Multi-view business process anomaly detection method, system and device based on GRU-AE network

Abstract

This invention provides a multi-view business process anomaly detection method based on GRU-AE networks, comprising the following steps: data preprocessing, performing event log preprocessing; performing model training; and anomaly detection, inputting the acquired features into the trained model to obtain attribute-level anomaly scores, and marking trajectories or attributes as abnormal or normal according to thresholds; wherein, the data preprocessing step further includes the steps of: acquiring each trajectory of the event log, adding a virtual start event before the first event, adding a virtual end event after the last event, and converting the event log into a third-order tensor as the feature to be input; this invention can be applied to online process anomaly detection, timely reporting of anomalies occurring during process execution, and can also be applied to offline process anomaly detection, filtering abnormal trajectories in event logs and analyzing the causes of anomalies.

Description

Technical Field

[0001] This invention relates to the field of data anomaly detection, and in particular to a multi-perspective business process anomaly detection method, system, and device based on a GRU-AE network. Background Technology

[0002] With the development of information technology, enterprises are increasingly relying on Process-Aware Information Systems (PAISs) to optimize their processes. However, anomalies are ubiquitous in real-world processes, caused by a variety of reasons, such as software malfunctions or operator errors. Detecting anomalies in business process execution is crucial. On the one hand, early detection of these anomalies during process execution is vital for the healthy operation of the enterprise. On the other hand, high-quality event logs are essential for process optimization, and anomalies in these logs should be detected and removed. For example, process mining (PM) provides techniques for understanding and optimizing processes. However, most existing process mining techniques are only effective when event logs are clean (i.e., free of anomalies).

[0003] Event logs contain information across multiple dimensions, such as activities, resources, data, and time, and these elements have complex interrelationships. For example, activities execute in a specific order (control flow dependency); data is passed and modified in each activity (data flow dependency); different activities execute based on different data values ​​(control flow and data flow coupling); activities have varying durations (time dependency); and different activities are executed by different machines or users (resource dependency). Event log exceptions can be categorized into six types: skipped, inserted, redoed, early, delayed, and attribute exceptions. The first five types can be termed control flow exceptions, caused by errors in the activity execution order. Errors related to resources, data, and time are classified as attribute exceptions. These complex dependencies and diverse exception scenarios present significant challenges to anomaly detection in business processes. Summary of the Invention

[0004] One of the objectives of this invention is to provide a multi-view business process anomaly detection method, system, and device based on a GRU-AE network. By training an autoencoder with GRU as the main structure that can reconstruct normal behavior, the trained model is used to detect anomalies in event logs.

[0005] To achieve at least one objective of this invention, the present invention provides a multi-view service process anomaly detection method based on a GRU-AE network, the method comprising the following steps:

[0006] Data preprocessing, including preprocessing of event logs;

[0007] Perform model training; and

[0008] Anomaly detection involves inputting the acquired features into the trained model to obtain anomaly scores at the attribute level, and then marking the trajectory or attribute as abnormal or normal based on a threshold.

[0009] The data preprocessing step further includes the following steps: acquiring each trajectory of the event log, adding a dummy start event before the first event, adding a dummy end event after the last event, and converting the event log into a third-order tensor as a feature to be input.

[0010] The execution model training step further includes the following steps: the GRU-AE network is trained based on the transformed 3D tensor execution model to learn normal behavior in the event log, wherein the loss function is based on the cross-entropy criterion, and the attribute values ​​of each attribute of each event are reconstructed in each trajectory, as shown in the formula:

[0011]

[0012] In the formula, t represents the trajectory, e represents the event, a represents the attribute, T represents the number of trajectories in the log, E represents the maximum length of the trajectory in the log, and A represents the number of attributes;

[0013] The anomaly detection step further includes the step of: the anomaly score is defined as the probability p that is greater than a specified attribute value v in the probability distribution. v The sum of all probabilities is given by the formula:

[0014]

[0015] Here, an abnormal score is mapped to 0 or 1 by using a threshold τ, where 0 represents normal and 1 represents abnormal.

[0016] In some embodiments, event logs that may contain anomalous trajectories are used for training to learn normal behavior for detecting anomalies, whereby portions of the event logs with large reconstruction errors are judged as anomalous based on a threshold of anomaly scores at the attribute level.

