=Paper=
{{Paper
|id=Vol-2973/paper_137
|storemode=property
|title=Process Learning for Autonomous Process Anomaly Correction (Extended Abstract)
|pdfUrl=https://ceur-ws.org/Vol-2973/paper_137.pdf
|volume=Vol-2973
|authors=Timo Nolle
|dblpUrl=https://dblp.org/rec/conf/bpm/Nolle21
}}
==Process Learning for Autonomous Process Anomaly Correction (Extended Abstract)==
https://ceur-ws.org/Vol-2973/paper_137.pdf
Process Learning for Autonomous Process Anomaly
Correction (Extended Abstract)
Timo Nolle1
1
Technische Universität Darmstadt, Germany
Abstract
This dissertation makes several contributions to the field of business process management and process
anomaly detection in particular. It is demonstrated that process-aware machine learning can be em-
ployed to learn the logic behind a business process directly from an event log, and hence serve as an
approximation of a process model. The resulting model can be utilized for process anomaly detection,
allowing to automatically detect anomalies in event logs on event attribute level. Finally, it is shown
how a pair of machine learning models can generate alignments between an event log and the process
model, as approximated by the machine learning models. Altogether, this thesis demonstrates how the
benefits of conformance checking and process anomaly detection can be combined to achieve process
anomaly correction.
Keywords
Anomaly Detection, Deep Learning, Alignments, Business Process Management
1. Introduction
The automatic detection of divergences from a desired process behavior is a common research
topic in the business process management community. An established technique to analyze
processes is called conformance checking. The result is usually a so-called alignment that provides
insights into where the divergence has occurred and how the execution must be altered to
conform to the process model. While conformance checking can provide these alignments, it
does have a downside: It relies on the existence of a predefined process model. Such a process
model cannot be assumed to always be available, and if it is, it might be outdated or even wrong.
Contrary to conformance checking, process anomaly detection aims to find anomalous execu-
tions without relying on a predefined process model. A process anomaly detection algorithm
derives the process logic from the event log itself and exploits the patterns found within the
event log to distinguish normal from anomalous process executions. Thus, process anomaly
detection can be a feasible alternative to conformance checking if no process model is available.
However, most process anomaly detection algorithms focus on the identification of anomalous
cases, and therefore only provide a binary classification as output. Furthermore, they typically
require a threshold to be predefined, which is often quite challenging to determine.
Proceedings of the Demonstration & Resources Track, Best BPM Dissertation Award, and Doctoral Consortium at BPM
2021 co-located with the 19th International Conference on Business Process Management, BPM 2021, Rome, Italy,
September 6-10, 2021
" nolle@tk.tu-darmstadt.de (T. Nolle)
0000-0001-5114-8636 (T. Nolle)
© 2021 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0).
CEUR
Workshop
Proceedings
http://ceur-ws.org
ISSN 1613-0073 CEUR Workshop Proceedings (CEUR-WS.org)
State-of-the-art Contributions of this thesis
Right/Wrong Alignments Alignments
Threshold
P5
Anomaly
scores Process
Anomaly P3 / P4
Correction
Process Process P1 / P2
Conformance Learning
Anomaly Model
Checking
Detection
Event Event Process Event Event Event
Log Log Model Log Log Log
Figure 1: Comparison of the state-of-the-art and process anomaly correction
In this thesis, a new approach is proposed that combines the benefits of process anomaly
detection and conformance checking. It uses as input only the event log itself but produces
an output akin to the alignments from conformance checking. The technique is called process
anomaly correction. It is based on the application of a machine learning technique that exploits
the event log data structure to learn the underlying business process, which in this thesis is
referred to as process learning. Similar to how process mining can be seen as process-aware data
mining, process learning is process-aware machine learning.
Figure 1 compares the two state-of-the-art approaches, process anomaly detection and confor-
mance checking on the left, with the proposed approach process anomaly correction on the right.
Conformance checking, on the one hand, is based on an alignment function, 𝛼, that compares an
event log and a process model and produces the desired alignments. Process anomaly detection,
on the other hand, first infers an internal model from the event log and then uses a scoring
function, 𝜎, to assign an anomaly score to every case in the event log. These anomaly scores
are passed through a threshold function, 𝜏 , that maps the anomaly scores to 0 or 1.
