# ADAL-NN: Anomaly Detection and Localization Using Deep Relational Learning in Distributed Systems
## 3 Methodology
This allows us to extract and encode the relevant semantic and temporal information specific to the current instance of the system. * Anomaly detection (online): In this step, the encoded log information is fed into the trained model to detect anomalies. By comparing the log sequences to the learned patterns and characteristics from the offline training, the model can identify deviations that indicate the presence of anomalies. If an anomaly is detected, an alarm is generated to alert the monitoring team about the issue. * Anomaly localization (online): Upon detecting an anomaly, the research team proceeds to localize the anomaly by examining the malfunctioning instance. The team focuses on investigating the specific instance associated with the anomaly and reports the instance ID related to it. This information is crucial for identifying the root cause of the anomaly and for taking appropriate corrective actions. The steps involved in the entire procedure are listed above. As our proposed method employs a deep learning architecture that leverages the power of BERT and attention-based BiLSTM networks, it is important to discuss the network structure, which can be described as follows:  
1. Input layer: The input layer receives the log data as input, which are typically represented as a sequence of log events. Each log event is encoded using sentence embeddings. 2. Embedding layer: The embedding layer transforms the sentence-embedded log events into continuous vector representations, capturing the semantic information of the log events. We utilize pre-trained BERT embeddings to capture the contextual information and semantic relationships between log events. 3. LSTM layer: The LSTM layer processes the log event sequence in a recurrent manner, capturing the temporal dependencies and patterns within the logs. It consists of multiple LSTM units that maintain and update the hidden state based on the current input and the previous hidden state. 4. Attention layer: The attention layer enhances the model's ability to focus on relevant log events by assigning different weights to different parts of the log sequence. It dynamically learns the importance of each log event based on its relevance to anomaly detection. 5. Output layer: The output layer is responsible for predicting whether a given log event or log sequence is anomalous or normal. It produces the anomaly score for each log event, indicating its deviation from normal behavior. We employ suitable functions such as Softmax as an activation function and Categorical Cross-Entropy Loss as a loss function to train the model effectively. This research project's design includes multiple phases for detecting and localizing anomalies in log data. The procedure begins with relation creation, which entails constructing a graph that depicts the relationships and dependencies among the system's various components. The next step is log parsing, which entails extracting the pertinent information from the log data and encoding it in a format that can be used for analysis. The encoded log data are then fed into a deep learning model that has been trained to recognize anomalies using techniques such as self-attention or masked language modeling. If an anomaly is detected, the system can utilize the relation graph and other contextual data to localize the anomaly and to determine its root cause. This may entail examining the malfunctioning instance and its dependencies in the relation graph, as well as employing heuristics or other techniques to determine the source of the anomaly.