A business process anomaly detection method based on concept drift discovery

Abstract

This invention discloses a business process anomaly detection method based on concept drift discovery, comprising the following steps: 1) collecting data to form an event log; 2) extracting process information using control flow features from the event log, encoding events, and constructing a process feature dataset; 3) building a prediction model for the next event in the business process based on a GRU model, and training the prediction model using the process feature dataset as input data; 4) calculating the anomaly score s of the business process attributes through probability distribution; 5) performing concept drift detection on the anomaly detection results using a concept drift discovery module; and 6) using an incremental learning method to incorporate the drift case set as new knowledge using an event prediction model update module. This method mines process models from event logs without requiring manual judgment to find concept drift cases, enabling more accurate detection of whether anomalies occur in business process instances and locating and determining whether concept drift has occurred.

Description

Technical Field

[0001] This invention relates to the field of business process management technology, and more specifically to a business process anomaly detection method based on concept drift discovery. Background Technology

[0002] Process-Aware Information Systems (PAIS) are widely used across various industries to handle numerous business processes. During PAIS operation, business processes may encounter anomalies. These anomalies include predictable anomalies (such as resource unavailability and business process timeouts) and unpredictable anomalies. Anomalies can cause business processes to deviate from their intended goals, leading to unforeseen losses for users. Examples include lending to users without verifying their credit history or refunding already shipped online orders. Early detection and timely intervention can reduce or avoid losses. Business process anomaly detection technology helps managers identify potential execution risks in business processes and take appropriate measures. In actual business process operation, processes may need to be modified to adapt to the constantly changing external environment. Concept drift in business processes refers to changes in the business process model during operation. In today's dynamic market, modern enterprises and organizations increasingly need to streamline business processes to reduce operating costs and improve business processing efficiency. Modern customers also expect enterprises and organizations to be flexible enough to adapt to the ever-changing business environment. Furthermore, extreme changes in supply and demand, seasonal effects, natural disasters and calamities, and escalating deadlines also force modern enterprises and organizations to change their business processes. The success of modern enterprises and organizations increasingly depends on their ability to adapt to changes in the operating environment. Currently, operational information about business processes is recorded in a large number of event logs within the PAIS systems of modern enterprises and organizations. Experience shows that assuming the business processes under study are in a stable state is highly unrealistic. The aforementioned situations can lead to changes in the process model or its event attribute values, resulting in conceptual drift in the event logs. Due to conceptual drift, existing anomaly detection methods will be unable to maintain their original performance. These methods will fail to distinguish between conceptual drift and anomalies, misclassifying conceptual drift as anomaly and losing a large number of cases in the event logs. Therefore, detecting conceptual drift in business process anomaly detection is a crucial task. In research on business process anomaly detection, Bezerra F et al. used business process event logs, employed process mining methods to obtain process models, and then used consistency checks to discover business process anomalies. This method can detect control flow anomalies in business processes but relies on low-noise event logs. Tax et al. used a Long Short-Term Memory (LSTM) network to predict the next execution event of the current business process instance. This method achieves good accuracy, but the inherent long-range dependency problem of LSTM can affect the detection accuracy of the prediction model. Nolle et al. used LSTM to build a Binet model for business process anomaly detection. This model employs unsupervised training, incorporating data streams into the autoencoder input.The Binet model can detect data flow anomalies in business processes and also anomalies at the event attribute level, improving the accuracy of anomaly detection. Sun Jinyong et al., building upon Binet, introduced a Transformer model with an attention mechanism to construct an anomaly detection model, proposing various attention strategies to capture dependencies between event attributes, further improving the accuracy of event attribute-level anomaly detection. While most of these anomaly detection methods have achieved good accuracy, none have considered the impact of concept drift on the business process model. When concept drift occurs in the business process, the performance of these anomaly detection methods will inevitably decline.

[0003] In research on concept drift detection, Gama et al. proposed the DDM algorithm, which detects concept drift by monitoring metrics such as classifier accuracy. This algorithm performed well in detecting mutation-type concept drift, but its performance was poor in detecting gradual-type concept drift, and it also had a large space overhead. Baena- M et al. proposed the EDDM algorithm based on DDM to improve the detection effect of gradual concept drift. Addressing the space overhead problem of the DDM algorithm, Barros RSM proposed the RDDM algorithm, effectively reducing the latency of concept drift. Pesaranghader A et al. proposed the HDMM method based on a sliding window mechanism using Hoeffding's inequality to detect concept drift. Compared with DDM, EDDM, and other methods, HDMM achieves significant improvements in latency and accuracy. Xu Qingyan et al. used the interquartile range-based sliding window size setting method (NFHDDM) to detect relevant feature indicators of concept drift and used an improved Hoeffding's inequality to determine whether concept drift has occurred. The NFHDDM window achieved good results in terms of latency and accuracy in concept drift detection and can determine the occurrence time of concept drift. However, in the event logs of business processes, finding the location of concept drift is crucial for anomaly detection, and the above methods cannot provide a relatively accurate location of concept drift. Therefore, directly using the above methods cannot reveal the location where concept drift occurs in the business process event log.