[0017] In some embodiments, the multi-view service process anomaly detection method based on GRU-AE network further includes the step of: executing a teacher-forced method during GRU-AE network training.

[0018] In some embodiments, the method further includes the steps of: providing a network structure comprising multiple encoders and decoders, wherein each attribute in the attribute set is assigned an encoder and a decoder, wherein the encoder uses a bidirectional GRU as the main structure to learn a representation of the features; and the decoder uses a GRU as the main structure to reconstruct normal behavior; and introducing an attention mechanism.

[0019] In some embodiments, the model training step further includes the step of using batch normalization and random deactivation methods to resist overfitting.

[0020] According to another aspect of the present invention, a multi-view service process anomaly detection device based on a GRU-AE network is also provided, comprising:

[0021] Memory, used to store software applications.

[0022] A processor is used to execute the software application, wherein each program of the software application correspondingly executes the steps in the multi-view service process anomaly detection method based on GRU-AE network.

[0023] According to another aspect of the present invention, a multi-view business process anomaly detection system based on a GRU-AE network is also provided. The multi-view business process anomaly detection system based on a GRU-AE network includes an event log preprocessing unit, a model training unit, and an anomaly detection unit. The event log preprocessing unit performs preprocessing of the event log, acquires each trajectory of the event log, adds a virtual start event before the first event, adds a virtual end event after the last event, and converts the event log into a third-order tensor as a feature to be input. The model training unit performs model training. The anomaly detection unit acquires the features from the event log preprocessing unit and inputs them into the model trained by the model training unit to obtain an attribute-level anomaly score, and marks the trajectory or attribute as abnormal or normal according to a threshold.

[0024] The formula for reconstructing the attribute values ​​of each attribute for each event in each trajectory in the model training unit is as follows:

[0025]

[0026] In the formula, t represents the trajectory, e represents the event, a represents the attribute, T represents the number of trajectories in the log, E represents the maximum length of all trajectories in the log, and A represents the number of attributes;

[0027] In the anomaly detection unit, the anomaly score is defined as the probability p that is greater than a specified attribute value v in a probability distribution. v The sum of all probabilities is given by the formula:

[0028]

[0029] Here, an abnormal score is mapped to 0 or 1 by using a threshold τ, where 0 represents normal and 1 represents abnormal.

[0030] In some embodiments, the model training unit is configured with a GRU-AE network model, which is trained through unsupervised learning. The model training unit assigns an encoder and a decoder to each attribute in the attribute set. The vector h output by all encoders is input to each decoder, and the vector s output by each encoder is input to the corresponding decoder. The model training unit introduces an attention mechanism into the GRU-AE network model and a teacher-forced method during the training of the autoencoder. The attention mechanism identifies which events and which attributes are related to the next target value of the attribute associated with the decoder and assigns high attention weights to these attribute values.

[0031] In some embodiments, batch normalization and random deactivation methods are applied to the network structure of the multi-view service process anomaly detection system based on the GRU-AE network to resist overfitting.

[0032] In some embodiments, when the model training unit performs model training, cross-entropy is used as the main component of the loss function. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of an anomaly detection framework for a multi-view service process anomaly detection system based on a GRU-AE network according to an embodiment of the present invention.

[0034] Figure 2 This is a schematic diagram of the architecture of the multi-view service process anomaly detection system based on the GRU-AE network according to the above embodiments of the present invention.

[0035] Figure 3 This is a schematic diagram of the encoder of the multi-view service process anomaly detection system based on the GRU-AE network according to the above embodiments of the present invention.

[0036] Figure 4 This is a schematic diagram of the decoder of the multi-view service process anomaly detection system based on the GRU-AE network according to the above embodiments of the present invention.

[0037] Figure 5 This is a schematic diagram of the probability distribution of a certain attribute output for a certain event by the multi-view business process anomaly detection system based on the GRU-AE network according to the above embodiments of the present invention. Detailed Implementation

[0038] The following description is intended to disclose the present invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art. The basic principles of the invention defined in the following description can be applied to other embodiments, modifications, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the invention.

[0039] It is understood that the term "a" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element can be one, while in another embodiment, the number of the element can be multiple, and the term "a" should not be understood as a limitation on the number.

[0040] In this invention, GRU is short for gated recursive unit and AE is short for automatic encoder.

