Graph neural network business process anomaly detection method and system based on multi-attribute graph

Abstract

This invention provides a graph neural network business process anomaly detection method and system based on multi-attribute graphs, including the following steps: Step 1: Converting trajectories in event logs into multiple graphs using a multi-graph generator; Step 2: Inputting the converted multiple graphs into a multi-graph encoder for one-hot encoding and positional encoding to obtain the hidden representation of each node; Step 3: Decoding the hidden representation of each node into a probability distribution using a multi-sequence decoder; Step 4: Calculating an anomaly score based on the probability distribution using an anomaly score calculator, and marking trajectories and attributes as abnormal or normal based on a threshold. This invention solves the technical problems of anomaly detection in the business process field, capable of automatically detecting abnormal trajectories in event logs and identifying the root cause of the anomaly.

Description

Technical Field

[0001] The present invention relates to the technical field of business process anomaly detection, and in particular to a graph neural network business process anomaly detection method and system based on a multi-attribute graph. Background Art

[0002] Anomaly detection, also known as outlier detection or novelty detection, primarily involves identifying rare, unexpected, and suspicious instances within a population of normal instances. Its applications range widely, including spam detection, financial fraud detection, and intrusion detection in network security. It is crucial for helping practitioners and decision makers discover, manage, and avoid anomalous patterns in data. With the recent advancement of information technology, businesses have increasingly relied on process-aware information systems (PAIS) to optimize their processes. However, anomalies in processes are inevitable, and these anomalies can arise from a variety of reasons, such as system failures and operator errors. Detecting anomalies in business processes has attracted considerable research attention.

[0003] Detecting anomalies in business processes is valuable. First, the healthy operation of an enterprise depends on the early detection of anomalies that arise during the execution of business processes. Furthermore, low-quality event logs (i.e., those containing anomalies) hinder our ability to extract valuable information from them, so we need to detect and remove anomalies. For example, process mining (PM) provides techniques for understanding and enhancing processes in various application areas. The output of process mining techniques using low-quality event logs is also likely to be low-quality, thereby reducing the quality of any decisions based on them.

[0004] Event logs represent multiple perspectives, such as activities, resources, data, and time, and they exhibit complex dependencies. For example, i) control flow dependencies: activities execute in a specific order; ii) data flow dependencies: data is passed and modified during the execution of each activity; iii) control flow and data flow coupling: different activities are executed based on different data values; iv) time dependencies: different activities have different durations; and iv) resource dependencies: different machines or users execute different activities. Capturing these complex dependencies and detecting anomalies in business processes is a challenging task.

[0005] Patent document CN115115019A (application number: CN202110296482.X) discloses a neural network-based anomaly detection method for automatically detecting anomalies in multidimensional time series data. The method includes the following steps:

[0006] Step 1: Set the length of three time windows, long, medium, and short, according to the length of the multidimensional time series data, divide the multidimensional time series data into multiple time window data according to the time window length, and calculate the correlation matrix according to the length of the divided time window as the signal matrix of the corresponding time window data; Step 2: Extract the spatial information of the signal matrix through a convolutional neural network and encode the signal matrix; Step 3: Extract the time series information of the signal matrix through a convolutional long-short memory neural network and add it to the encoded signal matrix; Step 4: Decode the encoded signal matrix through a convolutional neural network and a convolutional long-short memory neural network to obtain a restored matrix, calculate the reconstruction error of the restored matrix and the signal matrix, and set a threshold to determine abnormal data. However, this patent cannot solve the existing technical problems and cannot meet the needs of the present invention. Summary of the Invention

[0007] In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for detecting business process anomalies based on a graph neural network with multi-attribute graphs.

[0008] The method for detecting anomalies in business processes using a graph neural network based on a multi-attribute graph provided by the present invention includes:

[0009] Step 1: Convert the trajectories in the event log into multiple images through the multi-image generator;

[0010] Step 2: Input the converted multiple graphs into the multi-graph encoder for one-hot encoding and position encoding to obtain the hidden representation of each node;

[0011] Step 3: Decode the hidden representation of each node into a probability distribution through a multi-sequence decoder;

[0012] Step 4: Calculate the anomaly score based on the probability distribution through the anomaly score calculator and label the trajectory and attributes as abnormal or normal based on the threshold.

[0013] Preferably, the step 1 comprises:

[0014] Count the number of occurrences of each direct follow-up relationship (b, c), indicating that activity b is directly followed by activity c in the event log L;

[0015] Generate a directed global graph G(L) containing all activities in the trajectory as nodes. A directed edge b←c exists in the directed global graph G(L) if and only if the number of occurrences of the direct follow-up relationship (b,c) is at least β*|L| times, where β is a user-selected threshold.

[0016] Generate a directed event graph G(t) for trajectory t, which contains the events of trajectory t as nodes. For the directed event graph G(t), if e activity ←e′activity is an edge in the directed global graph G(L), then there is an edge e←e′ in the directed event graph G(t), where e represents the event and e activity Represents the name of the activity in the event;

[0017] Adjust the directed event graph G(t) to a directed connected graph. If event e directly follows event e′ in trajectory t, then e←e′ exists in the directed event graph G(t).

[0018] The directed event graph G(t) is exported as a separate graph for each attribute in the attribute set. For each attribute a in the attribute set, multiple graphs are obtained by replacing the nodes of the directed event graph G(t) from event e with the attribute a in event e.