[0004] To more accurately detect anomalies in business process instances when business processes change, a business process anomaly detection method based on concept drift discovery (ADCDD) is proposed to discover the location of concept drift and effectively improve the accuracy of anomaly detection methods when concept drift occurs. Summary of the Invention

[0005] This invention addresses the need for high-quality anomaly detection in business processes even when concept drift occurs, providing a business process anomaly detection method based on concept drift discovery. This method mines process models from event logs, eliminating the need for manual identification of concept drift cases. It can more accurately detect whether anomalies have occurred in business process instances and can locate and determine whether concept drift has occurred.

[0006] The technical solution to achieve the objective of this invention is:

[0007] A business process anomaly detection method based on concept drift discovery includes the following steps:

[0008] 1) Collect data from multiple data sources in the process-aware information system to form an event log. The event log is used to record a collection of information about the execution process of the business process. It consists of the activity execution trajectory of the business process, which is also called a case.

[0009] 2) Utilize the control flow features in the event logs to extract process information, encode events, and construct a process feature dataset; specifically: use the event's activity name as the control flow feature of the event's business process, and for cases with long event sequences, add a feature to the end of cases with short event sequences. <0> Fill in;

[0010] 3) Construct a prediction model for the next event in the business process based on the GRU model, and train the prediction model using the process feature dataset as input data; use the Embedding layer to convert events into vectors, use the Batchnorm layer to normalize the data, and the output layer is a Softmax layer. The output result is the probability distribution P of all occurrence events of the next event.

[0011] 4) Calculate the anomaly score s of business process attributes using probability distributions. Use the actual event attributes and the prediction model to predict the probability distribution P of the event and its attributes to calculate the anomaly score s of the event. Use TransNet, an adaptive method for determining the anomaly score threshold of event attributes, to calculate the anomaly score threshold θ to determine whether the event or attribute is abnormal. Anomaly score s greater than the anomaly score threshold θ is considered an anomaly case; otherwise, it is considered a normal case. Finally, obtain the anomaly detection result array result. d ;

[0012] 5) The concept drift detection module performs concept drift detection on the anomaly detection results to identify any concept drifts. It uses a double-layer sliding window and Hofding's inequality to detect concept drifts in the anomaly detection results. If no concept drift is found, the anomaly detection results are submitted; otherwise, all drift cases are extracted from the process feature dataset and submitted to the event prediction model update module. The specific concept drift detection process is as follows:

[0013] 5-1) A two-layer sliding window mechanism is used to calculate the concept drift threshold using Hofding's inequality. A two-layer sliding window is set on the anomaly detection results of the array in step 4). The upper window UW is composed of multiple basic windows W. i Composition, W i That is, a subsequence of UW. Essentially, UW is the anomaly detection result array result. d A subsequence in the array stores the case ID and the anomaly determination result, represented by UW as:

[0014] UW = {W1, W2, W3, ..., W} u-1 W u} (1);

[0015] Let u be the number of lower-level windows. A method for determining the size of a double-layer sliding window is proposed. The idea is to first determine the upper and lower limits of the size of the double-layer sliding window, and then select an appropriate window size from them.

[0016] 5-2) Let k i For a double-layered window W i The average value of the data, i.e., k i =sum(W i ) / len(W i Let i = 1, 2, 3, ..., u, where u is the number of lower-level windows, and k be the number of windows in the lower-level layer. m For all k i The maximum value in the range, m∈[1,n], is k in UW. m -k i >εd, then W is considered i Conceptual drift occurs, where the concept drift threshold εd is determined by formula (2), and formula (3) is a variant of the Hofding inequality:

[0017]

[0018] Assume the data K = {k1,k2,…,k n}, k i ∈[0,1], i=1,2,3,…,n, Substituting K into formula (2) yields the formula for calculating εd as in formula (3):

[0019]

[0020] Where δ is the anomaly rate of cases in the event log;

[0021] All event log instances identified as concept drift cases are placed into the concept drift detection result array `point`. set middle;

[0022] For boundary cases, where all detected event logs are judged as anomalous drift cases, it is considered that the number of detected cases is insufficient and more cases are needed; define the result array when the detection results are... d When the ratio of the number of "1"s to the total length of the array is less than the error rate δ, it is considered that the number of detected cases is insufficient. At this time, the concept drift detection module stops detecting and waits for more cases to be input.

[0023] 5-3) After the detection is completed, if the concept drift detection result array point set If the value is not empty, it indicates a concept drift has occurred, triggering a drift alert. set It stores the IDs of cases where concept drift occurred, for points set The instances are sorted and deduplicated, and then integrated from the corresponding event logs to form a cased set of detected cases of concept drift.

[0024] 6) The event prediction model update module uses an incremental learning method to treat the drift case set as new knowledge, i.e., the case set of cases where concept drift occurs, to update the event prediction model in the event prediction module. First, the new knowledge training set and the old knowledge training set are determined, and the ratio of the new knowledge training set to the old knowledge training set is calculated. Finally, the old knowledge training set and the new knowledge training set are combined to obtain a new dataset to retrain an event prediction model. The updated event prediction module is used to re-predict the probability of events occurring on the feature dataset to obtain new prediction results. Finally, the anomaly detection module continues to perform anomaly detection on the new prediction results and submits the anomaly detection results.

