Algorithms for anomaly detection of traces in logs of process aware information systems

This paper discusses four algorithms for detecting anomalies in logs of process aware systems. One of the algorithms only marks as potential anomalies traces that are infrequent in the log. The other three algorithms: threshold, iterative and sampling are based on mining a process model from the log, or a subset of it. The algorithms were evaluated on a set of 1500 artificial logs, with different profiles on the number of anomalous traces and the number of times each anomalous traces was present in the log. The sampling algorithm proved to be the most effective solution. We also applied the algorithm to a real log, and compared the resulting detected anomalous traces with the ones detected by a different procedure that relies on manual choices.

► We designed, implemented and assessed three anomaly detection algorithms for process aware systems. ► The algorithms are based on process mining techniques for model discovery and conformance checker. ► The assessment were carried out using artificial logs with different profiles. ► Among the proposed algorithms, the sampling one proved to be the best results. ► The performance of sampling algorithm is influenced by number of candidate traces and classes of traces.