Abstract: Identifying and addressing anomalies in business processes is critical for maintaining operational stability.Although existing methods often detect anomalies through statistical analysis of frequency,infrequent behaviors do not necessarily indicate anomalies.Consequently,detecting anomalies from a semantic perspective has become a research focus.A semantic anomaly detection method for business processes called SemAD was proposed based on large language models.Specifically,a large language model was fine-tuned to reconstruct normal traces and detect anomalies based on reconstruction errors.Since each executed activity (event) is tokenized into multiple tokens,the anomaly score of an event is aggregated from the anomaly scores of all its constituent tokens,a novel token anomaly score calculation method was designed.Experiments demonstrated that SemAD surpassed existing state-of-the-art semantic anomaly detection methods in both generalization ability and learning of given processes.

Key words: business process, anomaly detection, large language model, process mining, event log

摘要： 识别并处理业务流程中的异常对于确保企业稳定运营至关重要。虽然现有方法常通过统计分析频率来发现异常,但低频行为并不一定代表异常,从语义角度检测异常因此已成为研究热点。本文提出了一种基于大语言模型的业务流程语义异常检测方法(SemAD),通过微调大语言模型使其能够重建正常轨迹,并根据重建误差检测异常情况。同时,本文设计了一种新颖的词元异常分数计算机制,考虑到每个执行的活动(事件)会被分词为多个词元,事件的异常分数通过对其对应词元的异常分数进行聚合得到。实验证明,SemAD在泛化能力和给定流程的学习方面均优于现有的最先进的业务流程语义异常检测方法。

关键词: 业务流程, 异常检测, 大语言模型, 流程挖掘, 事件日志