[0019] Preferably, the step 2 comprises:

[0020] Multiple graphs generated by trajectory t, each graph contains |t| nodes, where |t| represents the length of trajectory t, and each graph is assigned a different one-hot encoding, position encoding, and GAT network;

[0021] Use one-hot encoding to convert discrete attribute values ​​into binary vectors. After one-hot encoding, the value of the node in the graph is converted into a two-dimensional vector, whose length is the number of all attribute values ​​of attribute a;

[0022] Information about the relative or absolute position of the event in the trajectory is injected into the one-hot encoding. The position encoding used is as follows:

[0023]

[0024]

[0025] Among them, pos is the position of the event in the sequence; i is the vector after one-hot encoding The i-th dimension in |v a | is the number of all possible attribute values ​​of attribute a;

[0026] Use the GAT network to encode the node and obtain the hidden representation of the node

[0027] Get the average of these hidden representations The initial hidden state of the GRU network used in the multi-sequence decoder:

[0028]

[0029] The multi-image encoder outputs |t|*A hidden representations {h1,h2,…,h |t|*A} and the initial hidden state of the GRU network in the A multi-sequence decoder Where |t| is the length of trajectory t, A is the number of attributes; is the hidden representation of the |t|th node in the graph corresponding to attribute a; h |t|*A is the |t|*Ath hidden representation; is the initial hidden state of the GRU network in the multi-sequence decoder corresponding to the Ath attribute.

[0030] Preferably, the step 3 comprises:

[0031] The outputs of all multi-image encoders {h1,h2,…,h |t|*A}After the scaled dot product attention layer, and generate c e Input into the GRU network, the expression is:

[0032]

[0033] Among them, c e Represents the output of the attention mechanism, which is the vector h i The weighted sum of

[0034] For the first attribute, only the ground truth attribute value at the last moment t is used e-1,1 To guide the prediction of the probability distribution of the attribute value of the current event e, the expression is:

[0035]

[0036] in, yes and The connection is input into GRU; It is t e-1,1 The initial hidden state of GRU is the output of the multi-image encoder represents the hidden representation output by the GRU in the multi-sequence decoder corresponding to the first attribute at the e-th time step; The output of the attention mechanism in the multi-sequence decoder corresponding to the first attribute is the vector h i The weighted sum of

[0037] Probability distribution is the probability distribution over all possible values ​​of the first attribute of event e, computed as follows:

[0038]

[0039] in, Represents a learnable weight matrix.

[0040] Preferably, step 4 includes:

[0041] By combining a multi-graph encoder and a multi-sequence decoder to form an autoencoder, the input trajectory t is compressed into a low-dimensional hidden representation, and then the probability distribution of each attribute a of each event e in the trajectory t is generated from the hidden representation. The training process of the autoencoder can be described as minimizing the following reconstruction error:

[0042]

[0043] in, Indicates the probability distribution The value of attribute a of event e in trajectory t is t e,a probability;

[0044] Dropout is applied after each layer of the GAT network and GRU network to offset the effect of overfitting, and the Adam optimizer is used for training;

[0045] Define the anomaly score S t,e,a For the probability distribution Greater than the specified attribute value t e,a Probability The sum of all probabilities is expressed as:

[0046]

[0047] in, is the probability distribution The probability of the i-th value in ;

[0048] A threshold τ is applied to the anomaly score of the attribute value, and the attribute value is marked as normal or abnormal. The higher the anomaly score of the attribute value, the greater the possibility of an abnormality.

[0049] The graph neural network business process anomaly detection system based on a multi-attribute graph provided by the present invention includes:

[0050] Module M1: Convert the trajectories in the event log into multiple graphs through a multi-graph generator;

[0051] Module M2: Input the converted multiple graphs into the multi-graph encoder for one-hot encoding and position encoding to obtain the hidden representation of each node;

[0052] Module M3: decodes the hidden representation of each node into a probability distribution through a multi-sequence decoder;

[0053] Module M4: Calculates anomaly scores based on probability distribution through anomaly score calculator and labels trajectories and attributes as abnormal or normal according to thresholds.

[0054] Preferably, the module M1 includes:

[0055] Count the number of occurrences of each direct follow-up relationship (b, c), indicating that activity b is directly followed by activity c in the event log L;

[0056] Generate a directed global graph G(L) containing all activities in the trajectory as nodes. A directed edge b←c exists in the directed global graph G(L) if and only if the number of occurrences of the direct follow-up relationship (b,c) is at least β*|L| times, where β is a user-selected threshold.

[0057] Generate a directed event graph G(t) for trajectory t, which contains the events of trajectory t as nodes. For the directed event graph G(t), if e activity ←e′ activity is an edge in the directed global graph G(L), then there is an edge e←e′ in the directed event graph G(t), where e represents the event and e activity Represents the name of the activity in the event;

[0058] Adjust the directed event graph G(t) to a directed connected graph. If event e directly follows event e′ in trajectory t, then e←e′ exists in the directed event graph G(t).

[0059] The directed event graph G(t) is exported as a separate graph for each attribute in the attribute set. For each attribute a in the attribute set, multiple graphs are obtained by replacing the nodes of the directed event graph G(t) from event e with the attribute a in event e.