[0041] This invention relates to computer programs. The present invention provides a multi-view service process anomaly detection method based on a GRU-AE network. It describes a solution to the problems proposed in this invention, based on a computer program processing flow, that controls or processes external or internal objects of the computer by executing a computer program written according to the flow.

[0042] The multi-view business process anomaly detection method based on GRU-AE network described in this invention is based on GRU network. GRU is a recurrent neural network that is simpler and more efficient than LSTM (Long Short-Term Memory). GRU can be applied to time-series related tasks. The mechanism of GRU is expressed by the following formula.

[0043] z e =σ(W z x e +U z h e-1 +b z (1)

[0044] r e =σ(W r x e +U r h e-1 +b r (2)

[0045] h e =tanh(U(r) e οh e-1 )+Wx e +b) (3)

[0046]

[0047] In the above formula, h e The hidden state at time step e, x e The input at time step e, h e-1 The hidden state is at time step e-1, and h0 is the initial hidden state. There are two gates in the GRU unit: the update gate and the reset gate, whose functions are explained by equations (1) and (2), respectively. The update gate controls the amount of memory to be updated, while the reset gate determines the portion of memory to be discarded. Therefore, after executing equations (3) and (4), the output of the current hidden state is generated, which will be used as the memory for the next state. It will be understood by those skilled in the art that o is a stepwise multiplication, and σ() is the sigmoid function.

[0048] The multi-view business process anomaly detection method based on GRU-AE network described in this invention enables the training of an autoencoder with GRU as its main structure, capable of reconstructing normal behavior. The trained model is then used to detect anomalies in event logs. It is understood that the term "computer" in this invention refers not only to desktop computers, laptops, tablets, and other devices, but also to other intelligent electronic devices capable of running programs and processing data.

[0049] Specifically, the multi-view service process anomaly detection method based on GRU-AE network includes the following steps:

[0050] S100: Data preprocessing, performing preprocessing of event logs;

[0051] S200: Perform model training; and

[0052] S300: Anomaly detection, which inputs the acquired features into the trained model to obtain anomaly scores at the attribute level, and marks the trajectory or attribute as abnormal or normal based on the threshold.

[0053] Specifically, the S100 data preprocessing step further includes the following steps:

[0054] Retrieve each track in the event log, add a dummy start event before the first event, add a dummy end event after the last event, and convert the event log into a third-order tensor.

[0055] More specifically, in a preferred embodiment, the S100 data preprocessing step preprocesses the event logs that may contain abnormal trajectories, converting them into a three-dimensional tensor. This requires processing all possible attribute values ​​of attribute a. Mapped to a unique positive integer, represented as The event log is then represented as a three-dimensional tensor, also known as a feature. That is, more specifically, in this preferred embodiment of the invention, to detect possible anomalies in the first and last events, a dummy start event is added before the first event for each trajectory in the event log. A dummy end event '■' is added after the last event. Due to the mathematical properties of neural networks, the event log is transformed into a three-dimensional tensor.

[0056] In other words, in a preferred embodiment of the present invention, the event log to be detected is characterized by: It is a set of attributes, among which V a It is an attribute The set of possible values. It is an event, which is a sequence of one of the possible values ​​of each property, where v a ∈V a Trajectory t is an event sequence, and event log L is a trajectory sequence.

[0057] When performing step S100, firstly, all possible attribute values ​​of attribute a are mapped to a unique positive integer, represented as: The event log is then represented as a third-order tensor. Each event e is a first-order tensor R. A Where A is the number of attributes. Then, each trajectory t is represented as a second-order tensor R. E*A E is the maximum length of all trajectories in the log. To ensure all trajectories have the same length, an event tensor containing only zeros is used to pad all shorter trajectories; this is defined as a padding event and will be ignored by the neural network. Finally, the log is represented as a third-order tensor R. T *E*A , where T is the number of trajectories in the log.

[0058] Specifically, the S200 model training step further includes the following steps:

[0059] The GRU-AE network is trained based on a transformed 3D tensor execution model, learning normal behavior from event logs. The loss function is based on the cross-entropy criterion, reconstructing the attribute values ​​of each attribute for each event on each trajectory. The formula is as follows:

[0060]

[0061] In the formula, t represents the track, e represents the event, a represents the attribute, T represents the number of tracks in the log, E represents the maximum length of all tracks in the log, and A represents the number of attributes.

