## 5 Conclusions  
In this study, the problem of Anomaly Detection in IT systems, specifically in a WebDAV service, has been addressed using a wide range of machine learning models, ranging from simpler architectures like the Single-Layer Perceptron to more complex models like Long Short-Term Memory (LSTM). The main objective of this study was to identify anomalies in time series data obtained from the service's sensors, tackling challenges such as the imbalanced nature of datasets and the need to capture temporal and spatial dependencies between the analyzed variables. The analyses clearly showed that while simpler models like the Single-Layer Perceptron offer a useful starting point for data exploration, they are not powerful enough to capture the complexities present in datasets that require accurate modeling of temporal \begin{table}
\begin{tabular}{c c} \hline \hline
**Metric** & **Aggregated Gradients** \\ \hline storm.http.handler.dispatches.m1\_rate & 0.020014 \\ storm.webdav.TPC.pull.ok-count.count & 0.013780 \\ load\_avg.fifteen & 0.009287 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Example anomaly—the 3 most important metrics for the LSTM for classification as an anomaly. dependencies. More advanced models like LSTMs proved to be much more effective, thanks to their ability to handle temporal relationships in sequential data. A crucial aspect that influenced the success of the models was hyperparameter tuning. Through random search and grid search processes, configurations such as the loss function, optimizer, learning rate, and, for LSTMs, the number of layers and the number of units per layer were optimized. This significantly improved the model's performance by reducing overfitting and maximizing generalization capacity. In particular, the use of a combined loss function between Binary Cross-Entropy and F1-Score proved particularly useful for our task. While the best models demonstrate promising predictive capabilities in terms of Precision and Recall, there is significant room for improvement. Two key limitations are identified: the limited amount of anomalous data and the granularity of the available data. The dataset is highly imbalanced, and while techniques like sample replication and weighted loss functions were applied, they were insufficient for achieving full generalization. Increasing the amount of anomalous data would enhance the model's ability to learn their distinguishing characteristics. Additionally, the 15 min sampling interval, resulting from downsampling higher-resolution data, may obscure critical details. This loss of granularity can mask subtle patterns and sudden peaks, reducing the model's ability to detect short-term anomalies. A higher temporal resolution would provide a more accurate representation of the system's behavior, improving the model's ability to identify and respond to anomalies effectively. In conclusion, the work presented shows how the use of machine learning techniques can provide an effective and automated method for predicting anomalies in complex IT systems, enabling continuous monitoring and prompt response to unexpected changes in system metrics. The adopted approach has proven useful in identifying anomalous patterns that would otherwise be difficult to detect with traditional manual analysis methods, requiring constant metric monitoring by domain experts. This work provides a solid foundation for future developments, which could benefit from more complete and detailed data, further improving model performance and strengthening anomaly prediction capabilities in a more precise and reliable manner. Conceptualization, D.C. and E.R. ; methodology, A.A., G.R. and E.R. ; software, G.R. ; validation G.R. ; investigation, G.R. ; resources, D.C.; data curation, D.C. and G.R. ; writing A.A., G.R., D.C. and E.R. ; supervision, A.A., D.C. and E.R. All authors have read and agreed to the published version of the manuscript.