing these anomalies, the managers realized that they exhibited similar patterns and classified these situations as false alarms. The proposed method was able to resolve these 16 situations. This is because the process of constructing the feature data of the normal state using this method has already included the sudden changes in parameters brought about by the spacecraft mode transitions. Therefore, these false alarms have been resolved. The one false alarm that this method did not solve was due to the shift in the distribution of telemetry data under a certain operating mode as the working time of the spacecraft equipment became longer. There was a significant time gap between the feature extraction and the subsequent collection of test data. This also indicates that the feature data in the knowledge graph is subject to temporal limitations. The knowledge graph needs to be updated timely with feature data to adapt to the operating conditions at different stages of the spacecraft's lifecycle. While our approach was successful in detecting anomalies in most of the test cases, it failed to identify exceptions in some specific situations. In particular, two anomalies in our test set were not detected. These two missed cases share a common characteristic: the range of distribution of the anomalous data points was relatively small compared to the reference data. This could have made it challenging for the DBSCAN clustering algorithm to distinguish these anomalous data points from the normal ones.