Research On Business Process Anomaly Detection Based On Concept Drift Discovery

Currently,many modern enterprises and organizations have begun to use process aware information systems to support business process management,improving their productivity and competitiveness.However,as the demands of modern enterprises and organizations continue to increase,business processes begin to become large and complex,leading to anomalies in the operation of the system.The occurrence of anomaly business processes can lead to unexpected operational results,resulting in unpredictable losses for enterprises and organizations.Therefore,it is necessary to detect business process anomalies as early as possible and take corresponding measures to reduce or avoid losses.On the other hand,modern enterprises and organizations need to simplify business processes to reduce operational costs and improve business processing efficiency,and hope that business processes can flexibly adapt to constantly changing business environments.At the same time,seasonal impacts,natural disasters and disasters,as well as policy changes,also force enterprises and organizations to change their business processes,which poses a huge challenge to anomaly detection in business processes.However,existing business process anomaly detection methods assume that the business process is fixed and unchanging,ignoring the situation where conceptual drift leads to changes in the business process model,resulting in a decrease in anomaly detection effectiveness.This article first proposes a business process anomaly detection method based on control stream concept drift discovery,and then proposes a business process anomaly detection method based on data stream concept drift discovery,which can simultaneously pay attention to changes in the control stream and data stream of event logs.The specific work is as follows:(1)A business process anomaly detection method based on control flow concept drift discovery is proposed to address the situation where existing business process anomaly detection methods cannot handle concept drift cases that occur in business processes.Firstly,extract event sequence features and event attribute datasets from the event log,and then use this data set to construct a business process anomaly detection model that combines concept drift discovery methods and recurrent neural networks to predict the probability distribution of event occurrence.Based on the probability distribution of event occurrence,calculate the anomaly score for each case in the event log.The case where the anomaly score exceeds the set anomaly score threshold is considered a candidate anomaly case.Use the Hoeffding’s inequality to determine whether concept drift has occurred,and use a double-layer sliding window mechanism to obtain the location of concept drift cases,extracting concept drift cases from candidate anomaly cases.Using incremental learning to update the event prediction module with concept drift cases enables the process anomaly detection model to distinguish between concept drift cases and true anomaly cases,and more accurately detect true business process anomalies.The experimental results show that compared with existing business process anomaly detection methods,the method proposed in this paper has better robustness and accuracy in controlling flow concept drift in event logs.(2)A business process anomaly detection method based on data flow concept drift discovery is proposed to address the situation where concept drift occurs in data flow in event logs without discovery in the business process anomaly detection method based on control flow concept drift discovery.Firstly,encode the events and attributes in the event log,then construct a feature data set and use it to construct a prediction model.Compare the predicted results of the prediction model with the actual occurrence results to determine candidate anomaly cases.Then,the Hoeffding’s inequality and double-layer sliding window mechanism are used to determine the location of concept drift and extract concept drift cases.Finally,the concept drift case set is used as new knowledge to update the anomaly detection model using incremental learning methods,and two different update methods are provided to update the anomaly detection model to cope with different scenarios.The experimental results show that the proposed anomaly detection method,compared with mainstream business process anomaly detection methods,can more accurately detect conceptual drift in business processes,and can more accurately detect anomalies that occur in business processes,which has a positive significance in improving the smoothness of business process operation.