DABL: Detecting Semantic Anomalies in Business Processes Using Large Language Models

TL;DR

DABL leverages large language models to detect semantic anomalies in business process logs, outperforming existing methods and providing natural language explanations for detected anomalies.

Contribution

Introduces DABL, a novel LLM-based approach for semantic anomaly detection in business processes that generalizes well and offers interpretability.

Findings

DABL surpasses state-of-the-art methods in accuracy.

It generalizes across different process models.

Provides natural language explanations for anomalies.

Abstract

Detecting anomalies in business processes is crucial for ensuring operational success. While many existing methods rely on statistical frequency to detect anomalies, it's important to note that infrequent behavior doesn't necessarily imply undesirability. To address this challenge, detecting anomalies from a semantic viewpoint proves to be a more effective approach. However, current semantic anomaly detection methods treat a trace (i.e., process instance) as multiple event pairs, disrupting long-distance dependencies. In this paper, we introduce DABL, a novel approach for detecting semantic anomalies in business processes using large language models (LLMs). We collect 143,137 real-world process models from various domains. By generating normal traces through the playout of these process models and simulating both ordering and exclusion anomalies, we fine-tune Llama 2 using the resulting log. Through extensive experiments, we demonstrate that DABL surpasses existing state-of-the-art semantic anomaly detection methods in terms of both generalization ability and learning of given processes. Users can directly apply DABL to detect semantic anomalies in their own datasets without the need for additional training. Furthermore, DABL offers the capability to interpret the causes of anomalies in natural language, providing valuable insights into the detected anomalies.