Abstract: The existing business process anomaly detection methods assume that the business process is fixed and ignore the change of the business process model due to the conceptual drift,resulting in the decrease of the accuracy of the existing anomaly detection methods.For this reason,a business process anomaly detection method based on concept drift discovery using event log was proposed.A business process anomaly detection model was built based on Recurrent Neural Network(RNN)combined with concept drift discovery method.The data set with event sequence features was extracted from the event log.The event prediction module in the model was used to predict the probability of event occurrence,and the anomaly score of each case in the event log was calculated according to the probability distribution of event occurrence.The case of which the anomaly score was greater than the anomaly score threshold was considered as a candidate abnormal case.Hoeffding's inequality was used to judge whether the concept drifting had occurred,and the double-layer sliding window mechanism was used to obtain the locations of the concept drifting cases and extract the concept drifting cases.Using incremental learning,the event prediction module was update with concept drifting cases,so that the business process anomaly detection model could distinguish the concept drifting cases from the true anomaly cases,and more accurately detect the true business process anomalies.The experimental results showed that,compared with the mainstream business process anomaly detection methods,the proposed anomaly detection method could more accurately detect the conceptual drifting in the business process,and could more accurately detect the anomalies in the business process.The proposed method was of important significance to improve the stability of the business process.

Key words: business process, anomaly detection, concept drifting, sliding window, anomaly score threshold

摘要： 现有的业务过程异常检测方法假定业务过程固定不变,忽视因出现概念漂移而导致业务过程模型变化的情况,以致现有的异常检测方法准确率下降。提出一种使用事件日志、基于概念漂移发现的业务过程异常检测方法。构建结合概念漂移发现方法和基于循环神经网络的业务过程异常检测模型,从事件日志中提取事件序列特征数据集,使用该模型中的事件预测模块来预测事件发生的概率,根据事件发生的概率分布来计算事件日志中每个案例的异常分数。异常分数大于设定的异常评分阈值的事件所在的案例被认为是候选异常案例。使用霍夫丁不等式来判断概念漂移是否已发生,并使用双层滑动窗口机制来获取概念漂移案例的发生位置,从候选异常案例提取概念漂移案例。使用增量学习将概念漂移案例用于更新事件预测模块,使过程异常检测模型能够辨别概念漂移案例与真正异常案例,更准确地检测出真正的业务过程异常。实验结果表明,与主流的业务过程异常检测方法相比,所提异常检测方法可以较准确地发现业务过程中的概念漂移,能够更准确地检测出业务过程中发生的异常,对提高业务过程运行的平稳性有积极意义。

关键词: 业务过程, 异常检测, 概念漂移, 滑动窗口, 异常评分阈值