## 4 Performance Metrics for Anomaly and Attack Detection  
Finally, in this section, we describe performance metrics used for anomaly and attack detection. Precision, recall, and F-measure are the most used evaluation metrics. There is no specialized metric to measure the performance of anomaly detection methods. The listed metrics are classic for machine learning methods, on which most anomaly detection methods are based. However, we discovered that there are different approaches to calculating them [28; 49; 50]. This section reviews proposed approaches. Let us denote the time series signal observed from \(K\) sensors during time \(T\) as  
\[X=\{x_{1},\ldots,x_{T}\},x_{t}\in\mathbb{R}^{N}.\]  
The normalized signal is divided into a number of time windows:  
\[ \begin{array}{l}W=\{w_{1},\ldots,w_{T-h+\tau}\},\\ w_{t}=\{x_{t},\ldots,x_{t+h-\tau}\},\end{array} \]  
where \(h\)--window size, \(\tau\)--step length. The purpose of the time series anomaly detection method is to predict the binary label of the presence of an anomaly \(\big{\langle}\hat{y}_{t}\big{\rangle}\), either for individual \(X\) instances or for time windows \(W\). The labels are obtained by comparing the anomaly estimates \(A\) with a threshold \(\delta\). For the specific instances:  
\[\hat{y}_{t}=\left\{ \begin{array}{ll}1,&\text{if }A(x_{t})>\delta,\\ 0,&\text{otherwise.}\end{array} \right.\]  
For all windows in the test dataset:  
\[\hat{y}_{t}=\left\{ \begin{array}{ll}1,&\text{if }A(w_{t})>\delta,\\ 0,&\text{otherwise.}\end{array} \right.\]  
A set of test data may contain several sequences (segments) of anomalies within a certain period of time. Let us denote \(S\) as a set of \(M\) segments of anomalies:  
\[ \begin{array}{l}S=\{S_{1},\ldots,S_{M}\},\\ S_{m}=\{x_{t^{ms}},\ldots,x_{t^{me}}\},\end{array} \]  
where \(t^{ms}\) and \(t^{me}\) are the \(S_{m}\) starting and ending time, accordingly. Below, several approaches to calculate the performance metrics of anomaly detection are described. Point-wise calculation approachThe calculation of the performance metrics is implemented using separate records within the dataset [28; 49]. The calculation of precision (\(P\)), recall (\(R\)), and F-measure (\(F1\)) is implemented using all points within the dataset:  
\[P=\frac{TP}{TP+FP},\hskip 28.452756 ptR=\frac{TP}{TP+FN},\hskip 28.452756 ptF1=2 \times\frac{P\times R}{P+R},\] \begin{table}
\begin{tabular}{l c c c c c c c c c c} \hline \hline \multirow{2}{*}{**File**} & \multicolumn{2}{c}{**DT**} & \multicolumn{2}{c}{**KNN**} & \multicolumn{2}{c}{**RF**} & \multicolumn{2}{c}{**LR**} & \multicolumn{2}{c}{**NN**} \\ \cline{2-13}  & **F1, \%** & **ACC, \%** & **F1, \%** & **ACC, \%** & **F1, \%** & **ACC, \%** & **F1, \%** & **ACC, \%** & **F1, \%** & **ACC, \%** \\ \hline hai-20.07/test1.csv,gz & 99.00 & 99.85 & 86.42 & 98.28 & 99.67 & 99.95 & 80.88 & 97.73 & 96.70 & 99.50 \\ hai-20.07/test2.csv,gz & 99.48 & 99.92 & 94.93 & 99.30 & 99.76 & 99.96 & 97.29 & 99.60 & 99.30 & 99.90 \\ hai-21.03/test1.csv,gz & 98.61 & 99.91 & 93.39 & 99.59 & 99.31 & 99.95 & 90.10 & 99.43 & 49.57 & 98.29 \\ hai-21.03/test2.csv,gz & 97.60 & 99.73 & 98.98 & 99.89 & 99.92 & 99.95 & 74.99 & 98.03 & 88.52 & 98.76 \\ hai-21.03/test3.csv,gz & 99.38 & 99.96 & 99.61 & 99.61 & 99.38 & 99.96 & 90.96 & 99.53 & 72.23 & 98.76 \\ hai-21.03/test4.csv,gz & 99.45 & 99.94 & 99.56 & 99.52 & 99.67 & 99.96 & 99.22 & 99.91 & 49.25 & 97.05 \\ hai-21.03/test5.csv,gz & 98.26 & 99.84 & 92.72 & 99.38 & 99.30 & 99.94 & 81.30 & 98.63 & 49.39 & 97.59 \\ hai-22.04/test1.csv & 98.66 & 99.95 & 90.87 & 99.67 & 99.11 & 99.97 & 78.76 & 99.39 & 49.75 & 98.99 \\ hai-22.04/test2.csv & 97.85 & 99.70 & 89.80 & 98.73 & 99.39 & 99.92 & 72.80 & 97.46 & 49.07 & 96.34 \\ hai-22.04/test3.csv & 98.79 & 99.73 & 94.45 & 98.83 & 99.64 & 99.92 & 90.00 & 98.03 & 94.30 & 98.65 \\ hai-22.04/test4.csv & 98.38 & 99.78 & 88.26 & 98.65 & 99.45 & 99.93 & 62.88 & 97.02 & 49.12 & 96.53 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Result of evaluating classifiers on HAI dataset.