# ADAL-NN: Anomaly Detection and Localization Using Deep Relational Learning in Distributed Systems
## 4 Implementation
### Discussion  
The comparative results of different models are given in Figure 5. These include deep-learning-based models i.e., Principle Component Analysis (PCA), Initial Margin (IM), Support Vector Machine (SVM), and Neural Network (NN) on HDFS illustrated in Figure 5a, BGL illustrated in Figure 5b, and Papertrail illustrated in Figure 5c data. These illustrated data were actually weighted average F1 scores of different models as we considered them for evaluation purposes. We also examine the offline training time and online inference time of the anomaly-detection model on the HDFS dataset. This investigation's execution time is measured in milliseconds per sequence (ms/seq). In Table 5, we compare the runtime of the anomaly-detection component of deep-learning-based models and models that do not use deep learning. Training time corresponds to offline training cost, while real or inference time corresponds to online detection time. These times were carried out by using a Python library \"timeit\", which is used to calculate the execution time of the algorithm. Due to the fact that a deep-learning-based model must be trained over multiple epochs, only the runtime of one epoch is presented here. Due to the immense complexity of deep-learning-based models and the limited resources of this research's experimental contexts, it is evident that deep-learning-based models are significantly slower than models that do not utilize deep learning. The ADAL-NN requires four times as much training as alternatives. This is acceptable, as the overhead incurred during offline training has no bearing on the online runtime of anomaly detection. The online inference time of the ADAL-NN is roughly double that of LogRobust. Given that this model is a three-classification problem and LogRobust is a two-classification task, it may take longer to learn and predict an additional class. Figure 5: Evaluation of a model based on a comparison of multiple models using distinct datasets. (**a**) HDFS anomaly-detection evaluation. PCA, IM, SVM, and NN F1 scores are 0.68, 0.85, 0.83, 0.90, respectively. (**b**) BGL anomaly-detection evaluation. PCA, IM, SVM, and NN F1 scores are 0.46, 0.86, 0.87, 0.90, respectively. (**c**) PT anomaly-detection evaluation. PCA, IM, SVM, and NN F1 scores are 0.66, 0.67, 0.82, 0.88, respectively. A large-scale system may generate over 60 GB of logs per hour, or 120 million log lines [2] (i.e., 6 million log sequences assuming each sequence comprises 20 log lines). According to Table 3, due to the limited processing power and device memory of a single Z-book system, it takes approximately one thousand minutes. We have also run the ADAL-NN in parallel on an eight-core CPU, which has a significant impact on the online detection time. The results indicate that it takes approximately 50 min to process such a large volume of log data. The proposed method presents a notable advancement in terms of efficiency, robustness, and generalization compared to existing approaches. Firstly, in terms of efficiency, the method incorporates various optimizations and techniques that enable faster processing and analysis of log data. By constructing the ID relation graph during the offline phase and leveraging log parsing and sentence embedding techniques, the method efficiently extracts and encodes the relevant semantic and temporal information from log sequences. This streamlined process reduces computational overhead and improves the overall efficiency of anomaly detection and localization. Secondly, the method exhibits enhanced robustness compared to previous approaches. By employing an attention-based Bi-LSTM, the model effectively captures the intricate patterns and dependencies within log sequences, enabling accurate detection and localization of anomalies. The use of deep learning techniques enhances the model's ability to handle complex and diverse log data, making it more robust in detecting anomalies across different scenarios and system environments.