Abnormality finding method and apparatus based on process mining

Abstract

The application provides a process mining-based anomaly discovery method and device, comprising: obtaining to-be-processed log data, wherein the to-be-processed log data at least comprises to-be-mined log data and to-be-detected log data; obtaining a process model according to the to-be-mined log data; sampling the to-be-detected log data to obtain a sampling result; calculating a cost cost according to the sampling result and the process model by using a cost function; the cost function comprises a transition cost function and an event cost function; performing process consistency detection on the to-be-processed log data based on beam search according to the cost function, the process model and the cost cost to obtain a target alignment scheme, and discovering anomalies of the to-be-processed log data according to the target alignment scheme. The application accelerates process consistency detection by using the method of beam search, and improves the accuracy of alignment calculation by using the cost function, so that the result is more accurate while being accelerated.

Description

Technical Field

[0001] This invention relates to the field of computer data analysis technology, and in particular to an anomaly detection method and apparatus based on process mining. Background Technology

[0002] Industrial system operation and maintenance includes crucial aspects such as personalized equipment status evaluation, anomaly detection, fault diagnosis, and fault prediction. With the rapid development of information technology, the integration of industrial systems and information technology is becoming increasingly close. Currently, the industrial sector widely uses various sensors to periodically monitor various status indicators of industrial systems. Subsequently, process mining techniques are typically used to analyze sensor data to identify anomalies in industrial systems, providing strong support for intelligent operation and maintenance and production safety management.

[0003] The main components of process mining technology include: calculating a process model that represents the log data from existing log data using model mining methods; then performing process consistency checks between new log data obtained from various sensors and the process model to identify anomalies. The purpose of anomaly detection based on process mining is to find and locate anomalies in real-world events, analyze the causes of the anomalies, and correct the process model, thereby optimizing and improving the industrial system.

[0004] To locate the anomaly, alignment-based process consistency detection methods are typically used during process consistency checks. However, since this method is based on a search method to calculate the alignment scheme, and due to the complexity of the process model, the number of states that need to be searched is enormous, resulting in a considerable amount of time required for the search. How to accelerate the process of searching for alignment schemes has become a key research focus in recent years.

[0005] Many solutions have been proposed to accelerate process consistency detection, such as sampling and estimation-based methods, subset selection and edit distance-based methods, trie-based methods, and EMD distance-based methods. Each method has its advantages and disadvantages, but the issue of balancing efficiency and accuracy remains. For example, some algorithms can only calculate the overall process consistency metric for the process model and log data, but cannot calculate the corresponding anomaly and its location for each event log; some algorithms need to calculate all event sequences that the process model can represent, so the efficiency improvement is not particularly significant; and some algorithms that calculate estimates can only obtain a range for the metric, not the specific value of the metric. Summary of the Invention

[0006] This invention provides an anomaly detection method and apparatus based on process mining, which addresses the shortcomings of existing technologies that cannot simultaneously achieve both efficiency and accuracy. It accelerates the process consistency detection algorithm while ensuring high accuracy.

[0007] This invention provides an anomaly detection method based on process mining, comprising:

[0008] Acquire log data to be processed, which includes at least log data to be mined and log data to be detected;

[0009] A process model is calculated based on the log data to be mined; the log data to be detected is sampled to obtain sampling results;

[0010] Based on the sampling results and the process model, the cost is calculated using cost functions; the cost functions include transition cost functions and event cost functions.

[0011] Based on the cost function, the process model, and the cost, a process consistency detection based on bundle search is performed on the log data to be processed to obtain a target alignment scheme, and anomalies in the log data to be processed are detected based on the target alignment scheme.

[0012] According to the present invention, an anomaly detection method based on process mining calculates the cost using a cost function based on the sampling results and the process model, specifically including:

[0013] Based on the sampling results and the process model, a basic alignment scheme is calculated using an alignment-based process consistency detection method.

[0014] The number of each event synchronization step, model step, and log step in the basic alignment scheme is counted to obtain statistical results;

[0015] The cost is calculated using a cost function based on the statistical results.

[0016] According to the present invention, an anomaly detection method based on process mining calculates the cost using a cost function based on the statistical results, specifically including:

[0017] Based on the statistical results, the transition cost of each transition in the basic alignment scheme is calculated using the transition cost function;

[0018] The transition cost function includes:

[0019]

[0020] Where Cost(transition) is the transition cost function; t_cnt represents the sum of the number of synchronization steps and model steps; skip represents the number of model steps; and totnum represents the sum of the number of synchronization steps, model steps, and log steps.

[0021] Based on the statistical results, the event cost of each event in the basic alignment scheme is calculated using the event cost function;

[0022] The event cost function includes:

[0023]

[0024] Where Cost(event) is the event cost function; totnum represents the sum of the number of synchronization steps, model steps, and log steps; insert represents the number of log steps; and e_cnt represents the sum of the number of synchronization steps and log steps.

