# A Real-Time Semi-Supervised Log Anomaly Detection Framework for ALICE O\({}^{2}\) Facilities
## 4 Results and Discussion
### The Effect of Clustering Algorithm  
As illustrated in Figure 1, the BERTopic architecture employs a modular design that can be decomposed into distinct functional components. The clustering mechanism serves as the algorithm's core element, responsible for cluster identification and topic assignments. To assess BERTopic's performance characteristics, a comprehensive comparative analysis was conducted. As detailed in Table 6, this analysis evaluated three distinct clustering methodologies across the two datasets: K-means, DBSCAN, and HDBSCAN.  
For the InfoLogger dataset, HDBSCAN demonstrated superior performance with an F1-score of 0.975 while maintaining minimal FPR and FNR. DBSCAN also achieved competitive effectiveness with an F1-score of 0.956, whereas K-means showed significantly diminished performance, suggesting its inadequacy for density-based clustering requirements. In the BGL dataset analysis, DBSCAN emerged as the optimal clustering method, followed closely by the HDBSCAN. The K-means again demonstrated suboptimal performance, indicating its limitations in the efficiency of clustering the embeddings.  
Figure 5 reveals that the density-based clustering algorithms, specifically DBSCAN and HDBSCAN, demonstrated superior performance compared to K-means across both datasets. In particular, DBSCAN achieved optimal results when applied to the BGL dataset, whereas HDBSCAN exhibited maximum effectiveness in processing the InfoLogger dataset. Nevertheless, DBSCAN's functionality was limited by its requirement to yield uniform density across clusters, presenting a limitation for complex datasets. With HDBSCAN's hierarchical architecture, it was able to handle variable density distributions across different clusters which means it can effectively accommodate complex datasets like InfoLogger.  
Figure 6 presents the time consumption of each algorithm. The results indicate that K-means exhibited the longest training time compared to DBSCAN and HDBSCAN. Notably, when applied to larger datasets such as InfoLogger, the training time of K-means increased exponentially, highlighting its major limitation as a computationally expensive  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & \begin{tabular}{c} **Clustering** \\ **Method** \\ \end{tabular} & **P** & **R** & **F1** & **FFR** & **FNR** \\ \hline \
\begin{tabular}{c} Infologger \\ (CERN) \\ \end{tabular} &
\begin{tabular}{c} HDBSCAN \\ \end{tabular} & **0.955** & **0.995** & **0.975** & **0.000** & **0.005** \\  & DBSCAN & 0.923 & **0.995** & 0.956 & **0.000** & **0.005** \\  & K-means & 0.123 & 0.821 & 0.214 & 0.014 & 0.179 \\ \hline BGL & HDBSCAN & 0.814 & **0.930** & 0.865 & 0.016 & **0.070** \\  & DBSCAN & **0.953** & 0.924 & **0.938** & **0.003** & 0.076 \\  & K-means & 0.789 & 0.903 & 0.822 & 0.023 & 0.097 \\ \hline \hline \end{tabular} \(\overline{\text{P}}\) = Precision; R = Recall.  
\end{table}
Table 6: Performance of BERTopic’s clustering algorithms.  
algorithm. In contrast, DBSCAN and HDBSCAN demonstrated less time consumption, with HDBSCAN requiring slightly more training time than DBSCAN due to its hierarchical clustering mechanisms. Regarding inference time, both datasets exhibited competitive time consumption across all three algorithms.  
According to the common structure of HDBSCAN and DBSCAN, as mentioned in Section 3.5, the third experiment focused on the parameter optimization of HDBSCAN to investigate whether fine-tuning could address the limitations observed in the current default setting.