This cumulative dissertation contains five publications (corresponding to P1 –P5 in Figure 1)
that demonstrate how process anomaly correction is achieved in a series of four core steps:
(1) The modeling phase of the process anomaly detection algorithm is replaced by a tailored
process learning neural network architecture. The resulting process learning model is used to
parameterize the three functions 𝜎 ′ , 𝜏 ′ , and 𝛼′ . (2) The scoring function 𝜎 is replaced by 𝜎 ′ to
allow for the detection of anomalous events and the detection of anomalous event attributes.
(3) The threshold function 𝜏 is replaced by 𝜏 ′ , a heuristic that is parameterized by the process
learning model. (4) The alignment algorithm 𝛼 is replaced by 𝛼′ which utilizes the process
learning model to produce alignments.
2. Contributions
To combine the benefits of conformance checking and process anomaly detection, this thesis
addresses three research questions:
RQ1 How can process anomaly detection provide results on event attribute level as opposed
to case level?
RQ2 How can process anomaly detection be automatically parameterized without relying on
external input?
RQ3 How can the concept of alignments from conformance checking be transferred to process
anomaly detection?
The following sections are dedicated to the three research questions and how the five individual
publications relate to them.
RQ1 : Providing Multi-perspective Detection (P1 and P2 )
This dissertation contains two publications, P1 and P2 , that address RQ1 . In P1 [1], we demon-
strated that denoising autoencoders can be extended to learn sequences of events coming from
a noisy event log by transforming the event log into a 2d tensor. We also showed that both the
input and the output of the autoencoder can be split up along the time dimension of the original
sequence, and hence the error can be computed for individual events of a case, rather than the
whole case at once. This novelty to autoencoders addressed RQ1 regarding the control-flow
perspective.
In P2 [2], we extend this idea to provide detection on event attribute level, incorporating
the data perspective. Instead of splitting the inputs and outputs of the autoencoder only along
the time dimension, additional dimensions can be added to facilitate the inclusion of the event
attributes. Altogether, we provided attribute-level process anomaly detection, answering RQ1 .
To demonstrate the significance in detection quality, we conducted a comprehensive eval-
uation of state-of-the-art anomaly detection techniques for discrete sequences, including all
process anomaly detection algorithms known to us at the time. By evaluating the performance
of all approaches on an elaborate data corpus of 600 synthetic and 100 real-life event logs,
we corroborated our preliminary results from 2016. The denoising autoencoder approach
outperformed all other methods.
RQ2 : Providing Automatic Parameterization (P3 and P4 )
The publications P3 and P4 focused on RQ2 , and partly on RQ3 . Our research on denoising
autoencoders had shown that a global threshold is not sufficient to accurately detect anomalies
on event and attribute level. To automatically parameterize the threshold function and address
RQ2 , the predictive capabilities of the process learning model can be utilized.
In P3 [3], we proposed the BINet neural network architecture that was tailored towards the
structure of event logs and was trained on the task of next event prediction. In comparison to
existing next event prediction solutions, BINet featured a specialized structure to incorporate
the data perspective in the learning process. To the best of our knowledge, BINet was the first
contribution to utilize recurrent neural networks for the purposes of process anomaly detection.
To detect anomalies, BINet assigns anomaly scores to every attribute in every event, based on
the probability of the respective attribute occurring in the next event in the case. However, one
must still define a threshold to define whether an anomaly score is high enough to indicate an
anomaly. Within this paper, we proposed the use of the elbow heuristic to mimic the human
intuition when assigning a threshold manually (e.g., by moving a slider in a graphical user
interface). We demonstrated that this heuristic outperforms existing state-of-the-art approaches.