[0025] The cost of all changes and the cost of all events constitute the cost.

[0026] According to the present invention, an anomaly detection method based on process mining is provided, which performs process consistency detection on the log data to be processed based on bundle search according to the cost function, the process model, and the cost, to obtain a target alignment scheme, specifically including:

[0027] S1: Extract an event sequence from the log data to be processed, construct a search queue, and add the initial state pre-constructed based on the event sequence to the search queue;

[0028] S2: Extract a preset number of search states with the lowest cost from the search queue, and delete the unretrieved search states with the same cost as the search states.

[0029] S3: Expand the search state using the process model, enumerate each excitationable transition of the search state in sequence, and calculate the subsequent search states of the model step, log step and synchronization step of the search state respectively to obtain the possible state set.

[0030] S4: Calculate the cost of each subsequent search state in the set of possible states using the cost, and add the subsequent search state and its cost to the search queue;

[0031] S5: Repeat steps S2-S4 until the search reaches a termination state or the maximum number of search iterations is reached to obtain the target search queue;

[0032] S6: Traverse all event sequences in the log data to be processed, and all target search queues constitute a target alignment scheme.

[0033] According to the anomaly detection method based on process mining provided by the present invention, the log data to be detected is sampled to obtain sampling results, specifically including:

[0034] The log data to be detected is randomly sampled or sampled according to the frequency of occurrence to obtain the sampling results;

[0035] The frequency of occurrence refers to the frequency of occurrence of the event sequence included in the log data to be detected.

[0036] According to the anomaly detection method based on process mining provided by the present invention, the log data to be detected is sampled to obtain sampling results, specifically including:

[0037] The event sequences in the log data to be detected are clustered, and the cluster centers are selected as the sampling results.

[0038] The present invention also provides an anomaly detection device based on process mining, comprising:

[0039] An acquisition unit is used to acquire log data to be processed, which includes at least log data to be mined and log data to be detected.

[0040] The model and sampling unit are used to calculate a process model based on the log data to be mined; and to sample the log data to be detected to obtain sampling results.

[0041] A calculation unit is used to calculate the cost based on the sampling results and the process model using a cost function; the cost function includes a transition cost function and an event cost function.

[0042] The detection unit is used to perform process consistency detection on the log data to be processed based on the cost function, the process model and the cost, to obtain a target alignment scheme, and to detect anomalies in the log data to be processed based on the target alignment scheme.

[0043] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the anomaly detection method based on process mining as described above.

[0044] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the anomaly detection method based on process mining as described above.

[0045] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the anomaly detection method based on process mining as described above.

[0046] This invention provides an anomaly detection method and apparatus based on process mining. The method involves acquiring log data to be processed, which includes at least log data to be mined and log data to be detected; calculating a process model based on the log data to be mined; sampling the log data to be detected to obtain sampling results; calculating a cost function based on the sampling results and the process model, where the cost function includes a transition cost function and an event cost function; performing a beam search-based process consistency detection on the log data to be processed based on the cost function, the process model, and the cost to obtain a target alignment scheme; and detecting anomalies in the log data to be processed based on the target alignment scheme. This invention accelerates process consistency detection by using a beam search method and improves the accuracy of alignment result calculation using an improved cost function, achieving both acceleration and a more accurate alignment scheme, thus making anomaly detection faster and more accurate. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0048] Figure 1 This is one of the flowcharts of the anomaly detection method based on process mining provided by the present invention;

[0049] Figure 2 This is the second flowchart of the anomaly detection method based on process mining provided by the present invention;

[0050] Figure 3 This is a schematic diagram of the anomaly detection device based on process mining provided by the present invention;

[0051] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention.

[0052] Figure label:

[0053] 310: Acquisition unit; 320: Model and sampling unit; 330: Calculation unit; 340: Detection unit;

[0054] 410: Processor; 420: Communication interface; 430: Memory; 440: Communication bus. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0056] The following is combined Figures 1-2 The present invention describes an anomaly detection method based on process mining. Figure 1 This is one of the flowcharts illustrating the anomaly detection method based on process mining provided by this invention, such as... Figure 1 As shown, the method includes the following steps:

[0057] Step 110: Obtain log data to be processed, which includes at least log data to be mined and log data to be detected.

[0058] It is important to note that the log data to be processed is event log data from the operation and maintenance process of industrial systems. It consists of a series of events obtained from terminals such as sensors. Each event sequence represents which events occurred in sequence during the operation of an industrial system in reality.

