## 4 Experiments
### Experimental Environment  
All experiments were run on a machine with an Intel(R) Core(TM) i5-4690K CPU @ 3.50 GHz processor and 8 GB RAM. The proposed solution was implemented in the Python programming language (Version 3.9.7) with the support of the following external libraries and modules:  
* Modified Drain3 (Version 0.9.9) [37] log-parser module;
* Re [41]--regular expression library,
* NumPy (Version 1.21.5) [42]--module for scientific computing;* Pandas (Version 1.4.1) [43]--Python Data Analysis Library;
* fastText module (Version 0.9.2) [44], providing an implementation of the feature extraction model;
* Scikit-learn (Version 1.0.2) [45], providing an implementation of the classification algorithms. The Drain parser is configurable with a number of parameters that affect the log parsing process. The two most important parameters are the maximum depth of the parsing tree and the _simth_ parameter, which is the threshold value of the log and template similarity metric that must be exceeded for the log to be assigned to a particular template group. For the experiments, the maximum tree depth was set to 3 and the similarity threshold was set to 0.3, following the suggestions from [35]. Furthermore, the parameter specifying the maximum number of child nodes in the parsing tree was set to the default value--100. Experiments with the modification of the above parameters did not improve the results. During the training phase, the training set of logs was parsed by the Drain parser, which creates a set of log templates--a dictionary. However, in validation mode, such behavior is undesirable. In that phase, Drain's objective is to parse incoming logs and assign them to suitable template groups if their metrics exceed the similarity threshold and, if not, assign them to separate single groups instead of creating a new one for each unknown template. The reason for that is that the feature extraction model is only able to represent the log templates in vector form if they were present in the training dataset. Therefore, Drain was modified so that it could create the \(<*>\) wildcard template, which prevented the creation of new templates. During the parsing process of the training dataset on each fold, Drain created a dictionary containing on average 1551 log templates. In the validation phase, the parser identified on average 266 logs that did not match any template. They were aggregated to the wildcard template \"\(<*>\)\". The remaining logs from the validation dataset were assigned to suitable log template groups created during the training phase. After the log parsing process, the log templates were split into non-overlapping log sequences of various lengths--from 3 to 100. Table 1 provides a comparison of the number of sequences depending on the length of the window. The split into training and testing sets was performed as part of the cross-validation process using the repeated stratified K-fold method. This validation method preserves the class ratios in both training and validation datasets, making it more suitable for model validation on imbalanced datasets than the classic train/test approach. The validator was configured to create five data splits and make two iterations. fastText, the feature extraction algorithm, was configured to map words into a 100-dimensional feature space. Moreover, the parameter for the minimal number of word occurrences was set to 1, and the parameter for the maximum length of character \(n\)-grams was set to 0. Character \(n\)-grams, which are strings of \(n\) consecutive characters that make up a word, are used by the fastText algorithm to embed words that do not occur in the