## 4 Experimental Analysis
### Analysis of Results
Using cosine similarity between the two datasets, we obtain a value of 0.9724, indicating that the vectors represented in these tensors are very similar in terms of their orientation in vector space. In other words, the embeddings of both tensors have very similar directions, even if their magnitudes (i.e., the length of the vectors) might be different. Since cosine similarity focuses on orientation and not magnitude, this high value suggests that the data represented by these embeddings share many features or patterns in the context being modeled by the vector space. Given that these embeddings result from running the 'bert-base-uncased' model on both the original and processed log files, it can be inferred that they share a similar context or semantic meaning. In the previous section, we verified the significant reduction in processing time of the 2 K and 20 M logs, achieving reductions of 760.8% and 995.8%, respectively, in tokenization time, and 989.5% and 999.8%, respectively, in BERT model training time. Finally, we analyzed the results of applying the BERT model to the processed 20 M log (HDFS_20M_HC) for anomaly detection, comparing it with other methods present in the literature. These methods are briefly described below:  
* PCA [13]: this work converts logs into vectors and then uses the Principal Component Analysis (PCA) algorithm to divide them into normal space and anomaly space. * Invariant Mining [30]: this paper proposes an Invariant Mining (IM) method to extract invariants from log vectors, which are labeled as anomalous logs. * LogCluster [31]: LogCluster proposes an approach that clusters logs for easier identification of issues based on logs and uses a knowledge base to reduce redundancy by pre-examining log sequences. * SVM [32]: this work represents log sequences as vectors and uses a Support Vector Machine (SVM) as its classification algorithm. * DeepLog [33]: DeepLog is a deep neural network model that uses LSTM to model a system log as a natural language sequence. * LogRobust [34]: LogRobust extracts semantic information from log events and represents them as semantic vectors. It uses a Bi-LSTM attention-based model to detect anomalous log sequences. To carry out this comparison, we used traditional evaluation metrics: precision, recall, and F1-Score. As shown in Table 5, our model (BERT_20M) has a precision of 88%, a recall of 86%, and an F1-Score of 83%. Comparing these results with those obtained by other methods, we observe that BERT_20M has a precision of 88%, which is lower than the best methods such as PCA, IM, LogCluster, and DeepLog, which reach 100% precision. However, it outperforms SVM, which has the worst precision with 62%. In terms of recall, BERT_20M obtains 86%, which is lower than the recall of LogCluster (96%) and LogRobust (91%), but significantly better than PCA, which has the worst recall with 67%. Regarding the F1-Score, BERT_20M achieves a value of 0.83. Although it is lower than LogCluster (0.96) and DeepLog (0.98), it surpasses PCA (0.70), which has the lowest F1-Score. Although the BERT_20M model does not achieve the best metrics compared to LogCluster and DeepLog, it offers considerably better performance than PCA and SVM.