[0025] The method for determining the size of the double-layer sliding window in step 5-1) involves first determining the upper and lower limits of the double-layer sliding window size, and then using the drift ratio to determine a suitable W. up Upper sliding window W up The upper limit of the size is result d Let the number of all "0"s in the string be uw. max W up The lower limit of the size is set to Where n is the number of cases in the event log, and δ is the anomaly rate of the cases in the event log;

[0026] In [uw min uw max Construct a candidate window set T in the [] as shown in formula (4):

[0027]

[0028] In formula (4), k is the number of equal divisions of the candidate interval. To describe the probability that a candidate anomalous case is a concept drift case, the concept drift ratio of the case is defined as follows:

[0029] The concept drift ratio is the result of the anomaly detection array. d The upper window size threshold is t. i When ∈T, the ratio of the number of times it is judged as drift to k is shown in formula (5):

[0030]

[0031] Where the function f(c) j ,t i () is the event log entry with id c j In the case where the size of the upper window is t i The drift determination result when ∈T, i=1,2,3…,k;

[0032] Exception determination result array result d The elements with a value of "0" originally represented candidate anomalies. After processing by calculating the concept drift ratio, the result... d Elements with a value of "0" are processed as decimals between 0 and 1, representing the probability that the anomaly candidate case is a concept drift case;

[0033] Because it is necessary to result d In order to determine the candidate concept drift threshold range with a high and stable concept drift ratio, the appropriate upper window size is determined. Therefore, it is necessary to obtain the range with a small change in concept drift ratio, that is, the range with a small concept drift ratio gradient. The difference method is used to estimate the approximate value of the concept drift ratio gradient. When the approximate value is close to 0, it is considered that the concept drift ratio is no longer changing. The calculation of the concept drift ratio gradient is shown in formula (6):

[0034]

[0035] Finally, the interval with the largest size is selected from multiple candidate concept drift threshold intervals as the candidate window interval, and the average value of the candidate threshold intervals is used as the determined upper-level sliding window size.

[0036] In step 6), the event prediction model in the event prediction module is updated using the case set cased obtained in step 5) that may cause concept drift. If the case samples in cased are too few, the prediction probability of the concept drift event sequence in the probability distribution P of all possible events in the next event will still be very low, causing the updated model to continue to judge concept drift as abnormal. Therefore, incremental learning based on playback is adopted to update the event prediction model in the original business process event prediction module, so that it retains the correct prediction of the original normal cases and no longer judges the concept drift cases as abnormal cases.

[0037] The specific operation method is to extract some cases from the event logs used to train the event prediction model as old knowledge to form an old knowledge training set, and use the detected concept drift case set as the new knowledge training set. The ratio of the old knowledge training set to the new knowledge training set is (1-Φ):Φ, where Φ is as shown in formula (7).

[0038]

[0039] n1 is the number of cases in the new knowledge training set; δ1 is the error rate allowed in the old knowledge training set. This ratio is determined by the Hofding inequality, which ensures that the proportion of concept drift cases in the new knowledge training set is above the drift judgment threshold, thereby preventing the updated model from continuing to judge concept drift as abnormal.

[0040] Using the ratio obtained from formula (7), the old knowledge training set and the new knowledge training set are combined to obtain a new dataset to retrain an event prediction model, and the anomaly score and threshold are re-evaluated. This new dataset is then combined with the anomaly detection module to form an updated anomaly detection model. Finally, this model is merged with the original anomaly detection model to form a new anomaly detection model.

[0041] Beneficial effects:

[0042] (1) This technical solution proposes a method for discovering concept drift in event logs, which can distinguish between real anomalies and concept drift in event logs;

[0043] (2) Define the concept drift ratio to determine whether concept drift has occurred in the current case;

[0044] (3) A method is proposed to use a two-layer sliding window mechanism to detect various types of concept drift and determine the location where concept drift occurs;

[0045] (4) The incremental learning method is used to update the anomaly detection model, which improves the robustness of the model to concept drift and can improve the accuracy of anomaly detection.

[0046] The effectiveness of the business process anomaly detection method based on concept drift discovery was demonstrated through experiments. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the structure of process model P1 in the embodiment;

[0048] Figure 2 This is a schematic diagram of the structure of process model P2 in the embodiment;

[0049] Figure 3 This is a framework diagram of an embodiment;

[0050] Figure 4 This is a structural diagram of the event prediction module in the embodiment;

[0051] Figure 5 This is a structural diagram of the double-layer sliding window in the embodiment;

[0052] Figure 6 This is a diagram of the new anomaly detection model in the embodiment;

[0053] Figure 7 This is an image showing the anomaly detection results before model update in the example;

[0054] Figure 8 This is a diagram showing the anomaly detection results after the model update in the example. Detailed Implementation

[0055] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this is not intended to limit the scope of the invention.

