# Software Operation Anomalies Diagnosis Method Based on a Multiple Time Windows Mixed Model
## 3 Anomaly Detection Synthesis Algorithm Based on Multiple Time Windows
### Model Integrated Based on Accuracy or Sensitivity  
Section A filters out suitable multiple anomaly algorithm detectors with better results for the dataset. This section introduces how to integrate the results of these anomaly detection algorithms to make the final anomaly result reach the optimal or suboptimal result.  
For each detector, its results on the test set contain two results: anomaly score and anomaly label. First, for each group of abnormal scores, to facilitate their integration, the respective scores are standardized by \(Z\) score. The conversion formula is shown in Formula (2). The purpose is to scale the scores that are inconsistent in each interval so that they fall into a specific interval for integration:  
\[z=\frac{x-\mu}{\sigma} \tag{2}\]  
where \(\mu\) is the sample mean and \(\sigma\) is the sample variance.  
Next, for the fusion of anomaly scores and anomaly labels, there are two solutions in this study, one based on accuracy and one based on sensitivity. The formula based on accuracy is as follows (3) and (4):  
\[A_{i}=\left\{\begin{array}{l}\sum\limits_{d\in D}A_{id}\times L_{id}/\sum \limits_{d\in D}L_{id},\sum\limits_{d\in D}L_{id}/num(D)\geq 0.5\\ \sum\limits_{d\in D}A_{id}\times(1-L_{id})/\sum\limits_{d\in D}L_{id},\sum \limits_{d\in D}L_{id}/num(D)<0.5\end{array}\right. \tag{3}\]  
\[L_{i}=\left\{\begin{array}{l}1,\sum\limits_{d\in D}L_{id}/num(D)\geq 0.5\\ 0,\sum\limits_{d\in D}L_{id}/num(D)<0.5\end{array}\right. \tag{4}\]  
where \(A\) is the anomaly score; \(L\) is the anomaly label; \(i\) refers to the \(i\)-th sample; \(D\) is all the selected anomaly detectors; and \(num(D)\) counts the number of anomaly detectors.  
When accuracy is most important, the abnormal label in this study is set to one when half or more of the selected algorithms report that there is an abnormality in the sample data. The final score is the average of the standardized scores of all models considered abnormal. This fusion calculation considers as much information as possible to reduce the false alarm rate in real fault diagnosis and to improve the accuracy of fault diagnosis.  
The formula based on sensitivity is as follows:  
\[A_{i}=\sum\limits_{d\in D}A_{id}\times L_{id}/\sum\limits_{d\in D}L_{id} \tag{5}\]  
\[L_{i}=\left\{\begin{array}{l}1,\sum\limits_{d\in D}L_{id}/num(D)>0\\ 0,else\end{array}\right. \tag{6}\]  
where \(A\) is the anomaly score; \(L\) is the anomaly label; \(i\) refers to the \(i\)-th sample; \(D\) represents all the selected anomaly detectors; and \(num(D)\) counts the number of anomaly detectors.  
When sensitivity is most important, the label of the point is set equal to one if the abnormal label of a certain point of sample data is identified as one using a specific model. This method tries to eliminate as many abnormalities as possible. All points are considered. In most cases, this method will reduce the recall rate of the model. However, in a real application, the two modes have their own advantages and disadvantages, as shown and analyzed in the experiments described below.