[0060] Preferably, the module M2 includes:

[0061] Multiple graphs generated by trajectory t, each graph contains |t| nodes, where |t| represents the length of trajectory t, and each graph is assigned a different one-hot encoding, position encoding, and GAT network;

[0062] Use one-hot encoding to convert discrete attribute values ​​into binary vectors. After one-hot encoding, the value of the node in the graph is converted into a two-dimensional vector, whose length is the number of all attribute values ​​of attribute a;

[0063] Information about the relative or absolute position of the event in the trajectory is injected into the one-hot encoding. The position encoding used is as follows:

[0064]

[0065]

[0066] Among them, pos is the position of the event in the sequence; i is the vector after one-hot encoding The i-th dimension in |va | is the number of all possible attribute values ​​of attribute a;

[0067] Use the GAT network to encode the node and obtain the hidden representation of the node

[0068] Get the average of these hidden representations The initial hidden state of the GRU network used in the multi-sequence decoder:

[0069]

[0070] The multi-image encoder outputs |t|*A hidden representations {h1,h2,…,h |t|*A} and the initial hidden state of the GRU network in the A multi-sequence decoder Where |t| is the length of trajectory t, A is the number of attributes; is the hidden representation of the |t|th node in the graph corresponding to attribute a; h |t|*A is the |t|*Ath hidden representation; is the initial hidden state of the GRU network in the multi-sequence decoder corresponding to the Ath attribute.

[0071] Preferably, the module M3 includes:

[0072] The outputs of all multi-image encoders {h1,h2,…,h |t|*A}After the scaled dot product attention layer, and generate c e Input into the GRU network, the expression is:

[0073]

[0074] Among them, c e Represents the output of the attention mechanism, which is the vector h i The weighted sum of

[0075] For the first attribute, only the ground truth attribute value at the last moment t is used e-1,1 To guide the prediction of the probability distribution of the attribute value of the current event e, the expression is:

[0076]

[0077] in, yes and The connection is input into GRU; It is t e-1,1 The initial hidden state of GRU is the output of the multi-image encoder represents the hidden representation output by the GRU in the multi-sequence decoder corresponding to the first attribute at the e-th time step; The output of the attention mechanism in the multi-sequence decoder corresponding to the first attribute is the vector h i The weighted sum of

[0078] Probability distribution is the probability distribution over all possible values ​​of the first attribute of event e, computed as follows:

[0079]

[0080] in, Represents a learnable weight matrix.

[0081] Preferably, the module M4 includes:

[0082] By combining a multi-graph encoder and a multi-sequence decoder to form an autoencoder, the input trajectory t is compressed into a low-dimensional hidden representation, and then the probability distribution of each attribute a of each event e in the trajectory t is generated from the hidden representation. The training process of the autoencoder can be described as minimizing the following reconstruction error:

[0083]

[0084] in, Indicates the probability distribution The value of attribute a of event e in trajectory t is t e,a probability;

[0085] Dropout is applied after each layer of the GAT network and GRU network to offset the effect of overfitting, and the Adam optimizer is used for training;

[0086] Define the anomaly score S t,e,a For the probability distribution Greater than the specified attribute value t e,a Probability The sum of all probabilities is expressed as:

[0087]

[0088] in, is the probability distribution The probability of the i-th value in ;

[0089] A threshold τ is applied to the anomaly score of the attribute value, and the attribute value is marked as normal or abnormal. The higher the anomaly score of the attribute value, the greater the possibility of an abnormality.

[0090] Compared with the prior art, the present invention has the following beneficial effects:

[0091] The present invention converts trajectories into multiple attribute graphs and uses the GAT network to encode the nodes of the graphs to obtain hidden representations of the attributes in the trajectories. The trajectories are reconstructed using the hidden representations and anomaly scores are calculated based on the reconstruction errors. This technical approach solves the technical problem of anomaly detection in the business process field and achieves the technical effect of automatically detecting abnormal trajectories in event logs and pointing out the root causes of the anomalies. Compared with existing methods, the method of the present invention fully considers the structural information of the process, and the essential relationship between attributes and control flow is well captured. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0093] Figure 1 Schematic diagram of the GAMA framework for anomaly detection of the present invention;

[0094] Figure 2a to Figure 2e The execution process of the multi-graph generator of the present invention;

[0095] Figure 3 This is a schematic diagram of the probability distribution output by GAMA of the present invention for a certain attribute of a certain event. DETAILED DESCRIPTION

[0096] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0097] Example 1:

[0098] The present invention provides a graph neural network business process anomaly detection method based on a multi-attribute graph, comprising:

[0099] The characteristics of the event log to be detected in the present invention are: defining a set of attributes in Indicates the number of attributes; attributes The set of all possible values ​​of a To express; event is a set of possible values ​​for each attribute, where v a ∈V a ; The trace t is an event sequence, and the event log L is a trace sequence; the activity name is a special attribute belonging to the attribute set The value of attribute a of event e in trajectory t is represented by t e,a To represent; the value of attribute a of event e is represented by e a express.

[0100] The present invention uses the GAT network, which is a graph neural network based on the attention mechanism. By assigning different weights to different neighbor nodes, GAT can aggregate the features of its neighbors for each node and use a multi-head attention mechanism to better learn the hidden representation of the node.

