Anomaly Detection for Service-Oriented Business Processes Using Conformance Analysis

Abstract

A significant challenge for organisations is the timely identification of the abnormalities or deviations in their process executions. Abnormalities are generally due to missing vital aspects of a process or possession of unwanted behaviour in the process execution. Conformance analysis techniques examine the synchronisation between the recorded logs and the learned process models, but the exploitation of event logs for abnormality detection is a relatively under-explored area in process mining. In this paper, we proposed a novel technique for the identification of abnormalities in business process execution through the extension of available conformance analysis techniques. Non-traditional conformance analysis techniques are used to find correlations and discrepancies between simulated and observed behaviour in process logs. Initially, the raw event log is filtered into two variants, successful and failed, based upon the outcome of the instances. Successfully executed instances refer to an ideal conduct of process and are utilised to discover an optimal process model. Later, the process model is used as a behavioural benchmark to classify the abnormality in the failed instances. Abnormal behaviour is compiled grounded on three dimensions of conformance, control flow-based alignment, trace-level alignment and event-level alignment. For early predictions, we introduced the notion of conformance lifeline presenting the impact of varying fitness scores during process execution. We applied the proposed methodology to a real-world event log and presented several process-specific improvement measures in the discussion section.