[0062] It is worth mentioning that in the S200 model training steps, batch normalization and random deactivation methods are used to resist overfitting; the model weights are trained using batch SGD (Stochastic Gradient Descent) and optimized using Adam (adaptive moment estimation).

[0063] Specifically, in this preferred embodiment of the invention, the original input is used as the target output when training the GRU-AE network, consistent with the training philosophy of the GRU-AE network. Even when trained on datasets containing anomalous situations, the model can capture normal behavior.

[0064] Specifically, the S300 anomaly detection step further includes the following steps:

[0065] An anomaly score is defined as the probability p that is greater than a specified attribute value v in a probability distribution. v The sum of all probabilities is as follows:

[0066]

[0067] Here, an abnormal score is mapped to 0 or 1 by using a threshold τ, where 0 represents normal and 1 represents abnormal.

[0068] A trained model can be used to detect anomalies, with a lower probability of anomaly values ​​compared to normal ones. In a preferred embodiment of the invention, a higher anomaly score indicates a more likely anomaly in the attribute value. By detecting which attribute is anomalous within which trajectory, the cause of the anomaly can be explained.

[0069] It is worth mentioning that the multi-view business process anomaly detection method based on GRU-AE network described in this invention uses event logs containing abnormal trajectories for training, learns normal behavior, and then uses it to detect anomalies. Parts of the event logs with large reconstruction errors are judged as anomalies. This multi-view business process anomaly detection method based on GRU-AE network can be trained in an unsupervised manner (i.e., without any data labeling) based on an autoencoder (AE) with GRU, and does not require any expert knowledge. Furthermore, unlike most deep learning models, this invention does not require a clean event log for training. Even when directly trained and performing detection using event logs containing abnormal trajectories, its performance is excellent. In addition, this invention can be applied not only to offline detection but also to online detection. Similar to most deep learning models, this invention can be incrementally trained to cope with concept drift that frequently occurs in real-world information systems.

[0070] Those skilled in the art will understand that embodiments of the present invention can be provided in the form of methods, systems, or computer program products. Therefore, the present invention can take the form of an all-hardware embodiment, an all-software embodiment, or an embodiment combining software and hardware.

[0071] Those skilled in the art will understand that the present invention can be implemented centrally in at least one computer system, or distributed in a decentralized manner by different parts distributed across several interconnected computer systems. Any computer system or other device capable of implementing the method is applicable. A common combination of hardware and software can be a general-purpose computer system with computer programs installed, controlling the computer system to operate according to the method by installing and executing the programs.

[0072] This invention can be embedded in a computer program product, which includes all the features that enable the methods described herein to be implemented. The computer program product is contained in one or more computer-readable storage media having computer-readable program code contained therein. According to another aspect of the invention, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, is capable of performing the steps of the methods of the invention. A computer storage medium is a medium in a computer memory used to store some discontinuous physical quantity. Computer storage media include, but are not limited to, semiconductors, disk drives, magnetic cores, magnetic drums, magnetic tapes, laser disks, etc. Those skilled in the art will understand that computer storage media are not limited to the foregoing examples, which are merely illustrative and not intended to limit the invention.

[0073] According to another aspect of the present invention, a multi-view service process anomaly detection device based on a GRU-AE network is also provided. This device includes: a software application, a memory for storing the software application, and a processor for executing the software application. Each program in the software application can correspondingly execute the steps in the multi-view service process anomaly detection method based on the GRU-AE network of the present invention.

[0074] Corresponding to the embodiments of the method of the present invention, according to another aspect of the present invention, a multi-view service process anomaly detection system based on GRU-AE network is also provided. This multi-view service process anomaly detection system based on GRU-AE network is an application of the multi-view service process anomaly detection method based on GRU-AE network of the present invention in computer program improvement.

[0075] like Figure 1 As shown, the multi-view service process anomaly detection process of the multi-view service process anomaly detection system based on the GRU-AE network is as follows:

[0076] First, the event logs, which may contain anomalous trajectories, are preprocessed and converted into a three-dimensional tensor. Then, all possible attribute values ​​of attribute 'a' are processed. Mapped to a unique positive integer, represented as Then, the event log can be represented as a three-dimensional tensor, which is also called a feature.