[0101] Specifically, K independent attention mechanisms are performed, and then their features are concatenated to form the following output feature representation for each node:

[0102]

[0103] Among them, ∥ is the connection operation; f j represents the initial eigenvector of node j; h i represents the new feature vector of node i, σ represents the sigmoid activation function; attention score is the normalized attention coefficient calculated by the kth attention mechanism, indicating the importance of the feature of node j to node i; W k represents the learnable matrix in the k-th attention mechanism;

[0104] Only for nodes calculate in is the set of neighbor nodes of node i in the graph, and the attention score Calculated according to the following formula:

[0105]

[0106]

[0107] in, T stands for transpose, LeakyReLU is a nonlinear activation function; Represents a constant; a k represents the learnable vector in the kth attention mechanism; m represents the neighbor node of node i; Express Perform softmax operation; Indicates base e Index of

[0108] The present invention uses a GRU network, which is a recurrent neural network. GRU can be trained faster than LSTM and is widely used in tasks related to time series.

[0109] z e =σ(W z x e +U z s e-1 +b z ) (1)

[0110] r e =σ(W r x e +U r s e-1 +b r ) (2)

[0111]

[0112]

[0113] Among them, o is an element-by-element multiplication; tanh is a nonlinear activation function; s e represents the hidden state at the current time step e; x e is the input at the current time step e; s e-1 is the hidden state at the previous time step e-1; s0 is the initial hidden state; Indicates the calculation of s e The middle vector of z represents a learnable matrix; U z represents a learnable matrix; b z Represents a learnable vector; W r represents a learnable matrix; U r represents a learnable matrix; b r represents a learnable vector; U represents a learnable matrix; W represents a learnable matrix; b represents a learnable vector;

[0114] Update gate z e and reset gate r e , calculated by formula (1) and formula (2) respectively; update gate z e Control stored in the previous hidden state z e-1 How much past information needs to be retained, and the reset gate r e Then it determines the part of the past information that needs to be discarded. Therefore, after executing formula (3) and formula (4), the current hidden state s e is generated. Simplified to s e =GRU(s e-1 ,x e ) to express formulas (1)-(4).

[0115] This paper introduces a scaled dot product attention mechanism, which serves as a bridge between the multi-graph encoder and the multi-sequence decoder. The scaled dot product attention mechanism can give different weights to the hidden representations of different attribute values. For the output {h1,h2,…,h E*A} and the previous hidden state s of the GRU layer in the multi-sequence decoder e-1 , the energy state expression is:

[0116]

[0117]

[0118] Among them, energy ei Represents the energy state, the energy state energy calculated at event e ei Use softmax to normalize to obtain the corresponding attention weight α ei ; Attention weight α ei It intuitively reflects the hidden representation h of each attribute value during reconstruction i Importance of attention weight α ei The higher the value of h, the better the hidden representation of the attribute value. i The more important it is for predicting the next attribute value; q represents a learnable matrix; W k Represents a learnable matrix; d represents the vector W k h i The dimension is a constant.

[0119] The present invention provides a method and system for detecting anomalies in business processes based on a graph neural network with multiple attributes. Figure 1 As shown:

[0120] GAMA consists of a multi-graph generator, a multi-graph encoder, a multi-sequence decoder, and an anomaly score calculator.

[0121] First, in order to better utilize the structural process information, the multi-graph generator is responsible for converting the trajectory into multiple graphs; next, the generated multiple graphs are input into the multi-graph encoder, and the attribute values ​​of the nodes are converted into vector representations using one-hot encoding and position encoding; next, the GAT is used to encode the graph, because GAT has good network topology structure and node attribute encoding capabilities and can be used for graph mining. The hidden representation output by the multi-graph encoder is decoded into a probability distribution by the multi-sequence decoder with the help of the teacher forcing method. The scaled dot product attention mechanism is an important link connecting the encoder and decoder; finally, the anomaly score calculator calculates the anomaly score based on the probability distribution and marks the trajectory or attribute as abnormal or normal based on the threshold.

[0122] This paper focuses on detecting anomalies in business processes. GAMA is an unsupervised business process anomaly detection method that does not require any data labels or any prior knowledge. GAMA is the first to apply graph neural networks to business process anomaly detection, fully considering the structural information of the process. It is the first to propose a method for converting a trajectory into multiple graphs to obtain hidden representations of attribute values ​​in the trajectory. It includes three different teacher forcing styles to improve the model's convergence speed and ability to reconstruct normal behavior.

[0123] GAMA is an unsupervised deep learning model similar to an autoencoder, which consists of four basic components, such as Figure 2a to Figure 2d As shown:

[0124] i) Graph Generator: Converts a trajectory into multiple graphs, one for each attribute;

[0125] ii) Multi-graph encoder: Use GAT to encode the graph corresponding to each attribute and obtain the hidden representation of each node;

[0126] iii) Multi-sequence decoder: attempts to reconstruct the value of each attribute of each event in the trajectory;

[0127] iv) Anomaly score calculator: calculates the anomaly score of each attribute of each event in the trajectory;

[0128] Inspired by the teacher forcing method, the ground truth trajectory is used as the input of the GRU in the multi-sequence decoder, and three different teacher forcing styles are proposed to guide the reconstruction of attribute values.

