Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction

Knowledge-Based Systems, vol. 310, pp. 112970

Abstract

The business processes of organizations may deviate from normal control flow due to disruptive anomalies, including unknown, skipped, and wrongly-ordered activities. To identify these control-flow anomalies, process mining can check control-flow correctness against a reference process model through conformance checking, an explainable set of algorithms that allows linking any deviations with model elements. However, the effectiveness of conformance checking-based techniques is negatively affected by noisy event data and low-quality process models. To address these shortcomings and support the development of competitive and explainable conformance checking-based techniques for control-flow anomaly detection , we propose a novel process mining-based feature extraction approach with alignment-based conformance checking. This variant aligns the deviating control flow with a reference process model; the resulting alignment can be inspected to extract additional statistics such as the number of times a given activity caused mismatches. We integrate this approach into a flexible and explainable framework for developing techniques for control-flow anomaly detection . The framework combines process mining-based feature extraction and dimensionality reduction to handle high-dimensional feature sets, achieve detection effectiveness, and support explainability. The results show that the framework techniques implementing our approach outperform the baseline conformance checking-based techniques while maintaining the explainable nature of conformance checking. We also provide an explanation of why existing conformance checking-based techniques may be ineffective. Finally, the results indicate that detection effectiveness is not solely dependent on the specific framework technique used, as no one-size-fits-all process mining-based feature extraction approach is suitable for all the synthetic and real-world datasets.

Authors 3

1. Marco Pegoraro Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University, Ahornstr. 55, Aachen, 52074, Nordrhein-Westfalen, Germany

2. Wil M. P. van der Aalst
3. Nicola Mazzocca

   University of Naples Federico II

   Affiliation as printed

   University of Naples Federico II, Via Claudio, 21, Naples, 80125, Campania, Italy