Matching business process behavior with encoding techniques via meta-learning: An anomaly detection study

Abstract

Recording anomalous traces in business processes diminishes an event log?s quality. The abnormalities may represent bad execution, security issues, or deviant behavior. Focusing on mitigating this phenomenon, organizations spend efforts to detect anomalous traces in their business processes to save resources and improve process execution. However, in many real-world environments, reference models are unavailable, requiring expert assistance and increasing costs. The considerable number of techniques and reduced availability of experts pose an additional challenge for particular scenarios. In this work, we combine the representational power of encoding with a Meta-learning strategy to enhance the detection of anomalous traces in event logs towards fitting the best discriminative capability between common and irregular traces. Our approach creates an event log profile and recommends the most suitable encoding technique to increase the anomaly detection performance. We used eight encoding techniques from different families, 80 log descriptors, 168 event logs, and six anomaly types for experiments. Results indicate that event log characteristics influence the representational capability of encodings. Moreover, we investigate the process behavior?s influence for choosing the suitable encoding technique, demonstrating that traditional process mining analysis can be leveraged when matched with intelligent decision support approaches.