[0077] Next, the GRU-AE network is trained on this tensor to learn normal behavior in event logs. During training, cross-entropy is used as the main component of the loss function. Batch normalization and random deactivation are used to combat overfitting. The model weights are trained using batch SGD and optimized with Adam.

[0078] Finally, the features obtained in the first step are input into the trained model to obtain anomaly scores at the attribute level, and the trajectory or attribute is marked as abnormal or normal based on the threshold.

[0079] Specifically, in a specific embodiment of the present invention, the multi-view business process anomaly detection system based on GRU-AE network is provided with an event log preprocessing unit, a model training unit, and an anomaly detection unit.

[0080] More specifically, the network structure characteristics of the multi-view service process anomaly detection system based on the GRU-AE network are as follows: Figure 2As shown. The GRU-AE network is based on an autoencoder (AE) with gated recurrent units (GRUs), trained through unsupervised learning. A typical autoencoder consists of two parts: an encoder and a decoder. The autoencoder's structure is trained to learn a reconstruction close to its original input, while the gated recurrent units (GRUs) are used to extract features of the attributes. Unlike ordinary autoencoders, the GRU-AE network has multiple encoders and decoders. The model training unit of the multi-view business process anomaly detection system based on the GRU-AE network assigns an encoder and a decoder to each attribute in the attribute set. The vector h output by all encoders is input to each decoder, while the vector s output by each encoder is input to the corresponding decoder. Inspired by the teacher-forced method (one of the neural network training methods where, when training a recurrent neural network, it does not use the output of the previous state as the input of the next state, but directly uses the corresponding previous item of the ground truth of the training data as the input of the next state), the ground truth F is input to the decoder. Finally, the probability distribution P... t,e,a The output of the decoder is a probability distribution that represents the probability distribution of all possible values ​​of attribute a for each event e in each trajectory t.

[0081] More specifically, the encoder in the GRU-AE network of the model training unit of the multi-view business process anomaly detection system based on the GRU-AE network is as follows: Figure 3 As shown. GRUs typically learn information from previous states. However, the current attribute value depends on the attribute values ​​before and after it, so this learning behavior is insufficient to reconstruct the actual attribute value. Therefore, the model training unit of the multi-view business process anomaly detection system based on the GRU-AE network uses a bidirectional gated recurrent unit (BGRU) as the main component of the encoder. It is an extension of the GRU, consisting of two GRUs: a forward GRU that accepts forward input and a backward GRU that accepts backward input. First, each attribute value F... e Each attribute value (positive integer) is converted into a vector representation F through an embedding layer. e The goal is to learn a lower-dimensional representation than one-hot encoding. Then, the embedding vector f e The data is fed into the BGRU layer. The forward GRU reads the input sequentially, while the backward GRU reads it in reverse order. The BGRU generates a forward hidden state for event e. and reverse hidden state Then they are connected together to generate the encoder's output. The final hidden state of the forward GRU The final hidden state of the reverse GRU The cells are connected and passed through a linear layer to generate s0. In the linear layer, Leaky ReLU is used as the activation function.

[0082]

[0083] More specifically, the decoder in the GRU-AE network of the model training unit of the multi-view business process anomaly detection system based on the GRU-AE network is as follows: Figure 4 As shown. In contrast to the encoder, the decoder transforms the vector into a meaningful probability distribution P. The higher the probability of an attribute value, the more likely it is to be normal.

[0084] First, the outputs of all encoders are H = {H1, h2, ..., h...} E*A It needs to go through an attention layer to generate c. e .

[0085]

[0086] Next, in order to better reconstruct the target attribute values, the model training unit introduced a teacher-forced method used in the field of natural language processing, using the previously obtained ground truth attribute values ​​F. e-1 To predict the current attribute value. We will [c e ;f e-1 The input is into the GRU, which is c e and f e-1 The connection, where f e-1 It is F e-1 Embedding vector (see) Figure 4 (The blue part). The initial hidden state of the GRU is the output s0 of the encoder, which has the same properties as the decoder. Finally, we will... e c e and f e-1 Connecting them together, we get [s] e ;c e ;f e-1 ], where s e This is the hidden state of the GRU. After passing through a linear layer and a softmax layer, the probability distribution P of all possible values ​​of each attribute in event e can be obtained. e .