[0056] Example:

[0057] The process for a bank to process personal loans under 20,000 yuan is as follows: Figure 1 The business process model P1 is shown in the diagram, where events A is "Accepting Loan Application", B is "Reviewing Eligibility", C is "Feedback on Approval", D is "Feedback on Approval Disapproval", E is "Confirming Collateral", F is "Disbursing Loan Funds", and G is "Logging". The case in the event log of P1 has two tracks: trace1 = {A, B, C, E, F, G} and trace2 = {A, B, D, G}. Due to the bank's new policy, the bank no longer performs the "Confirming Collateral" operation for personal loans under 20,000 yuan. At this point, P1 becomes... Figure 2 The process model shown is P2. The event log of P2 should contain traces of cases such as trace3 = {A, B, C, F, G} and trace4 = {A, B, D, G}. In this case, process P1 is said to have undergone conceptual drift, evolving into process P2; P2 is considered a new version of P1. Since trace3 does not contain the event "confirm mortgaged assets," if the model and anomaly detection method of business process P1 are not updated in a timely manner, the original anomaly detection method will classify the case with trace3 as an anomaly.

[0058] Reference Figure 3 A business process anomaly detection method based on concept drift discovery includes the following steps:

[0059] 1) Collect data from multiple data sources in the process-aware information system to form an event log, extract process information from the event log, use the event name as a discrete attribute for anomaly detection, encode the events using one-hot encoding, and construct a process feature dataset.

[0060] To better utilize the control flow features in the event log, this example treats the event name as a discrete attribute of the event and encodes it using the one-hot encoding method. This constructs a process feature dataset, which encodes all event names that appear in the event log. At the same time, a start event and an end event are added to the beginning and end of each case and encoded. The code for the start event is set to the total number of events, and the code for the end event is set to the total number of events minus 1.

[0061] Suppose the event log of a certain business process is L, and the case set is C, then Since the event sequence lengths of each case in C may be different, when extracting process control flow features, "0" is added to the end of the case with shorter event sequences to fill in the gaps. The case is represented as shown in formula (8):

[0062] case i = <e n ,e1,e2,... e i ,…,e m-2 ,e m-1 ,0,0,....,0> (8),

[0063] Among the cases i For the i-th case in the event log, i = 1, 2, 3, ..., m, where m is the total number of events including start and end events, e m Encode for Start, e m-1 0 is the End code, and 0 is the fill case code;

[0064] Example 1: A certain case is case1 =<e1,e2,e3,e4> If the maximum length of the event sequence in case set C is 8 and the total number of events is 8, then the encoding of case1 should be case1=<8,1,2,3,4,7,0,0>, where 8 is the start event encoding, 7 is the end event encoding, 0 is the padding event encoding, and 1-4 are the normal event encodings;

[0065] 2) The event prediction module is constructed using a GRU-based event prediction model, such as... Figure 4 In the middle, f i-1 For the (i-1)th event in a certain case in C, an Embedding layer is used to convert the event into a vector, a Batchnorm layer is used for data normalization, and the output layer is a Softmax layer. The output result is the probability distribution p of all possible events of the i-th event. i ;

[0066] After the above data processing, the event log L and the case set C in L are processed into the form of formula (8). For each case, the training model predicts the probability distribution P of all possible events after the start event, as shown in formula (9):

[0067] P = {(e1,p1),(e2,p2),...,(e...} en ,p en )} (9),

[0068] Where en is the length of the longest event sequence, and e en If it is the encoding of Start, then (e en ,p en ) indicates that the probability of Start occurring at this position is p. en The model is trained using unsupervised learning to predict f. i-1 The probability distribution P of the next possible event after the event has occurred. i The case always begins with Start. The model first predicts the probability distribution P of all possible events after Start occurs. i This continues until the End statement appears in the case statement;

[0069] After the above training, the model can predict f in the event sequence. i-1 The probability distribution P of all possible event names of the next event after the event has occurred;

[0070] Example 2: After processing in step 1), a case becomes case1 = <8, 1, 2, 3, 4, 7, 0, 0>, and the maximum length of the event sequence in the case set C is 8, and the total number of events is 8. The trained model predicts the probability distribution of the occurrence of each event "1", "2", "3", "4", "5", "6", "7", "8", "0" after the initial event "8" occurs, P8 = {(1,p1), (2,p2), (3,p3), (4,p4), (5,p5), (6,p6), (7,p7), (8,p8), (0,p0)}, where p iLet be the probability of the time interval with a number of size "i" after the occurrence of "8", and And so on, predicting the next event for each event in case 1;

[0071] 3) Corresponding Figure 3 The anomaly detection module is divided into two sub-modules: anomaly scoring and anomaly determination. The anomaly scoring sub-module uses the probability distribution of event occurrence to obtain the event anomaly score of cases in the event log. The anomaly determination sub-module first adaptively calculates the event anomaly score threshold, and then compares the threshold with the anomaly score. If the score is higher than the threshold, the case is determined to be an anomaly case; otherwise, it is a normal case. At this time, the cases determined to be anomalies may be real anomalies, but they may also be conceptual drift. Therefore, the cases determined to be anomalies are collectively referred to as candidate anomaly cases.

[0072] 3-1) Anomaly scoring:

[0073] From step 2), the probability of each event in the event sequence of the case can be obtained, as shown in formula (9). For a certain case, starting from the first event, the probability distribution of all possible events at each position in the event sequence is predicted one by one to obtain the probability distribution P of the case.

[0074] However, the actual business process structure is more complex. In the case, there may be multiple reasonable events after a certain event. Considering that there may be concurrent or loop structures in the business process model, it is necessary to convert the probability of each event into anomaly scores.

