Process Learning for Autonomous Process Anomaly Correction (Extended Abstract) Timo Nolle1 1 Technische Universität Darmstadt, Germany Abstract This dissertation makes several contributions to the field of business process management and process anomaly detection in particular. It is demonstrated that process-aware machine learning can be em- ployed to learn the logic behind a business process directly from an event log, and hence serve as an approximation of a process model. The resulting model can be utilized for process anomaly detection, allowing to automatically detect anomalies in event logs on event attribute level. Finally, it is shown how a pair of machine learning models can generate alignments between an event log and the process model, as approximated by the machine learning models. Altogether, this thesis demonstrates how the benefits of conformance checking and process anomaly detection can be combined to achieve process anomaly correction. Keywords Anomaly Detection, Deep Learning, Alignments, Business Process Management 1. Introduction The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. The result is usually a so-called alignment that provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. While conformance checking can provide these alignments, it does have a downside: It relies on the existence of a predefined process model. Such a process model cannot be assumed to always be available, and if it is, it might be outdated or even wrong. Contrary to conformance checking, process anomaly detection aims to find anomalous execu- tions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Thus, process anomaly detection can be a feasible alternative to conformance checking if no process model is available. However, most process anomaly detection algorithms focus on the identification of anomalous cases, and therefore only provide a binary classification as output. Furthermore, they typically require a threshold to be predefined, which is often quite challenging to determine. Proceedings of the Demonstration & Resources Track, Best BPM Dissertation Award, and Doctoral Consortium at BPM 2021 co-located with the 19th International Conference on Business Process Management, BPM 2021, Rome, Italy, September 6-10, 2021 " nolle@tk.tu-darmstadt.de (T. Nolle)  0000-0001-5114-8636 (T. Nolle) © 2021 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). CEUR Workshop Proceedings http://ceur-ws.org ISSN 1613-0073 CEUR Workshop Proceedings (CEUR-WS.org) State-of-the-art Contributions of this thesis Right/Wrong Alignments Alignments Threshold P5 Anomaly scores Process Anomaly P3 / P4 Correction Process Process P1 / P2 Conformance Learning Anomaly Model Checking Detection Event Event Process Event Event Event Log Log Model Log Log Log Figure 1: Comparison of the state-of-the-art and process anomaly correction In this thesis, a new approach is proposed that combines the benefits of process anomaly detection and conformance checking. It uses as input only the event log itself but produces an output akin to the alignments from conformance checking. The technique is called process anomaly correction. It is based on the application of a machine learning technique that exploits the event log data structure to learn the underlying business process, which in this thesis is referred to as process learning. Similar to how process mining can be seen as process-aware data mining, process learning is process-aware machine learning. Figure 1 compares the two state-of-the-art approaches, process anomaly detection and confor- mance checking on the left, with the proposed approach process anomaly correction on the right. Conformance checking, on the one hand, is based on an alignment function, 𝛼, that compares an event log and a process model and produces the desired alignments. Process anomaly detection, on the other hand, first infers an internal model from the event log and then uses a scoring function, 𝜎, to assign an anomaly score to every case in the event log. These anomaly scores are passed through a threshold function, 𝜏 , that maps the anomaly scores to 0 or 1. This cumulative dissertation contains five publications (corresponding to P1 –P5 in Figure 1) that demonstrate how process anomaly correction is achieved in a series of four core steps: (1) The modeling phase of the process anomaly detection algorithm is replaced by a tailored process learning neural network architecture. The resulting process learning model is used to parameterize the three functions 𝜎 ′ , 𝜏 ′ , and 𝛼′ . (2) The scoring function 𝜎 is replaced by 𝜎 ′ to allow for the detection of anomalous events and the detection of anomalous event attributes. (3) The threshold function 𝜏 is replaced by 𝜏 ′ , a heuristic that is parameterized by the process learning model. (4) The alignment algorithm 𝛼 is replaced by 𝛼′ which utilizes the process learning model to produce alignments. 2. Contributions To combine the benefits of conformance checking and process anomaly detection, this thesis addresses three research questions: RQ1 How can process anomaly detection provide results on event attribute level as opposed to case level? RQ2 How can process anomaly detection be automatically parameterized without relying on external input? RQ3 How can the concept of alignments from conformance checking be transferred to process anomaly detection? The following sections are dedicated to the three research questions and how the five individual publications relate to them. RQ1 : Providing Multi-perspective Detection (P1 and P2 ) This dissertation contains two publications, P1 and P2 , that address RQ1 . In P1 [1], we demon- strated that denoising autoencoders can be extended to learn sequences of events coming from a noisy event log by transforming the event log into a 2d tensor. We also showed that both the input and the output of the autoencoder can be split up along the time dimension of the original sequence, and hence the error can be computed for individual events of a case, rather than the whole case at once. This novelty to autoencoders addressed RQ1 regarding the control-flow perspective. In P2 [2], we extend this idea to provide detection on event attribute level, incorporating the data perspective. Instead of splitting the inputs and outputs of the autoencoder only along the time dimension, additional dimensions can be added to facilitate the inclusion of the event attributes. Altogether, we provided attribute-level process anomaly detection, answering RQ1 . To demonstrate the significance in detection quality, we conducted a comprehensive eval- uation of state-of-the-art anomaly detection techniques for discrete sequences, including all process anomaly detection algorithms known to us at the time. By evaluating the performance of all approaches on an elaborate data corpus of 600 synthetic and 100 real-life event logs, we corroborated