## 1 Introduction
This challenge is particularly pronounced in large-scale systems like distributed data centers, where efficient and reliable management of computational and storage resources is essential. Proactively addressing anomalies in these environments helps prevent potentially harmful events, such as cyberattacks or security breaches [23; 24]. One of the major challenges in anomaly prediction lies in the sparsity of data: systems generally operate in a healthy mode, with their normal behavior adhering to expected patterns and exhibiting few significant deviations. This scarcity of anomalous events limits the availability of labeled data, which is crucial for training and validating predictive models. Furthermore, different domains often exhibit unique characteristics and constraints, such as uni-modal versus multi-modal data [25; 26], spatio-temporal dependencies [27; 28], single versus compound faults [29; 30], and varying scales or patterns of anomalies. These domain-specific variations exacerbate the difficulty of developing models that are both generalizable and effective across diverse contexts. The work presented in this article focuses on adopting a machine learning-based approach to predict anomalies within an INFN-CNAF WebDAV service starting from a time series dataset comprising various system metrics, such as CPU usage, memory, and network traffic. The WebDAV service is implemented exploiting the StoRM-WebDAV tool [31; 32] developed at INFN-CNAF and deployed in multiple instances to serve the data management requirements of the scientific communities accessing the data center. In the following, the INFN-CNAF WebDAV service always refers to the StoRM WebDAV service. Preliminary investigations identified a single major type of anomaly that caused the monitoring system to fail in collecting data, indicating a system malfunction. Our research focuses on predicting this specific anomaly with the aim of enabling proactive prevention. Various models were tested to identify the one most suited to the context, also exploring optimal configurations to maximize their effectiveness. Furthermore, it has been shown that, with the aid of additional techniques, it is possible to improve the interpretability of the results, obtaining valuable insights into the potential causes of the detected anomalies. This aspect is particularly important in critical operational contexts, such as data centers, where a deep understanding of anomalies enables timely intervention to prevent malfunctions, reduce downtime, and minimize the risk of system crashes, thereby ensuring stable and reliable operation. The work is organized as follows: Section 2 delves into the state of the art in anomaly detection, presenting the main techniques and approaches used for anomaly detection. Section 3 describes the proposed method and implementation, covering the entire pipeline, including data collection, metric analysis and its relationships, pre-processing, data organization for training, a description of the machine learning models used, and their application. Section 4 presents and compares the results obtained, along with an analysis via a Saliency Map of an exemplary case in Section 4.2. Finally, Section 5 provides the conclusions and an overview of possible future work.