Anomaly Detection Algorithms In Business Process Logs

In some domains of application, like software development and health care processes, a normative business process system (e.g. workflow management system) is not appropriate because a flexible support is needed to the participants. On the other hand, while it is important to support flexibility of execution in these domains, security requirements can not be met whether these systems do not offer extra control, which characterizes a trade off between flexibility and security in such domains. This work presents and assesses a set of anomaly detection algorithms in logs of Process Aware Systems (PAS). The detection of an anomalous instance is based on the "noise" which an instance makes in a process model discovered by a process mining algorithm. As a result, a trace that is an anomaly for a discovered model will require more structural changes for this model fit it than a trace that is not an anomaly. Hence, when aggregated to PAS, these methods can support the coexistence of security and flexibility.AIDSS1118Agarwal, D.K., An empirical bayes approach to detect anomalies in dynamic multidimensional arrays (2005) ICDM, pp. 26-33Agrawal, R., Gunopulos, D., Leymann, F., Mining process models from workflow logs (1998) EDBT '98: Proceedings of the 6th International Conference on Extending Database Technology, pp. 469-483. , London, UK. Springer-VerlagCook, J.E., Wolf, A.L., Discovering models of software processes from event-based data (1998) ACM Trans. Softw. Eng. Methodol, 7 (3), pp. 215-249de Medeiros, A., van der Aalst, W., Weijters, A., Workflow mining: Current status and future directions (2003) LNCS, 2888. , Meersman, R, Tari, Z, and Schmidt, D, editors, On The Move to Meaningful Internet Systems, ofde Medeiros, A.K.A., Weijters, A.J.M.M., van der Aalst, W.M.R., Genetic process mining: A basic approach and its challenges (2006) Lecture Notes in Computer Science, 3812, pp. 203-215. , ISSN 0302-9743Donoho, S., Early detection of insider trading in option markets (2004) KDD '04: Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 420-429. , New York, NY, USA. ACM PressFawcett, T., (2004) Roc graphs, , Notes and practical considerations for researchersFawcett, T., Provost, F., Adaptive fraud detection (1997) Data Mining and Knowledge Discovery, 50, pp. 291-316Hammori, M., Herbst, J., Kleiner, N., Interactive workflow mining - requirements, concepts and implementation (2006) Data Knowl. Eng, 56 (L), pp. 41-63Lee, W., Xiang, D., Information-theoretic measures for anomaly detection (2001) IEEE Symposium on Security and PrivacyMaruster, L., van der Aalst, W.M.P., Weijters, T., van den Bosch, A., Daelemans, W., Automated discovery of workflow models from hospital data (2001) Proceedings of the 13th Belgium-Netherlands Conference on Artificial Intelligence (BNAIC 2001), pp. 183-190. , Krse, B, Rijke, M, Schreiber, G, and Someren, M, editorsNoble, C.C., Cook, D.J., Graph-based anomaly detection (2003) KDD '03: Proceedings of the ninth ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 631-636. , New York, NY, USA. ACM PressPandit, S., Chau, D.H., Wang, S., Faloutsos, C., Netprobe: A fast and scalable system for fraud detection in online auction networks (2007) WWW '07: Proceedings of the 16th international conference on World Wide Web, pp. 201-210. , New York, NY, USA. ACM PressRozinat, A., van der Aalst, W.M.P., Conformance testing: Measuring the fit and appropriateness of event logs and process models (2005) Business Process Management Workshops, pp. 163-176Sabhnani, R., Neill, D., Moore, A., Detecting anomalous patterns in pharmacy retail data (2005) Proceedings of the KDD 2005 Workshop on Data Mining Methods for Anomaly DetectionSchimm, G., Mining exact models of concurrent workflows (2004) Comput. Ind, 53 (3), pp. 265-281van der Aalst, W.M.P., de Medeiros, A.K.A., Process mining and security: Detecting anomalous process executions and checking process conformance (2005) Electr. Notes Theor. Comput. Sci, 121, pp. 3-21van der Aalst, W.M.P., Weijters, T., Maruster, L., Workflow mining: Discovering process models from event logs (2004) IEEE Trans. Knowl. Data Eng, 16 (9), pp. 1128-1142van der Aalst Minseok Song, W.M., Mining social networks: Uncovering interaction patterns in business processes (2004) LNCS, 3080, pp. 244,260. , Desel, J, Pernici, B, and Weske, M, editors, Business Process Management: Second International Conference, of ppWainer, J., Kim, K., and Ellis, C. A. (2005). A workflow mining method through model rewriting. In Fuks, H., Lukosch, S., and Salgado, A. C, editors, Groupware: Design, Implementation, and Use: 11th International Workshop, 3706, pages p. 184-19, Porto de Galinhas, Brazil. CRIWG 200