# Software Operation Anomalies Diagnosis Method Based on a Multiple Time Windows Mixed Model
## 3 Anomaly Detection Synthesis Algorithm Based on Multiple Time Windows
### Automatic Selection of Detectors Based on Multiple Time Windows  
This section describes how to select the most similar and optimal multiple detectors from multiple anomaly detection models. As shown in Figure 2, the steps of this method are as follows:  
1. Training data are input into 10 anomaly detection algorithms for training, and each algorithm obtains a set of anomaly scores. 2. Multiple time windows are selected, where each time window refers to a continuous set of data. 3. The time windows are cycled through, as shown in Figure 3.  
We set the sample data corresponding to the largest \(n\) scores with the same number of windows in each group as an abnormal label. We randomly generate adjacent spaces. The default number of random times is 1/3 to 1/2 of the total sample data. The length of the adjacent data is equal to the length of the time window. We then find the space with the largest number of abnormal tags in this space and the front and rear spaces. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Algorithm Type** & **Abbreviation** & **Introduction** \\ \hline \multirow{2}{*}{Linear model} & \multirow{2}{*}{PCA} & Principal Component Analysis (the sum of weighted projected distances to the eigenvector hyperplanes) \\  & & One-Class Support Vector Machines \\ \multirow{2}{*}{Linear model} & OCSVM & One-Class Support Vector Machines \\ \multirow{2}{*}{Based on proximity} & LOF & Local Outlier Factor \\ \multirow{2}{*}{Based on proximity} & COF & Connectivity-Based Outlier Factor \\ \multirow{2}{*}{Based on proximity} & CBLOF & Clustering-Based Local Outlier Factor \\ \multirow{2}{*}{Based on proximity} & HBOS & Histogram-based Outlier Score \\ \multirow{2}{*}{Based on proximity} & KNN & k Nearest Neighbors (use the distance to the kth nearest neighbor as the outlier score) \\ \multirow{2}{*}{Combination of abnormal} & IForest & Isolation Forest \\ \multirow{2}{*}{Neural network} & \multirow{2}{*}{AutoEncoder} & Fully connected AutoEncoder (use reconstruction error as the outlier score) \\ \multirow{2}{*}{Neural network} & \multirow{2}{*}{VAE} & Variational AutoEncoder (use reconstruction error as the outlier score) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Abnormal data monitoring algorithm table. Figure 1: Overall detection scheme. We record the model sequence with abnormal labels in the adjacent space obtained in the previous step. * We repeat steps 3.1 to 3.3 for the models that did not appear in 3.3 to obtain the second set of model sequences. * The anomaly scores and anomaly labels of the two sets of the model sequences obtained in step 3 are then fused as the final detection result. Figure 3: Time window loop. Figure 2: Automatic selection model. The first step is to put the training data into each anomaly detection algorithm for training and to obtain each anomaly score and anomaly label. For each set of abnormal tags, multiple sets of model selection tags are generated with different time windows. The label setting condition is the position corresponding to the largest \(n_{s}\) scores, where n is equal to the length of the time window. We select labels for multiple sets of models in the same time window and generate a neighboring space to count the number of abnormal labels in the space. For data group \(i\) with different total numbers of abnormal labels, the number of spatial abnormal labels should be multiplied by the corresponding weight \(\alpha_{i}\), which is determined by the real number of abnormal labels \(n_{t}\) and the set number of labels \(n_{s}\). The calculation method is shown in Formula (1). In this study, we assume that if there are anomalies in the dataset, there should be multiple anomaly detectors that can identify most of the typical anomalies. The goal of this step is to use a random neighboring space to find these abnormal points recognized by multiple detectors. \[\alpha_{i}=\max\left(1,\frac{n_{t}}{n_{s}}\right) \tag{1}\]  
Then, we count the number of detectors with abnormal tags in the abnormal space centered on this abnormal point.