# Unsupervised Deep Anomaly Detection for Industrial Multivariate Time Series Data
## 3 Materials and Methods
### Inference  
During the inference process, the reconstruction error is first obtained through the characterization network. Higher reconstruction scores are assigned to time steps with sudden changes in the time series. In the prediction network, greater attention is given to time series with larger deviations. The anomaly score is a linear combination of the reconstruction score and the prediction score, where \(\alpha\) and \(\beta\) determine their relative influences, serving as tunable hyperparameters. The final expression for the _anomaly score_ is as follows:  
\[Anomaly\ score=\alpha\big{\|}S-S^{\prime}\big{\|}_{2}+\beta\|R-P_{out}\|_{2}, \tag{20}\]  
After processing with the anomaly score function, the anomaly score for each sample is calculated. To ensure a fair comparison with other testing methods, we also use the POT (Peak Over Threshold) algorithm to select the threshold automatically and dynamically. Essentially, this is a statistical method that fits the data distribution to the generalized Pareto distribution using the \"extreme value theory\". During the inference process, if the anomaly score is greater than the threshold automatically calculated by POT, the test sample is labeled as anomalous (1); otherwise, it is labeled as normal (0). Algorithm 1 outlines the complete training and inference process for AT-DCAEP. ```
0: Training dataset \(S\)
0: Model parameter \(w\)
0: Randomly initialize parameter \(w\);
1:while not converge do
2: Calculate low-dimensional representation \(D^{\prime}\) and reconstruction error \(R\) at each time step; // Equations (2) and (3)
3: Apply downsampling to the reconstruction error \(R\) to get \(R^{\prime}\); //Equation (8)
4: Add \(D^{\



## 4 Experiments

### Datasets

We utilized six publicly available datasets in our experiments. Table 1 summarizes their characteristics, where (%) indicates the percentage of anomalous data points in the dataset. 1. Soil Moisture Active Passive (SMAP) Dataset: This dataset comprises soil samples and telemetry information from NASA's Mars rover [37]. 2. Secure Water Treatment (SWaT) Dataset: Originating from an actual water treatment plant, this dataset includes 11 days of continuous operation data, with 7 days of normal operation and 4 days of anomalous operation [38]. The dataset consists of sensor values (water level, flow, etc.) and actuator operations (valves and pumps). 3. Water Distribution (WADI) Dataset: An extension of the SWaT system, it has more than twice the number of sensors and actuators compared to the SWaT model [39]. The dataset spans 16 days, with 14 days of normal operation and 2 days of anomalous operation. 4. Server Machine Dataset (SMD): SMD is a newly released dataset collected by a large internet company over 5 weeks, containing monitoring data from 28 machines in a computing cluster [23]. SMD is divided into two equally sized subsets: the first half serves as the training set and the second half as the testing set. 5. Multi-Source Distributed System (MSDS) Dataset: This dataset comprises high-quality multi-source data, including distributed traces, application logs, and metrics from a complex distributed system [40]. Constructed specifically for artificial intelligence operations, it involves tasks such as automatic anomaly detection, root cause analysis, and remediation. 6. MIT-BIH Supraventricular Arrhythmia Database (MBA): Collected from four patients, this dataset includes electrocardiogram recordings with multiple instances of two different types of anomalies (atrial premature contractions or premature beats) [41; 42]. It is a widely used, large-scale dataset in the data management community [43; 44].