# ADAL-NN: Anomaly Detection and Localization Using Deep Relational Learning in Distributed Systems
###### Abstract
Latency issues are a main indicator of biased failure [13], which refers to partially compromised functionalities [1; 14; 15; 16; 17]. Frequently, it is necessary to analyze a variety of system observations, including log data, to determine whether or not there is a performance issue, and discovering hidden issues in log data can help to improve system reliability. For the detection and localization of anomalies in distributed systems, there are a variety of methods available. Here are some common methods that are frequently employed:  
* Statistical analysis: This technique entails analyzing performance metrics and other system data to identify anomalous patterns or deviations from normal behavior. Statistical methods such as hypothesis testing and regression analysis can be used to identify and comprehend anomalies. * Machine Learning: Machine learning algorithms can be used to first learn the typical behavior of a system and then to detect and label as anomalies any behavior that deviates from the learned normal behavior. This method can be used in conjunction with statistical analysis techniques to manage large amounts of data. * Rule-based systems: A set of rules or thresholds are defined to identify anomalies based on specific conditions or events. For instance, a rule could be configured to trigger an alarm if a server's CPU utilization exceeds a certain threshold. * Heuristic techniques: They employ human expertise and intuition to identify anomalies based on patterns or trends in the data. This may involve manual inspection of log data or other types of data or the use of automated tools that employ heuristics to detect anomalies. * Graph-based systems: Graph-based systems use graph theory and network analysis techniques to determine dependencies and correlations between a system's various components. This is useful for identifying anomalies that may not be immediately apparent from individual metrics or events. One approach to detect and locate anomalies in distributed systems is by leveraging neural networks and relation graphs. Neural networks are models of machine learning that can be trained to recognize patterns and correlations in data, making them well suited for anomaly detection in distributed systems. Relation graphs, on the other hand, are graphical representations of the relationships between various distributed system components or subsystems. By combining these two methods, it is possible to not only detect anomalies but also to identify the specific components or subsystems that are causing them. We provide a log anomaly detection and localization tool based on techniques of deep learning. The application excels at managing unstructured interleaved logs, which may contain both natural language text and IDs within individual log messages. This is one of the areas in which the application shines. Changes to log time intervals and log sequence orders are identified as two typical forms of log modification based on real-world log data. This research focuses on log-based data anomalies, including sequential-based log anomalies and latency issues, taking into account the aforementioned two categories as the primary considerations. This research is conducted in stages, the first of which is relation construction, followed by log parser, anomaly identifier, and then anomaly localizing. A step that takes place offline is distinct from a phase that takes place online. Instead of assigning log templates an index, this work uses BERT, which is an encoder module of modern transformers [18], to encode the semantic information in the templates. BERT makes templates resistant to updated arriving templates and takes temporal data into account through projection onto large-dimensional embeddings. During the online phase, encoded templates are used to detect and localize anomalies in log data. The following are the four major contributions to this research:  
1. We propose a novel method for processing online logs that are dictionary based and generalized without the need for any parameter tuning.