[0059] This invention uses log data to detect anomalies in industrial processes. Anomalies refer to events that exhibit unusual phenomena during the process, broadly encompassing various abnormal situations in industrial production. These anomalies often lead to mismatches between the process model and the event sequences in the logs, which can be identified by calculating alignment schemes. It is important to note that an event sequence may contain one or more anomalies.

[0060] Furthermore, based on the data flow direction of the log data to be processed, the log data is divided into log data to be mined for mining the process model and log data to be detected for process consistency testing. It's important to understand that a process model is an abstraction of a real-world process using mathematical language. Currently, Petri nets are generally used to describe processes. A Petri net consists of places, transitions, tokens, and arcs, with the distribution of tokens in the places representing a state.

[0061] It is important to note that the distinction between log data to be mined and log data to be tested is determined at the input stage. In other words, when acquiring the log data to be processed, it is already established which log files are used for model mining and which are used for process consistency checks. In some embodiments, log files before each time point are used as log data to be mined, and log files after that time point are used as log data to be tested.

[0062] Step 120: Calculate the process model based on the log data to be mined; sample the log data to be detected to obtain the sampling results.

[0063] The process model mining and sampling steps are not sequential. In some embodiments, process model mining is performed first, followed by sampling. Alternatively, sampling can be performed first, followed by model mining.

[0064] Specifically, process mining methods are used to perform model mining on event log data used for model mining. Process mining refers to a method that takes event log data as input and outputs a process model that represents the event log data. Specifically, existing model mining algorithms can be selected to perform model mining on the log data to be mined. In practice, the model mining algorithm can be inductive mining or other model mining algorithms; this invention does not limit this.

[0065] In addition, sampling methods are used to sample log records that require process consistency testing. These sampling methods include sampling event sequences through random sampling, frequency-based sampling, or clustering methods to obtain sampling results.

[0066] It's important to note that process consistency testing refers to a method that takes process models and log data as input and identifies anomalies in these models and log data as output. The log records to be tested for process consistency are the log data to be inspected.

[0067] Step 130: Based on the sampling results and the process model, calculate the cost using cost functions; the cost functions include transition cost functions and event cost functions.

[0068] Specifically, the cost is calculated based on the sampling results using a pre-defined cost function. It's important to note that before calculating the cost, a process consistency check needs to be performed on the sampling results using a process model to obtain a basic alignment scheme. Then, the cost is calculated using the number of alignment steps in the basic alignment scheme and the cost function. The cost includes the cost corresponding to each transition and the cost corresponding to each event in the log data. For ease of distinction, the cost corresponding to a transition is denoted as the transition cost, and the cost corresponding to an event is denoted as the event cost. In essence, the cost includes the cost of each possible alignment step during the alignment process, used to calculate the cost of the search state and the target alignment scheme in further bundle-based process consistency checks.

[0069] Step 140: Perform process consistency detection on the log data to be processed based on the cost function, the process model and the cost, obtain the target alignment scheme, and discover the anomalies of the log data to be processed based on the target alignment scheme.

[0070] Specifically, using the cost calculated in step 130 and the process consistency check of the process model and all pending log data by the join-bundle search method, a target alignment scheme is obtained, and anomalies are detected based on the target alignment scheme.

[0071] In some embodiments, all event sequences in the log data to be mined are sampled sequentially, their costs are calculated, and a process consistency check based on a bundle search is performed according to the cost function and process model to obtain an alignment scheme.

[0072] It's important to note that the basic principle of the beam search method is to divide the search process into stages, expanding only a portion of the search states in each stage. This reduces the number of states traversed during the search, thus accelerating the process. This method was initially proposed to speed up search methods, and can also be used to accelerate the alignment of search process models and event sequences. Essentially, the beam search method is a search method that reduces some search precision while increasing search speed.

[0073] The process consistency detection part of this invention introduces optimizations such as a bundle search method and an improved cost function on the basis of an alignment-based process consistency detection algorithm. While accelerating the process consistency detection algorithm, it maintains high accuracy and obtains a superior alignment scheme.

[0074] Based on the above embodiments, the method, which calculates the cost using a cost function according to the sampling results and the process model, specifically includes:

[0075] Step 210: Based on the sampling results and the process model, calculate the basic alignment scheme using the alignment-based process consistency detection method.

[0076] Specifically, a search method is used to find the basic alignment scheme. The search state is (current Petri net marking, current event sequence matching index), the initial state is (initial marking, 0), and the termination state is (terminating marking, event sequence length). The search method expands the sampling results based on the process model. When expanding the search state, each excitationable transition is enumerated sequentially, and finally, the possible log steps are enumerated to obtain the basic alignment scheme.

[0077] Step 220: Count the number of each event synchronization step, model step, and log step in the basic alignment scheme to obtain the statistical results.

