  CyberPhysical systems (CPS) must be closely monitored to identify and
potentially mitigate emergent problems that arise during their routine
operations. However, the multivariate time-series data which they typically
produce can be complex to understand and analyze. While formal product
documentation often provides example data plots with diagnostic suggestions,
the sheer diversity of attributes, critical thresholds, and data interactions
can be overwhelming to non-experts who subsequently seek help from discussion
forums to interpret their data logs. Deep learning models, such as Long
Short-term memory (LSTM) networks can be used to automate these tasks and to
provide clear explanations of diverse anomalies detected in real-time
multivariate data-streams. In this paper we present RESAM, a requirements
process that integrates knowledge from domain experts, discussion forums, and
formal product documentation, to discover and specify requirements and design
definitions in the form of time-series attributes that contribute to the
construction of effective deep learning anomaly detectors. We present a
case-study based on a flight control system for small Uncrewed Aerial Systems
and demonstrate that its use guides the construction of effective anomaly
detection models whilst also providing underlying support for explainability.
RESAM is relevant to domains in which open or closed online forums provide
discussion support for log analysis.
