# An Interpretable Method for Anomaly Detection in Multivariate Time Series Predictions
## 3 Interpretable Method Design
### Detailed Design  
Suppose the data we use includes actual abnormal data \(X^{o}=\{x_{1}^{o},\cdots,x_{L1}^{o},x_{L1+L2}^{o}\}\), consisting of \(L_{1}\) historical sequence of data \(x_{1}^{o},\cdots,x_{L1}^{o}\) and a predicted data point \(x_{L1+L2}^{o}\). The optimized data is \(X^{*}=\{x_{1}^{*},\cdots,x_{L1}^{*},x_{L1+L2}^{*}\}\), where \(L_{1}\) and \(L_{2}\) are the length of the historical sequence and the length of the future time series, respectively. \(x_{l}^{o}\) represents the anomaly of the \(l\)th time step, and \(x_{l}^{*}\) represents the optimized \"normal value\" of the \(l\)th time step. (1) Design of optimization function  
When abnormal behavior is detected, the system activates the interpreter and iteratively optimizes the algorithm to find a normal reference value \(X^{*}\). This also means that, after \(X^{*}\) is trained with a deep learning anomaly detection model, its detection result is judged as a normal value, which satisfies the normal decision boundary of the detection model, as expressed in inequality (1):  
\[\varepsilon_{p}\big{(}X^{*},f_{p}(X^{*})\big{)}<TH \tag{1}\]  
where \(\varepsilon_{p}(\cdot)\) represents the error function, \(f_{p}(\cdot)\) represents the predicted value of the deep learning anomaly detection model, and \(TH\) is the threshold. However, when searching for the normal value \(X^{*}\), the value of \(\varepsilon_{p}\big{(}X^{*},f_{p}(X^{*})\big{)}\) does not need to be infinitely minimized as long as the predicted value of anomaly detection can reach the decision boundary of anomaly detection. Therefore, \(\varepsilon_{p}\big{(}X^{*},f_{p}(X^{*})\big{)}\) can be constrained within the decision boundary range by using the RELU function. To ensure that \(X^{*}\) is on the normal data side of the decision boundary, a small value \(\varepsilon\) can be subtracted from \(TH\), represented by \(RELU\big{(}\varepsilon_{p}\big{(}X^{*},f_{p}(X^{*})\big{)}-(TH-\varepsilon) \big{)}\). Meanwhile, we hope that the optimized normal data can be as similar as possible to the predicted data. Therefore, we use the original anomaly detection prediction model to predict abnormal data, calculate the predicted value x, and introduce the Euclidean distance between normal data and predicted data to the optimization function. The final optimization function is shown in Equation (2). For the convenience of subsequent description, we will abbreviate the objective function as \(D(X^{p};X^{*})\). \[X^{*}=\arg\min_{X^{*}}RELU\big{(}\varepsilon_{p}\big{(}X^{*},f_{p}(X^{*}) \big{)}-(TH-\varepsilon)\big{)}+\lambda\frac{1}{N}\|X^{*}-X^{p}\|_{2} \tag{2}\]  
(2) Selection of important features  
In existing interpretable methods based on gradient optimization, it is often assumed that features are independent of each other. However, in ICS, this assumption is often difficult to establish. The physical component data of industrial control terminals usually includes two categories: data from sensors and data from actuators. A sensor is a device that can detect and respond to physical or chemical changes in the environment, typically used to measure various parameters such as temperature, pressure, flow rate, liquid level, etc. The actuator usually receives signals from the control system (such as PLC and microcontroller) and executes corresponding actions based on these signals. Figure 1: Overall framework of the proposed interpretable method. When attacking these physical components, a significant phenomenon will occur; i.e., the trend of the temporal waveform changes is significantly different from the normal mode. For example, Figure 2 shows the timing waveform diagram of the relevant components during the attack on the liquid level transmitter LIT-101 in the SWAT dataset. The attack caused the water tank to overflow by shutting down pump P-101 and manipulating the value of LIT-101 to remain at 700 millimeters. In the red area, the curve of LIT-101 deviates significantly from the normal state.