# ADAL-NN: Anomaly Detection and Localization Using Deep Relational Learning in Distributed Systems
## 4 Implementation
### Results
On the other hand, the F1 score provides a balanced measure that combines precision and recall, making it well suited for imbalanced classification problems. Therefore, in the context of anomaly detection, the weighted average F1 score emerges as a more informative and suitable evaluation metric than accuracy, precision, or recall alone. We also compared our results with the other methods in the literature. Table 4 shows the effectiveness of our proposed method. In the context of anomaly detection and localization, XAI systems can provide explanations for why an anomaly was detected and for its system location. Using XAI for anomaly detection and localization offers a number of advantages:  
1. Improved trust: By providing explanations for their decisions and actions, XAI systems can help to build trust with users and stakeholders who may be skeptical of the capabilities of AI. 2. Enhanced accountability: XAI systems can help to improve accountability by providing a clear record of the steps that were taken to detect and locate an anomaly, which can be useful for audit and compliance purposes. 3. Better understandability: XAI systems can help to make the results of anomaly detection and localization more understandable to humans, which can help to improve the effectiveness of the process. There are several approaches to developing XAI systems for anomaly detection and localization, including:  
1. Rule-based systems: Rule-based systems provide explanations by presenting the specific rules or heuristics that were used to make a decision. 2. Model-based systems: Model-based systems provide explanations by presenting the underlying model or algorithms that were used to make a decision. 3. Example-based systems: Example-based systems provide explanations by presenting examples of similar cases that were used to make a decision. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Precision** & **Recall** & **F1 Score** \\ \hline
[3] & 82 & 71 & 77 \\ \hline
[8] & 86 & 77 & 82 \\ \hline
[13] & 76 & 66 & 71 \\ \hline ADAL-NN & 85 & 92 & 88 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of F1 scores, precision, and recall for selected studies. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Classes** & **Precision** & **Recall** & **F1 Score** \\ \hline
0 & 0.92 & 1.00 & 0.96 \\ \hline
1 & 0.00 & 0.00 & 0.00 \\ \hline
2 & 0.00 & 0.00 & 0.00 \\ \hline Accuracy & - & - & 0.92 \\ Macro Average & 0.31 & 0.33 & 0.32 \\ Weighted Average & 0.85 & 0.92 & 0.88 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Classification report of anomaly detection. Here, we examine two significant limitations of this study:  
First, this study is only capable of identifying anomalies in log data. On the one hand, this study cannot detect abnormalities (such as excessive CPU utilization) revealed by KPI data as opposed to log data. This study employs log time interval change to identify as many potential performance issues as possible, but not all, because not all performance problems are linked to logs. Second, the scope of this study is limited to log statements whose core meanings are stable despite their constant flux. If the updated logging statement has a different meaning than the previous ones, or if the incoming log message is significantly different from the previous ones, the pre-trained model may not capture the meaning, leading to incorrect results.