# ADAL-NN: Anomaly Detection and Localization Using Deep Relational Learning in Distributed Systems
## 3 Methodology  
There are two primary techniques that constitute the ADAL-NN proposed methodology as described in Figure 2. Logs are parsed, converted into sentence-level embedding, and then a model is trained on the embedded logs using an Att-BiLSTM neural network in the offline mode. In online mode, we take a new log and tweak the relation graph, parse the log using a previously trained model, detect anomalies in real time, and pinpoint their location using the relation graph. We begin with an overview of this research, which is shown in Figure 2. This research is separated into offline processing and online processing sections. A description of the steps involved in detecting and localizing anomalies in log data in greater detail is as follows:  
1. Constructing R graph (offline): During the offline phase, we construct an ID relation graph (\(R\) graph) using historical log data. This involves analyzing the log data to identify relationships between various log messages and system components. By mapping the dependencies and correlations between log messages and components, the \(R\) graph provides a representation of the system's behavior and structure. 2. Log parsing (offline): In this step, we tokenize and dictionaries the historical log data. The log data are divided into individual words or tokens and are then grouped based on common word sets present in the dictionaries. This process allows us to extract numerous log templates that capture the natural utterances within the log data, as opposed to relying solely on event IDs. 3. Sentence embedding (offline): The sequence of bundled logs obtained from the log parsing step is further processed to encode semantic and temporal information. We employ the BERT (bidirectional encoder representations from transformers) encoder to capture the semantic information present in the log data. This transforms the log information into a high-dimensional embedding called \(E_{context}\). Additionally,  
Figure 2: Anomaly detection and localization architecture diagram. The offline phase involves four steps: constructing R graph, log parsing, sentence embedding, and Att-based Bi-LSTM. The online phase involves five steps: grouping by IDs, constructing Ri graph, log parsing, anomaly detection, and anomaly localization. the temporal information, which represents the order and timing of log events, is projected onto a separate high-dimensional embedding referred to as \(E_{time}\). * Att-based Bi-LSTM (offline): The semantic embedding (\(E_{context}\)) and the temporal embedding (\(E_{time}\)) obtained from the previous steps are concatenated and input into an Attention-based Bidirectional Long Short-Term Memory (Att-based Bi-LSTM) network. This network is trained to learn the characteristics of normal, abnormal, and performance-anomalous log sequences. By capturing temporal dependencies and semantic patterns, the Att-based Bi-LSTM model can effectively identify anomalies within log sequences. * Grouping by IDs (online): During the online phase, when a new log message is received in real time, it is correlated with existing log messages that share the same IDs. This step aims to understand the relationships and dependencies between the incoming log message and the previous log messages associated with the same IDs. By considering the contextual information within the log data, we can gain insights into the behavior of system components. * Constructing \(R_{i}\) graph (online): Based on the correlated log messages, a new instance-specific \(R\) graph, denoted as \(R_{i}\) graph, is instantiated. The \(R_{i}\) graph represents the current state of the system and captures any changes or deviations from the normal behavior observed during runtime. This graph can be leveraged to identify and analyze anomalies that occur in real time. * Log parsing (online): The \(R_{i}\) graph obtained from the previous step is passed through the log parsing stage, similar to the offline phase.