## 3 CFTL Log Parsing Method
### Algorithmic Details of CFTL  
After introducing the overall processing flow of CFTL, we describe how CFTL parses raw log messages, as shown in the second row of Table 1. \begin{table}
\begin{tabular}{c c c c c} \hline
**CFTL Steps** & **Log No.** & **Log Attribution** & **Group No.** & **Log and Template Content** \\ \hline \multirow{8}{*}{Raw log file} & 1 & / & Connection closed by user 72480 \\  & 2 & / & Connection reset by user 72480 \\  & 3 & Raw log & / & Invalid user test9 from 173.234.31.186 \\  & 4 & Messages & / & Invalid user adom from 173.234.31.186 \\  & 5 & / & Invalid user [PERSON] from 173.234.31.186 \\  & 6 & / & Invalid user [PERSON] from 173.234.31.186 \\  & 7 & / & PacketResponder 2 for block blk\_-6670 terminating \\ \hline \multirow{8}{*}{Preprocessing (Step 0)} & 1 & / & Connection closed by user * \\  & 2 & / & Connection reset by user * \\ \cline{1-1}  & 3 & Logs after & / & Invalid user test9 from * \\ \cline{1-1}  & 4 & Parameter & / & Invalid user adom from * \\ \cline{1-1}  & 5 & Erasing & / & Invalid user [PERSON] from * \\ \cline{1-1}  & 6 & / & Invalid user [PERSON] from * \\ \cline{1-1}  & 7 & / & PacketResponder * for block * terminating \\ \hline \end{tabular}
\end{table} 
Table 1: System logs and templates involved in CFTL. Figure 3: Outline of the proposed CFTL method, * is the simple parameters in the log event. **Preprocessing. ** Log file preprocessing using the CFTL method is very simple with regular expressions. Similar to other log parsing algorithms, specific parameters, such as IP addresses, and special symbols (colons or equal signs) are erased by empirical rules. This simple preprocessing improves log parsing accuracy. The CFTL method preprocesses log files by defining regular expressions that match log parameters and then erasing them. To improve the accuracy of CFTL and its ability to handle the overfitting challenges associated with the final templates in the preprocessing step, simple parameters can be erased. The advantages of this approach are obvious. When there is an uncertain number of simple parameters in the same log event, replacing them with \"*\" results in a situation in which the log length for the same type of event may not be the same, thereby affecting the final result. However, if simple parameters are directly erased, after preprocessing log messages with different simple parameters belonging to the same type of event, their log lengths are the same. **Clustering. ** The proposed CFTL method employs a two-step clustering strategy. First, whether the first word is the same is considered for clusters; then, the length of log messages is also considered, as shown in Figure 4. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**CFTL Steps** & **Log No.** & **Log Attribution** & **Group No.** & **Log and Template Content** \\ \hline \multirow{5}{*}{Clustering (Step 1)} & 1 & Processed Log & 1 & Connection closed by user * \\  & 2 & Messages & & Connection reset by user * \\  & 3 & (Grouped or & & Invalid user test9 from * \\  & 4 & clustered by the & 2 & Invalid user adom from * \\  & 5 & first token and & & Invalid user [PERSON] from * \\  & 6 & the length of & & Invalid user [PERSON] from * \\  & 7 & log messages) & 3 & PacketResponder * for block * terminating \\ \hline \multirow{5}{*}{Separating (Step 2)} & 1 & 1 & Connection closed by user * \\  & 2 & Processed Log & 2 & Connection reset by user * \\  & 3 & Messages & & Invalid user test9 from * \\  & 4 & (Making & 3 & Invalid user adom from * \\  & 5 & clustering results & & Invalid user [PERSON] from * \\  & 6 & more accurate) & & Invalid user [PERSON] from * \\  & 7 & & 4 & PacketResponder * for block * terminating \\ \hline \multirow{5}{*}{Extracting (Step 3)} & 1 & 1 & Connection closed by user * \\  & 2 & Generated Log & 2 & Connection reset by user * \\ \cline{1-1}  & 2 & Templates & 3 & Invalid user * from * \\ \cline{1-1}  & 4 & (Events) & 4 & PacketResponder * for block * terminating \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._  
Figure 4: Clustering step.