## 2 Materials and Methods
### Experimental Setup
#### 2.3.2 Anomaly Score Classification  
To ensure a fair comparison of the results produced using the six anomaly detection methods, we use the principle of Extreme Value Theory (EVT) to determine a threshold for classifying subsequences as anomalous or normal [44]. EVT is an approach used to find the law of extreme values, which are often located in the tails of a probability distribution, without making any assumptions about the data distribution [46]. The _Peaks-Over-Threshold (POT)_ method [44], which is the second theorem in EVT, fits the tail of a probability distribution with a Generalized Pareto Distribution (GPD). In the context of anomaly score classification, the Peak-Over-Threshold (POT) method is utilized to learn an appropriate threshold for the anomaly scores \(\{\sigma_{1},\sigma_{2},\ldots,\sigma_{n}\}\)[46]. Specifically, the Generalized Pareto Distribution (GPD) is adapted to focus on values at the low ends of the distribution. According to [46], a modified version of POT for anomaly score classification is defined as follows: Given a random variable \(S\) that models the anomaly scores \(\{\sigma_{1},\sigma_{2},\ldots,\sigma_{n}\}\) and an initial threshold \(th^{0}\), the cumulative distribution function of the GPD is adapted to:  
\[\tilde{F}(s)=\mathbb{P}(th^{0}-S>s|S<th^{0})\sim(1+\frac{\gamma S}{\beta})^{- \frac{1}{\gamma}}\, \tag{1}\]  
where \(\beta\) and \(\gamma\) are the scale and shape parameters of the GPD. The threshold \(th\) is then computed by:  
\[th\simeq th^{0}-\frac{\hat{\beta}}{\hat{\gamma}}((\frac{qn}{n_{th^{0}}})^{- \hat{\gamma}}-1)\, \tag{2}\]  
where \(\hat{\beta}\) and \(\hat{\gamma}\) are the maximum likelihood estimates of the scale and shape parameters in Equation (1) estimated from \(\{\sigma_{1},\sigma_{2},\ldots,\sigma_{n}\}\), \(q\) is the preferred probability to observe an anomaly score below the initial threshold \(S<th^{0}\) and \(n_{th^{0}}\) is the number of anomaly scores below the initial threshold \(|\{\sigma_{i}|\sigma_{i}<th^{0}\}|\). The anomaly label \(y_{i}\) for a predicted subsequence \(\hat{S}_{i,i+w}\) of length \(w\) is obtained by:  
\[y_{i}=\mathds{1}(\sigma_{i}\geq th)\,\]  
where \(\sigma_{i}\) is the anomaly score for the subsequence \(\hat{S}_{i,i+L}\), \(th\) is the threshold from Equation (2), and \(\mathds{1}(\cdot)\) is the indicator function. For further information on POT, interested readers may refer to [44; 46]. In the experiments, the Streaming POT variant from [44] is used, with POT being initialized on the first 10% of the anomaly scores and the parameter \(q\) set to 0.01 empirically.  
We do not perform this step for the MERLIN method because it already returns binary labels per subsequence. Since it is typically acceptable for an algorithm to detect any point in an anomalous subsequence as long as the delay is not too long, we adopt the method proposed in [25] and subsequently used in [13; 47] for adjusting the predicted anomalous labels to account for varying subsequence lengths. If a point in a true anomalous segment can be detected by the derived score and threshold, we count this segment as correctly detected from that point forward and treat all points within the segment as if they could be detected by the threshold.