## 3 Concepts and Problems
### MoLFI  
To acquire the log message types, the MoLFI (Multi-objective Log message Format Identification) method [24] utilizes the multi-objective genetic algorithm, NSGA-II [25]. NSGA-II first randomly generates a pool of chromosomes, which is also known as the population. A chromosome is a possible solution for the problem in question. To imitate the selection and replication process that can be seen in nature, it improves and evolves the chromosomes through continuous iterations, which are called generations. In each iteration, NSGA-II employs binary tournament selection [25] to find the best solutions that will be reproduced. With the use of mutation and crossover, a new chromosome is created from two of the chromosomes from the current iteration. Crossover swaps parts of the parent chromosomes to create new ones, while mutation slightly changes the newly generated chromosomes. From these chromosomes, a new generation is created with the use of crowding distance [25]. The MoLFI algorithm works in a similar fashion.  
Before using the steps of NSGA-II, MoLFI pre-processes data with the use of domain knowledge and regular expressions to filter out clearly variable tokens, such as IP addresses, error codes that consist of only numbers, and so on. Such guidelines can be found in [22]. These variables are changed to a special \"#spect#\" token that cannot be modified later. The deletion of duplicate entries and the tokenization are also performed here. The messages are also partitioned based on the number of tokens they have. In the end, the group \(G_{L}\) contains all the entries that contain \(L\) tokens.  
To accelerate the speed, a two-level encoding schema is defined, where a chromosome contains a set of groups that are each a collection of event types with the same length. More formally,  
\[C=\{G_{1},G_{2},\ldots,G_{max}\}, \tag{1}\]  
where a group, \(G_{L}=\{t_{1},t_{2},\ldots,t_{k}\}\), is a set containing \(k\) templates that consist of the same number of words, \(L\). With this encoding schema, they ensure that only entries of the same length are matched in the later steps.  
In the first step, the initial population \(P\) is created from \(M\), which is a set of pre-processed log messages, and \(N\), the size of the population. After the creation of one previously introduced \(C\) chromosome, it is packed with one group of event types, \(G_{L}\), for each group. At first, \(G_{L}\) is empty. The algorithm selects a log entry from the unmatched collection (initially, every entry is located here) and creates a \(t\) template which is a copy of the original message except that one of its tokens is changed to a wildcard \"*\". The token to be modified is selected randomly. The entry is then deleted from the unmatched set and the template \(t\) is added to \(G_{L}\). This is repeated as long as the unmatched set contains messages.  
In the next step, the uniform crossover operation [26; 27] is used to shuffle the characteristics of the parents that were selected from the previous population with the use of binary tournament selection [25], \(P_{1}=\{G_{1p_{1}},G_{2p_{1}},\ldots,G_{max_{P_{1}}}\}\) and \(P_{2}=\{G_{1p_{2}},G_{2p_{2}},\ldots,G_{max_{P_{2}}}\}\). A random binary vector is used to create two children, \(C_{1}\) and \(C_{2}\). If the vector's \(i\)th element is 1, then \(C_{1}\) inherits \(G_{i_{P_{2}}}\) and \(C_{2}\) inherits \(G_{i_{P_{1}}}\); if the vector's \(i\)th element is anything other than 1, the result will be the other way around.  
In the last step, the newly generated children are mutated. Each group in the chromosome has a \(\frac{1}{G_{max}}\) chance of being mutated. The mutation is performed by changing one of its \(t_{1}\) templates with the removal or addition of a variable token. Each token has a \(\frac{1}{t_{k}}\) probability of being changed.  
At the end of the NSGA-II algorithm, the set of feasible solutions is post-processed, namely, the knee point [28], a Pareto optimal solution, is selected to be the final product.