Object-oriented event log anomaly detection method and system

Abstract

This invention discloses an object-oriented event log anomaly detection method and system. This method designs an object-oriented event log anomaly detection model based on a graph convolutional autoencoder module, a long short-term memory network, and a bidirectional gated recurrent unit. The graph convolutional autoencoder module extracts the dependencies between object attributes between events in an object-centric event log. The long short-term memory network extracts long-term temporal information from the object-oriented event log. The bidirectional gated recurrent unit extracts the dependencies between previous and next events in the object-oriented event log. Finally, the outputs of these three modules are combined to obtain an event anomaly score. This invention can perform event-level anomaly detection on object-oriented event logs with high accuracy.

Description

Technical Field

[0001] The present invention relates to the field of event log anomaly detection, and in particular to an object-oriented event log anomaly detection method based on graph convolution, long short-term memory network and bidirectional gated recurrent unit. Background Art

[0002] In an era of rapid information technology development, enterprises are widely using process-aware information systems (PAIS) to manage their processes. Due to the complexity of business process management scenarios, anomalies often occur, such as operator transactions or program failures. A business process anomaly is an illogical behavior that conflicts with normal process data and violates process execution constraints. Due to the uncertainty of their outcomes, business process anomalies can cause economic losses to an enterprise or organization. Anomaly detection technology is designed to detect violations of process constraints in event logs and to address these anomaly logs accordingly. Object-oriented event logs are event logs with multiple case identifiers, which we call objects. Therefore, events in such logs can reference any number of objects. In contrast to object-oriented event logs, there are "flat" event logs, commonly processed by process-aware information systems, where events are represented by a single case identifier.

[0003] Currently, the challenges of anomaly detection in object-oriented event logs are as follows:

[0004] The first challenge is how to capture the implicit relationships between events in object-oriented event logs. In a standard event log (SEL), a trajectory can be extracted based on whether it shares a common case. All events in this trajectory constitute a process instance. However, in an object-oriented event log, the concept of a case does not exist. Instead, there are object types and object instances, which blurs the boundaries of process instances. The associations between events are no longer bound by explicit case IDs but are implicitly embedded in the interaction network and attribute dependencies of object instances. Uncovering the implicit relationships between different events is crucial to improving the model's anomaly detection capabilities.

[0005] The second challenge is extracting temporal correlation information from object-oriented event logs. Timestamp errors (such as event reversal and time window conflicts) are typical anomaly types in anomaly detection (for example, an order shipment event occurs before a payment event). However, the multi-object correlation of object-oriented event logs makes extracting temporal correlations uniquely difficult. Existing anomaly detection models based on graph structures or feature engineering, while capable of capturing topological correlations between objects, generally neglect the extraction and utilization of critical temporal features. Summary of the Invention

[0006] The purpose of the present invention is to overcome the above-mentioned deficiencies of the prior art and to provide an object-oriented event log anomaly detection method and system.

[0007] The technical solutions specifically adopted in the present invention are as follows:

[0008] In a first aspect, the present invention provides an object-oriented event log anomaly detection method, comprising:

[0009] S1. Obtain an object-oriented event log to be detected, perform data cleaning and attribute field standardization on the event log, and obtain a target event log in which each row represents only one event and each column represents only one independent attribute;

[0010] S2. Extract all objects from the target event log, organize all events associated with each object into an initial event sequence according to event timestamps, and then merge all initial event sequences with common events into subgraphs using the common events as connecting nodes, thereby converting the target event log into a series of process instances in the form of subgraphs;

[0011] S3. The target event log and all the converted process instances are input into the event log anomaly detection model, and predictions are made by three prediction branches, namely, a graph convolution module, a long short-term memory network module and a bidirectional gated recurrent unit module. The graph convolution module takes the subgraph set of all process instances as input, and obtains the first log feature through graph convolution autoencoding and graph convolution decoding. The long short-term memory network module takes the initial log feature obtained by encoding the target event log as input, fuses the output features of all time steps through the attention mechanism, and then splices them with the output features of the last time step to obtain the second log feature. The bidirectional gated recurrent unit module takes the initial log feature obtained by encoding the target event log as input, splices the output features of all forward time steps and reverse time steps to obtain the third log feature. Finally, the log features output by each of the three prediction branches are spliced ​​and passed through a fully connected layer to obtain a log reconstruction feature. The feature error of each event in the log reconstruction feature and the initial log feature is used as the anomaly score of the event, thereby determining whether the event is abnormal.

