# Software Operation Anomalies Diagnosis Method Based on a Multiple Time Windows Mixed Model
## 4 Experiments Design
### Anomaly Detector Selection  
For the base anomaly detector, we have selected the 10 anomaly detection methods listed in Table 1. In this study, the proposed methods are denoted as mixModel-pre and mixModel-sen, representing the precision-based integration model and the sensitivity-based integration model, respectively. To compare these integration models, we have chosen LSCP [30], which is a method that prioritizes integrated anomalizers following the clustering of anomaly data.  
To enhance the understanding of the integration models' capabilities, the study introduces two distinct models: mixModel-pre and mixModel-sen. These models focus on precision and sensitivity, respectively, which are essential aspects of anomaly detection. By separately considering these two dimensions, the study aims to provide a comprehensive evaluation of the integration models' performance in capturing anomalies effectively.  
To benchmark the performance of the integration models, LSCP is employed as a reference. This method utilizes clustering techniques to enable effective integration of multiple anomaly detectors, ultimately enhancing the overall detection capabilities.  
Our expectation for the method presented in this study is that it has the potential to optimize one or more of the numerous anomaly detectors that exhibit similar anomaly detection outcomes. By integrating the results of these detectors, we anticipate achieving anomaly detection results that are consistent with the optimal model or demonstrate only a marginal decrease in performance.  
Furthermore, it is important to highlight that, prior to the experiments, we optimized the hyperparameters of the 10 base detectors using Bayesian optimization. However, it should be noted that this optimization was conducted within a specific range and may not be generalizable to all datasets. The primary objective of this paper is to explore the selection of suitable detectors for integration based on the time window, rather than delving into the hyperparameter optimization problems of the individual models. Hence, to ensure consistency and prevent the influence of varying hyperparameter combinations on the experimental results, we directly employed the same hyperparameter settings for all detectors. The specific parameter configurations for each detector can be found in Table 4.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Detector** & **Parameters** & **Value** & **Detector** & **Parameters** & **Value** \\ \hline \multirow{4}{*}{HBOS} & n\_bin & 10 & & degree & 2 \\  & alpha & 0.1 & & Coef0 & 0 \\  & Tol & 0.5 & & tol & 0.005 \\  & contamination & 0.1 & & nu & 0.5 \\ \hline \multirow{4}{*}{LOF} & n-neighbors & 10 & & contamination & 0.1 \\  & leaf\_size & 15 & & encoder\_neurons & [15; 8; 4] \\  & contamination & 0.1 & & encoder\_neurons & [4; 8; 15] \\  & p & 2 & & contamination & 0.1 \\ \hline \multirow{4}{*}{IFOREST} & n\_estimator & 10 & & n-neighbors & 5 \\  & contamination & 0.1 & & radius & 1.0 \\  & max\_features & 0.5 & & leaf\_size & 30 \\  & n\_jobs & 1 & & P & 2 \\ \hline AutoEncoder & hidden\_neurons & [8; 15] & & COF & contamination & 0.1 \\ \hline \multirow{4}{*}{CBLOF} & n\_cluster & 10 & & n-neighbors & 6 \\  & contamination & 0.1 & & contamination & 0.1 \\ \cline{1-1}  & alpha & 0.9 & & n\_components & None \\ \cline{1-1}  & beta & 5 & & other & default \\ \hline \hline \end{tabular}
\end{table}
Table 4: Parameter use of the basic anomaly detectors.