Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction

TL;DR

This paper introduces a process mining-based framework that combines feature extraction and dimensionality reduction to improve control-flow anomaly detection, addressing noise and low-quality models for more effective and explainable results.

Contribution

It proposes a novel alignment-based feature extraction method integrated into a flexible framework, enhancing anomaly detection performance over existing conformance checking techniques.

Findings

Framework outperforms baseline conformance checking methods

Effective handling of noisy event data and low-quality models

Maintains explainability of anomaly detection results

Abstract

The business processes of organizations may deviate from normal control flow due to disruptive anomalies, including unknown, skipped, and wrongly-ordered activities. To identify these control-flow anomalies, process mining can check control-flow correctness against a reference process model through conformance checking, an explainable set of algorithms that allows linking any deviations with model elements. However, the effectiveness of conformance checking-based techniques is negatively affected by noisy event data and low-quality process models. To address these shortcomings and support the development of competitive and explainable conformance checking-based techniques for control-flow anomaly detection, we propose a novel process mining-based feature extraction approach with alignment-based conformance checking. This variant aligns the deviating control flow with a reference process model; the resulting alignment can be inspected to extract additional statistics such as the number of times a given activity caused mismatches. We integrate this approach into a flexible and explainable framework for developing techniques for control-flow anomaly detection. The framework combines process mining-based feature extraction and dimensionality reduction to handle high-dimensional feature sets, achieve detection effectiveness, and support explainability. The results show that the framework techniques implementing our approach outperform the baseline conformance checking-based techniques while maintaining the explainable nature of conformance checking. We also provide an explanation of why existing conformance checking-based techniques may be ineffective.