## 4 Results
### Comparison with Other Methods  
In this part, we compare the the proposed method with six one-class classification-based ETD methods. We implement all these methods on the preprocessed data for fair comparison. 1. OCSVM [35]: OCSVM is a support vector machine-based algorithm designed for anomaly detection. It distinguishes normal samples from anomalies by maximizing the margin between the data and the origin in the feature space. We set the kernel function and \(\
u\) parameters as 'linear' and 0.2, respectively;
2. ifForest [36]: iForest is an efficient unsupervised anomaly detection method leveraging random forests. It isolates anomalies by exploiting their tendency to be easier to separate from the majority of the data through random partitioning. We set the contamination, maxFeatures, and nEstim parameters as 0.1, 0.6, and 300, respectively;
3. LOF [37]: LOF is a density-based anomaly detection algorithm. It detects outliers by comparing the local density of a sample with the densities of its neighbors, identifying anomalies as points with significantly lower densities. We set the contamination rate as 0.1 while keeping other parameters as default;
4. Autoencoder with one-class (OC) classifier [26]: Reference [26] incorporates the concept of autoencoding and OC classification. We implement this method using CNN-AE(1D) as the autoencoder along with three OC classifiers. Figure 6 shows the confusion matrix of different methods. Based on the confusion matrix, we can calculate recall, FPR, precision, and F1 score using the formulas mentioned above. Table 5 presents the comparison results between our proposed method and six baseline methods, and the following findings can be observed: \begin{table}
\begin{tabular}{c c c} \hline \hline
**Hyper-Parameter** & **Range of Values** & **Optimal Value** \\ \hline k & 100, 200, 300 & 200 \\ contamination rate & 0.01, 0.1, 0.2 & 0.01 \\ distance metric & ‘manhattan’, ‘euclidean’ & ‘euclidean’ \\ d & 64, 128 & 128 \\ H & 8, 16 & 8 \\ N & 2, 3, 4 & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Selection of hyper-parameters. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Model for** & & & & & & **Metrics** & & \\ \cline{3-8}
**Unsupervised** & **OC Classifier** & & & & & **Model Size** & **Training** & **Prediction** \\
**Representation** & & **F1** & **AUC** & **Recall** & **FPR** & **(bytes)** & **Time (s)** & **Speed** \\ \hline \multirow{3}{*}{-} & OCSVM & 0.434 & 0.893 & 0.816 & 0.217 & & 0.54 & 50,076.87 \\  & iForest & - & - & - & - & - & 1.29 & 21,742.70 \\  & LOF & - & - & - & - & 0.97 & 24,930.60 \\ \hline \multirow{3}{*}{Autoencoder} & OCSVM & 0.477 & 0.917 & 0.890 & 0.209 & & 142.31 & 1761.15 \\  & iForest & 0.402 & 0.840 & 0.743 & 0.223 & \(0.17\times 10^{6}\) & 134.90 & 1881.23 \\  & LOF & 0.814 & 0.952 & 0.856 & 0.027 & & 133.89 & 1831.21 \\ \hline \multirow{3}{*}{Periodicformer} & OCSVM & 0.517 & 0.940 & 0.918 & 0.189 & & 725.39 & 155.04 \\  & iForest & 0.434 & 0.860 & 0.752 & 0.194 & \(3.11\times 10^{6}\) & 717.94 & 154.39 \\ \cline{1-1}  & LOF & 0.833 & 0.973 & 0.877 & 0.025 & & 716.93 & 151.32 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Performance of different methods. * Overall, the combination of the Periodicformer encoder and LOF achieved the best performance, with F1, AUC, recall, and FPR scores of 0.833, 0.973, 0.877, and 0.025, respectively. Compared to the second-best approach, the combination of autoencoder and LOF (F1, AUC, recall, and FPR scores of 0.814, 0.952, 0.856, and 0.027, respectively), it achieved improvements of 2.3%, 1.7%, 2.4%, and 8% in F1, AUC, recall, and FPR, respectively. * The three approaches that rely solely on the OC classifier exhibit relatively poor anomaly detection performance, with some even failing (defined as AUC or recall values below 0.5). This observation aligns with the findings reported in Reference [26]. This suggests that the one-class classifier fails to effectively capture the distribution of the data, which is a good approximation of the classification error.