# MDFULog: Multi-Feature Deep Fusion of Unstable Log Anomaly Detection Model
## 2 Related Work  
The steps of log anomaly detection include log gathering, log parsing, feature extraction, and anomaly detection. Logs are usually generated automatically by large systems, and each log contains the timestamp and logs' message information for a specific event. Since log messages are unstructured text, the goal of log parsing is to withdraw an event template from a set of logs for subsequent structuralanalysis. Presently, the log parsing methods can be classified into offline and online methods. In offline methods, [PERSON] et al. [4] proposed regular expressions to identify log templates. The clustering-based log parsing algorithm SLCT was proposed by [PERSON] et al. [5], which extracts log templates by clustering the same word sets that appear more frequently than the threshold in the log. [PERSON] et al. [6] proposed the IPLoM model based on hierarchical clustering, which iteratively clusters the message length, token position, and mapping relationship of the log layer by layer. Compared with SLCT, it does not require threshold setting. The limitation of the offline method is that it cannot perform real-time anomaly detection and needs to be retrained for novel log types. In order to meet the actual industrial needs, an online method that can be resolved in real-time for subsequent anomaly detection is proposed. [PERSON] et al. [7; 8] proposed the Spell algorithm for online log clustering based on the longest common subsequence. [PERSON] et al. [9] presented a Drain algorithm for log clustering based on the idea of a deep fixed tree. [PERSON] et al. [10] proposed the frequent template tree (FT-Tree) to obtain a log template by extracting the longest combination of words. [PERSON] et al. [11] proposed the template word embedding model Template2 Vec based on synonym and antonym sets, combining FT-Tree to generate a log template vector. [PERSON] et al. [12; 13] proposed the graph-based data structure to determine the similarity between logs, where log templates are extracted by clustering automation. However, as the quantity of log data enlarges, the effect of these methods will change significantly. After parsing the log into a separate event, it is necessary to encode it into different feature vectors for subsequent anomaly detection. The features include sequence features, variable value features, window features, the co-occurrence matrix, etc. The current anomaly detection methods are partitioned into supervised and unsupervised based on whether there are labeled training data. The accuracy of supervised anomaly detection models often relies on the number and accuracy of the training data. The supervision methods include logistic regression [14], decision trees [15], and SVM [16; 17; 18]. Unsupervised anomaly detection methods comprise various clustering methods [5], association rule mining [19], and PCA [20]. In recent years, some researchers have also applied deep learning to the field of anomaly detection, including CNNs [21], RNNs [22], LSTM [23; 24; 25; 26; 27], Bi-LSTM [28; 29; 30; 31], Auto-Encoder [32; 33], Transformer [34; 35; 36], the GRU [37; 38], Bert [39], and so on. Among them, the work [5] proposed the LogCluster method to identify online anomalies by clustering logs. The work [23] proposed the DeepLog method, which uses a deep learning model based on LSTM to model the system log and perform anomaly detection. DeepLog ignores the semantic information of logs. The work [24] trained the stacked LSTM to model normal and abnormal sequential patterns. The work [22] proposed the use of the attention-based RNN for anomaly detection, which enhanced the attention to anomaly detection in system logs and improved the interpretability of the model. However, it only concentrates on log events and overlooks the context relationship in the log sequence. The work [11] proposed the LogAnomaly model and realized the end-to-end log group and sequence anomaly detection through the anomaly detection model based on LSTM.