Abstract: The existing methods for business process anomaly detection cannot discover potential data flow drift that may occur in the business process model,and will classify reasonable data flow drift cases as abnormal cases,thereby reducing the accuracy of anomaly detection.A method for business process anomaly detection that combined data flow and control flow drift detection was proposed.Event attributes (data flow) in the event log were treated in the same way as the event names (control flow).A onehot encoding was used to uniformly encode them to obtain a case feature dataset.Then,an event attribute prediction model was built to obtain the probability distribution of all possible events and their attributes for the next event in the business process instance.Next,the above probability distribution was converted into anomaly scores to obtain candidate anomaly case sets.Then,the double-layer sliding window mechanism based on Hoeffding's inequality with concept drift ratio were used to identify the data flow and control flow drift cases from the candidate exception case set,and then the real exception cases are obtained.Finally,a cyclic update strategy was adopted using the obtained drift case set as new knowledge to update the event attribute prediction model,making the proposed method more accurate when detecting true business process anomalies.The simulation experiment results showed that the proposed method could accurately detect data flow drift in event logs,and achieve high anomaly detection accuracy for event logs containing data flow and control flow concept drifts by comparing to existing methods for business process anomaly detection.

Key words: business process anomaly detection, data flow drift, event attributes, concept drift ratio, model update

摘要： 现有的业务过程异常检测方法不能发现业务过程模型可能发生的数据流漂移,会将合理的数据流漂移案例判定为异常案例,降低了异常检测的准确性。因此,提出一种结合数据流和控制流漂移发现的业务过程异常检测方法。首先,将事件日志中的事件名（即控制流）与其他事件属性（即数据流）一样看待,使用独热编码对其进行统一编码,得到案例特征数据集。然后,构建事件属性预测模型来获取业务过程实例的下一事件的所有可能发生事件及其属性的概率分布。进一步,将以上概率分布转换为异常评分,得到候选异常案例集。接着,使用基于霍夫丁不等式的双层滑动窗口机制、概念漂移比率从候选异常案例集中识别出数据流、控制流漂移案例,进而得到真正的异常案例。最后,采用循环更新策略,使用得到的漂移案例集作为新知识来更新事件属性预测模型,使得所提出的方法更准确地检测出真正的业务过程异常。仿真实验结果表明,相比现有的业务过程异常检测方法,所提出的方法能够较准确地发现事件日志中的数据流漂移,对于包含数据流和控制流漂移的事件日志可以获得较高的异常检测准确性。

关键词: 业务过程异常检测, 数据流漂移, 事件属性, 概念漂移比率, 模型更新