# An Interpretable Method for Anomaly Detection in Multivariate Time Series Predictions
## 3 Interpretable Method Design
### Detailed Design
Another characteristic is that, even if only attacking LIT-101, the consequences of the attack often extend beyond just one physical component. From Figure 2, it can be seen that downstream sensors (such as FIT-201) and actuators (such as MV-201) may be affected by attacks. Therefore, there is a certain correlation between the data changes in these components. These phenomena are not only present in the SWAT dataset but are also very common in other ICS datasets. Therefore, in the selection of important features, how to balance the independent and interactive effects of features is the key to accurately explaining the location of anomalies. When assessing the importance of features, we consider two aspects. On the one hand, it is the independent function of a single feature. In multivariate functions, gradients contain the partial derivatives of all independent variables, describing how the function changes with the variation in each independent variable. Introducing eigenvalues based on gradients can measure the contribution of features to model decision-making more accurately. Meanwhile, we only focus on determining the importance of features and do not pay attention to specific directions of influence. Therefore, when quantifying independent effects, Equation (3) is used for calculation. In the \(t\)-th iteration, the larger the \(1 nd\) value of the \(j\)-th dimensional feature, the more sensitive the model is to changes in that feature and the higher its importance. Finally, use Equation (4) to calculate the index \(j1^{*}_{1\sim k_{1}}\) of the \(k_{1}\) values with the greatest impact in the independent action. \[Ind(t)=abs\bigg{(}\frac{\partial D(X^{p};X^{*}(t))}{\partial X^{*j}(t)}\cdot X ^{*j}(t)\bigg{)} \tag{3}\]  
where \(X^{*j}(t)\) represents the data of the \(j\)-th dimensional feature in the \(t\)-th iteration. \[j1^{*}_{1\sim k_{1}}=\arg sort\bigg{(}{\sum_{n=1}^{L1}Ind_{n}(t)}\bigg{)}[:,k_{ 1}] \tag{4}\]  
On the other hand, it is also necessary to consider the interactions that are affected by the collateral effects after the attack. To comprehensively evaluate the cascading effects caused by attack behavior, we use KSG mutual information estimation [18] combined with  
Figure 2: Time sequence diagram of implementing attacks on LIT101. multivariate cross-correlation analysis to quantitatively evaluate the interactive effects of multidimensional temporal data within the same sliding window. KSG mutual information estimation is a non-parametric method based on k-nearest neighbors, which can maintain stable estimation performance in small-sample scenarios and is particularly suitable for revealing nonlinear dependencies between different dimensions of time series. The core calculation formula is shown in Equation (5):  
\[I\Big{(}X^{si};X^{\ast j}\Big{)}=\psi(K)+\psi(N)-\frac{1}{N}\sum_{l=1}^{N}\Big{[} \psi\Big{(}n_{l}^{i}+1\Big{)}+\psi\Big{(}n_{l}^{j}+1\Big{)}\Big{]} \tag{5}\]  
where \(K\) is the number of neighbors, \(n_{l}^{i}\) and \(n_{l}^{j}\), respectively, represent the number of neighborhood points in the \(X^{si}(t)\) and \(X^{\ast j}(t)\) subspaces, whose distance from the \(l\)th sample is less than the \(k\)-th nearest neighbor distance \(\epsilon_{l}\) in the joint space, \(N\) represents the number of samples, and \(\psi(\cdot)\) is the digamma function, defined as Equation (6):  
\[\psi(x)=\frac{d}{dx}\ln\Gamma(x) \tag{6}\]  
Multivariate cross-correlation analysis can capture time delay dependencies by calculating the linear correlation between two time series at different lag orders. The cross-correlation of time delay \(\tau\) for time series \(X^{si}\) and \(X^{\ast j}\) is shown in Equation (7):  
\[R(\tau)=\frac{\sum_{l}\Big{(}X_{l}^{\ast i}-\overline{X^{\ast i}}\Big{)}\Big{(} X_{l+\tau}^{\ast j}-\overline{X^{\ast j}}\Big{)}}{\sqrt{\sum_{l}\Big{(}X_{l}^{ \ast i}-\overline{X^{\ast i}}\Big{)}^{2}\sum_{l}\Big{(}X_{l+\tau}^{\ast j}- \overline{X^{\ast j}}\Big{)}^{2}}} \tag{7}\]  
where \(\tau\in[-\max\_lag,\max\_lag]\), and \(\max\_lag\) is the maximum lag order.