Business process event log anomaly detection based on statistical leverage

Abstract

We present a novel information-theoretic framework to detect anomalous traces in business process event logs. Although informationtheoretic approaches to anomaly detection are considered fundamental in data analytics, they have not been considered in the context of event logs. The proposed framework combines a trace-level anomaly score based on statistical leverage, which also gives an indication of the severity of an anomaly, and different ways of setting the value of a threshold to detect anomalous traces. The framework has been first proposed in a traditional offline setting, but we also discuss its extension in the online setting, i.e., when events in a log are considered as a stream.