GRASPED: A GRU-AE Network Based Multi-Perspective Business Process Anomaly Detection Model

Abstract

In process-aware information systems (PAISs), anomalies are ubiquitous, having a number of different underlying causes, such as software malfunctions or operator errors. The presence of anomalies not only has an enormous impact on the economic well-being of the business, but also interferes with our ability to mine useful information from event logs. In this paper, we propose GRASPED, a <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GR</b> U- <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">A</b> E Network based multi-per <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</b> pective business <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">P</b> ROC <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">E</b> ss anomaly <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">D</b> etection model. GRASPED can detect anomalies not only from the control flow but also from the data perspective of a business process. GRASPED is based on an autoencoder (AE) with gated recurrent units (GRU) which is trained in an unsupervised fashion (i.e., does not require any labeling of the data). In addition, GRASPED introduces the teacher forcing method as well as the attention mechanism to improve its detection performance. GRASPED does not require training on a clean log (i.e., it can be trained and perform anomaly detection directly on logs containing anomalies). We conduct extensive experiments on synthetic logs as well as real-life logs. The experiment results show that GRASPED outperforms the state-of-the-art methods for both trace-level and attribute-level anomaly detection.