[0075] Anomaly score is a real number s, where s is a decimal between 0 and 1, used to determine whether the value of a certain event attribute of a business process instance is abnormal. The function f is used to evaluate the score. score (P,p t The calculation method is as follows:

[0076]

[0077] Where P is the probability distribution predicted by the event prediction module, (e i ,p i ) represents the event e at this location. i The probability of occurrence is p i i = 1, 2, 3, ..., m, where m is the total number of events in the event log, e t For events that actually occur, p t The event prediction module predicts the occurrence of event e. t The probability of;

[0078] The higher the predicted probability of an actual event, the fewer events in P whose probability of occurrence is higher than the probability of the actual event, and the lower the anomaly score; conversely, the lower the predicted probability of an event, the higher the anomaly score.

[0079] Example 3: In a certain case, after a certain event occurs, the probability distribution of all possible events that occur in the next event is P.

[0080] P={(e1,0.05),(e2,0.05),(e3,0.1),(e4,0.4),(e5,0.4)},

[0081] If the actual event is e1, then its anomaly score is f. score (P, 0.05) = 0.1 + 0.4 + 0.4 = 0.9. If the actual event is e4, then its anomaly score f score (P, 0.4) = 0; if the actual event is e5, f score (P,0.4)=0, and it is found that the anomaly score of e4 or e5 is the lowest. Therefore, it is reasonable for the next event to occur to be e4 or e5. The anomaly score of e1 is the highest. If the next event is e1, then the case may be anomaly. This solves the problem that after a certain event occurs in a case, multiple reasonable events may occur, which may cause the anomaly detection method to misjudge normal cases as abnormal cases.

[0082] 3-2) Anomaly detection method:

[0083] Based on the anomaly score calculation method in step 3-2), the anomaly score of each event in each case in the event log can be obtained. In this example, formula (11) is used to determine whether a case is a candidate anomaly case:

[0084]

[0085] Where θ is the anomaly score threshold. In this example, TransNet's adaptive method for determining the anomaly score threshold for event attributes is used to determine θ. Since the phenomenon of anomaly scores exceeding the threshold θ may be caused by concept drift, these cases are considered as candidate anomaly cases.

[0086] To detect concept drift, if the anomaly detection module determines a case as an anomaly, this example inserts 0 into the anomaly detection result array `result`. d Otherwise, insert 1 into the anomaly detection result array result. d In the array result d = <d1,d2,d3,.....,d n-1 ,d n >, where d i∈{0,1}, i=1,2,3…,n, where n is the number of cases in the event log, resulting in an array result that stores the anomaly detection results. d ;

[0087] Example 4: The anomaly score threshold θ is 0.72. After processing in step 3-1), the anomaly scores of each case can be obtained. If the anomaly score of a case is greater than 0.72, it is determined to be a candidate anomaly case, and 0 is inserted into the anomaly detection result array result. d In the middle; if the anomaly score of a case is less than or equal to 0.72, it is judged as a normal case, and 1 is inserted into the anomaly detection result array result. d If the result is obtained d =<1,1,0,0,0,0,0,0,1,1> indicates that the 3rd, 4th, 5th, 6th, 7th, and 8th cases in the log are candidate abnormal cases, and the rest are normal cases;

[0088] 4) Most business process anomaly detection algorithms rely on user-defined anomaly thresholds, or are set to a constant based on experience; correspondingly Figure 3 The concept drift detection module in the system allows concept drift to occur anywhere in the event log, such as the beginning, middle, or end. The corresponding array `result` can be located based on the case ID. d At the corresponding position, considering the boundary case, that is, all detected event logs are drift cases, in which case the array result d In order to detect concept drift and determine its location, this example proposes a two-layer sliding window mechanism that uses the Hofding inequality to calculate the concept drift determination threshold.

[0089] In the array result d Set a two-layer sliding window above, such as Figure 5 As shown, the upper-level window UW consists of multiple basic windows W. i Composition, W i That is, a subsequence of UW. In essence, UW is the array result. d A subsequence in the array stores the case ID and the anomaly determination result. UW can be represented as:

[0090] UW = {W1, W2, W3, ..., W} u-1 W u} (1),

[0091] u represents the number of lower-level windows;

[0092] Let k i for Figure 5 Medium double-layer window W i The average value of the data, i.e., ki =sum(W i ) / len(W i Let i = 1, 2, 3, ..., n, and let k be the number of the nth ... m For all k i The maximum value in the range, m∈[1,n], is k in UW. m -k i >εd, then W is considered i Conceptual drift occurs, where the concept drift threshold εd is determined by formula (2), which is a variant of the Hofding inequality:

[0093]

[0094] Assume the data K = {k1,k2,…,k n}, k i ∈[0,1], i=1,2,3,…,n, substituting K into formula (2) yields the formula for calculating εd as in formula (3):

[0095]

[0096] Where n is the number of cases in the event log, and δ is the anomaly rate of the cases in the event log;

[0097] Example 5, result in Example 4 d =<1,1,0,0,0,0,0,0,1,1>, the abnormality rate δ of the cases in the hyperparameter event log is assumed to be 2.718%, and substituting it into formula (3) yields εd = 0.42456;

[0098] In boundary cases, where all detected event logs are identified as anomalous drift cases, the number of detected cases is considered insufficient, and more cases are needed. In this example, the detection result array `result` is defined as... d When the ratio of the number of "1"s to the total length of the array is less than the error rate δ, it is considered that the number of detected cases is insufficient. At this time, the concept drift detection module stops detecting and waits for more cases to be input.

