# A Real-Time Semi-Supervised Log Anomaly Detection Framework for ALICE O\({}^{2}\) Facilities
## 5 Conclusions  
In conclusion, this research has presented a framework for log-based anomaly detection that effectively combines natural language processing techniques with density-based clustering algorithms. Through comprehensive experimental evaluation, we demonstrated several key contributions to the field. First, our framework demonstrated remarkable resilience in processing raw log messages, delivering exceptional performance metrics. It  
Figure 11: Magnified rectangular area of Figure 10, highlighting the examples of log message’s content in a brown cluster. achieved F1-scores of 0.957 and 0.958 for the InfoLLogger and BGL datasets, respectively. This remarkable performance eliminated the need for complex preprocessing configurations that often require dataset-specific tuning. This capability significantly enhances the framework's practical applicability in real-world scenarios. Second, our comparative analysis established the superiority of density-based clustering approaches over traditional methods. Both DBSCAN and HDBSCAN demonstrated more competitive performance compared to K-means clustering, with DBSCAN proving particularly effective as a default configuration for datasets with static density distributions, such as InfoLogger. Additionally, HDBSCAN excelled in handling varying cluster densities, a critical feature for real-world log analysis, for which log message distributions are inherently heterogeneous. The integration of SBERT embeddings with BERTopic further enhanced this framework, enabling the sophisticated semantic representation of log messages without requiring extensive preprocessing. Our research extends the application of topic modeling techniques to anomaly detection, equipping system administrators with interpretable topic distributions that enhance log message classification and analysis. The framework integrates real-time intervention capabilities through a comprehensive dashboard, enabling users to detect anomalies and respond to potential issues with minimal delay. Since logging systems vary and require dedicated tuning based on dataset characteristics, as discussed in the sections on InfoLogger and BGL in this study, our framework is built for adaptability. This flexibility makes it suitable for different real-world logging environments, providing a robust solution for log-based anomaly detection. These findings not only validate our approach but also contribute to the understanding of log-based anomaly detection systems. Future research could explore the framework's adaptability to different log sources and its potential integration with real-time monitoring systems. Additionally, since our current approach relies on a semi-supervised setup by guiding the model with seed words, future work could investigate the feasibility of an unsupervised method or an automated approach to generating seed words to reduce human dependency in the system. Methodology, A.T.; Validation, S.T., V.C.B. and P.P. ; Writing--original draft, A.T.; Writing--review & editing, S.T., V.C.B. and P.P. ; Project administration, V.C.B. All authors have read and agreed to the published version of the manuscript. This research was funded by NSRF via the Program Management Unit for Human Resources & Institutional Development, Research and Innovation under grant number B39G670016, and this research was funded by the National Science and Technology Development Agency grant number P-19-51650. Not applicable. The data presented in this study are both available publicly and available upon request from the corresponding author. For the BGL dataset, the data are publicly available at [[https://github.com/logpai/loghub](https://github.com/logpai/loghub)]([https://github.com/logpai/loghub](https://github.com/logpai/loghub)) (accessed on 17 March 2025). For the InfoLogger dataset, the data are not publicly available due to CERN's privacy.