[0012] As a preferred embodiment of the first aspect, the event log anomaly detection model needs to be trained in advance using a labeled event log dataset, and the event log dataset used for training is obtained by injecting abnormal events into normal target event logs. The injected abnormal event types include attribute exchange, timestamp errors and random activities.

[0013] As a preferred embodiment of the first aspect, the graph convolution module is formed by cascading a graph convolution autoencoding module and a graph convolution decoding module. The graph convolution autoencoding module uses two layers of graph convolution layers to perform graph convolution encoding on the node feature matrix of the complete graph composed of the subgraph set to obtain the global features of the graph structure. The graph convolution decoding module uses a single layer of graph convolution layer to decode the global features of the graph structure to obtain a first log feature with the same dimension as the initial log feature.

[0014] As a preferred embodiment of the first aspect, in the long short-term memory network module, the output features of all time steps need to be spliced ​​and then passed through a fully connected layer with a tanh activation function to calculate the attention weight of each time step, and then the attention weight is normalized by the Softmax function, and the output features of all time steps are weightedly fused according to the normalized weight. The obtained fused feature is reduced in dimension through a fully connected layer and then spliced ​​with the output feature of the last time step to obtain a second log feature with the same dimension as the initial log feature.

[0015] As a preference of the first aspect, the feature error used as the abnormality score of each event is the mean square error between the feature vector corresponding to the event in the log reconstruction feature and the feature vector corresponding to the event in the initial log feature.

[0016] As a preferred embodiment of the first aspect, a threshold method is used to determine whether an event is abnormal based on the abnormality score.

[0017] In a second aspect, the present invention provides an object-oriented event log anomaly detection system, comprising:

[0018] The log preprocessing module is used to obtain the object-oriented event log to be detected, and perform data cleaning and attribute field standardization on the event log to obtain the target event log in which each row represents only one event and each column represents only one independent attribute;

[0019] a process instance conversion module, configured to extract all objects from the target event log, organize all events associated with each object into an initial event sequence in sequence according to event timestamps, and then merge all initial event sequences with common events into subgraphs using the common events as connecting nodes, thereby converting the target event log into a process instance in the form of a series of subgraphs;

[0020] The log anomaly detection module is used to input the target event log and all the converted process instances into the event log anomaly detection model, and the three prediction branches, namely the graph convolution module, the long short-term memory network module and the bidirectional gated recurrent unit module, perform predictions respectively; wherein the graph convolution module takes the subgraph set of all process instances as input, and obtains the first log feature through graph convolution autoencoding and graph convolution decoding; the long short-term memory network module takes the initial log feature obtained by encoding the target event log as input, fuses the output features of all time steps through the attention mechanism, and then splices them with the output features of the last time step to obtain the second log feature; the bidirectional gated recurrent unit module takes the initial log feature obtained by encoding the target event log as input, splices the output features of all forward time steps and reverse time steps to obtain the third log feature; finally, the log features output by each of the three prediction branches are spliced ​​and passed through a fully connected layer to obtain a log reconstruction feature, and the feature error of each event in the log reconstruction feature and the initial log feature is used as the anomaly score of the event, thereby determining whether the event is abnormal.

[0021] In a third aspect, the present invention provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, can implement the object-oriented event log anomaly detection method as described in any one of the first aspects above.

[0022] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the object-oriented event log anomaly detection method as described in any one of the first aspects above is implemented.

