# Software Operation Anomalies Diagnosis Method Based on a Multiple Time Windows Mixed Model
## 5 Result and Discussion
### Impact of Different Time Windows on Model Selection
Figures 13-16 depict the classification of anomalous labels under different time windows of the cardio dataset. Table 9 presents the detectors selected by our algorithm with comparable performance under different time windows and the preferred detectors when combining multiple time windows. The cardio dataset is characterized by the fact that its anomalies are concentrated on the last period of time and are cumulative continuous anomalies. This differs from both the SKAB and occu datasets. Figure 11: **(a)** Distribution of anomalies with a time window of 40 for occu dataset; **(b)** Distribution of anomalies with a time window of 50 for occu dataset. Figure 12: Distribution of anomalies with a time window of 60 for occu dataset. Figure 14: (a) Distribution of anomalies with a time window of 20 for cardio dataset; (b) Distribution of anomalies with a time window of 30 for cardio dataset. Figure 15: (a) Distribution of anomalies with a time window of 40 for cardio dataset; (b) Distribution of anomalies with a time window of 50 for cardio dataset. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Size of Time Windows** & **Detector of Choice** & **Time Window Combination** & **Detector of Choice** \\ \hline
2 & HBOS, OCSVM, IFOREST, CBDOF, KNN, PCA & 2-10 & HBOS, OCSVM, IFOREST, CBDOF, KNN \\
10 & HBOS, OCSVM, IFOREST, CBDOF, KNN & 2-20 & HBOS, OCSVM, IFOREST, CBDOF, KNN \\
20 & HBOS, OCSVM, IFOREST, CBDOF, KNN & 2-30 & HBOS, OCSVM, IFOREST, CBDOF, KNN \\
30 & HBOS, OCSVM, IFOREST, CBDOF, KNN & 2-40 & HBOS, OCSVM, IFOREST, CBDOF, KNN \\
40 & HBOS, OCSVM, IFOREST, CBDOF, KNN & 2-50 & HBOS, OCSVM, IFOREST, CBDOF, KNN \\
50 & HBOS, OCSVM, IFOREST, CBDOF, KNN & 2-60 & HBOS, OCSVM, IFOREST, CBDOF, KNN \\
60 & HBOS, OCSVM, IFOREST, CBDOF, KNN, PCA & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Algorithm selection results under different time windows of occu dataset. Figure 13: (a) Distribution of anomalies with a time window of two for cardio dataset; (b) Distribution of anomalies with a time window of ten for cardio dataset. Figure 15: (a) Distribution of anomalies with a time window of 40 for cardio dataset; (b) Distribution of anomalies with a time window of 50 for cardio dataset. As evident from the changes depicted in Figures 13-16, most of the base detectors exhibit effective recognition of cardio anomaly data in the case of a small window setting. However, as the time window increases, sporadic false alarms of anomalies start to emerge, although the primary anomalies remain concentrated in the final segment. Nonetheless, our method adeptly selects the three detectors (VAE, AutoEncoder, PCA) that demonstrate the best recognition capability. The primary reason behind this lies in the fact that, as the time window expands, the other anomaly detectors, while also proficient at identifying true anomalies, tend to exhibit a higher tendency to falsely recognize anomalies compared to the three VAEs. Conversely, the three detectors (VAE, AutoEncoder, PCA) are better at concentrating on the actual anomalies, making them stand out. Additionally, from Figures 9 and 16, it can be observed that when the time window is either too small or too large, it becomes more challenging to select our method. However, the combination of time windows can effectively address this issue and provide an appropriate solution. It is evident that our time-window combination approach may effectively select the underlying detectors that demonstrate excellent performance in identifying cumulative anomalies over extended periods of time. This observation is further supported by the analysis of the vowels dataset in Appendix A. However, in order to consistently demonstrate this conclusion, further experiments with datasets exhibiting similar characteristics would be necessary. This is one of the future directions of this work. It is worth highlighting that each time window experiment in this study involves separate retraining and data detection processes.