[0087] It is worth mentioning that the model training unit incorporates an attention mechanism, which acts as a bridge between the encoder and decoder. The attention mechanism aims to identify which events and which attributes are relevant to the next target value of the decoder's associated attributes and assigns high attention weights to these attribute values. This is based on the encoder's output H = {h1, h2, ..., h...} E*A} and the previous hidden state s of the GRU layer in the decodere-1 .

[0088]

[0089]

[0090] In formula (5), [·; ·] represents connecting two vectors, while energy e,i This represents the energy state. Intuitively, in formula (6), all energy states generated by event e are represented by the energy... e,i All are normalized using softmax to obtain the attention weights α. e,i This is used to report the importance of each attribute value during the reconstruction process. Attention weight α e,i The higher the value, the more it indicates h. i The more important it is to predict the next attribute value.

[0091] In a specific embodiment, the event log preprocessing unit performs data preprocessing, which is implemented as follows: In order to detect possible anomalies in the first and last events, we add a dummy start event before the first event for each track in the log. Add a dummy end event '■' after the last event. Due to the mathematical properties of neural networks, we must convert the log into a three-dimensional tensor. First, we need to map all possible attribute values ​​of an attribute 'a' to a unique positive integer, represented as... Then, the event log can be represented as a third-order tensor. Each event e is a first-order tensor R. A Where A is the number of attributes. Then, each trajectory t is represented as a second-order tensor R. E*A E is the maximum length of all trajectories in the log. To ensure all trajectories have the same length, we fill all shorter trajectories with an event tensor containing only zeros; we call this the padding event, which will be ignored by the neural network. Finally, the log can be represented as a third-order tensor R. T*E*A , where T is the number of trajectories in the log.

[0092] In a specific embodiment, the model training unit performs model training, which is implemented as follows:

[0093] In training the autoencoder, the raw input is used as the target output, consistent with the training philosophy of the GRU-AE network. Even when trained on datasets containing anomalous trajectories, the model can capture normal behavior. The cross-entropy criterion is used to train the entire network. The attribute values ​​for each event and each trajectory are reconstructed using the following formula:

[0094]

[0095] Batch normalization and random deactivation methods are applied to the network architecture to combat overfitting. The model weights are trained using batch SGD and optimized using Adam.

[0096] In a specific embodiment, the anomaly detection unit performs anomaly detection, which is implemented as follows:

[0097] After the training phase, the trained model can be used to detect anomalies. Intuitively, anomalous attribute values ​​have a lower probability than normal attribute values. Based on this idea, an anomaly score is defined as the probability p of an attribute value greater than a specified attribute value v in a probability distribution. v The sum of all probabilities is formalized as follows:

[0098]

[0099] An anomaly score is mapped to either 0 or 1 using a threshold τ, where 0 represents normal and 1 represents anomaly. A higher anomaly score indicates a more likely anomalous attribute value. By detecting which attribute is anomalous within which trajectory, the cause of the anomaly can be explained.

[0100] The multi-view business process anomaly detection system based on GRU-AE network described in this invention can be applied to online process anomaly detection, promptly reporting anomalies that occur during process execution, and can also be applied to offline process anomaly detection, filtering abnormal trajectories in event logs and analyzing the causes of anomalies.

[0101] Those skilled in the art will understand that the invention has been described with reference to flowchart illustrations and / or block diagrams of methods, systems, and computer program products according to the invention. Each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can obviously be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, thereby instructing (the instructions via the processor of the computer or other programmable data processing apparatus) to generate means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or block diagrams.

[0102] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are merely examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments, and any modifications or variations of the implementation of the present invention may be made without departing from these principles.

