Natural language-based detection of semantic execution anomalies in event logs. Issue 102 (December 2021)

• Record Type: Journal Article
• Authors: van der Aa, Han; Rebmann, Adrian; Leopold, Henrik
• Is Part Of: Information systems. Issue 102(2021)
• Publication Date: 2021-12
• Subjects: Process mining -- Natural language processing -- Anomaly detection; Database management -- Periodicals; Electronic data processing -- Periodicals; Bases de données -- Gestion -- Périodiques; Informatique -- Périodiques; Database management; Electronic data processing; Periodicals; 005.7
• DOI: 10.1016/j.is.2021.101824
• Languages: English
• ISSNs: 0306-4379

Abstract

Abstract: Anomaly detection in process mining aims to recognize outlying or unexpected behavior in event logs for purposes such as the removal of noise and identification of conformance violations. Existing techniques for this task are primarily frequency-based, arguing that behavior is anomalous because it is uncommon. However, such techniques ignore the semantics of recorded events and, therefore, do not take the meaning of potential anomalies into consideration. In this work, we overcome this caveat and focus on the detection of anomalies from a semantic perspective, arguing that anomalies can be recognized when process behavior does not make sense . To achieve this, we propose an approach that exploits the natural language associated with events. Our key idea is to detect anomalous process behavior by identifying semantically inconsistent execution patterns. To detect such patterns, we first automatically extract business objects and actions from the textual labels of events. We then compare these against a process-independent knowledge base. By populating this knowledge base with patterns from various kinds of resources, our approach can be used in a range of contexts and domains. We demonstrate the capability of our approach to successfully detect semantic execution anomalies through an evaluation based on a set of real-world and synthetic event logs and show the complementary nature of semantics-based anomaly detection to existing frequency-based techniques. Highlights: We propose to detect anomalies in business processes based on the meaning of events. Our approach recognizes behavior as anomalous when it violates common-sense patterns. We employ state-of-the-art NLP techniques and a process-independent knowledge base. Our evaluation experiments reveal that our approach achieves accurate results. We show its complementary nature to existing, frequency-based detection approaches.