# An Interpretable Method for Anomaly Detection in Multivariate Time Series Predictions
## 4 Experiments  
### Parameter Settings  
We used SWAT and WADI datasets for testing. In the model interpretation stage, we directly use the complete dataset containing anomalies as the test set for evaluation, where the sample sizes of SWAT and WADI datasets are 449,919 and 172,801, respectively. The data preprocessing method is the same as in our previous work [19]. The anomaly detection model to be explained adopts the sub-models of Group 1 trained on the SWAT dataset and Group 2 trained on the WADI dataset in [19]. The interpreter uses the Adam optimizer. We use the random grid search method, combined with three indicators: label flipping rate, successfully identified attack feature rate, and explain success rate, to determine the optimal combination of hyperparameters. (1) Label Flipping Rate (\(LFR\)) [16]: It represents the rate at which abnormal data becomes normal after optimization iterations. The higher the value, the more accurate it will be to identify the important features that cause anomalies. The calculation formula is shown in Equation (13). \[LFR=\frac{\text{Number of abnormal samples that become normal after iterated optimization}}{\text{Number of abnormal samples that need to be explained}}*100\% \tag{13}\]  
(2) Successfully Identified Attack Feature Rate (\(SAR\)): It represents the ratio of the number of successfully identified attack features to the number of anomalous samples that need to be explained. The higher the value, the greater the probability of locating the anomalies. The calculation formula is shown in Equation (14). \[SAR=\frac{\text{Number of successfully identified attack features}}{\text{Number of abnormal samples that need to be explained}}*100\% \tag{14}\]  
(3) Explain Successful Rate (\(ESR\)): It represents the ratio of the number of samples that can accurately predict abnormal trends to the number of abnormal samples that need to be explained. The higher the proportion, the better the interpretation effect. The calculation formula is shown in Equation (15). \[ESR=\frac{\text{Number of samples that can accurately predict abnormal trends}}{\text{Number of abnormal samples that need to be explained}}*100\% \tag{15}\]  
In this section, we take the SWAT dataset as an example to illustrate the method of parameter selection. Using the random grid search method, we preliminarily determine that the learning rate is 0.1, \(th\) is 0.7, the maximum number of iterations is 100, and \(\epsilon\) is 0.005, \(\lambda=0.001\), \(K=3\), \(\text{max\_lag}=25\), and \(w=0.9\). To determine the values of \(k_{0}\), \(k_{1}\), and \(k_{2}\), we conduct the following experiments. When \(k_{0}=2\), the values of \(k_{1}\) are 5, 7, and 9, respectively, As the value of \(k_{2}\) gradually decreases to 40%, 30%, 20%, and 10% of the total dimension, respectively, the changes in \(SAR\) and \(ESR\) are shown in Figure 2(a),b. As can be seen from Figure 2(a), when the value of \(k_{1}\) is set to be 7, the value of \(ESR\) is slightly better than the cases of \(k_{1}=5\) and \(k_{1}=9\). As can be seen from Figure 2(b), the value of \(k_{1}\) has little effect on the value of \(SAR\). As the feature dimension is preserved more, the value of \(SAR\) becomes slightly higher. At the same time, it can also be observed that, when the value of \(k_{2}\) is 20-40% of the total dimension, the \(SAR\) indicator value changes little, and the excessive dimension of \(k_{2}\) may cause greater difficulties for management personnel in identifying attack points. Therefore, after comprehensive consideration, it is recommended to keep the dimension of \(k_{2}\) at around 30% of the total dimension, that is, \(k_{2}=4\). As a result, the values of \(k_{1}\) and \(k_{2}\) can be initially set to 7 and 4, respectively. At this time, the \(SAR\) and \(ESR\) values are 96.73% and 65.05%, respectively. This result is considered a more appropriate choice. When \(k_{2}\) is set to 4, the value of \(k_{1}\) decreases to 60%, 50%, 40%, 30%, and 20% of the total dimension, respectively.