## 4 Experiments
### Experimental Results
#### 4.3.1 HDFS Dataset Evaluation  
Table 1 shows the performance of LTA Anomaly and the six baseline methods on the HDFS dataset, with the highest score expressed in bold. LTA Anomaly shows the highest recall rate, with an F1-measure of 0.985. High F1-measures of LogRobust, HitAnomaly, CL2 MLog, LogLS, and LTA Anomaly make it clear that the semantic information of the log template has an impact on exception detection. LogRobust produces more errors than LTA Anomaly because it does not use component value information provided by the dataset. HitAnomaly is better than LTA Anomaly when detecting normal logs. However, there are more false detections of anomalous logs, with serious ramifications for the system. Further observation shows that many anomaly detection methods work efficiently on HDFS datasets, i.e., the log parser does a good job extracting log templates from HDFS datasets. Therefore, the results show that the log parser plays an important role in the anomaly detection of logs. For large systems that are not easily manageable, small improvements can be crucial for efficiency. In some cases, making LTA Anomaly 0.02 more accurate than LogLS may result in more precise identification of potential failures or anomalies, thus enabling businesses or organizations to react faster and avoid potential losses. Moreover, in critical domains such as finance and healthcare, even a relatively minor accuracy improvement can have a significant impact on system security and reliability. The LTA Anomaly model achieves high accuracy in log anomaly detection by combining semantic information, sequence relationships, and component values to represent logs as vectors. This is achieved by incorporating a Transformer with long short-term memory (LSTM) as the final classification model, which enables the model to consider both local and global information when processing sequences. The flexibility, simplicity, and robustness of \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Technique** & **Precision** & **Recall** & **F1-Measure** \\ \hline DeepLog & 0.92 & 0.95 & 0.934 \\ LogCluster & 0.96 & 0.83 & 0.890 \\ LogRobust & 0.96 & 0.96 & 0.970 \\ HitAnomaly & **0.99** & 0.97 & 0.979 \\ CL2 MLog & 0.96 & 0.98 & 0.970 \\ LogLS & 0.96 & 0.98 & 0.970 \\ LTA Anomaly & 0.98 & **0.99** & **0.985** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: HDFS dataset for evaluation. the LTAnomaly model make it more effective than existing log anomaly detection models, and it has been shown to perform well in detecting HDFS data anomalies. On the other hand, Transformer-based anomaly detection methods also use deep learning techniques, and the Transformer architecture has been adapted for time series analysis by using a self-attention mechanism to learn the relationship between different parts of time series data. The reason why LTAnomaly may outperform Transformer-based methods in HDFS anomaly detection is due to various factors, such as the size and complexity of the dataset, the quality of the data, and the hyperparameter tuning of each algorithm. The design of its model architecture increases the sensitivity to long sequence information, making the model more accurate in considering the relationship between local and global information. Moreover, the unique characteristics of the dataset, such as the size and complexity of the logs or the nature of the detected anomalies, may favor the LTAnomaly model over other methods, confirming that there are scenarios where our proposed model performs better at log anomaly detection. Log anomaly detection requires not only high accuracy but also high efficiency. This paper compares the time-consuming performance of Deeplog, HitAnomaly, and LTAnomaly methods on HDFS datasets. To ensure the consistency of the experimental results, Deeplog, HitAnomaly, and LTAnomaly are conducted in the same experimental environment. Table 2 shows the results of the experiment. DeepLog takes less time than LTAnomaly at the expense of low accuracy.