# ADAL-NN: Anomaly Detection and Localization Using Deep Relational Learning in Distributed Systems
## 2 Literature Review
### Log Parsing  
Log parsing is a fundamental step in many log analysis works, such as those that have been thoroughly researched in [3; 20; 21]. These works parse logs by generating regular expressions from source codes in order to perform log parsing. In reality, all codes are already available online, and log parser techniques are classified into a few groups. 1. Threshold-based grouping: LKEs [22], LogSigs [23], Log-Mines [24], SHISOs [25], and LenMas [26] find variation between two logs before grouping them via the threshold method. For finding the template associated with a single group, threshold-based  
Figure 1: Papertrail’s real-time logs. The logs were created by the multi-tenant system. grouping techniques typically need a predefined value. Parameter tuning is time-consuming, labor-intensive, and non-universal. 2. Frequency-based grouping: Finding the counts of an entity in the logs is a simple method for automatically parsing the logs. Because a group of static entities is repeated in the logs, finding the counts makes it easier to understand how the logs are created. SLCT [27], LFA [28], and LogCluster [29] first record the frequency of items before categorizing them into multiple groups. 3. Heuristics based on tree searching: Drain divides log messages into nodes using a fixed-depth prefix tree [30]. Spell utilizes a tree structure to parse the logs into numerous templates [31]. Each layer of the prefix tree reflects a distinct log characteristic, such as the length or first token features. 4. Dictionary-based clustering: Both Logram [32] and Logparse [33] demonstrate the ability to parse logs using a dictionary. Logram builds dictionaries from pre-existing templates, and Logparse uses a classification method for the classification of the logs. Logparse uses the characteristics of variable words before the construction of each word. 5. Based on deep learning: These techniques, on the other hand, require significantly more resources to run than other log parsers. NuLog [34] suggested a neural-network-based log parser model, and the parsing job was formulated as masked language modeling (MLM). In contrast, a number of studies have identified trust-based connection in distributed and centralized Internet of things [35; 36; 37; 38]. A survey [39] presented on Blockchain technologies also highlights open issues and future direction. **Anomaly Detection. ** Numerous existing anomaly-detection methods concentrate on identifying sequential log abnormalities, which can be difficult to detect due to the large volumes of data involved. To effectively detect these anomalies, it is frequently necessary to analyze data from multiple sources and to employ techniques that can manage large amounts of data. Data-mining-based techniques encompass both supervised and unsupervised learning methods. **Supervised:** Supervised approaches (e.g., decision tree [40], support vector machines [41], regression-based methodology [42]) may learn the fixed pattern of distinct labeled logs by training on labeled log data. As a result, they consistently outperform unsupervised approaches. However, labeling a huge volume of historical data for training takes time. Furthermore, they are unable of detecting a black swan, which may be present in previous data. **Unsupervised:** Unsupervised algorithms train on unlabeled historical data, rather than label it, in the same way that supervised approaches train on log data. This approach often creates an anomalous space and a non-anomalous space for the anomalous and non-anomalous sequences, respectively [3; 4]. With the popularity of deep learning, deep-learning-based anomaly-detection models are frequently investigated [6; 8; 9; 43]. DL approaches include log parser, training, and prediction of the model. 1. Key value method: A study demonstrates that LSTM is more accurate than a log-key-based model at predicting the structure of anomalous and non-anomalous sessions [6; 43]. This is because log statements are processed into templates prior to being assigned log keys.