[0078] Specifically, the number of synchronization steps, model steps, and log steps for each event in the basic alignment scheme is counted, and the number of synchronization steps, model steps, and log steps for each event in the basic alignment scheme is used as the statistical result.

[0079] It's important to understand that in the alignment scheme, a valid alignment step can be written as (t, a), where t ∈ T ∪ {>>}, a ∈ A ∪ {>>}. t and a cannot both be skipped events ">>", where T is the set of all transitions in the Petri net. A combination like (t, a) indicates that t and a are mapped during the alignment process, or that one of t and a is a skipped event. It's crucial to note that if one of t and a is a skipped event, it means that the other transition, which is not a skipped event, cannot find a corresponding transition or event during the alignment process. To ensure that each alignment step is meaningful and helpful to the alignment process, it is stipulated that t and a cannot both be skipped events. To categorize alignment steps, they are divided into: synchronization steps where neither t nor a is a skipped event; log steps where t is a skipped event and a is not; and model steps where t is not a skipped event but a is.

[0080] In some embodiments, in the statistical results, for a certain event or transition in the basic alignment scheme, the occurrence count corresponding to the synchronization step is denoted as 'sync', the occurrence count corresponding to the model step is denoted as 'skip', and the occurrence count corresponding to the log step is denoted as 'insert'. Further, the statistical results also include: calculating the sum of the occurrence counts of the synchronization step, model step, and log step for each event in the basic alignment scheme, denoted as 'totnum'; calculating the sum of the occurrence counts of the model step and synchronization step for each event in the basic alignment scheme, denoted as 't_cnt'; and calculating the sum of the occurrence counts of the log step and synchronization step for each event in the basic alignment scheme, denoted as 'e_cnt'.

[0081] Step 230: Calculate the cost using the cost function based on the statistical results.

[0082] Specifically, the cost is calculated based on statistical results using a pre-defined cost function. It's important to understand that the cost function in this invention is an improved cost function, including a transition cost function corresponding to each transition in the process model and an event cost function corresponding to each event; correspondingly, the cost includes transition cost and event cost. When calculating the cost, the transition cost corresponding to each transition in the model and the event cost corresponding to each event in the log data are calculated separately to obtain the transition cost and event cost. All transition costs and all event costs together constitute the total cost. The calculated cost is used for further process consistency checks.

[0083] Based on the above embodiments, the method, which calculates the cost using a cost function based on the statistical results, specifically includes:

[0084] Based on the statistical results, the transition cost of each transition in the basic alignment scheme is calculated using the transition cost function;

[0085] The transition cost function includes:

[0086]

[0087] Where Cost(transition) is the transition cost function; t_cnt represents the sum of the number of synchronization steps and model steps; skip represents the number of model steps; and totnum represents the sum of the number of synchronization steps, model steps, and log steps.

[0088] Based on the statistical results, the event cost of each event in the basic alignment scheme is calculated using the event cost function;

[0089] The event cost function includes:

[0090]

[0091] Where Cost(event) is the event cost function; totnum represents the sum of the number of synchronization steps, model steps, and log steps; insert represents the number of log steps; and e_cnt represents the sum of the number of synchronization steps and log steps.

[0092] The cost of all changes and the cost of all events constitute the cost.

[0093] Specifically, for each transition in the basic alignment scheme, its transition cost is calculated using the transition cost function, and for each event in the basic alignment scheme, its event cost is calculated using the event cost function. The transition costs of all transitions and the event costs of all events in the basic alignment scheme together constitute the cost.

[0094] Based on the above embodiments, in this method, a process consistency detection based on bundle search is performed on the log data to be processed according to the cost function, the process model, and the cost, to obtain a target alignment scheme, specifically including:

[0095] S1: Extract an event sequence from the log data to be processed, construct a search queue, and add the initial state pre-constructed based on the event sequence to the search queue;

[0096] S2: Extract a preset number of search states with the lowest cost from the search queue, and delete the unretrieved search states with the same cost as the search states.

[0097] S3: Expand the search state using the process model, enumerate each excitationable transition of the search state in sequence, and calculate the subsequent search states of the model step, log step and synchronization step of the search state respectively to obtain the possible state set.

[0098] S4: Calculate the cost of each subsequent search state in the set of possible states using the cost, and add the subsequent search state and its cost to the search queue;

[0099] S5: Repeat steps S2-S4 until the search reaches a termination state or the maximum number of search iterations is reached to obtain the target search queue;

[0100] S6: Traverse all event sequences in the log data to be processed, and all target search queues constitute a target alignment scheme.

