# Software Operation Anomalies Diagnosis Method Based on a Multiple Time Windows Mixed Model
## 5 Result and Discussion
### Impact of Different Time Windows on Model Selection
The combination of multiple time windows effectively mitigates the impact of randomness associated with a single time window. However, it is important to note that determining whether a larger time window is superior is not possible to conclude definitively. In datasets such as twitter and other non-cumulative data anomalies (as shown in Appendix A), employing too many time windows may not align with the actual distribution of anomalies, leading to algorithmic judgment issues. Therefore, for practical purposes, we recommend limiting the selection of time windows based on the number of actual data anomalies. Generally, it is optimal to set the time window to no more than 1.5 times the size of the actual anomaly area. This approach ensures a more accurate assessment of anomalies while avoiding potential judgment problems caused by excessive time window combinations. Figure 8: Distribution of anomalies with a time window of 60 for SKAB dataset. Figure 7: (**a**) Distribution of anomalies with a time window of 40 for SKAB dataset; (**b**) Distribution of anomalies with a time window of 50 for SKAB dataset. Figures 9-12 depict the classification of anomalous labels under different time windows of the occu dataset. Table A4 presents the detectors selected by our algorithm with comparable performance under different time windows and the preferred detectors when combining multiple time windows. \begin{table}
\begin{tabular}{c c} \hline \hline
**Size of Time Windows** & **Detector of Choice** \\ \hline
2 & LOF, VAE, AutoEncoder, CBLOF, KNN, PCA \\
10 & LOF, OCSVM, VAE, AutoEncoder, CBLOF, COF, KNN, PCA \\
20 & HBOS, OCSVM, IFOREST, VAE, AutoEncoder, CBLOF, PCA \\
30 & IFOREST, VAE, AutoEncoder, PCA \\
40 & VAE, AutoEncoder \\
50 & VAE, AutoEncoder, PCA \\
60 & SO\_GAAL, VAE, AutoEncoder, CBLOF \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Algorithm selection results under different time windows. Figure 10: (**a**) Distribution of anomalies with a time window of 20 for occu dataset; (**b**) Distribution of anomalies with a time window of 30 for occu dataset. \begin{table}
\begin{tabular}{c c} \hline \hline
**Time Widow Combination** & **Detector of Choice** \\ \hline
2-10 & LOF, VAE, AutoEncoder, CBLOF, KNN, PCA \\
2-20 & LOF, VAE, AutoEncoder, CBLOF, PCA \\
2-30 & LOF, VAE, AutoEncoder, PCA \\
2-40 & VAE, AutoEncoder, PCA \\
2-50 & VAE, AutoEncoder, PCA \\
2-60 & VAE, AutoEncoder, PCA \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Algorithm selection results under different Time Window Combination. Figure 9: (**a**) Distribution of anomalies with a time window of two for occu dataset; (**b**) Distribution of anomalies with a time window of ten for occu dataset. As observed in Figures 9-12, the distribution of anomalies in the occu dataset is limited, and these anomalies occur for a short duration. When the time window is small, detectors such as HBOS, OCSVM, IFOREST, CBLOF, KNN, and PCA can effectively identify these anomalies. However, as the time window increases, the accuracy of these detectors starts to decline, leading to a concentration of errors on certain common points, which results in misreported anomalies. Consequently, our method remains relatively stable regardless of changes in the time window, and different combinations of time windows do not significantly affect the preferred model's outcomes. This is also evident from Table 8. Although our method successfully selects a few anomaly detectors that perform well, this could be attributed to chance or the specific selection of basic detectors. Our analysis suggests that this observation may be related to the characteristics of the occu dataset. All datasets from this data source are one-dimensional and exhibit a discrete distribution of anomalies. A similar pattern can be observed in the speed and twitter datasets, as outlined in Appendix A. Upon further examination of the results, when some of the underlying anomaly detectors correctly identify similar anomalies, our method can identify these detectors with similar detection results.