our preliminary results from 2016. The denoising autoencoder approach outperformed all other methods. RQ2 : Providing Automatic Parameterization (P3 and P4 ) The publications P3 and P4 focused on RQ2 , and partly on RQ3 . Our research on denoising autoencoders had shown that a global threshold is not sufficient to accurately detect anomalies on event and attribute level. To automatically parameterize the threshold function and address RQ2 , the predictive capabilities of the process learning model can be utilized. In P3 [3], we proposed the BINet neural network architecture that was tailored towards the structure of event logs and was trained on the task of next event prediction. In comparison to existing next event prediction solutions, BINet featured a specialized structure to incorporate the data perspective in the learning process. To the best of our knowledge, BINet was the first contribution to utilize recurrent neural networks for the purposes of process anomaly detection. To detect anomalies, BINet assigns anomaly scores to every attribute in every event, based on the probability of the respective attribute occurring in the next event in the case. However, one must still define a threshold to define whether an anomaly score is high enough to indicate an anomaly. Within this paper, we proposed the use of the elbow heuristic to mimic the human intuition when assigning a threshold manually (e.g., by moving a slider in a graphical user interface). We demonstrated that this heuristic outperforms existing state-of-the-art approaches. In P4 [4], we demonstrated that utilizing the predictive capabilities of BINet, a rule-based classifier can be constructed to identify different types of anomalies, such as rework, late execution, or early execution. Moreover, we optimized the BINet neural architecture with respect to computational efficiency and proposed three different versions of it. These versions differ in the data dependencies they can model, namely: no dependencies (only the control-flow is used), dependencies between the event activity and event attributes, and dependencies between event attributes. Further, we refined the threshold heuristics from the previous publication and introduced the lowest-plateau heuristic to more closely mimic human intuition. This publication addresses a part of RQ3 since it provides anomaly classifications. To our knowledge, no other process anomaly detection algorithm had incorporated anomaly classification. RQ3 : Bringing Alignments to Process Anomaly Detection (P5 ) To be able to correct detected anomalies and thus answer RQ3 , the learned process model, as approximated by BINet, had to be made accessible. Similar to how alignments in conformance checking indicate skipped and incorrect events, BINet had to be utilized to alter sequences of events by removing unnecessary events and adding skipped events. In the last publication P5 [5], we introduced DeepAlign, a concept of aligning a case with a process model, approximated by two separate BINet models. DeepAlign is based on two identical but separate BINet models. One is processing the cases from the left (forward), while the other is processing them from the right (backward). BINet can be utilized to calculate the probability of an event given a sequence of preceding events. By iteratively calculating probabilities, the individual probability for each event in a sequence can be computed. These probabilities are computed both for the forward BINet and the backward BINet and are combined into a joint probability for each event in the case. To find the best alterations to a sequence, all possible single operation alterations are calcu- lated, namely deletion, insertion (of any activity at any position), or leaving the sequence as is. The altered sequences are ranked by their respective probability according to both BINet models. Only the top-k sequences are selected and used for the next iteration. This procedure is repeated until convergence, that is when no alteration to the top-k resulting sequences would yield a higher probability. We demonstrated that the resulting sequence of alterations to the original case can be transformed into a valid alignment. Comparing the performance of the DeepAlign algorithm to state-of-the-art conformance checking methods based on alignments showed that DeepAlign can outperform existing approaches both in the control-flow perspective as well as in the data perspective. 3. Conclusion The contribution of this dissertation is the combination of the benefits from both conformance checking and process anomaly detection to create a new method, process anomaly correction. Without relying on a priori knowledge about the process, process anomaly correction can provide comparable, if not better, results than classical conformance checking. By lifting the restriction of conformance checking relying on predefined process models, process anomaly correction can provide the same quality of analysis across a variety of different scenarios, which until now, required a process model to be created. This dissertation further serves as an example that process learning as a general concept can be utilized to infer complex process logic from event logs, without being specifically programmed. The use case of process anomaly correction has shown that process learning can model dependencies between the different process perspectives. Process learning significantly reduces the effort of adding new concepts to a process model. As long as the event log contains a sufficient amount of examples of the concept, process learning can pick up on the emerging patterns. Process learning is mature enough to be applied in various other scenarios apart from process anomaly correction. It offers a solid foundation for promising future research in the field of BPM. References [1] T. Nolle, A. Seeliger, M. Mühlhäuser, Unsupervised anomaly detection in noisy business process event logs using denoising autoencoders, in: Proceedings of the 19th International Conference on Discovery Science – DS’16, Springer, 2016, pp. 442–456. [2] T. Nolle, S. Luettgen, A. Seeliger, M. Mühlhäuser, Analyzing Business Process Anomalies Using Autoencoders, Machine Learning 107 (2018) 1875–1893. [3] T. Nolle, A. Seeliger, M. Mühlhäuser, BINet: Multivariate Business Process Anomaly Detection Using Deep Learning, in: Proceedings of the 16th International Conference on Business Process Management – BPM’18, 2018, pp. 271–287. [4] T. Nolle, S. Luettgen, A. Seeliger, M. Mühlhäuser, BINet: Multi-perspective Business Process Anomaly Classification, Information Systems (2019) 101458. [5] T. Nolle, N. Thoma, A. Seeliger, M. Mühlhäuser, DeepAlign: Alignment-based Process Anomaly Correction using Recurrent Neural Networks, in: Proceedings of the 32nd Inter- national Conference on Advanced Information Systems Engineering – CAiSE’20, 2020, pp. 319–333.