[0101] Specifically, process consistency detection based on the bundle search method is performed using a process model based on the sampling results. In actual operation, finding the minimum cost alignment scheme through bundle search requires a search process for each event sequence, and the search queue obtained from all event sequences constitutes the target alignment scheme. Specifically, for each event sequence in the log data to be processed, a search sequence is constructed, and the initial state is added to the search sequence. At each step of the search, the number of search states with the minimum cost and a preset bundle width are extracted from the search queue, and each search state is expanded using the process model. It should be noted that the search state is (current Petri net marking, current event sequence matching index), the initial state is (initial marking, 0), and the termination state is (terminating marking, event sequence length). For example, ({start}, 0); ({1}, 1); ({2}, 2); ({3}, 3); ({4}, 4); ({5}, 5); ({end}, 6).

[0102] For the search state with the lowest cost extracted from the search queue, the search states with the same cost that have not yet been extracted are deleted from the search queue at the same time. In the process of expanding the search states extracted from the search queue using the process model, it is necessary to enumerate each activatable transition of the search state sequentially, and calculate the subsequent search states of the model step, log step, and synchronization step of the search state to obtain a set of possible states. In one embodiment, for the search state ({1},1), for example, if it can activate two transitions: f (reject the application) and g (accept the application and proceed with subsequent steps), then it can have three subsequent states: ({2},2); ({end},1); ({1},2), corresponding to activating g and adding a synchronization step; activating f and adding a model step; and not activating any transition but adding a log step. These three subsequent states constitute the set of possible states.

[0103] Next, the cost of each subsequent search state in the set of possible states is calculated using cost-based calculation, and the subsequent search states and their costs are added to the search queue. After the subsequent search states are added to the search queue, the steps of extracting search states and searching are repeated until a termination state is found or the maximum number of search iterations is reached, to obtain the target search queue, which includes alignment schemes for the event sequences. Further, the search path from the initial state to the termination state is the alignment scheme for the searched event sequence. It should be noted that for each search state, there is a search path from the initial state to that search state, which can be represented as a portion of the currently searched alignment schemes, and the cost of the search state is the sum of the costs of each alignment step of this alignment scheme. In one embodiment, for example for a Petri net, the event sequence...<a,g,b,c,d,e> Calculating the alignment scheme with it, the search states will include ({start},0), ({1},1), ({2},2), ({3},3), ({4},4), ({5},5), and ({end},6). The partial alignment schemes corresponding to these seven search states are: <>; <(a,a)>; <(a,a),(g,g)>; <(a,a),(g,g),(b,b)>; <(a,a),(g,g),(b,b),(c,c)>; <(a,a),(g,g),(b,b),(c,c),(d,d)>; <(a,a),(g,g),(b,b),(c,c),(d,d),(e,e)>. Here, (a,a), (g,g), (b,b), (c,c), (d,d), and (e,e) represent alignment steps. The cost of each search state is the sum of the costs of each alignment step in the alignment scheme corresponding to that search state. The previously calculated cost includes the cost of all alignment steps used in this step, such as the cost of alignment steps (a,>>) and (g,>>) and the cost of alignment steps (>>,a) and (>>,b).

[0104] Finally, after obtaining the target search queue of the extracted event sequences, all event sequences in the log data to be processed are traversed, and all target search queues constitute a target alignment scheme. Essentially, the search is a process of continuously calculating the subsequent states for each extracted state, ultimately finding a terminating state. The goal of the search is to find an alignment scheme between the model and the currently processed event sequence.

[0105] The cost of the alignment scheme obtained using the existing alignment-based process consistency detection method is used as the cost of the sampling results and included in the search queue. The search state with the lowest cost is extracted from the search queue, and other search states with the same cost as the extracted search state are deleted. In specific implementation, all search states in the current search queue are sorted from smallest to largest according to cost, and a preset number of search states (within a pre-defined beamwidth) are extracted. Other search states with the same cost as the extracted search state are deleted. In other words, throughout the entire search process, for all states with the same cost, only a preset number of states (within a pre-defined beamwidth) are selected for state expansion.

[0106] The extracted search states are then expanded. A cost function is used to calculate the cost of the expanded new states. When expanding the search states, each excitationable transition is enumerated sequentially, and finally, the possible log steps are enumerated. The cost function essentially calculates the total cost of the search states and the final alignment scheme, thereby evaluating the quality of an alignment scheme. It is important to note that the preset beamwidth is finite and can be flexibly chosen to find a balance between accuracy and computational cost. In one embodiment, the preset beamwidth is 2.

[0107] Based on the above embodiments, the method involves sampling the log data to be detected to obtain sampling results, specifically including:

[0108] The log data to be detected is randomly sampled or sampled according to the frequency of occurrence to obtain the sampling results;

[0109] The frequency of occurrence refers to the frequency of occurrence of the event sequence included in the log data to be detected.

