# LogEDL: Log Anomaly Detection via Evidential Deep Learning
## 6 Discussion  
We have demonstrated the feasibility and effectiveness of using uncertainty to identify anomalous logs in LogEDL, showcasing the significant potential of evidential neural networks in practical log anomaly detection. Nevertheless, several open research questions related to log anomaly detection remain to be further explored and elucidated.  
In the real world, log patterns continuously evolve with software updates or system configuration changes. LogEDL assumes that log templates are stable and unchanging, which hinders the model's ability to detect anomalies due to changes in log patterns. However, with the advancement of large language models (LLMs), current changes in log patterns can be easily transformed into our desired format. We propose developing a log template management system that combines LLMs and machine learning technologies to automatically detect and update log templates. This system will ensure the accuracy of log parsing and anomaly detection. For logs that differ significantly from the existing log template set, an online learning or incremental learning framework should be utilized to update the log collection.  
The interpretability of deep learning models is crucial. The LogEDL model quantifies the degree of anomaly in logs using uncertainty, yet this study does not delve deeply into the relationship between the sequence of logs labeled as anomalies and the underlying causes of these anomalies. By employing masked language modeling (MLM), the LogEDL model effectively learns the contextual relationships of normal log sequences and identifies logs that do not conform to contextual semantics as anomalous. The process of log templating can result in the loss of some critical information inherent in the original logs, which hinders the interpretability of log anomalies. In the future, deep learning techniques should be utilized to extract latent semantic vectors from logs to better understand the reasons behind certain log sequences being marked as anomalies. Integrating interpretable AI techniques will enhance the interpretability of the anomaly detection process.  
The scalability of LogEDL in handling large volumes of log data has yet to be thoroughly investigated. In practical applications, logs are generated in the thousands, necessitating the anomaly detection system to scale accordingly. These models must be able to operate efficiently with varying scales of log data. In the future, message queues could be employed to manage sudden surges of log sequences, custom-adapting to existing monitoring tools and databases.  
Future research could explore the development of more computationally efficient, highly generalizable, and scalable models that require minimal normal data for training, thereby quickly adapting to changes in real-world applications. Additionally, utilizing large models and incremental learning strategies could be beneficial. With this approach, the model could be initially labeled using a large model, and as new data are parsed, the model could be updated incrementally. This could help the system adapt to evolving logs without requiring extensive computational resources.