[0023] In a fifth aspect, the present invention provides a computer electronic device comprising a memory and a processor;

[0024] The memory is used to store computer programs;

[0025] The processor is configured to implement the object-oriented event log anomaly detection method as described in any one of the first aspects above when executing the computer program.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] The present invention provides an object-oriented event log anomaly detection method. The designed neural network model can be based on the object-centric event log, and can use the graph convolution autoencoder module to extract the dependency relationship between object attributes between events in the object-centric event log, use the long short-term memory network to extract the long-term temporal information in the object-oriented event log, and use the bidirectional gated recurrent unit to extract the dependency relationship between previous and next events in the object-oriented event log. Finally, the outputs of the three modules are fused to obtain the event anomaly score. In practical applications, the present invention can use the quartile method to automatically set the threshold and accurately predict which events in the event log are abnormal. While taking into account the graph structure and time characteristics, the present invention can identify abnormal patterns in different situations and provide a more comprehensive anomaly detection solution for object-centric event logs. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flowchart of the steps of the object-oriented event log anomaly detection method;

[0029] Figure 2 A schematic diagram for converting the initial event sequence into a series of process instance subgraphs;

[0030] Figure 3 This is a schematic diagram of the model structure of the event log anomaly detection model;

[0031] Figure 4 This is a schematic diagram of the module composition of the object-oriented event log anomaly detection system;

[0032] Figure 5 It is a structural diagram of computer electronic equipment. DETAILED DESCRIPTION

[0033] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below. The technical features in the various embodiments of the present invention can be combined accordingly without conflicting with each other.

[0034] like Figure 1 As shown, in a preferred embodiment of the present invention, the above-mentioned object-oriented event log anomaly detection method specifically includes steps S1 to S3, and the specific implementation method of each step is described in detail below.

[0035] S1. Obtain an object-oriented event log to be detected, and perform data cleaning and attribute field standardization on the event log to obtain a target event log in which each row represents only one event and each column represents only one independent attribute.

[0036] It should be noted that the object-oriented event log in this invention, also known as the Object-Centric Event Log (OCEL), is a standard for storing object-centric event logs. It is primarily used to capture detailed interaction patterns between different process entities. OCEL logs are event logs with multiple case identifiers, which are referred to as objects. Events in such logs can reference any number of objects. The attributes of each event in an OCEL log include both object-type attributes and non-object-type attributes.

[0037] The original OCEL log needs to be preprocessed to form a standardized log. In an embodiment of the present invention, the specific process of preprocessing the OCEL log is as follows: add a unique event id attribute to each row of events, and clean the log at the same time, discard some repeated and unnecessary attributes; for each event's separable attributes (i.e., a field containing multiple independent attributes in an attribute field), split the attribute string of each cell according to a special identifier, so that each column represents only one independent attribute, which is convenient for one-hot encoding. The object attributes of each event in the original attributes remain unchanged. In addition, normalization processing is required for numerical attributes. In the final target event log, each row represents only one event, and each column represents only one independent attribute.

[0038] S2. Extract all objects from the target event log processed in S1, organize all events associated with each object into an initial event sequence in sequence according to the event timestamps, and then merge all initial event sequences with common events into subgraphs with the common events as connecting nodes, thereby converting the target event log into a series of process instances in the form of subgraphs.

[0039] Due to the nature of OCEL logs, it's impossible to capture the relationships between events simply by displaying case IDs. Therefore, the present invention requires converting object-centric logs into one or more process instances. By extracting process instances, discrete multi-object events can be transformed into a topological subgraph, forming a graph structure that includes object attribute dependencies and event relationships. This structured representation provides an effective input form for graph neural networks, enabling the model to simultaneously capture the relationships between events.

[0040] In an embodiment of the present invention, an OCEL log fragment with an abnormal event is shown in Table 1, where abnormal attributes are represented by bold and underline.

