Explainable Anomaly Detection Through Temporal Event Patterns in Distributed Information Systems

Distributed information systems generate extensive operational logs, making abnormal behavior difficult to identify through isolated events or frequency statistics alone. This study investigates an explainable anomaly detection framework that considers temporal event patterns and machine learning to support reliable system monitoring. The experimental investigation uses three Loghub benchmark datasets: HDFS_v1, Blue Gene/L (BGL), and OpenStack, while preserving their distinct annotation structures. The completed HDFS baseline experiment applies a Random Forest classifier to 29 event frequency features using a stratified 80:20 train test split. The model achieved 98.62% precision, 99.94% recall, and a 99.28% F1 score, with a PR AUC of 0.99894 and a ROC AUC of 0.99998. The confusion matrix recorded 47 false positives and two false negatives among 115,013 test sequences. Feature importance identified E20 as the leading predictor, with a score of approximately 0.288. These findings demonstrate the predictive value of event frequency information for HDFS anomaly classification. The study provides an empirical baseline for subsequent temporal modeling, explanation analysis, and cross dataset evaluation, supporting further development of interpretable log based monitoring systems.