In P4 [4], we demonstrated that utilizing the predictive capabilities of BINet, a rule-based
classifier can be constructed to identify different types of anomalies, such as rework, late
execution, or early execution. Moreover, we optimized the BINet neural architecture with
respect to computational efficiency and proposed three different versions of it. These versions
differ in the data dependencies they can model, namely: no dependencies (only the control-flow is
used), dependencies between the event activity and event attributes, and dependencies between
event attributes. Further, we refined the threshold heuristics from the previous publication and
introduced the lowest-plateau heuristic to more closely mimic human intuition. This publication
addresses a part of RQ3 since it provides anomaly classifications. To our knowledge, no other
process anomaly detection algorithm had incorporated anomaly classification.
RQ3 : Bringing Alignments to Process Anomaly Detection (P5 )
To be able to correct detected anomalies and thus answer RQ3 , the learned process model, as
approximated by BINet, had to be made accessible. Similar to how alignments in conformance
checking indicate skipped and incorrect events, BINet had to be utilized to alter sequences of
events by removing unnecessary events and adding skipped events.
In the last publication P5 [5], we introduced DeepAlign, a concept of aligning a case with a
process model, approximated by two separate BINet models. DeepAlign is based on two identical
but separate BINet models. One is processing the cases from the left (forward), while the other
is processing them from the right (backward). BINet can be utilized to calculate the probability
of an event given a sequence of preceding events. By iteratively calculating probabilities, the
individual probability for each event in a sequence can be computed. These probabilities are
computed both for the forward BINet and the backward BINet and are combined into a joint
probability for each event in the case.
To find the best alterations to a sequence, all possible single operation alterations are calcu-
lated, namely deletion, insertion (of any activity at any position), or leaving the sequence as is.
The altered sequences are ranked by their respective probability according to both BINet models.
Only the top-k sequences are selected and used for the next iteration. This procedure is repeated
until convergence, that is when no alteration to the top-k resulting sequences would yield a
higher probability. We demonstrated that the resulting sequence of alterations to the original
case can be transformed into a valid alignment. Comparing the performance of the DeepAlign
algorithm to state-of-the-art conformance checking methods based on alignments showed that
DeepAlign can outperform existing approaches both in the control-flow perspective as well as
in the data perspective.
3. Conclusion
The contribution of this dissertation is the combination of the benefits from both conformance
checking and process anomaly detection to create a new method, process anomaly correction.
Without relying on a priori knowledge about the process, process anomaly correction can provide
comparable, if not better, results than classical conformance checking. By lifting the restriction
of conformance checking relying on predefined process models, process anomaly correction can
provide the same quality of analysis across a variety of different scenarios, which until now,
required a process model to be created.
This dissertation further serves as an example that process learning as a general concept
can be utilized to infer complex process logic from event logs, without being specifically
programmed. The use case of process anomaly correction has shown that process learning can
model dependencies between the different process perspectives. Process learning significantly
reduces the effort of adding new concepts to a process model. As long as the event log contains
a sufficient amount of examples of the concept, process learning can pick up on the emerging
patterns. Process learning is mature enough to be applied in various other scenarios apart from
process anomaly correction. It offers a solid foundation for promising future research in the field
of BPM.
References
[1] T. Nolle, A. Seeliger, M. Mühlhäuser, Unsupervised anomaly detection in noisy business
process event logs using denoising autoencoders, in: Proceedings of the 19th International
Conference on Discovery Science – DS’16, Springer, 2016, pp. 442–456.
[2] T. Nolle, S. Luettgen, A. Seeliger, M. Mühlhäuser, Analyzing Business Process Anomalies
Using Autoencoders, Machine Learning 107 (2018) 1875–1893.
[3] T. Nolle, A. Seeliger, M. Mühlhäuser, BINet: Multivariate Business Process Anomaly
Detection Using Deep Learning, in: Proceedings of the 16th International Conference on
Business Process Management – BPM’18, 2018, pp. 271–287.
[4] T. Nolle, S. Luettgen, A. Seeliger, M. Mühlhäuser, BINet: Multi-perspective Business Process
Anomaly Classification, Information Systems (2019) 101458.
[5] T. Nolle, N. Thoma, A. Seeliger, M. Mühlhäuser, DeepAlign: Alignment-based Process
Anomaly Correction using Recurrent Neural Networks, in: Proceedings of the 32nd Inter-
national Conference on Advanced Information Systems Engineering – CAiSE’20, 2020, pp.
319–333.