## 2 Related Work
### Anomaly Detection  
Anomaly detection [25] is widely employed in scenarios such as financial fraud [26], post-disaster situation analysis [27], social media event monitoring [28], and network traffic [29]. It can detect system anomalies in a timely and effective manner, thereby ensuring network security. Various machine learning [30] and deep learning methods are currently used in anomaly detection research. Log anomaly detection was first proposed using machine learning, using either supervised or unsupervised learning. Many supervised learning methods have been applied to log anomaly detection. [PERSON] et al. [10] used an SVM classifier to detect log event anomalies. [PERSON] et al. [31] presented a detection method based on a decision tree. [PERSON] et al. [32] introduced an approach for regression-based analysis that found a correlation between activity logs of operations and the impact of operational activities on cloud resources, enabling the discovery of anomalies in operational cloud application logs. [PERSON] et al. [33] proposed the PreFix framework, which uses a random forest algorithm to model template sequences that can intervene and \"fix\" potential failures. [PERSON] et al. [34] used Word2 Vec for vector representation of logs and applied a classifier to detect whether they were anomalous. However, this approach is limited by its reliance on the quality of the dataset labels. Subsequently, more unsupervised learning methods have been applied to anomaly detection in logs. In practical studies, the quantity of abnormal data is much less than that of normal data, and anomaly logs are generally unlabeled. Thus, the advantages of unsupervised learning can be better utilized. [PERSON] et al. [6] proposed IM, which can detect more anomalous messages in distributed systems, and then, execution anomalies can be tested effectively. [PERSON] et al. [5] utilized PCA to identify abnormal events and visualize the final results. [PERSON] et al. [35] proposed LogOHC, which has high extraction efficiency in multi-source log datasets. Unsupervised learning with high automation saves labor costs, but most detection uses clustering and correlation analysis, and the degree of automated correlation between these methods is not high. Therefore, deep learning methods have been applied by more studies to jointly analyze events and automate the discovery of potential security threats. Deep learning methods have ushered in a boom in research and application in recent years, with good results in various fields. [PERSON] et al. [36] and [PERSON] et al. [37] summarized the use of deep learning models in anomaly detection. Deep learning models provide new methods for log anomaly detection. [PERSON] et al. [11] applied LSTM for fault prediction in a log system, grouping logs with similar formats and content and processing rare marker data in training to capture long-term dependencies across log sequences. [PERSON] et al. [8] proposed DeepLog, which models logs as natural language sequences, enabling the automatic learning of log patterns from normal execution and discovering anomalies when log events deviate from the trained model under normal execution. However, the model can only be trained with large amounts of normal data. Attention-based RNN was proposed by [PERSON] et al. [38] and focuses on log events and overlooks contextual relationships in the log sequence. Unstable log data can be dealt with by LogRobust [9]. An attention-based Bi-LSTM neural network grasps contextual information. This method can automatically analyze the significance of log events. However, large log data volumes result in slow speeds and high calculation costs. [PERSON] [39] proposed AutoLog, which periodically samples logs, calculates numerical scores, trains a semi-supervised deep autoencoder, and uses the encoder for classification. [PERSON] et al. [12] proposed HitAnomaly, which uses log template sequences and parameter values to represent logs and simultaneously applies a Transformer structure for anomaly detection.