Abstract:The detection of anomalous behavior in business process data is a crucial task for preventing failures that may jeopardize the performance of any organization. Supervised learning techniques are impracticable because of the difficulties of gathering huge amounts of labeled business process anomaly data. For this reason, unsupervised learning techniques and semi-supervised learning approaches trained on entirely labeled normal data have dominated this domain for a long time. However, these methods do not work well because of the absence of prior knowledge of true anomalies. In this study, we propose a deep weakly supervised reinforcement learning-based approach to identify anomalies in business processes by leveraging limited labeled anomaly data. The proposed approach is intended to use a small collection of labeled anomalous data while exploring a huge set of unlabeled data to find new classes of anomalies that are outside the scope of the labeled anomalous data. We created a unique reward function that combined the supervisory signal supplied by a variational autoencoder trained on unlabeled data with the supervisory signal provided by the environment's reward. To further reduce data deficiency, we introduced a sampling method to allow the effective exploration of the unlabeled data and to address the imbalanced data problem, which is a common problem in the anomaly detection field. This approach depends on the proximity between the data samples in the latent space of the variational autoencoder. Furthermore, to efficiently model the sequential nature of business process data and to handle the long-term dependences, we used a long short-term memory network combined with a self-attention mechanism to develop the agent of our reinforcement learning model. Multiple scenarios were used to test the proposed approach on real-world and synthetic datasets. The findings revealed that the proposed approach outperformed five competing approaches by efficiently using the few available anomalous examples.

Kernel Based Sequential Data Anomaly Detection in Business Process Event Logs

A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-Based Anomaly Detection Techniques

Multi-perspective Anomaly Detection in Business Process Execution Events

Log-based Anomaly Detection of Enterprise Software: An Empirical Study

Pattern-Based Reconstruction of Anomalous Traces in Business Process Event Logs

An Anomaly Detection Approach of Part-of-Speech Log Sequence Via Population Based Training

Sequential Event Detection Using Multimodal Data in Nonstationary Environments

One Class Process Anomaly Detection Using Kernel Density Estimation Methods

xSemAD: Explainable Semantic Anomaly Detection in Event Logs Using Sequence-to-Sequence Models

Anomaly Detection for Industrial Big Data

Deep reinforcement learning for data-efficient weakly supervised business process anomaly detection

A COMPARATIVE ANALYSIS OF ANOMALY DETECTION FROM MICROSERVICE GENERATED UNSTRUCTURED LOGS

Detecting Anomalies in Time Series Using Kernel Density Approaches

Detecting Anomalous Events in Object-centric Business Processes via Graph Neural Networks

Pinpointing Anomaly Events in Logs from Stability Testing -- N-Grams vs. Deep-Learning

Anomaly Detection via Learning-Based Sequential Controlled Sensing

Anomaly detection of unstructured big data via semantic analysis and dynamic knowledge graph construction

DABL: Detecting Semantic Anomalies in Business Processes Using Large Language Models

Applied Machine Learning to Anomaly Detection in Enterprise Purchase Processes

Detecting Data-Model-Oriented Anomalies In Parallel Business Process

Robust Log-Based Anomaly Detection on Unstable Log Data