[0129] The GAMA method for detecting anomalies in business processes using a graph neural network based on a multi-attribute graph is as follows:

[0130] 1. Multi-image generator

[0131] like Figure 2e As shown, first calculate the number of occurrences of each direct follow-up relationship (b, c), which describes that activity b is directly followed by activity c in log L; second, generate a directed global graph G(L), which contains all activities in the trajectory as nodes. A directed edge b←c exists in the directed global graph G(L) if and only if the number of occurrences of the direct follow-up relationship (b, c) is not less than β*|L| times, where β is a user-selected threshold used to filter out infrequent direct follow-up relationships (i.e., noise); third, generate a directed event graph G(t) for trajectory t, which contains the events of trajectory t as nodes. For the directed event graph G(t), if e activity ←e′ activityis an edge in the directed global graph G(L), then there is an edge e←e′ in the directed event graph G(t), where e represents the event and e activity represents the name of the activity in the event; fourth, to ensure the work of GAT, the directed event graph G(t) is adjusted to a directed connected graph. If event e directly follows event e′ in trajectory t, then e←e′ exists in the directed event graph G(t); finally, the directed event graph G(t) can be derived as a separate graph for each attribute in the attribute set. For each attribute a in the attribute set, multiple graphs can be obtained by simply replacing the nodes of the graph G(t) from event e with the attributes a in event e.

[0132] Where L represents the event log; e′ activity Represents the name of the activity in event e′; e′ represents event e′.

[0133] 2. Multi-image encoder

[0134] Given multiple graphs generated by a trajectory t, each graph contains |t| nodes, where |t| represents the length of trajectory t. Each graph is assigned a different one-hot encoding, positional encoding, and GAT. Next, using attribute a as an example, we will describe these three components in detail.

[0135] First, one-hot encoding is used to convert discrete attribute values ​​into binary vectors. After one-hot encoding, the values ​​of the nodes in the graph can be converted into a two-dimensional vector whose length is the number of all possible attribute values ​​of attribute a.

[0136] In order for GAT to exploit the order of events, some information about the relative or absolute position of events in the trajectory must be injected into the one-hot encoding. In this work, the position encoding used is as follows:

[0137]

[0138]

[0139] Among them, pos is the position of the event in the sequence; i is the vector after one-hot encoding The i-th dimension in ; is the number of all possible attribute values ​​of attribute a.

[0140] Next, GAT is used to encode the node (i.e., the attribute value of the event) to obtain the hidden representation of the node

[0141] Get the average of these hidden representations It is used as the initial hidden state of the GRU in the multi-sequence decoder:

[0142]

[0143] The multi-image encoder outputs |t|*A hidden representations {h1,h2,…,h |t|*A} and the initial hidden state of the GRU in the A multi-sequence decoder Where |t| is the length of trajectory t, A is the number of attributes; is the hidden representation of the |t|th node in the graph corresponding to attribute a; h |t|*A is the |t|*Ath hidden representation; is the initial hidden state of the GRU in the multi-sequence decoder corresponding to the Ath attribute.

[0144] 3. Multi-sequence decoder

[0145] First, the outputs of all multi-image encoders {h1,h2,…,h |t|*A} needs to go through the scaled dot product attention layer and generate c e Input to GRU.

[0146]

[0147] where c e represents the output of the attention mechanism, which is the vector h i The weighted sum of .

[0148] For the first attribute (the default first attribute is activity), only the ground truth attribute value (i.e., activity name) at the previous moment is used. e-1,1 To guide the prediction of the probability distribution of the attribute value (i.e., activity name) of the current event e.

[0149]

[0150] in yes and The connection of , which is input into GRU; It is t e-1,1 The initial hidden state of GRU is the output of the multi-image encoder represents the hidden representation output by the GRU in the multi-sequence decoder corresponding to the first attribute at the e-th time step; represents the output of the attention mechanism in the multi-sequence decoder corresponding to the first attribute, which is the vector h i The weighted sum of .

[0151] Finally, the probability distribution is the probability distribution over all possible values ​​of the first attribute (activity) of event e and can be calculated as follows, which represents the linear layer and the softmax layer.

[0152]

[0153] in Represents a learnable weight matrix.

[0154] While for other attributes a, three different teacher forcing styles are proposed to guide the reconstruction of attribute values.

[0155] i) Activity Name (AN). We believe that the current attribute value mainly depends on the current activity name. Therefore, the ground truth activity name t of the current event e e,1 It is used to guide the prediction of the probability distribution of the attribute value a of the current event e. It can be calculated by the following formula:

[0156]

[0157]

[0158] in, It is t e,1 The embedding vector of .

[0159] ii) The corresponding attribute value of the previous event (PAV). We believe that the current attribute value mainly depends on the previous attribute value. Therefore, the ground truth attribute value of the previous event t e-1,a It is used to guide the prediction of the probability distribution of the attribute value a of the current event e. It can be calculated by the following formula:

[0160]

[0161]

[0162] in, It is t e-1,a The embedding vector of .

[0163] iii) Fusion of activity name and previous attribute value (FAP). We consider that the current attribute value depends on both the activity name of the current event and the attribute value of the previous event. Therefore, the ground truth activity name t of the current event e is e,1 The fusion of the ground truth attribute value of the previous event is used to guide the prediction of the probability distribution of the attribute value a of the current event e. It can be calculated by the following formula:

[0164]

[0165]

[0166] 4. Anomaly Score Calculator

[0167] After the training phase, the trained model can be used to detect anomalies in business processes. Input the trajectory t into the trained model to obtain the probability distribution of all possible values ​​of the attribute a of the event e. Generally speaking, the probability of abnormal attribute values ​​is lower than that of normal attribute values. Based on this idea, the anomaly score S t,e,a is defined as the probability distribution Greater than the specified attribute value t e,a Probability The sum of all probabilities is formalized as follows:

[0168]

[0169] in, is the probability distribution The probability of the i-th value in .

