Anomaly detection in business processes is crucial to prevent erroneous organizational decision-making. Existing anomaly detection methods often assume access to a clean event log without anomalies, a scenario that is impractical in the real world. To solve this problem, MuGAD is proposed, a novel framework that detects anomalies in scenarios where only a limited number of labeled anomalies are available. By converting traces into a newly designed graph structure, the framework captures the control flow, order of events, and attribute information, facilitating the effective use of graph neural networks. Furthermore, MuGAD uses a two-stage training procedure designed to (1) reduce the risks posed by unlabeled traces and (2) enable the detection of anomalous traces and events. Comparative experiments are conducted on five real-life event logs to validate our proposed framework. The experimental results indicate that MuGAD outperforms the existing methods and provides better detection accuracy along with better interpretability in terms of F1-score.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Multi-task Trained Graph Neural Network for Business Process Anomaly Detection with a Limited Number of Labeled Anomalies

  • Yongjae Lee,
  • Dohee Kim,
  • Donghwan Kim,
  • Hyerim Bae

摘要

Anomaly detection in business processes is crucial to prevent erroneous organizational decision-making. Existing anomaly detection methods often assume access to a clean event log without anomalies, a scenario that is impractical in the real world. To solve this problem, MuGAD is proposed, a novel framework that detects anomalies in scenarios where only a limited number of labeled anomalies are available. By converting traces into a newly designed graph structure, the framework captures the control flow, order of events, and attribute information, facilitating the effective use of graph neural networks. Furthermore, MuGAD uses a two-stage training procedure designed to (1) reduce the risks posed by unlabeled traces and (2) enable the detection of anomalous traces and events. Comparative experiments are conducted on five real-life event logs to validate our proposed framework. The experimental results indicate that MuGAD outperforms the existing methods and provides better detection accuracy along with better interpretability in terms of F1-score.