[0110] Specifically, the log data to be tested is sampled randomly or based on frequency of occurrence. Random sampling involves randomly capturing event sequences from the log data to be tested. Frequency-based sampling involves first calculating the frequency of occurrence of each event sequence in the log data to be tested, then sampling based on this frequency, and the final sampled event sequence is the sampling result.

[0111] Based on the above embodiments, the method involves sampling the log data to be detected to obtain sampling results, specifically including:

[0112] The event sequences in the log data to be detected are clustered, and the cluster centers are selected as the sampling results.

[0113] Specifically, the sampling method also includes directly clustering the event sequences in the log data to be detected, and selecting the cluster centers as the sampling results. In some embodiments, the K-mediods clustering method is used for sampling.

[0114] The anomaly detection method based on process mining provided by this invention has the following advantages:

[0115] (1) It has a fast response speed when performing process consistency detection, and can calculate the alignment scheme obtained by performing process consistency detection based on alignment between process model and log data more quickly, so as to find the location where the anomaly occurs;

[0116] (2) A new cost function is calculated when performing process consistency detection, and the frequency of anomalies is included in the calculation, which improves the accuracy of alignment scheme search.

[0117] Based on the above embodiments, a specific embodiment of using the process consistency detection method for process mining provided by the present invention to detect anomalies is given, such as... Figure 2 This includes the following steps:

[0118] S101: Perform process model mining, which is carried out by obtaining log data to be processed and using inductive mining algorithms.

[0119] S102: The log data to be detected is sampled using a random sampling method to obtain a sequence of sampled events as the sampling result.

[0120] The cost is calculated based on the sampling results, including the following steps:

[0121] S103: A process consistency detection method based on alignment calculates the basic alignment scheme for sampled event sequences;

[0122] S104: Count the number of alignment steps in the alignment scheme; in this step, the alignment scheme refers to the basic alignment scheme.

[0123] S105: Calculate the cost function based on the alignment result; obtain the cost from the cost function.

[0124] S106: Finally, the alignment scheme is calculated again; when the alignment scheme is calculated again, the bundle search method is used to obtain the target alignment scheme and detect anomalies based on the target alignment scheme.

[0125] This invention provides an anomaly detection method based on process mining. The method involves acquiring log data to be processed, which includes at least log data to be mined and log data to be detected; calculating a process model based on the log data to be mined; sampling the log data to be detected to obtain sampling results; calculating a cost function based on the sampling results and the process model, where the cost function includes a transition cost function and an event cost function; performing process consistency detection based on a beam search on the log data to be processed based on the cost function, the process model, and the cost to obtain a target alignment scheme; and detecting anomalies in the log data to be processed based on the target alignment scheme. This invention, based on given event log data, uses a four-stage processing approach—process model mining, event sequence sampling, cost function calculation, and alignment scheme calculation—to ultimately detect anomalies in the log data. It accelerates process consistency detection using a beam search method and improves the accuracy of alignment result calculation using an improved cost function, achieving both acceleration and a more accurate alignment scheme, thus making anomaly detection faster and more accurate.

[0126] The anomaly detection device based on process mining provided by the present invention will be described below. The anomaly detection device based on process mining described below can be referred to in correspondence with the anomaly detection method based on process mining described above. Figure 3 This is a schematic diagram of the anomaly detection device based on process mining provided by the present invention, as shown below. Figure 3 As shown, it includes an acquisition unit 310, a model and sampling unit 320, a calculation unit 330, and a detection unit 340. Among them,

[0127] The acquisition unit 310 is used to acquire log data to be processed, which includes at least log data to be mined and log data to be detected.

[0128] The model and sampling unit 320 is used to calculate a process model based on the log data to be mined; and to sample the log data to be detected to obtain sampling results.

[0129] The calculation unit 330 is used to calculate the cost based on the sampling results and the process model using a cost function; the cost function includes a transition cost function and an event cost function.

[0130] The detection unit 340 is used to perform process consistency detection on the log data to be processed based on the cost function, the process model and the cost, to obtain a target alignment scheme, and to detect anomalies in the log data to be processed based on the target alignment scheme.

[0131] Based on the above embodiments, in this device, the cost is calculated using a cost function according to the sampling results and the process model, specifically including:

[0132] Based on the sampling results and the process model, a basic alignment scheme is calculated using an alignment-based process consistency detection method.

[0133] The number of each event synchronization step, model step, and log step in the basic alignment scheme is counted to obtain statistical results;

[0134] The cost is calculated using a cost function based on the statistical results.

[0135] Based on the above embodiments, in this device, the calculation of cost using a cost function based on the statistical results specifically includes:

[0136] Based on the statistical results, the transition cost of each transition in the basic alignment scheme is calculated using the transition cost function;

[0137] The transition cost function includes:

[0138]

[0139] Where Cost(transition) is the transition cost function; t_cnt represents the sum of the number of synchronization steps and model steps; skip represents the number of model steps; and totnum represents the sum of the number of synchronization steps, model steps, and log steps.