[0041] Table 1 OCEL fragments with anomalies

[0042]

[0043] For the OCEL log shown in Table 1, all objects can be extracted from it, that is, all resources, customers, and pizzas in the three attribute fields of resources, customers, and pizza numbers. Each object is associated with a different timestamp in the log. Therefore, all events associated with each object are organized into an initial event sequence according to the event timestamp. Figure 2 As shown, An event set mapping function that maps objects to event sets can extract a series of different initial event sequences from the log in Table 1. These initial event sequences are added to the processing queue, and the event sequences in the queue are processed using a breadth-first search mechanism. Common events in the event sequences (i.e., events that appear simultaneously in multiple initial event sequences) are scanned, and all initial event sequences with common events are merged into subgraphs with the common events as connecting nodes, thereby converting the target event log into a series of process instances in the form of subgraphs. For example, Figure 2 Process instance in It is composed of a series of event sequence queues, and its generation process is shown as follows:

[0044]

[0045] Among the events and As The connection event. exist Appears in multiple event sequences. It can also be used as a connection event. Therefore, the event sequences of the three pizza objects will be automatically merged to form a process instance containing 8 events. Figure 2 In the example shown, the extracted process instances are not only , based on the connection event ,constitute Some process instances contain only one event, such as , These process instances that contain only one event are usually related to exceptions.

[0046] Therefore, the present invention can convert the OCEL log into a process instance set , Represents the process instance collection process instance, The specific value depends on the actual log situation.

[0047] S3. Input the target event log and all the converted process instances into an event log anomaly detection model to determine whether the events in the target event log are abnormal.

[0048] like Figure 3 As shown in the figure, the specific model structure of the event log anomaly detection model is demonstrated. The model is composed of three prediction branches: a graph convolution module, a long short-term memory network module, and a bidirectional gated recurrent unit module. The graph convolution module takes the subgraph set of all process instances as input and obtains the first log feature through graph convolution autoencoding and graph convolution decoding. The long short-term memory network module takes the initial log feature obtained by encoding the target event log as input, fuses the output features of all time steps through the attention mechanism, and then splices them with the output features of the last time step to obtain the second log feature. The bidirectional gated recurrent unit module takes the initial log feature obtained by encoding the target event log as input and splices the output features of all forward time steps and reverse time steps to obtain the third log feature. Finally, the log features output by each of the three prediction branches are spliced ​​and passed through a fully connected layer to obtain a log reconstruction feature. The feature error between the log reconstruction feature and the initial log feature of each event is used as the anomaly score of the event, thereby determining whether the event is abnormal.

[0049] In the embodiment of the present invention, the graph convolution module is formed by cascading a graph convolution self-encoding module and a graph convolution decoding module. The graph convolution self-encoding module adopts The graph convolution (GCN) layer performs graph convolution encoding on the node feature matrix of the complete graph composed of the subgraph set to obtain the global features of the graph structure. The graph convolution decoding module adopts The graph convolutional layer (GCN) of the layer decodes the global features of the graph structure to obtain a first log feature with the same dimension as the initial log feature.

[0050] It should be noted that the input of the above graph convolution module is a subgraph set consisting of all subgraphs, that is, the subgraphs of the process instance form a complete graph for input. The graph adjacency matrix corresponding to the complete graph is recorded as , the node feature matrix is ​​recorded as , where E is the total number of events and W is the sum of the dimensions of the encoding features of all attributes of each event. The element in row i and column j is represented as , representing any node and nodes The edge connection situation is expressed as:

[0051]

[0052] At the same time, the node feature matrix It is composed of the node features of each event node, which are derived by combining the encoded features of all attributes of the corresponding event. Different attributes require different encodings. For example, numeric attributes can be directly used as features after normalization, while categorical attributes can use one-hot encoding. The specific encoding methods are conventional feature engineering techniques and will not be discussed in detail here.

[0053] In the graph convolution self-encoding module, the graph adjacency matrix can be obtained and node feature matrix Through the graph convolutional network The GCN calculation of the layer outputs the final graph convolutional coding result . The graph convolution process of the layer is expressed as follows:

[0054]

[0055] in is the graph adjacency matrix The degree matrix of is the trainable parameter matrix, It is The output of the graph convolution layer, where Using the aforementioned node feature matrix , Represents the ReLU activation function.

[0056] In the embodiment of the present invention, 2 to 4 layers of GCN are used to learn the potential representation of the input graph, that is, , preferably 3.

