Detecting Anomalies in Hybrid Business Process Logs

Checking and analyzing various executions of different Business Processes can be a tedious task as the logs from these executions may contain lots of events, each with a (possibly large) number of both numerical and categorical attributes. We developed a way to automatically model the behavior captured in log files with dozens of these attributes. The advantage of our method is that we do not need any prior knowledge about the data or the attributes. We introduce a new algorithm that is able to learn a model of a log file starting from the data itself. The learned model can then be used to detect anomalous executions in the data. To achieve this we extend Dynamic Bayesian Networks with numerical attributes and functional dependencies to better model the normal behavior found in log files. The model is capable of scoring events and cases, even when previously unseen values or new combinations of values appear in the log file. An important benefit of our model is the ability to give a decomposition of the score that indicates the root cause of the anomalies. We also conducted a comparison with other state-of-the-art algorithms for detecting anomalies in Business Processes which shows that our approach outperforms other algorithms.