[0099] UW's size W up Algorithm 1 determines the window size by first setting the upper and lower limits, and then using the drift ratio to determine a suitable W. up Upper window W up The upper limit of the size is result d Let the number of all "0"s in the string be uw. max W up The lower limit of the size is set to Where n is the number of cases in the event log, and δ is the anomaly rate of the cases in the event log;

[0100] Example 6: In Example 4, the result d =<1,1,0,0,0,0,0,0,1,1>, the anomaly rate δ of the cases in the event log is 2.718%, then we can obtain uw max =6, uw min =5.76, uw min Rounding down to 5, the window size range is [6, 5].

[0101] In [uw min uw max Construct a candidate window set T in the [equation], as shown in equation (4):

[0102]

[0103] In equation (4), k is the number of equal divisions of the candidate interval. In order to balance computation time and accuracy, after multiple experimental comparisons, k = 10 is taken in this example. In order to describe the probability that the candidate abnormal case is a concept drift case, the concept drift ratio of the case is defined as follows:

[0104] The concept drift ratio is the result of the anomaly detection array. d The upper window size threshold is t. i When ∈T, the ratio of the number of times it is judged as a drift to k is shown in equation (5):

[0105]

[0106] Where the function f(c) j ,t i () is the event log entry with id c j In the case where the size of the upper window is t i The drift determination result when ∈T, i=1,2,3…,k,k=10;

[0107] Exception determination result array result d The elements with a value of "0" originally represented candidate anomalies. After processing by calculating the concept drift ratio, the result... d Elements with a value of "0" are processed as decimals between 0 and 1, representing the probability that the anomaly candidate case is a concept drift case;

[0108] Example 7, the result in Example 6 d =<1,1,0,0,0,0,0,1,1,1> will be processed as result. d=<1,1,0.9,0.5,0,0.5,0.9,1,1,1>, where “0.9” means that when k=10, the case was judged as a normal case 9 times out of 10 different window size values; “0” means that it was judged as a concept drift case in all 10 times.

[0109] Because this example requires the result... d In this study, a candidate concept drift threshold range with a high and stable concept drift ratio is determined to determine the appropriate upper-level window size. Therefore, it is necessary to obtain the range where the concept drift ratio changes little, that is, the range where the concept drift ratio gradient is small. In this example, the difference method is used to estimate the approximate value of the concept drift ratio gradient. When the approximate value is close to 0, it is considered that the concept drift ratio is no longer changing. The calculation of the concept drift ratio gradient is shown in equation (6):

[0110]

[0111] Therefore, based on the drift ratio gradient, a suitable upper-level window size is found in T, as shown in Algorithm 1:

[0112]

[0113]

[0114] Analysis shows that the time complexity of Algorithm 1 is O(k|C|) and the space complexity is O(|C|), where C is the case set. In this example, the interval with the largest interval size is selected from multiple candidate concept drift threshold intervals as the candidate window interval, and the average value of the candidate threshold intervals is used as the determined upper sliding window size.

[0115] To facilitate the identification of the location where the drift occurs, the anomaly detection result array result is used. d This is transformed into the accuracy set data_mean of the lower-level window, i.e., data_mean = {k1, k2, ..., k n}, where k i ∈[0,1],k i The mean of the data within the two-layer window, data_mean i Let i be the i-th value in data_mean, where i = 1, 2, 3, ..., n.

[0116] Example 8, the result in Example 7 is calculated using Algorithm 1. d When W = <1,1,0.9,0.5,0,0.5,0.9,1,1,1>, up The maximum value across all stationary intervals is 5.3561. Rounding up to 6, we can obtain the value for...

[0117] result d =<1,1,0.9,0.5,0,0.5,0.9,1,1,1>, where W is the size of the upper sliding window. up The value should be 6, and the size of the lower-level window should be W. down The value should be 1;

[0118] After obtaining the size W of the upper sliding window up Then, a two-layer sliding window mechanism can be used to identify possible concept drift cases. Based on the results of multiple experiments, the size W of the lower sliding window is set in this example. down =0.1*W up This example uses Algorithm 2 to discover all possible concept drift cases. The idea is to find the maximum value pmax in data_mean and the maximum value pmax in data_mean. i When the difference is greater than the threshold εd, it is considered that data_mean i A concept drift occurred, and the case IDs within the window were saved in the concept drift case set point. set In the middle, add the ID of the concept drift case to the concept drift case set point. set middle;

[0119]

[0120]

[0121] Analysis shows that Algorithm 2 has a time complexity of O(n) and a space complexity of O(n), where... Lines 2-8 of Algorithm 2 compare pmax with the average value of all lower-level windows, data_mean. i The difference, if pmax - data_mean exists i If the value is greater than εd, it is considered that the case within the lower-level window has undergone concept drift, and the lower-level window's data_mean is set to... i Add the IDs of all events to the concept drift case set point set middle;

[0122] After the test is completed, if the point set If the value is not empty, it indicates a concept drift has occurred, triggering a drift alert. set It stores the IDs of cases where concept drift occurred, for points set Sort and remove duplicates, and integrate the corresponding cases in C to form the case set cased, which is the case set that may have detected concept drift.