[0057] The operation of the graph convolution decoding stage is similar to the above graph convolution encoding stage, except that the input of the graph convolution decoding stage is the output of the graph convolution encoding stage. , graph convolutional decoding is to map the embedded representation of the node back to the original input space. In the graph convolutional decoding module, a total of Calculate the graph convolution layer and output the output of the final graph convolution module In an embodiment of the present invention, 1 to 4 layers of GCN are used to reconstruct the output in the decoding stage, i.e. , preferably 1. Output result That is, the first log feature with the same dimension as the initial log feature. .

[0058] In event log anomaly detection models, the graph convolution module effectively captures spatial correlation information between implicit relationships, but it ignores the temporal dependencies of the entire event log. For example, two events may not have any spatial correlation in their implicit relationships, but they may have temporal correlation information in the entire event log. Relying solely on the graph structure (or the relationships between nodes) to identify anomalies may miss some temporal dynamic features. To this end, this paper introduces a temporal enhancement module consisting of a long short-term memory network (LSTM) module and a bidirectional gated recurrent unit (BiGRU) module to help the model mine important temporal information and accurately reconstruct event logs.

[0059] The medium-long short-term memory network module in this invention is implemented using a long short-term memory network. The LSTM network itself is a state-of-the-art technology. This network can retain contextual information in longer sequences, overcoming the vanishing or exploding gradient problems that are common in traditional RNNs. It can be used to extract long-term temporal information from object-oriented event logs. The neuron formula in the long short-term memory network is as follows:

[0060]

[0061]

[0062]

[0063]

[0064]

[0065]

[0066] The weight parameter Offset value Represent the learning parameters and bias terms in each threshold, Represents the sigmoid function. Inside the neural unit, the cell state The update is performed by the forget gate and output gate Common control, including the forget gate For control The information that needs to be forgotten, and the output gate control and The information will be added. In addition, the output gate Integration and And after being updated Three signals, outputting the hidden state of the current time step Finally, the cell state at the current time step is and hidden state It will be output to the next neuron for information transmission.

[0067] In the long short-term memory network module of the present invention, its input is the initial log feature obtained by encoding the target event log , the initial log feature It is composed of all the attributes of each time in the target event log, which is actually the same as the node feature matrix mentioned above. The LSTM network is calculated by time step, and each time step will output the hidden layer features representing the context information. In this invention, the output features of all time steps can be spliced ​​to obtain the complete output features. :

[0068]

[0069] Where: Represent the output features of different time steps, Represents the output features of the last time step T.

[0070] Next, the above output features The attention weight of each time step is calculated through a fully connected layer with a tanh activation function, and then the attention weight is normalized by the Softmax function and used to perform weighted fusion on the output features of all time steps to obtain the fused features representing the temporal context information:

[0071]

[0072] Where: is the output feature of the i-th time step The corresponding normalized attention weights.

[0073] Therefore, by fusing different time steps through the above-mentioned global attention mechanism, the information of key time steps can be highlighted, and the fusion features obtained are The output features of the last time step of LSTM Splicing to get the output features of the module :

[0074]

[0075] The output characteristics That is, the second log feature with the same dimension as the initial log feature above, .

[0076] In addition, in addition to LSTM, the timing enhancement module also introduces a BiGRU module to extract bidirectional timing information. LSTM can generally capture long-term dependencies of data, but LSTM or ordinary gated recurrent units still have limitations in terms of the order of events before and after and possible bidirectional contextual information. Therefore, the BiGRU of the present invention adds a backpropagation branch based on the unidirectional GRU, so that each event can simultaneously perceive the contextual information of its adjacent events before and after, thereby improving the ability to capture sequence dependencies. The input of the BiGRU module is also the initial log feature obtained by encoding the target event log. . Initial log characteristics After entering the BiGRU module, information can be gradually learned from both the forward and backward time steps. For each time step, the forward gated recurrent unit generates a forward hidden state , the reverse gated recurrent unit generates the reverse hidden state These hidden states can form the output features of each time step , the output features of each time step The output features of the BiGRU module can be obtained by splicing and combining The output features This is the third log feature with the same dimension as the initial log feature above, .

