Multi-Perspective Approach for Anomalous Behavior Detection and Repairing

Abstract

Event logs of business systems are often dirty owing to recording errors or system conventions, and this dirty data can definitely affect the quality of the event logs. Consequently, many anomalous behaviors that deviate from pre-established process models are frequently seen in event logs. To properly assess and enhance business processes, it is imperative to identify and correct such anomalous behaviors. When the missing or anomalous location is known, the current repair methods have a high success rate; however, when the missing or anomalous location is unknown, they do not function well. Therefore, a formalized solution using an activity feature graph is proposed for event logs where uncertainty arises from missing, duplicate, and replaced occurrences. Several prediction and repair models are used in conjunction with the viewpoints of control flow and data flow to identify and address anomalous behaviors in event logs. In addition to fixing exceptions at the case level, the proposed repairing approach can also correct exceptions at the attribute level, or feature repairing. Process analysts are provided with an activity feature graph to examine and refine the repair outcomes. Finally, four event logs with various anomaly ratios are used to confirm the method's viability.