Detecting and repairing anomaly patterns in business process event logs

Abstract

Event log anomaly detection and log repairing concern the identification of anomalous traces in an event log and the reconstruction of a correct trace for the anomalous ones, respectively. Trace-level anomalies in event logs often appear according to specific patterns, such events inserted, repeated, or skipped. This paper proposes P-BEAR (Pattern-Based Event Log Anomaly Reconstruction), a semi-supervised pattern-based anomaly detection and log repairing approach that exploits the pattern-based nature of trace-level anomalies in event logs. P-BEAR captures, in a set of ad-hoc graphs, the behaviour of clean traces in a log and uses these to identify anomalous traces, determine the specific anomaly pattern that applies to them, and then reconstruct the correct trace. The proposed approach is evaluated using artificial and real event logs against traditional trace alignment in conformance checking, the edit distance-based alignment method, and an unsupervised method based on deep learning. Overall, the proposed method outperforms the alignment method in anomalous trace reconstruction while providing interpretability with respect to anomaly pattern classification. P-BEAR is also quicker to execute, and its performance is more balanced across different types of anomaly patterns.