[0077] Therefore, the three branches mentioned above can output their respective log features respectively, and the first log feature output by the graph convolution module is , the second log feature output by the long short-term memory network module and the third log feature of the bidirectional gated recurrent unit module After splicing, the dimension is reduced through the fully connected layer to obtain the log reconstruction feature with the same dimension as the initial log feature above :

[0078] 、

[0079] in represents the activation function, and Represents the learnable parameter matrix and bias term in the fully connected layer.

[0080] When the above log reconstruction characteristics are obtained After that, due to the remaining initial log characteristics The dimensions are the same, both , so each event in the log reconstruction feature and initial log characteristics There are corresponding feature vectors in the log. For each event, the feature error of the two feature vectors is calculated as the abnormality score of the event, and then the event is determined to be abnormal. For any i-th event, if it is in the log reconstruction feature and initial log characteristics The corresponding eigenvectors are and , then the characteristic error calculation formula is:

[0081]

[0082] Where: and They are and The jth dimension of .

[0083] Finally, in practical applications, we can use anomaly scores to To determine whether an event is abnormal, a threshold method can be used. The threshold can be optimized based on the actual data.

[0084] In the embodiment of the present invention, it is recommended to use the quartile method (IQR) to determine the threshold value of abnormal markers , so as to achieve the purpose of identifying outliers. The quartile method is a statistical indicator that represents the range of the middle 50% of the values ​​in the data set, that is, the third quartile and the first quartile The difference between them is calculated as follows:

[0085]

[0086]

[0087] Where: k is a hyperparameter, set according to convention .

[0088] Therefore, setting the threshold Finally, the present invention automatically marks events in the event log as normal or abnormal based on whether the anomaly score is lower or higher than a threshold.

[0089] During actual detection, if the anomaly score of an event (that is, its corresponding average reconstruction error) exceeds the above threshold, the event will be marked as an anomaly, otherwise it will be judged as normal. This process is regarded as a binary classification problem, and the threshold is the classification boundary. In actual business scenarios, the amount of event log data is large and the distribution pattern may be complex. The IQR method can adaptively adapt to the distribution changes of data at different stages without having to assume in advance that the data is normal or uniformly distributed. For scenarios with large fluctuations (such as data in high concurrency periods), the threshold will be raised accordingly; for scenarios with small fluctuations, the threshold will be lower, so that the sensitivity of anomaly detection remains within a reasonable range. In addition, for some scenarios that clearly require more stringent detection, the threshold can be appropriately adjusted. value to improve detection sensitivity.

[0090] It should also be noted that the methods described in S1 to S3 above are actually the process of model reasoning or actual application of the present invention. However, those skilled in the art should know that the above event log anomaly detection model needs to be pre-trained before application, and only used for reasoning in actual business after meeting the corresponding performance requirements.

[0091] In the embodiment of the present invention, it is necessary to use a labeled event log data set for training in advance, and the event log data set used for training is obtained by injecting abnormal events into normal target event logs. The injected abnormal event types include attribute exchange, timestamp error, and random activity. Attribute exchange refers to replacing the attribute value of one event with the attribute value of another event. Given a candidate event, , you can select the event with the farthest Euclidean distance from the event as an exchange event, then use the event All properties on the replace event The timestamp error is based on the timestamp information of all events in the event log, and is divided into two groups based on the maximum and minimum values. 5%, and then replace the timestamp information of the candidate event with any timestamp outside this range. A random activity refers to a newly inserted activity whose type is not from the original event log but is randomly generated, but whose other attributes are extracted from the original event log. After injecting different abnormal events into a normal target event log (i.e., a log without anomalies), a label can be set to indicate whether the event is an anomaly. Finally, all labeled training samples constitute the training sample set.

[0092] In addition, when actually training the event log anomaly detection model, the loss function can be set to the mean of the feature errors of all time periods in the target event log, that is, the reconstruction error of the entire log, which can be expressed as follows:

[0093]

[0094] Therefore, based on the above loss function, we can use the loss function of the event log anomaly detection model in each round of iterative training to calculate the loss function of the event log anomaly detection model. The backpropagation algorithm is used to calculate the gradient of the loss function with respect to the model parameters. All learnable parameters of the event log anomaly detection model are updated based on the calculated gradient and the optimizer's strategy. The model iterates the training process on the dataset until the maximum number of iterations is reached or the loss function converges, completing the model training.

