## 3 Materials and Methods
### Data Pre-Processing and Feature Selection  
After identifying anomalous moments, the next phase involves defining and organizing the temporal windows used as input for the predictive model. The first decision made concerned the type of data to use. The available data have different granularities, defined based on the specific retention policy applied. There are four available retention policies, as described previously:  
* one_week, with data every 5 min and a retention period of one week;
* one_month, with data every 15 min and a retention period of one month;
* six_month, with data every 2 h and a retention period of six months;
* all_data, with data every 3 h and infinite retention. The best choice would be to adopt the \"one_week\" retention policy, which would allow for a higher granularity. With this choice, more detailed data could be obtained, collected more frequently and without intermediate processing such as averaging or similar operations, directly from the sensors. However, the available data are limited. Therefore, a compromise was sought between the Precision of the data and their quantity. It was decided to use the \"one_month\" retention policy, which allowed for a significant number of observations while maintaining reasonable Precision in the measurements, albeit averaged. This was considered the most sensible choice to have a meaningful number of data, as otherwise, the sample would have been too small to allow for effective and adequate analysis. An initial pre-processing of the data was then carried out, with the goal of better organizing the sensor data from the various CSV files obtained previously. Using a Python script that utilizes the Pandas library, the CSV files were manipulated to organize them into a more structured format, providing a clear view of the measurements  
Figure 4: Example case 1—anomaly visible via the “TPC pull success/error” metric, which represents the success or failure rate of data transfer operations using the TPC (Third-Party Copy) protocol. associated with each time point. Another important decision concerns the organization of time windows to be considered in a single observation. In fact, a single observation is not treated as an isolated time point but is considered as a time window composed of multiple time instances, to capture the evolution of the various metrics rather than a simple static snapshot of the moment. Therefore, it was decided to organize the data in three distinct modes, each characterized by a different time window size:  
1. Time window equal to 2: equivalent to observing the data from the 30 min preceding the anomalous time instant. 2. Time window equal to 3: equivalent to observing the data from the 45 min preceding the anomalous time instant. 3. Time window equal to 5: equivalent to observing the data from the 75 min preceding the anomalous time instant. Subsequently, a crucial phase was undertaken: the selection of the metrics to be used. The metrics were selected following an approach based on the analysis of their significance and redundancy. To this end, analyses were conducted among the various metrics using correlation matrices to identify those that were potentially redundant or uninformative. Metrics identified as such were removed to optimize the dataset and reduce noise in the data, while most of the metrics were retained, as no sufficient evidence or strong reasons emerged to justify their elimination, ensuring the most comprehensive dataset possible. A total of 32 metrics were selected. Specifically, 11 of these relate to CPU usage, addressing aspects such as the distribution of time spent by the processor on various activities, including time dedicated to system processes or user processes. Another 8 metrics focus on memory and system load, describing the total memory usage, cache, and buffer memory, as well as providing insights into the system's average load.