Claims

1. A multi-view service process anomaly detection method based on GRU-AE network, characterized in that, The multi-view service process anomaly detection method based on GRU-AE network includes the following steps: Data preprocessing, including preprocessing of event logs; Perform model training; and Anomaly detection involves inputting the acquired features into the trained model to obtain anomaly scores at the attribute level, and then marking the trajectory or attribute as abnormal or normal based on a threshold. The data preprocessing step further includes the following steps: acquiring each trajectory of the event log, adding a dummy start event before the first event, adding a dummy end event after the last event, and converting the event log into a third-order tensor as a feature to be input. The execution model training step further includes the following steps: the GRU-AE network is trained based on the transformed 3D tensor execution model to learn normal behavior in the event log, wherein the loss function is based on the cross-entropy criterion, and the attribute values ​​of each attribute of each event are reconstructed in each trajectory, as shown in the formula: ； In the formula, t represents the trajectory, and e represents the event. Represents attributes, This indicates the number of tracks in the log. This indicates the maximum length of the track in the log. Indicates the number of attributes; The anomaly detection step further includes the step of: an anomaly score is defined as a value greater than a specified attribute value in a probability distribution. probability The sum of all probabilities is given by the formula: ； Here, by using a threshold τ, the abnormal score is mapped to 0 or 1, where 0 represents normal and 1 represents abnormal; The multi-view service process anomaly detection method based on GRU-AE network further includes the following steps: providing a network structure including multiple encoders and decoders, each attribute in the attribute set is assigned an encoder and a decoder, in the encoder, a bidirectional GRU is used as the main structure to learn the representation of features; in the decoder, a GRU is used as the main structure to reconstruct normal behavior; and an attention mechanism is introduced.

2. The multi-view service process anomaly detection method based on GRU-AE network as described in claim 1, wherein event logs containing abnormal trajectories are used for training to learn normal behavior for anomaly detection, and based on an anomaly score threshold, the portion of the event log with a large reconstruction error is judged as an anomaly.

3. The multi-view service process anomaly detection method based on GRU-AE network as described in claim 1, wherein the multi-view service process anomaly detection method based on GRU-AE network further includes the step of: executing a teacher-forced method during the training process of GRU-AE network.

4. The multi-view service process anomaly detection method based on GRU-AE network as described in any one of claims 1 to 3, wherein the model training step further includes the step of using batch normalization and random deactivation methods to resist overfitting.

5. A multi-view service process anomaly detection device based on a GRU-AE network, characterized in that, include: Memory, used to store software applications. A processor is configured to execute the software application, wherein each program of the software application correspondingly performs the steps in the multi-view service process anomaly detection method based on GRU-AE network as described in any one of claims 1 to 4.

6. A multi-view service process anomaly detection system based on GRU-AE network, characterized in that, The multi-view business process anomaly detection system based on GRU-AE network includes an event log preprocessing unit, a model training unit, and an anomaly detection unit. The event log preprocessing unit performs preprocessing of the event log, obtains each trajectory of the event log, adds a virtual start event before the first event, and adds a virtual end event after the last event, converting the event log into a third-order tensor as the feature to be input. The model training unit performs model training, and the anomaly detection unit obtains the features from the event log preprocessing unit and inputs them into the model trained by the model training unit to obtain an attribute-level anomaly score, and marks the trajectory or attribute as abnormal or normal according to the threshold. The formula for reconstructing the attribute values ​​of each attribute for each event in each trajectory in the model training unit is as follows: ; In the formula, t represents the trajectory, and e represents the event. Represents attributes, This indicates the number of tracks in the log. This represents the maximum length of all tracks in the log. Indicates the number of attributes; In the anomaly detection unit, the anomaly score is defined as a value greater than a specified attribute value in the probability distribution. probability The sum of all probabilities is given by the formula: ； Here, by using a threshold τ, the abnormal score is mapped to 0 or 1, where 0 represents normal and 1 represents abnormal; The model training unit is equipped with a GRU-AE network model, which is trained through unsupervised learning. The model training unit assigns an encoder and a decoder to each attribute in the attribute set. The vector h output by all encoders is input to each decoder, and the vector s output by each encoder is input to the corresponding decoder. The model training unit introduces an attention mechanism into the GRU-AE network model and a teacher-forced method during the training of the autoencoder. The attention mechanism identifies which events and which attributes are related to the next target value of the attribute associated with the decoder and assigns high attention weights to these attribute values.

7. The multi-view service process anomaly detection system based on GRU-AE network as described in claim 6, wherein batch normalization and random deactivation methods are applied to the network structure of the multi-view service process anomaly detection system based on GRU-AE network to resist overfitting.

8. The multi-view service process anomaly detection system for GRU-AE network as described in claim 6 or 7, wherein the model training unit uses cross-entropy as the main component of the loss function when performing model training.

Images