## 5 Experiment
### Anomaly-Detection Classification Model  
**Exp3. Anomaly classification. ** In this experiment, we evaluate the effectiveness of the method's anomaly-detection models using the following evaluation metrics:  
\[Precision=\frac{TP}{TP+FP} \tag{9}\]  
\[Recall=\frac{TP}{TP+FN} \tag{10}\]  
\[F1=\frac{2\times Precision\times Recall}{Precision+Recall}=\frac{2\times TP}{2 \times TP+FP+FN} \tag{11}\]  
For each input sequence window, if it carries an anomaly label and is classified as an anomaly in the detection results, it is considered a True Positive (TP); otherwise, it is a False Negative (FN). To compare the difference between deep learning-based solutions, the HIDS adopted by [PERSON] et al. (2018) and the LSTM-VAE adopted by [PERSON] et al. (2019) are \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Scenario**} & \multicolumn{4}{c}{**Total Templates**} \\ \cline{2-5}  & **Original** & **Filtered by Seq** & **Filtered by Rules** & **Final** \\ \hline Employee Service & 71602 & 53104 & 13417 & 5081 \\ Gateway Service & 30388 & 10217 & 14077 & 6094 \\ Redis Service & 7337 & 1495 & 2248 & 3594 \\ MySQL Service & 16756 & 11463 & 3540 & 1753 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Syscall filtering results. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multicolumn{2}{c}{**Average CPU Times (s)**} & \multicolumn{2}{c}{**Testing Time (s)**} \\ \hline
**Original** & **Filtered** & **Original** & **Filtered** \\ \hline
27.08 & 3.35 & 6.24 & 0.81 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The performance benefit by filtering. Figure 7: CPU usage and time for testing. taken as the representatives of the traditional reconstructed anomaly-detection model and compared with the model in our method. The settings for each model are presented in Table 6.  
The results are presented in Table 7 and Figure 8. As observed from the data in the table, when using system call vectors with parameters, the detection performance across various scenarios averages a precision of 0.91, a recall of 0.978, and an F1 score of 0.944, with a low False Positive Rate of 0.014. Compared to HIDS, our approach achieves higher accuracy and F1 values in all scenarios, which is likely due to the fact that HIDS ignores parameter information other than file paths. Moreover, HIDS analyzes the system calls of the whole host without dividing them by applications and containers, which may degrade its performance under a large number of containers and high environmental noise. On the other hand, the inclusion of various parameters makes the information richer and reduces false positives. Compared to LSTM-VAE, our model also performs better. To validate our competitiveness and robustness in different datasets and scenarios, we experiment with CB-DS along with HIDS. The results are shown in Table 8. In this dataset, U-SCAD achieves a great performance that is roughly the same as HIDS. These experiments show that our method not only outperforms the comparison methods in certain scenarios, but also has robustness for a wider range of scenarios. **Exp4. Case study. ** In this experiment, we select several typical scenarios to evaluate the principles of anomaly detection using visual methods and to demonstrate the reliability of the method through Receiver Operating Characteristic (ROC) curves. In Figure 9 and Figure 10, each point on the X-axis represents a time window of the original sequential data, and the Y-axis represents the anomaly score of a current time window. \begin{table}
\begin{tabular}{c c} \hline \hline
**Algorithms** & **Settings** \\ \hline \multirow{3}{*}{U-SCAD} & (Input dimension = 512, Encoder layers = 3, Attention heads = 8, \\  & FeedForward hidden dimension = 512, max\_window\_size = 256, \\  & criterion = MSELoss, fasttext\_dim = 50) \\ \hline HIDS & (thres = 0.8) \\ \hline LSTM-VAE & (hidden\_size = 2048, latent\_size = 1024) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Model settings.