[0123] Example 9, the result obtained from Example 4 d=<1,1,0,0,0,0,0,0,1,1>, εd = 0.42456 obtained from Example 5, and W calculated from Example 7. up =6, W down =1, substituting into Algorithm 2, we can get cased=<3,4,5,6,7,8> which means that the cases with event log numbers 3, 4,5,6,7,8 are the set of cases that can experience concept drift;

[0124] 5) Corresponding Figure 3 In the event prediction model update module, the case set cased obtained in step 4) is used to update the model. If the case samples in cased are too few, the prediction probability of the concept drift event sequence in the probability distribution P of all possible events in the next event will still be very low, causing the updated model to continue to judge concept drift as abnormal. Therefore, the event prediction model in the original business process event prediction module is updated by incremental learning based on playback, so that it retains the correct prediction of the original normal cases and no longer judges the concept drift cases as abnormal cases.

[0125] In this example, a portion of cases will be extracted from the event logs used to train the event prediction model as old knowledge, forming the old knowledge training set. The set of detected concept drift cases will be used as the new knowledge training set. The ratio of the old knowledge training set to the new knowledge training set is (1-Φ):Φ, where... n is the number of cases in the new knowledge training set; δ is the error rate allowed in the old knowledge training set. This ratio is determined by the Hofding inequality, which ensures that the proportion of concept drift cases in the new knowledge training set is above the drift judgment threshold, thereby preventing the updated model from continuing to judge concept drift as abnormal.

[0126] Using the above operations, a new event prediction model is retrained with the new dataset. Anomaly scores and thresholds are then re-evaluated, and this updated model is combined with the anomaly detection module to form a new anomaly detection model. This updated model is then merged with the original anomaly detection model to create a new anomaly detection model, as shown below. Figure 6 As shown.

[0127] After the original anomaly detection model makes an anomaly judgment, the updated anomaly detection model is used again to identify concept drift cases that were mistakenly identified as anomalies by the original model, thus achieving the goal of discovering concept drift. The detection results are as follows: Figure 7 , Figure 8 As shown. Comparison Figure 7 , Figure 8 It can be observed that the original model would recognize concept drift cases as anomalous cases, while the updated model can correctly identify concept drift cases.

Claims

1. A method for detecting anomalies in business processes based on concept drift discovery, characterized in that, Includes the following steps: 1) Collect data from multiple data sources in the process-aware information system to form an event log. The event log is used to record a collection of information about the execution process of the business process. It consists of the activity execution trajectory of the business process, which is also called a case. 2) Utilize the control flow features in the event log to extract process information, encode events, and construct a process feature dataset; Specifically, the event activity name is used as the control flow characteristic of the event's business process. For cases with long event sequences, zeros are added to the end of the event sequence for padding. 3) Construct a prediction model for the next event in the business process based on the GRU model, and train the prediction model using the process feature dataset as input data; The event is converted into a vector using an Embedding layer, the data is normalized using a Batchnorm layer, and the output layer is a Softmax layer. The output result is the probability distribution P of all events that occur in the next event. 4) Calculate the anomaly score s of business process attributes using probability distributions. Use the actual event attributes and the prediction model to predict the probability distribution P of the event and its attributes to calculate the anomaly score s of the event. Use TransNet, an adaptive method for determining the anomaly score threshold of event attributes, to calculate the anomaly score threshold Ɵ to determine whether the event or attribute is abnormal. Anomaly score s greater than the anomaly score threshold Ɵ is considered an anomaly case; otherwise, it is considered a normal case. Finally, obtain the anomaly detection result array result. d ; 5) The concept drift detection module performs concept drift detection on the anomaly detection results to identify any concept drifts. It uses a double-layer sliding window and Hofding's inequality to detect concept drifts in the anomaly detection results. If no concept drift is found, the anomaly detection results are submitted; otherwise, all drift cases are extracted from the process feature dataset and submitted to the event prediction model update module. The specific concept drift detection process is as follows: 5-1) A two-layer sliding window mechanism is used to calculate the concept drift threshold using Hofding's inequality. A two-layer sliding window is set on the anomaly detection results of the array in step 4). The upper window UW is composed of multiple basic windows W. i Composition, W i That is, a subsequence of UW. Essentially, UW is the anomaly detection result array result. d A subsequence in the array stores the case ID and the anomaly determination result, represented by UW as: UW={W1,W2,W3……W u-1 W u (1) Let u be the number of lower-level windows. A method for determining the size of a double-layer sliding window is proposed. The idea is to first determine the upper and lower limits of the size of the double-layer sliding window, and then select an appropriate window size from them. 5-2) Let k i For a double-layered window W i The average value of the data, i.e., k i =sum(W i ) / len(W i Let i = 1, 2, 3, ..., n, and let k be the number of the nth group of the nth group. m For all k i The maximum value in, Within UW, if there exists k m -k i >εd, then W is considered i Conceptual drift occurs, where the concept drift threshold εd is determined by formula (2), which is a variant of the Hofding inequality: （2）， Data K = {k1,k2,…,k n }, k i ∈ [0,1], i=1,2,3,…,n, substituting K into formula (2) yields the εd calculation formula as in formula (3): = （3）， Where n is the number of cases in the event log, and δ is the anomaly rate of the cases in the event log; All event log instances identified as concept drift cases are placed into the concept drift detection result array `point`. set middle; In boundary cases, where all detected event logs are judged as anomalous drift cases, it is considered that the number of detected cases is insufficient and more cases are needed; when the detection result array result... d When the ratio of the number of "1"s to the total length of the array is less than the error rate δ, it is considered that the number of detected cases is insufficient. At this time, the concept drift detection module stops detecting and waits for more cases to be input. 5-3) After the detection is completed, if the concept drift detection result array point set If the value is not empty, it indicates a concept drift has occurred, triggering a drift alert. set It stores the IDs of cases where concept drift occurred, for points set The instances are sorted and deduplicated, and then integrated from the corresponding event logs to form a cased set of detected cases of concept drift. 6) The event prediction model update module uses the incremental learning method to take the drift case set as new knowledge, that is, the case set of cases where concept drift occurs, to update the event prediction model in the event prediction module; the updated event prediction module is used to re-predict the probability of the event occurring on the feature dataset to obtain new prediction results. Finally, the anomaly detection module continues to perform anomaly detection on the new prediction results and submits the anomaly detection results.

