Anomaly Detection Using Process Mining

Bezerra, Fábio; Wainer, Jacques; Aalst, Wil M. P. van der

doi:10.1007/978-3-642-01862-6_13

Cited by 66 publications

(47 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…That is, the method loops through the steps of mining the ''most appropriate model'' (in that case using heuristic mining) and removing all instances of one or more activities that makes the mined model particularly complex. [8] does not propose an automatic method to select the activities that are ''causing'' the complexity of the mined model, and thus that selection was necessarily performed by a specialist. Once the activity or activities are selected, all instances of those activities are removed from all traces.…”

Section: Example With a Real Logmentioning

confidence: 99%

“…The result of the most appropriate model method described in [8] to the Dutch municipality logs required the filtering out of two activities, and resulted in six traces as potential anomalies. Notice that we have no independent confirmation that those six traces were anomalous, or that there was no other anomalies among the traces deemed ''normal''.…”

Section: Example With a Real Logmentioning

confidence: 99%

“…As an example of running the Sampling and Naive algorithm in a real log, we obtained the log used in [8,9] to illustrate another process anomaly detection. The log is derived from the different information systems used by a Dutch municipality to support handicapped and mobile restricted citizens.…”

Section: Example With a Real Logmentioning

confidence: 99%

“…The anomaly detection method proposed in [8] used a series of ''filtering'' and mining steps. The idea of the method is finding the ''most appropriate model'' that is mined from the log, and flagging as anomalous the traces that do not fit the model.…”

Section: Example With a Real Logmentioning

confidence: 99%

See 3 more Smart Citations

Algorithms for anomaly detection of traces in logs of process aware information systems

Bezerra

Wainer

2013

Information Systems

Self Cite

View full text Add to dashboard Cite

a b s t r a c tThis paper discusses four algorithms for detecting anomalies in logs of process aware systems. One of the algorithms only marks as potential anomalies traces that are infrequent in the log. The other three algorithms: threshold, iterative and sampling are based on mining a process model from the log, or a subset of it. The algorithms were evaluated on a set of 1500 artificial logs, with different profiles on the number of anomalous traces and the number of times each anomalous traces was present in the log. The sampling algorithm proved to be the most effective solution. We also applied the algorithm to a real log, and compared the resulting detected anomalous traces with the ones detected by a different procedure that relies on manual choices.

show abstract

Section: Example With a Real Logmentioning

confidence: 99%

Section: Example With a Real Logmentioning

confidence: 99%

Section: Example With a Real Logmentioning

confidence: 99%

Section: Example With a Real Logmentioning

confidence: 99%

See 2 more Smart Citations

Algorithms for anomaly detection of traces in logs of process aware information systems

Bezerra

Wainer

2013

Information Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…By the intervention of cost inclusion factor, the solution gets more realistic. Bezerra (2009) propose a method to detect anomalies by using a process mining technique. First, the log gets trimmed by scoping.…”

Section: Anomaly Detection Using Process Miningmentioning

confidence: 99%

Detecting Abnormal Behavior in Social Network Websites by Using a Process Mining Technique

Sahlabadi

Muniyandi

Shukur

2014

Journal of Computer Science

View full text Add to dashboard Cite

Detecting abnormal user activity in social network websites could prevent from cyber-crime occurrence. The previous research focused on data mining while this research is based on user behavior process. In this study, the first step is defining a normal user behavioral pattern and the second step is detecting abnormal behavior. These two steps are applied on a case study that includes real and syntactic data sets to obtain more tangible results. The chosen technique used to define the pattern is process mining, which is an affordable, complete and noise-free event log. The proposed model discovers a normal behavior by genetic process mining technique and abnormal activities are detected by the fitness function, which is based on Petri Net rules. Although applying genetic mining is time consuming process, it can overcome the risks of noisy data and produces a comprehensive normal model in Petri net representation form.

show abstract

A Conceptual Framework for Supporting Deep Exploration of Business Process Behavior

Tsoury

Soffer

Reinhartz-Berger

2018

Conceptual Modeling

View full text Add to dashboard Cite

Anomaly Detection Using Process Mining

Cited by 66 publications

References 15 publications

Algorithms for anomaly detection of traces in logs of process aware information systems

Algorithms for anomaly detection of traces in logs of process aware information systems

Detecting Abnormal Behavior in Social Network Websites by Using a Process Mining Technique

A Conceptual Framework for Supporting Deep Exploration of Business Process Behavior

Contact Info

Product

Resources

About