| As the development of computer science, people’s work and life have becom e more automatic and informationalized. Most of the companies use some kind o ff information systems which can fulfill their need. These information systems gu ide the companies’routine work impliedly, and also record this work trail to eve nt logs. Accordingly, the companies’review object changed from manual records to system logs. The most important aim of review is to find out abnormal beha viors in routine work.This paper introduced several methods on how to detect abnormal behaviors and their advantages and disadvantages. We proposed a method based on process mining which can check out the detail information about abnormal behaviors an d can be understood and analyzed easily. Meanwhile, we introduced several proc ess mining algorithms. Before building our diagnosis model, we adapted a mix method to building the process model first, the method has combined Apriori alg orithm and alpha algorithm, and overcome some insufficient of alpha algorithm, i t can mine process from imperfectness logs. The process model is presented as SWF-NET, and then we use the fire rules of Petri-net to review each case in lo g. Appending some definition of abnormal types about the cases’executed results and some abnormal definition during pre-preparing the logs will finally form ou r diagnosis model.The experimental results demonstrate that our process mining algorithm is be tter than alpha in some condition, the diagnosis model can detect all given abnor mal behaviors and show us the detail, which indicates the model’s accuracy and superiority. |