# Technical Document Extraction: Anomaly Detection Workflow
## 1. Normal Period Data
- **Structure**:
- Three time-series variables (`x0`, `x1`, `x2`)
- Colored blocks represent data points:
- `x0`: Yellow
- `x1`: Blue
- `x2`: Purple
- Legend placement: Left side of diagram
- Spatial grounding:
- Normal period data: `[x=0, y=0]` to `[x=2, y=2]`
## 2. Anomaly Detection Process
### 2.1 ODE Learning from Normal Period
- **Flow**:
- Arrow `1` connects normal period to ODE learning block
- Process outputs:
- Learned variables: `x0`, `x1`, `x2`
- Adjacency matrix (3x3) with values `0`, `1`, `2`
- **Spatial grounding**:
- ODE learning block: `[x=1, y=0]`
### 2.2 Anomaly Period Analysis
- **Data Segmentation**:
- Two anomaly patterns:
- **Pattern A**:
- `x0`: Red (anomaly)
- `x1`: Blue (normal)
- `x2`: Purple (normal)
- **Pattern B**:
- `x0`: Yellow (normal)
- `x1`: Red (anomaly)
- `x2`: Purple (normal)
- Color legend mapping:
- Red: Anomaly
- Blue/Purple: Normal
- Yellow: Normal (original normal period)
## 3. Adjacency Matrix Analysis
- **Matrix Structure**:
- 3x3 grid with values `0`, `1`, `2`
- Red blocks highlight changes from normal period
- **Spatial grounding**:
- Adjacency matrix: `[x=1, y=1]`
## 4. Anomaly Type Classification
### 4.1 Measurement Anomaly
- **Root Cause**:
- `x0` (red block)
- Spatial grounding: `[x=2, y=0]`
- **Flow**:
- Adjacency matrix → Measurement anomaly → Root cause localization
### 4.2 Cyber Anomaly
- **Root Cause**:
- `x1` (red block)
- Spatial grounding: `[x=2, y=1]`
- **Flow**:
- Adjacency matrix → Cyber anomaly → Root cause localization
## 5. Key Technical Components
1. **Color-Coded Legend**:
- Yellow: Normal `x0`
- Blue: Normal `x1`
- Purple: Normal `x2`
- Red: Anomaly
- Spatial reference: `[x=0, y=0]` to `[x=2, y=2]`
2. **Process Flow**:
- Normal period data → ODE learning → Adjacency matrix → Anomaly classification → Root cause localization
3. **Critical Data Points**:
- Measurement anomaly root cause: `x0` (red)
- Cyber anomaly root cause: `x1` (red)
- Adjacency matrix values: `0`, `1`, `2` with red highlights
## 6. Trend Verification
- **Normal Period**:
- Consistent color patterns (no red blocks)
- **Anomaly Periods**:
- Pattern A: Red block in `x0` column
- Pattern B: Red block in `x1` column
- Visual trend: Vertical red blocks indicate anomaly type
## 7. Component Isolation
### 7.1 Header
- Title: "ODE learned from normal period"
- Spatial: `[x=1, y=0]`
### 7.2 Main Chart
- Adjacency matrix analysis
- Anomaly type classification
### 7.3 Footer
- Root cause localization (x0/x1)
- Spatial: `[x=2, y=0]` to `[x=2, y=1]`
## 8. Data Table Reconstruction
| Variable | Normal Color | Anomaly Color | Anomaly Type | Root Cause |
|----------|--------------|---------------|-------------------|------------|
| x0 | Yellow | Red | Measurement | x0 |
| x1 | Blue | Red | Cyber | x1 |
| x2 | Purple | Purple | Normal | - |
## 9. Spatial Grounding Summary
- Normal period: `[x=0, y=0]` to `[x=2, y=2]`
- ODE learning: `[x=1, y=0]`
- Adjacency matrix: `[x=1, y=1]`
- Anomaly classification: `[x=2, y=0]` (Measurement), `[x=2, y=1]` (Cyber)