## 4 Experiments and Results
### Abnormal Detection Results  
The anomaly detection part first requires determining the error threshold. Set \(k\) to 3. According to [PERSON]'s inequality, an error \(e_{t}\) exceeding \(\mu_{e}+3\sigma_{e}\) or \(\mu_{e}-3\sigma_{e}\) is considered to be an outlier for that data point, i.e., at least \(1-\frac{1}{9}\approx 88.9\%\) of the errors should fall within the range of \(\mu_{e}\pm 3\sigma_{e}\). Combined with the above proposed prediction model, anomaly detection is carried out, and the number of detected anomalies in the PEMS04 and PEMS08 datasets are 46 and 51, respectively. The detection results are shown in Figures 9 and 10. Among them, Figures 9a and 10a display the residual plots for the two datasets, showing the residual range when \(k=3\) and the detected anomalies in the residual plots. Figures 9b and 10b show the anomalous points detected in the original traffic flow for the two datasets. Figure 8: Experimental results in the PEMS08 dataset. The dataset used in this paper is real traffic flow data, and there is no labeling of anomaly data. In order to more reasonably verify the effectiveness and accuracy of the detection method in this paper, this paper compares the classical unsupervised anomaly detection methods: the Ensemble-based isolated forest method [34], the reconstruction-based LSTM-VAE [35] method, and the prediction-based LSTM-NDT [36] methods, to further validate the accuracy of anomaly detection. Isolation Forest (IF) distinguishes normal and abnormal data by isolation and is suitable for high-dimensional data and large-scale datasets; LSTM-VAE captures temporal dependencies by invoking a combinatorial model that feeds potential variables learned by VAE into LSTM, and finally identifies anomalies by using the reconstruction probabilities; and LSTM-NDT predicts the anomalies by using LSTM data, detects anomalies by computing errors, and introduces an unsupervised nonparametric anomaly thresholding strategy. The results of the three methods, Isolation Forest, LSTM-VAE, and LSTM-NDT, are aggregated by the voting method, and at least two methods are set to consider a point as anomalous before it is considered as an anomaly. The anomalies obtained from the aggregation are compared with the anomalies detected in this paper, and the results are shown in Figure 11. The blue points in the figure are the anomalies detected using the methods in this paper and not detected by the aggregation methods, the yellow points are the common anomalies detected by the aggregation methods and also detected by the methods in this paper, and the red points are the anomalies detected by the aggregation methods and not detected by the methods in this paper. Figure 10: Anomaly detection results in the PEMS08 dataset. Figure 9: Anomaly detection results in the PEMS04 dataset. Analysis of the aggregation results shows that in the PEMS04 dataset, the number of anomalies obtained by the aggregation method is 21, and the number of anomalies obtained by this paper's detection method is 46. Compared with the anomalies obtained by the aggregation method, this paper's detection method detected 19 of them, and 2 data points were not detected. In the PEMS08 dataset, the number of anomalies obtained by the aggregation method is 30, and the number of anomalies obtained by the detection method in this paper is 51. Compared with the anomalies obtained by the aggregation method, the detection method in this paper detects 29 of them, and 1 data point is not detected. After analysis, the two data points that were not detected in this paper in the PEMS04 dataset were in the time periods of the third and ninth days. Similarly, the one data point in the PEMS08 dataset that appeared to be undetected was in the time period of the seventh day, as shown in Figure 12.  
Figure 11: Anomalous data aggregation results in datasets. Figure 12: Visualization of undetected data points in the dataset. We expanded the time range and visualized the results, as shown in Figures 13 and 14.