Analysis of Language Inspired Trace Representation for Anomaly Detection

Abstract

A great concern for organizations is to detect anomalous process instances within their business processes. For that, conformance checking performs model-aware analysis by comparing process logs to business models for the detection of anomalous process executions. However, in several scenarios, a model is either unavailable or its generation is costly, which requires the employment of alternative methods to allow a confident representation of traces. This work supports the analysis of language inspired process analysis grounded in the word2vec encoding algorithm. We argue that natural language encodings correctly model the behavior of business processes, supporting a proper distinction between common and anomalous behavior. In the experiments, we compared accuracy and time cost among different word2vec setups and classic encoding methods (token-based replay and alignment features), addressing seven different anomaly scenarios. Feature importance values and the impact of different anomalies in seven event logs were also evaluated to bring insights on the trace representation subject. Results show the proposed encoding overcomes representational capability of traditional conformance metrics for the anomaly detection task.

Case2vec: Advances in Representation Learning for Business Processes

“…Trace2vec representations were used to cluster traces into similar groups in [4]. Tavares et al [13] use the same representations to identify anomalous cases.…”

“…Vector representations of cases are required by many techniques in process mining such as trace clustering [4,11,12], prediction [3], and anomaly detection [10,13]. Trace clustering aims to improve the discovery of process models by grouping similar cases.…”

Vector space models for trace clustering: a comparative study

“…The schemes (b) and (c) are known as countbased vector space models [Appice and Malerba 2016]. In recent years, representations built through learning models have received the attention of process mining researchers [Koninck et al 2018, Peeperkorn et al 2020, Tavares and Barbon 2020. Learning models are trained on the event log and encode entities (e.g., an activity or a trace) in a vector space such that entities involved in similar contexts are expected to be positioned closer in the vector space.…”

“…Solutions for other problems in process mining using embedding-based representations for traces were studied by Peeperkorn et al [Peeperkorn et al 2020] and Tavares and Barbon [Tavares and Barbon 2020]. The former applied such a representation scheme for conformance checking.…”

Databases and Information Systems in the AI Era: Contributions from ADBIS, TPDL and EDA 2020 Workshops and Doctoral Consortium

“…In the last paper, "Analysis of language inspired trace representation for anomaly detection" [28], the authors develop a comparative study about approaches using vector space modeling for trace profiling. Their comparison can guide the appropriate trace profiling choice for all methods working at the intersection of Process Mining and Machine Learning.…”