[0170] A threshold τ is applied to the anomaly score of the attribute value, and the attribute value is marked as normal or abnormal. In our method, the higher the anomaly score of the attribute value, the more likely it is an anomaly.

[0171] 5. Model Training

[0172] Obviously, by combining the multi-graph encoder and the multi-sequence decoder, a simple autoencoder can be formed, which completes the encoding and reconstruction process, that is, compressing the input trajectory t into a low-dimensional hidden representation, and then generating the probability distribution of each attribute a of each event e in the trajectory t from the hidden representation. Formally, the training process of an autoencoder can be described as minimizing the following reconstruction error (i.e., cross entropy loss):

[0173]

[0174] in, Indicates the probability distribution The value of attribute a of event e in trajectory t is t e,a probability.

[0175] Dropout is applied after each layer of GAT and GRU to counteract the effects of overfitting. Adam optimizer is used for training.

[0176] Example 2:

[0177] The present invention also provides a graph neural network business process anomaly detection system based on a multi-attribute graph. The graph neural network business process anomaly detection system based on a multi-attribute graph can be implemented by executing the process steps of the graph neural network business process anomaly detection method based on a multi-attribute graph. That is, those skilled in the art can understand the graph neural network business process anomaly detection method based on a multi-attribute graph as a preferred implementation of the graph neural network business process anomaly detection system based on a multi-attribute graph.

[0178] The graph neural network business process anomaly detection system based on multi-attribute graphs provided by the present invention includes: module M1: converting the trajectories in the event log into multiple graphs through a multi-graph generator; module M2: inputting the converted multiple graphs into a multi-graph encoder for one-hot encoding and position encoding to obtain the hidden representation of each node; module M3: decoding the hidden representation of each node into a probability distribution through a multi-sequence decoder; module M4: calculating the anomaly score according to the probability distribution through an anomaly score calculator, and marking the trajectories and attributes as abnormal or normal according to the threshold.

[0179] The module M1 includes:

[0180] Count the number of occurrences of each direct follow-up relationship (b, c), indicating that activity b is directly followed by activity c in the event log L;

[0181] Generate a directed global graph G(L) containing all activities in the trajectory as nodes. A directed edge b←c exists in the directed global graph G(L) if and only if the number of occurrences of the direct follow-up relationship (b,c) is at least β*|L| times, where β is a user-selected threshold.

[0182] Generate a directed event graph G(t) for trajectory t, which contains the events of trajectory t as nodes. For the directed event graph G(t), if e activity ←e′ activity is an edge in the directed global graph G(L), then there is an edge e←e′ in the directed event graph G(t), where e represents the event and e activity Represents the name of the activity in the event;

[0183] Adjust the directed event graph G(t) to a directed connected graph. If event e directly follows event e′ in trajectory t, then e←e′ exists in the directed event graph G(t).

[0184] The directed event graph G(t) is exported as a separate graph for each attribute in the attribute set. For each attribute a in the attribute set, multiple graphs are obtained by replacing the nodes of the directed event graph G(t) from event e with the attribute a in event e.

[0185] The module M2 includes:

[0186] Multiple graphs generated by trajectory t, each graph contains |t| nodes, where |t| represents the length of trajectory t, and each graph is assigned a different one-hot encoding, position encoding, and GAT network;

[0187] Use one-hot encoding to convert discrete attribute values ​​into binary vectors. After one-hot encoding, the value of the node in the graph is converted into a two-dimensional vector, whose length is the number of all attribute values ​​of attribute a;

[0188] Information about the relative or absolute position of the event in the trajectory is injected into the one-hot encoding. The position encoding used is as follows:

[0189]

[0190]

[0191] Among them, pos is the position of the event in the sequence; i is the vector after one-hot encoding The i-th dimension in ; is the number of all possible attribute values ​​of attribute a;

[0192] Use the GAT network to encode the node and obtain the hidden representation of the node

[0193] Get the average of these hidden representations The initial hidden state of the GRU network used in the multi-sequence decoder:

[0194]

[0195] The multi-image encoder outputs |t|*A hidden representations {h1,h2,…,h |t|*A} and the initial hidden state of the GRU network in the A multi-sequence decoder Where |t| is the length of trajectory t, A is the number of attributes; is the hidden representation of the |t|th node in the graph corresponding to attribute a; h |t|*A is the |t|*Ath hidden representation; is the initial hidden state of the GRU network in the multi-sequence decoder corresponding to the Ath attribute.

[0196] The module M3 includes:

[0197] The outputs of all multi-image encoders {h1,h2,…,h |t|*A}After the scaled dot product attention layer, and generate c e Input into the GRU network, the expression is:

[0198]

[0199] Among them, c e Represents the output of the attention mechanism, which is the vector h i The weighted sum of

[0200] For the first attribute, only the ground truth attribute value at the last moment t is used e-i,1 To guide the prediction of the probability distribution of the attribute value of the current event e, the expression is:

[0201]

[0202] in, yes and The connection is input into GRU; It is t e-1,1 The initial hidden state of GRU is the output of the multi-image encoder represents the hidden representation output by the GRU in the multi-sequence decoder corresponding to the first attribute at the e-th time step; The output of the attention mechanism in the multi-sequence decoder corresponding to the first attribute is the vector h i The weighted sum of

[0203] Probability distribution is the probability distribution over all possible values ​​of the first attribute of event e, computed as follows:

[0204]

[0205] in, Represents a learnable weight matrix.

