# ADAL-NN: Anomaly Detection and Localization Using Deep Relational Learning in Distributed Systems
## 2 Literature Review
### Log Parsing
When the source codes for a new version of the model are updated, they are treated as new templates, resulting in performance degradation. 2. Context-based method: Log-based data provide a plethora of semantic information about system states. [PERSON] et al. [8] used Long Short-Term Memory via word vectors to analyze synonyms and antonyms. However, they utilize the counting vectors, which are not resistant to varying the log-based data. To detect abnormalities, [PERSON] et al. [9] used Att-Bi-LSTM. In contrast, Word2 Vec and TF-IDF disregard contextual information in sentences. In this study, BERT is utilized to determine the contextual semantic meaning of utterances. **Anomaly Localization. ** A prevalent area of investigation is the utilization of statistics and machine learning for the purpose of anomaly detection. If you only rely on methods for detecting anomalies, you will end up with a significant number of false positives because anomalies tend to spread quickly through distributed and interdependent systems. The authors in [8] provide a taxonomy of anomaly-detection methods based on categorization, statistics, information theory, and clustering. Using system traces and supervised model training, the authors of [9] present a method for defect localization. In contrast to this investigation, their methodology requires the manual selection of characteristics. This procedure's disadvantage is its complexity, and its authors advocate combining a route condition time series method with an adapted random walk algorithm [10]. This enables not only the recording of sequential links in time series data, but also the incorporation of information regarding causal links, temporal order, and monitoring data priority. We learn the characteristics of anomalies, whereas their method relies on root cause metrics criteria, which frequently require specialized knowledge to establish properly. This research simplifies feature extraction by only considering temporal correlations within relevant time series slices. The authors of [5] conduct an individual analysis for every system component in addition to an ensemble analysis that only considers global predictions and disregards the underlying network structure of system relationships. MonitorRank [11] is a real-time metric collection system intended for use in service-oriented architectures to conduct root cause analysis (RCA) when abnormalities are reported. It uses an unsupervised and heuristic (clustering) technique to generate a sorted list of potential root causes that monitoring teams can use as a guide. MonitorRank focuses on diagnosis after an abnormality has been reported, as opposed to the detection of abnormalities themselves. This means that it is not intended to identify abnormalities in real time, but rather to assist teams in determining the root cause of previously identified abnormalities. Table 1 also displays research gaps for the related study. In distributed systems, several systems use causality graphs to perform end-to-end anomaly identification and root cause investigation. LOUD is an example of a system that creates a model based on accurate executions and employs graph centrality methods to locate faulty cloud system resources. However, LOUD [3] relies on positive training and may not be able to recognize specific abnormalities. eBay's GRANO [12] is another example of an enterprise-level software framework that includes a detection layer, anomaly graph layer, and application layer to aid fault-resolution teams. GRANO is customized for cloud-native distributed data platforms. By providing a comprehensive and integrated approach to these tasks, these types of systems can enhance the efficiency and effectiveness of anomaly detection and root cause analysis. Additionally, GRANO employs numerous techniques for identifying and localizing aberrant behavior. On the other hand, RCA advocates [7] deducing the underlying causes of performance issues by comparing application