[0140] Based on the statistical results, the event cost of each event in the basic alignment scheme is calculated using the event cost function;

[0141] The event cost function includes:

[0142]

[0143] Where Cost(event) is the event cost function; totnum represents the sum of the number of synchronization steps, model steps, and log steps; insert represents the number of log steps; and e_cnt represents the sum of the number of synchronization steps and log steps.

[0144] The cost of all changes and the cost of all events constitute the cost.

[0145] Based on the above embodiments, in this device, a process consistency detection based on bundle search is performed on the log data to be processed according to the cost function, the process model, and the cost, to obtain a target alignment scheme, specifically including:

[0146] S1: Extract an event sequence from the log data to be processed, construct a search queue, and add the initial state pre-constructed based on the event sequence to the search queue;

[0147] S2: Extract a preset number of search states with the lowest cost from the search queue, and delete the unretrieved search states with the same cost as the search states.

[0148] S3: Expand the search state using the process model, enumerate each excitationable transition of the search state in sequence, and calculate the subsequent search states of the model step, log step and synchronization step of the search state respectively to obtain the possible state set.

[0149] S4: Calculate the cost of each subsequent search state in the set of possible states using the cost, and add the subsequent search state and its cost to the search queue;

[0150] S5: Repeat steps S2-S4 until the search reaches a termination state or the maximum number of search iterations is reached to obtain the target search queue;

[0151] S6: Traverse all event sequences in the log data to be processed, and all target search queues constitute a target alignment scheme.

[0152] Based on the above embodiments, in this device, the log data to be detected is sampled to obtain sampling results, specifically including:

[0153] The log data to be detected is randomly sampled or sampled according to the frequency of occurrence to obtain the sampling results;

[0154] The frequency of occurrence refers to the frequency of occurrence of the event sequence included in the log data to be detected.

[0155] Based on the above embodiments, in this device, the log data to be detected is sampled to obtain sampling results, specifically including:

[0156] The event sequences in the log data to be detected are clustered, and the cluster centers are selected as the sampling results.

[0157] This invention provides an anomaly detection device based on process mining. It acquires log data to be processed, which includes at least log data to be mined and log data to be detected. A process model is calculated based on the log data to be mined. The log data to be detected is sampled to obtain sampling results. Based on the sampling results and the process model, a cost function is used to calculate the cost, which includes a transition cost function and an event cost function. Based on the cost function, the process model, and the cost, a beam search-based process consistency detection is performed on the log data to be processed to obtain a target alignment scheme. Anomalies in the log data to be processed are then detected based on the target alignment scheme. This invention accelerates process consistency detection by using a beam search method and improves the accuracy of alignment result calculation by using an improved cost function. This achieves both acceleration and a more accurate alignment scheme, resulting in faster and more accurate anomaly detection.

[0158] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4 As shown, the electronic device may include a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute an anomaly detection method based on process mining. This method includes: acquiring log data to be processed, which includes at least log data to be mined and log data to be detected; calculating a process model based on the log data to be mined; sampling the log data to be detected to obtain sampling results; calculating a cost using a cost function based on the sampling results and the process model; the cost function includes a transition cost function and an event cost function; performing a beam search-based process consistency detection on the log data to be processed based on the cost function, the process model, and the cost to obtain a target alignment scheme; and detecting anomalies in the log data to be processed based on the target alignment scheme.

[0159] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0160] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the anomaly detection method based on process mining provided by the above methods. The method includes: acquiring log data to be processed, the log data to be processed including at least log data to be mined and log data to be detected; calculating a process model based on the log data to be mined; sampling the log data to be detected to obtain sampling results; calculating a cost using a cost function based on the sampling results and the process model; the cost function including a transition cost function and an event cost function; performing process consistency detection based on a bundle search on the log data to be processed according to the cost function, the process model, and the cost to obtain a target alignment scheme; and detecting anomalies in the log data to be processed according to the target alignment scheme.

[0161] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the process mining-based anomaly detection method provided by the above methods. The method includes: acquiring log data to be processed, the log data to be processed including at least log data to be mined and log data to be detected; calculating a process model based on the log data to be mined; sampling the log data to be detected to obtain sampling results; calculating a cost using a cost function based on the sampling results and the process model; the cost function including a transition cost function and an event cost function; performing a beam search-based process consistency detection on the log data to be processed based on the cost function, the process model, and the cost to obtain a target alignment scheme; and detecting anomalies in the log data to be processed based on the target alignment scheme.