[0206] The module M4 includes:

[0207] By combining a multi-graph encoder and a multi-sequence decoder to form an autoencoder, the input trajectory t is compressed into a low-dimensional hidden representation, and then the probability distribution of each attribute a of each event e in the trajectory t is generated from the hidden representation. The training process of the autoencoder can be described as minimizing the following reconstruction error:

[0208]

[0209] in, Indicates the probability distribution The value of attribute a of event e in trajectory t is t e,a probability;

[0210] Dropout is applied after each layer of the GAT network and GRU network to offset the effect of overfitting, and the Adam optimizer is used for training;

[0211] Define the anomaly score S t,e,a For the probability distribution Greater than the specified attribute value t e,a Probability The sum of all probabilities is expressed as:

[0212]

[0213] in, is the probability distribution The probability of the i-th value in ;

[0214] A threshold τ is applied to the anomaly score of the attribute value, and the attribute value is marked as normal or abnormal. The higher the anomaly score of the attribute value, the greater the possibility of an abnormality.

[0215] Those skilled in the art will appreciate that, in addition to implementing the system, device, and various modules provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, embedded microcontrollers, and the like by logically programming the method steps. Therefore, the system, device, and various modules provided by the present invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; the modules for implementing various functions can also be considered both software programs for implementing the method and structures within the hardware component.

[0216] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A graph neural network business process anomaly detection method based on multi-attribute graph, characterized in that: include: Step 1: Convert the trajectories in the event log into multiple images through the multi-image generator; Step 2: Input the converted multiple graphs into the multi-graph encoder for one-hot encoding and position encoding to obtain the hidden representation of each node; Step 3: Decode the hidden representation of each node into a probability distribution through a multi-sequence decoder; Step 4: Calculate the anomaly score based on the probability distribution through the anomaly score calculator, and mark the trajectory and attribute as abnormal or normal according to the threshold; The step 1 comprises: Count the number of occurrences of each direct follow-up relationship (b, c), indicating that activity b is directly followed by activity c in the event log L; Generate a directed global graph G(L) containing all activities in the trajectory as nodes. A directed edge b←c exists in the directed global graph G(L) if and only if the number of occurrences of the direct follow-up relationship (b,c) is at least β*|L| times, where β is a user-selected threshold. Generate a directed event graph G(t) for trajectory t, which contains the events of trajectory t as nodes. For the directed event graph G(t), if e activity ←e′ activity is an edge in the directed global graph G(L), then there is an edge e←e′ in the directed event graph G(t), where e represents the event and e activity Represents the name of the activity in the event; Adjust the directed event graph G(t) to a directed connected graph. If event e directly follows event e′ in trajectory t, then e←e′ exists in the directed event graph G(t). Derive the directed event graph G(t) as a separate graph for each attribute in the attribute set. For each attribute a in the attribute set, multiple graphs are obtained by replacing the nodes of the directed event graph G(t) from event e with the attribute a in event e. The step 2 includes: Multiple graphs generated by trajectory t, each graph contains |t| nodes, where |t| represents the length of trajectory t, and each graph is assigned a different one-hot encoding, position encoding, and GAT network; Use one-hot encoding to convert discrete attribute values ​​into binary vectors. After one-hot encoding, the value of the node in the graph is converted into a two-dimensional vector, whose length is the number of all attribute values ​​of attribute a; Information about the relative or absolute position of the event in the trajectory is injected into the one-hot encoding. The position encoding used is as follows: Among them, pos is the position of the event in the sequence; i is the vector after one-hot encoding The i-th dimension in ; is the number of all possible attribute values ​​of attribute a; Use the GAT network to encode the node and obtain the hidden representation of the node Get the average of these hidden representations The initial hidden state of the GRU network used in the multi-sequence decoder: The multi-image encoder outputs |t|*A hidden representations {h1,h2,…,h |t|*A } and the initial hidden state of the GRU network in the A multi-sequence decoder Where |t| is the length of trajectory t, A is the number of attributes; is the hidden representation of the |t|th node in the graph corresponding to attribute a; h |t|*A is the |t|*Ath hidden representation; is the initial hidden state of the GRU network in the multi-sequence decoder corresponding to the Ath attribute; The step 3 comprises: The outputs of all multi-image encoders {h1,h2,…,h |t|*A }After the scaled dot product attention layer, and generate c e Input into the GRU network, the expression is: Among them, c e Represents the output of the attention mechanism, which is the vector h i The weighted sum of For the first attribute, only the ground truth attribute value at the last moment t is used e-1,1 To guide the prediction of the probability distribution of the attribute value of the current event e, the expression is: in, yes and The connection is input into GRU; It is t e-1,1 The initial hidden state of GRU is the output of the multi-image encoder represents the hidden representation output by the GRU in the multi-sequence decoder corresponding to the first attribute at the e-th time step; The output of the attention mechanism in the multi-sequence decoder corresponding to the first attribute is the vector h i The weighted sum of Probability distribution is the probability distribution over all possible values ​​of the first attribute of event e, computed as follows: in, Represents a learnable weight matrix.

