Process Learning for Autonomous Process Anomaly Correction

Abstract

The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. Given a definition of a process in form of a process model, conformance checking can be used to test whether the executions of a process contained in a so-called event log data structure are conforming with the process as it was defined. The result is a comparison of the execution traces and their respective correct execution, according to the process model. This technique provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. However, a problem is that it requires a process model to be available. Process models in the correct format are not always available. Contrary to conformance checking, process anomaly detection aims to find anomalous executions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Though process anomaly detection provides the benefit of not relying on a process model, it typically does not provide the level of detail that conformance checking does. A process execution can either be normal or it can be anomalous. This dissertation proposes process anomaly correction, a novel approach that combines the benefits of conformance checking and process anomaly detection. Given only an event log, process anomaly correction detects anomalous executions, clearly indicates where the anomaly has occurred during the execution and suggests possible corrective measures. The solution presented in this work is based on a new concept to the field of process anomaly detection: Process learning. In process learning, the task of understanding the process based on the example data is transformed into a learning problem in which a neural network is trained to predict the very next activity in a running process execution. The resulting machine learning model thus represents an approximation of the real process that created the data. This cumulative dissertation consists of five contributions to the field of business process management that demonstrate how, starting from a process anomaly detection, process anomaly correction is achieved in a series of four steps. (1) Process learning is employed to generate an approximated model of the process logic. (2) The limitation of only distinguishing between normal and anomalous process executions is overcome by employing the process learning model which processes the process executions on a finer level of detail than existing approaches. (3) The necessity of providing manual threshold settings, as it is typical for process anomaly detection algorithms, is replaced by an automatic parameterization utilizing the process learning model. (4) The predictive capabilities of the process learning model are exploited to generate possible corrections of detected anomalies. The resulting process anomaly correction approach can be employed in scenarios where classic conformance checking would be infeasible, due to the restriction of relying on a process model. Furthermore, it can be employed alongside classical conformance checking, for it incorporates more information coming from the event log than classical conformance checking (such as employees executing a process step, in which country the process is executed, etc.), and thus provides a new perspective for the process analyst.