[0162] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0163] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0164] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An anomaly detection method based on process mining, characterized in that, include: Acquire log data to be processed, which includes at least log data to be mined and log data to be detected; A process model is calculated based on the log data to be mined; the log data to be detected is sampled to obtain sampling results; Based on the sampling results and the process model, the cost is calculated using cost functions; the cost functions include transition cost functions and event cost functions. Based on the cost function, the process model, and the cost, a process consistency detection based on bundle search is performed on the log data to be processed to obtain a target alignment scheme, and anomalies in the log data to be processed are detected based on the target alignment scheme. Specifically, the cost is calculated using a cost function based on the sampling results and the process model, including: Based on the sampling results and the process model, a basic alignment scheme is calculated using an alignment-based process consistency detection method. The number of each event synchronization step, model step, and log step in the basic alignment scheme is counted to obtain statistical results; The cost is calculated using a cost function based on the statistical results. Specifically, the cost is calculated using a cost function based on the statistical results, including: Based on the statistical results, the transition cost of each transition in the basic alignment scheme is calculated using the transition cost function; The transition cost function includes: in, The transition cost function; This represents the sum of the number of synchronization steps and model steps; Indicates the number of model steps; This represents the sum of the number of synchronization steps, model steps, and log steps; Based on the statistical results, the event cost of each event in the basic alignment scheme is calculated using the event cost function; The event cost function includes: in, For event cost function; This represents the sum of the number of synchronization steps, model steps, and log steps; Indicates the number of log steps; This represents the sum of the number of synchronization steps and log steps; The cost of all changes and the cost of all events constitute the cost.

2. The anomaly detection method based on process mining according to claim 1, characterized in that, Based on the cost function, the process model, and the cost, a beam search-based process consistency check is performed on the log data to be processed to obtain a target alignment scheme, specifically including: S1: Extract an event sequence from the log data to be processed, construct a search queue, and add the initial state pre-constructed based on the event sequence to the search queue; S2: Extract a preset number of search states with the lowest cost from the search queue, and delete the unretrieved search states with the same cost as the search states. S3: Expand the search state using the process model, enumerate each excitationable transition of the search state in sequence, and calculate the subsequent search states of the model step, log step and synchronization step of the search state respectively to obtain the possible state set. S4: Calculate the cost of each subsequent search state in the set of possible states using the cost, and add the subsequent search state and its cost to the search queue; S5: Repeat steps S2-S4 until the search reaches a termination state or the maximum number of search iterations is reached to obtain the target search queue; S6: Traverse all event sequences in the log data to be processed, and all target search queues constitute a target alignment scheme.

3. The anomaly detection method based on process mining according to claim 1, characterized in that, The log data to be detected is sampled to obtain sampling results, specifically including: The log data to be detected is randomly sampled or sampled according to the frequency of occurrence to obtain the sampling results; The frequency of occurrence refers to the frequency of occurrence of the event sequence included in the log data to be detected.

4. The anomaly detection method based on process mining according to claim 1, characterized in that, The log data to be detected is sampled to obtain sampling results, specifically including: The event sequences in the log data to be detected are clustered, and the cluster centers are selected as the sampling results.

5. An anomaly detection device based on process mining, characterized in that, include: An acquisition unit is used to acquire log data to be processed, which includes at least log data to be mined and log data to be detected. The model and sampling unit are used to calculate a process model based on the log data to be mined; and to sample the log data to be detected to obtain sampling results. A calculation unit is used to calculate the cost based on the sampling results and the process model using a cost function; the cost function includes a transition cost function and an event cost function. The detection unit is used to perform process consistency detection on the log data to be processed based on the cost function, the process model and the cost, obtain a target alignment scheme, and detect anomalies in the log data to be processed based on the target alignment scheme. The calculation unit is specifically used to: calculate a basic alignment scheme based on the sampling results and the process model using an alignment-based process consistency detection method; The number of each event synchronization step, model step, and log step in the basic alignment scheme is counted to obtain statistical results; The cost is calculated using a cost function based on the statistical results. Specifically, the cost is calculated using a cost function based on the statistical results, including: Based on the statistical results, the transition cost of each transition in the basic alignment scheme is calculated using the transition cost function; The transition cost function includes: in, The transition cost function; This represents the sum of the number of synchronization steps and model steps; Indicates the number of model steps; This represents the sum of the number of synchronization steps, model steps, and log steps; Based on the statistical results, the event cost of each event in the basic alignment scheme is calculated using the event cost function; The event cost function includes: in, For event cost function; This represents the sum of the number of synchronization steps, model steps, and log steps; Indicates the number of log steps; This represents the sum of the number of synchronization steps and log steps; The cost of all changes and the cost of all events constitute the cost.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the anomaly detection method based on process mining as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the anomaly detection method based on process mining as described in any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the anomaly detection method based on process mining as described in any one of claims 1 to 4.

Images