# LogEDL: Log Anomaly Detection via Evidential Deep Learning
## 4 Methodology
### LogEDL
#### 4.5.3 Uncertainty  
After obtaining the evidence, the Dirichlet prior distribution is utilized to compute the uncertainty, which is then used for subsequent anomaly detection. The Dirichlet distribution is a probability density function (pdf) that defines the possible values of a probability  
Figure 4: ENN head.  
mass function (pmf) \(p\). It is characterized by \(K\) parameters \(\alpha=[\alpha_{1},\dots,\alpha_{k},\dots,\alpha_{K}]\) and is expressed as follows:  
\[Dir(p|\alpha)=\begin{cases}\frac{1}{\mathcal{B}(\alpha)}\prod_{k=1}^{K}p_{k}^{ \alpha_{k}-1},&for\;\;p\in P_{K}\\ 0,&otherwise\end{cases} \tag{2}\]  
where \(P_{K}\) is the K-dimensional unit simplex, \(P_{K}=\left\{p\;|\;\sum_{i=1}^{K}p_{i}=1\text{ and }0\leq p_{1},\cdots,p_{K}\leq 1\right\}\)\(\alpha_{k}\) represents the concentration parameter of the Dirichlet distribution, and \(K\) denotes the number of log key classes.  
According to belief theory [29], subjective logic provides a belief mass \(b_{k}\) for each singleton \(k=1,\cdots,K\), along with an overall uncertainty mass \(u\). These \(K+1\) mass values are non-negative and sum to 1, i.e.,  
\[u+\sum_{k=1}^{K}b_{k}=1 \tag{3}\]  
where \(u\geq 0\) and \(b_{k}\geq 0\), for \(k\;=\;1,\dots,\;K\).  
A belief mass \(b_{k}\) for a singleton \(k\) is computed using evidence for a singleton. Let \(e_{k}\geq 0\) be the evidence derived for the \(k^{th}\) singleton, then the belief \(b_{k}\) and the uncertainty \(u\) are computed as  
\[b_{k}=\frac{e_{k}}{\mathcal{S}}\text{ and }u=\frac{K}{\mathcal{S}} \tag{4}\]  
where \(\mathcal{S}=\sum_{k=1}^{K}\alpha_{k}\) is referred to as the Dirichlet strength, and a belief mass assignment, i.e., subjective opinion, corresponds to a Dirichlet distribution with parameters \(\alpha_{k}=e_{k}+1\).  
The probability is given by  
\[p_{k}=\frac{\alpha_{k}}{\mathcal{S}} \tag{5}\]  
We optimized the network by setting a suitable loss function, enabling it to effectively learn normal log sequences. By leveraging uncertainty, we identified unknown anomalous logs, thus determining whether a log sequence is anomalous. We use the K-simplex (illustrated as a triangular heatmap in Figure 5) to jointly represent the token classification probability and uncertainty at the masked positions. The uncertainty detection at [MASK] is particularly suitable for log anomaly detection. Using a three-class classification as an example and assuming the first class is the correct label, a well-calibrated model should give accurate and certain (AC) predictions (Figure 5a), indicating that the context for the [MASK] token is very certain. Accurate and uncertain (AU) predictions (Figure 5b) indicate that the model is somewhat confused by the context and cannot classify it well. Inaccurate and certain (IC) predictions (Figure 5c) suggest that the [MASK] token could have multiple possible values, which aligns well with the contextual variability in log sequences. Inaccurate and uncertain (IU) predictions (Figure 5d) indicate that the context for the [MASK] token is completely unfamiliar, suggesting a high likelihood of the log sequence being anomalous.  
Figure 5: Examples of probability simplex.