Research On Process Anomaly Detection Method Based On Autoencoder

Unsupervised anomaly detection has a wide application prospect in the field of process mining.In recent years,many models in machine learning and deep learning have been used to detect anomalies in logs.Among them,autoencoders have attracted much attention because of their simple model structure and good detection effect.Addressing to the problem of change detection of traces with hidden transitions,this paper proposed trace change mining method,and learned the correlation relationship of activities in traces based on the anomaly detection idea of autoencoder.Furthermore,the proposed method in this paper combined the behavior contour matrix of trace and deep self-coding Gaussian mixture model together,in order to improve the detection effect.The main research contents are as follows:(1)Addressing to the problem that some trace change operations with hidden transitions cannot be detected by using the behavior contour relation between activities,an approach of trace change mining method based on autoencoder is proposed.In the scenarios that the reference model of the business system keeps unknown and the traces in the original log are changed,though some changes have been operated,such as adding hidden transitions and other operations,however the activities behavior relationship may keep the same as the previous one.Hence,the autoencoder is used to learn the distribution characteristics of the original log.It is can be achieved that any kind of change operation can be detected from the perspective of trace change mining,and the change can be in the form of delete,insert or move operation.changes occur in each trace in the actual log to realize active change mining from the trace perspective.(2)The performance of an autoencoder-based anomaly detection method depends on the size of the gap between the reconstruction errors generated by the model of normal trace and abnormal trace.The larger the gap between their reconstruction errors is,the more likely the autoencoder is to find the abnormal trace.Therefore,how to expand the reconstruction error gap between normal trace and abnormal trace is the key to improve the anomaly detection performance of the autoencoder.In order to solve this problem,a Transformer-AE model is proposed.The correlation between activities in the encoder network learning trace of the Transformer model is used to expand the reconstruction error gap between normal data and abnormal data,which significantly improves the anomaly detection performance of the autoencoder.(3)The method based on dimensionality reduction of autoencoder has the problem that it cannot retain the basic information in the low-dimensional space,which leads to poor model fitting effect.In order solve this problem,the autoencoder is expressed in the form of a compression network in the Deep Autoencoding Gaussian Mixture Model(DAGMM for short)to promote the learning of the hybrid model,so as to improve the detection effect.Considering the special Behavior characteristics existed in log data,this paper proposes a Behavior Profile Deep Autoencoding Gaussian Mixture Model(Behavior-DAGMM),which transmits the behavior characteristics and attribute characteristics of trace to the hybrid model through the compressed network,so as to improve the learning effect of the model.The experimental results give evidence that the proposed Behavior-DAGMM model is effective based on benchmarks of manual logs and real logs.The experimental results also show that the detection effect of the proposed Behavior-DAGMM is superior than that of both autoencoders and DAGMM in all experimental logs.Figure [20] Table [12] Reference [94]...