2. The business process anomaly detection method based on concept drift discovery according to claim 1, characterized in that, The method for determining the size of the double-layer sliding window in step 5-1) involves first determining the upper and lower limits of the double-layer sliding window size, and then using the drift ratio to determine a suitable W. up Upper sliding window W up The upper limit of the size is result d Let the number of all "0"s in the string be uw. max W up The lower limit of the size is set to uw. min *n; In [uw min uw max Construct a candidate window set T in the [] as shown in formula (4): （4）， In formula (4), k is the number of equal divisions of the candidate interval. To describe the probability that a candidate abnormal case is a concept drift case, the concept drift ratio of the case is defined as follows: The concept drift ratio is the result of the anomaly detection array. d The upper window size threshold is When ∈T, it is the ratio of the number of drifts to k, as shown in equation (5): , c j ∈result d (5), Where the function f(c) j , t i () is the event log entry with id c j In the case where the upper window size is... The drift determination result when i ∈ T, i = 1, 2, 3, ..., k; Exception determination result array result d The elements with a value of "0" originally represented candidate outliers. After calculating the concept drift ratio, the result... d Elements with a value of "0" are processed as decimals between 0 and 1, representing the probability that the anomaly candidate case is a concept drift case; Because it is necessary to result d In order to determine the candidate concept drift threshold range with high and stable concept drift ratio, the appropriate upper window size is determined. Therefore, it is necessary to obtain the range with small change in concept drift ratio, that is, the range with small concept drift ratio gradient. The difference method is used to estimate the approximate value of the concept drift ratio gradient. When the approximate value is close to 0, it is considered that the concept drift ratio is no longer changing. The calculation of the concept drift ratio gradient is shown in formula (6): ， ∈T （6）； Finally, the interval with the largest size is selected from multiple candidate concept drift threshold intervals as the candidate window interval, and the average value of the candidate threshold intervals is used as the determined upper-level sliding window size.

3. The business process anomaly detection method based on concept drift discovery according to claim 1, characterized in that, In step 6), the event prediction model in the event prediction module is updated, that is, the case set cased obtained in step 5) that causes concept drift is updated. If there are few case samples in cased, the prediction probability of the concept drift event sequence in the probability distribution P of all events in the next event will still be low, causing the updated model to continue to judge concept drift as abnormal. Therefore, the event prediction model in the original business process event prediction module is updated by incremental learning based on playback, so that it retains the correct prediction of the original normal cases and no longer judges the concept drift case as an abnormal case e. A portion of cases will be extracted from the event logs used to train the event prediction model as old knowledge to form an old knowledge training set. The set of detected concept drift cases will be used as the new knowledge training set. The ratio of the old knowledge training set to the new knowledge training set is (1-Φ):Φ, where Φ is as shown in formula (7). Φ= (7) n1 is the number of cases in the new knowledge training set; δ1 is the error rate allowed in the old knowledge training set. This ratio is determined by the Hofding inequality, which ensures that the proportion of concept drift cases in the new knowledge training set is above the drift judgment threshold, thereby preventing the updated model from continuing to judge concept drift as abnormal. Using the ratio obtained by formula (7), the old knowledge training set and the new knowledge training set are combined to obtain a new dataset to retrain an event prediction model, and the anomaly score and threshold are re-evaluated. The updated anomaly detection model is formed with the anomaly detection module, and the model is merged with the original anomaly detection model to form a new anomaly detection model. After the original anomaly detection model makes an anomaly judgment, the updated anomaly detection model is used to detect again, and the concept drift cases that were mistakenly treated as anomalies by the original anomaly detection model are selected, so as to achieve the purpose of discovering concept drift.

Images