Start time of the anomalies will be the start time of the first flow indicating the attack, not the detection time