2. The method for detecting anomalies in business processes using a graph neural network based on a multi-attribute graph according to claim 1, wherein: The step 4 comprises: By combining a multi-graph encoder and a multi-sequence decoder to form an autoencoder, the input trajectory t is compressed into a low-dimensional hidden representation, and then the probability distribution of each attribute a of each event e in the trajectory t is generated from the hidden representation. The training process of the autoencoder is described as minimizing the following reconstruction error: in, Indicates the probability distribution The value of attribute a of event e in trajectory t is t e,a probability; Dropout is applied after each layer of the GAT network and GRU network to offset the effect of overfitting, and the Adam optimizer is used for training; Define the anomaly score S t,e,a For the probability distribution Greater than the specified attribute value t e,a Probability The sum of all probabilities is expressed as: in, is the probability distribution The probability of the i-th value in ; A threshold τ is applied to the anomaly score of the attribute value, and the attribute value is marked as normal or abnormal. The higher the anomaly score of the attribute value, the greater the possibility of abnormality.

3. A graph neural network business process anomaly detection system based on multi-attribute graph, characterized by: include: Module M1: Convert the trajectories in the event log into multiple graphs through a multi-graph generator; Module M2: Input the converted multiple graphs into the multi-graph encoder for one-hot encoding and position encoding to obtain the hidden representation of each node; Module M3: decodes the hidden representation of each node into a probability distribution through a multi-sequence decoder; Module M4: Calculates anomaly scores based on probability distribution through anomaly score calculator and labels trajectories and attributes as abnormal or normal based on thresholds; The module M1 includes: Count the number of occurrences of each direct follow-up relationship (b, c), indicating that activity b is directly followed by activity c in the event log L; Generate a directed global graph G(L) containing all activities in the trajectory as nodes. A directed edge b←c exists in the directed global graph G(L) if and only if the number of occurrences of the direct follow-up relationship (b,c) is at least β*|L| times, where β is a user-selected threshold. Generate a directed event graph G(t) for trajectory t, which contains the events of trajectory t as nodes. For the directed event graph G(t), if e activity ←e′ activity is an edge in the directed global graph G(L), then there is an edge e←e′ in the directed event graph G(t), where e represents the event and e activity Represents the name of the activity in the event; Adjust the directed event graph G(t) to a directed connected graph. If event e directly follows event e′ in trajectory t, then e←e′ exists in the directed event graph G(t). Derive the directed event graph G(t) as a separate graph for each attribute in the attribute set. For each attribute a in the attribute set, multiple graphs are obtained by replacing the nodes of the directed event graph G(t) from event e with the attribute a in event e. The module M2 includes: Multiple graphs generated by trajectory t, each graph contains |t| nodes, where |t| represents the length of trajectory t, and each graph is assigned a different one-hot encoding, position encoding, and GAT network; Use one-hot encoding to convert discrete attribute values ​​into binary vectors. After one-hot encoding, the value of the node in the graph is converted into a two-dimensional vector, whose length is the number of all attribute values ​​of attribute a; Information about the relative or absolute position of the event in the trajectory is injected into the one-hot encoding. The position encoding used is as follows: Among them, pos is the position of the event in the sequence; i is the vector after one-hot encoding The i-th dimension in ; is the number of all possible attribute values ​​of attribute a; Use the GAT network to encode the node and obtain the hidden representation of the node Get the average of these hidden representations The initial hidden state of the GRU network used in the multi-sequence decoder: The multi-image encoder outputs |t|*A hidden representations {h1,h2,…,h |t|*A } and the initial hidden state of the GRU network in the A multi-sequence decoder Where |t| is the length of trajectory t, A is the number of attributes; is the hidden representation of the |t|th node in the graph corresponding to attribute a; h |t|*A is the |t|*Ath hidden representation; is the initial hidden state of the GRU network in the multi-sequence decoder corresponding to the Ath attribute; The module M3 includes: The outputs of all multi-image encoders {h1,h2,…,h |t|*A }After the scaled dot product attention layer, and generate c e Input into the GRU network, the expression is: Among them, c e Represents the output of the attention mechanism, which is the vector h i The weighted sum of For the first attribute, only the ground truth attribute value at the last moment t is used e-1,1 To guide the prediction of the probability distribution of the attribute value of the current event e, the expression is: in, yes and The connection is input into GRU; It is t e-1,1 The initial hidden state of GRU is the output of the multi-image encoder represents the hidden representation output by the GRU in the multi-sequence decoder corresponding to the first attribute at the e-th time step; The output of the attention mechanism in the multi-sequence decoder corresponding to the first attribute is the vector h i The weighted sum of Probability distribution is the probability distribution over all possible values ​​of the first attribute of event e, computed as follows: in, Represents a learnable weight matrix.

4. The multi-attribute graph-based neural network business process anomaly detection system according to claim 3 is characterized in that: The module M4 includes: By combining a multi-graph encoder and a multi-sequence decoder to form an autoencoder, the input trajectory t is compressed into a low-dimensional hidden representation, and then the probability distribution of each attribute a of each event e in the trajectory t is generated from the hidden representation. The training process of the autoencoder is described as minimizing the following reconstruction error: in, Indicates the probability distribution The value of attribute a of event e in trajectory t is t e,a probability; Dropout is applied after each layer of the GAT network and GRU network to offset the effect of overfitting, and the Adam optimizer is used for training; Define the anomaly score S t,e,a For the probability distribution Greater than the specified attribute value t e,a Probability The sum of all probabilities is expressed as: in, is the probability distribution The probability of the i-th value in ; A threshold τ is applied to the anomaly score of the attribute value, and the attribute value is marked as normal or abnormal. The higher the anomaly score of the attribute value, the greater the possibility of abnormality.

Images