## 2 Related Work  
### Log Parsing and Preprocessing  
Since log messages are unstructured texts, log parsing aims to extract a set of event templates for logs and perform a structured analysis. Current methods of log parsing can be divided into offline and online methods, where offline methods are further split into rule- or clustering-based. [PERSON] et al. [14] presented a method to identify log templates using regular expressions. However, it becomes more difficult to create and update regular expressions as the log volume increases. The first clustering-based log parsing algorithm, the Simple Logfile Clustering Tool (SLCT) [15], extracts log templates by clustering the word sets occurring more frequently than a threshold in logs. [PERSON] et al. [16] proposed the IPLoM algorithm based on hierarchical clustering, which clusters logs by iterating their message length, token location, and mapping relationships layer by layer. Unlike SLCT, no threshold setting is required. A limitation of offline methods is that offline parsing cannot perform real-time anomaly detection and must be retrained for newly emerging log types. Online methods that can be parsed in real-time for timely subsequent anomaly detection have been proposed to meet industrial needs. [PERSON] et al. [17; 18] proposed Spell, an algorithm based on the longest common sub-sequence method to cluster logs online, dynamically extracting log templates from incoming logs. The Drain algorithm [19] uses a deep fixed tree-based idea for clustering logs and can parse logs with stream processing and a just-in-time approach, which greatly reduces running time. [PERSON] et al. [20] established a frequent template tree (FT-Tree) to obtain log templates by extracting the longest combination of words with high frequency. [PERSON] et al. [21; 22] modeled event logs as graphs and utilized a graph clustering method to group log entries. [PERSON] et al. [23] evaluated multiple log parsing algorithms and found that the Drain method performed best. We choose Drain for log parsing due to its characteristics of high resolution and efficiency.  
Feature extraction [24] is a crucial step in anomaly detection. Identifying and extracting the most useful features from data enables models to develop a better understanding of the information and generate more effective input for subsequent tasks such as classification and clustering. Extracting these key features allows models to process more accurate data, leading to improved overall performance. Feature extraction methods for detecting log anomalies can be based either on log event counts [5; 6; 7; 8] or log event semantic information [2; 9]. The first type extracts log events from log messages and converts them to a message count feature space, leaving out the order of log events and the semantic information in the log messages, and therefore it cannot accurately perform log parsing. The latter type models log streams as natural language sequences, using word embedding to convert log events to vectors, based on which the authors train the model. However, existing methods of word-vector-weighted aggregation do not focus on word order relationships, and there is no guarantee that logs will have a unique representation. Moreover, the method is confined to the semantics of log events and can easily overlook other key values in the log for exception detection. Some exceptions do not necessarily manifest as deviations from the normal sequence of log events but rather as potential threats, such as component values that behave as exceptions. Therefore, the values of some specific parameters can be considered important factors in the log-based exception detection mode.