[0095] It should be noted that the method steps shown in S1 to S3 above can essentially be implemented in the form of a computer program.

[0096] Therefore, based on the same inventive concept, Figure 4 As shown, the present invention also provides an object-oriented event log anomaly detection system, which includes:

[0097] The log preprocessing module is used to obtain the object-oriented event log to be detected, and perform data cleaning and attribute field standardization on the event log to obtain the target event log in which each row represents only one event and each column represents only one independent attribute;

[0098] a process instance conversion module, configured to extract all objects from the target event log, organize all events associated with each object into an initial event sequence in sequence according to event timestamps, and then merge all initial event sequences with common events into subgraphs using the common events as connecting nodes, thereby converting the target event log into a process instance in the form of a series of subgraphs;

[0099] The log anomaly detection module is used to input the target event log and all the converted process instances into the event log anomaly detection model, and the three prediction branches, namely the graph convolution module, the long short-term memory network module and the bidirectional gated recurrent unit module, perform predictions respectively; wherein the graph convolution module takes the subgraph set of all process instances as input, and obtains the first log feature through graph convolution autoencoding and graph convolution decoding; the long short-term memory network module takes the initial log feature obtained by encoding the target event log as input, fuses the output features of all time steps through the attention mechanism, and then splices them with the output features of the last time step to obtain the second log feature; the bidirectional gated recurrent unit module takes the initial log feature obtained by encoding the target event log as input, splices the output features of all forward time steps and reverse time steps to obtain the third log feature; finally, the log features output by each of the three prediction branches are spliced ​​and passed through a fully connected layer to obtain a log reconstruction feature, and the feature error of each event in the log reconstruction feature and the initial log feature is used as the anomaly score of the event, thereby determining whether the event is abnormal.

[0100] In addition, based on the same inventive concept, Figure 5 As shown, the present invention also provides a computer electronic device corresponding to the object-oriented event log anomaly detection method provided in the above embodiment, which includes a memory and a processor;

[0101] The memory is used to store computer programs;

[0102] The processor is configured to implement the object-oriented event log anomaly detection method as described above when executing the computer program;

[0103] Furthermore, the logic instructions in the aforementioned memory can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention.

[0104] Therefore, based on the same inventive concept, the present invention provides a computer-readable storage medium corresponding to an object-oriented event log anomaly detection method, on which a computer program is stored. When the computer program is executed by a processor, the object-oriented event log anomaly detection method as described above can be implemented.

[0105] Therefore, based on the same inventive concept, the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, can implement the object-oriented event log anomaly detection method as described above.

[0106] Specifically, in the computer-readable storage medium of the above three embodiments, the stored computer program is executed by the processor to perform the above steps S1 to S3.

[0107] It is understood that the storage medium may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Furthermore, the storage medium may be any medium capable of storing program code, such as a USB flash drive, a mobile hard drive, a magnetic disk, or an optical disk.

[0108] It is understandable that the above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0109] It should also be noted that those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the various embodiments provided in this application, the division of steps or modules in the system and method is only a logical function division. In actual implementation, there may be other division methods, for example, multiple modules or steps can be combined or integrated together, and a module or step can also be split.

[0110] In order to demonstrate the advantages of the object-oriented event log anomaly detection method shown in S1 to S3 above of the present invention, it is applied to a specific example below to demonstrate its technical effect.

[0111] Example

[0112] The steps of this embodiment are shown in S1 to S3 above, and will not be repeated here. The following is a demonstration of some of the implementation processes and results:

[0113] This example uses publicly available order management process event logs. These logs contain over 20,000 events from May 20, 2019, to August 25, 2020, documenting the entire process from customer order placement and confirmation to product processing, packaging, and shipment. Each event contains three object attributes: two numeric attributes and two separable attributes. Model training and testing were performed using the methods described in S1 and S2 above.

[0114] For the sake of convenience, the event log anomaly detection model trained in the method shown in S1 to S3 of the present invention is referred to as Model. In this embodiment, the parameters of Model are selected as follows: the ratio of the number of abnormal events to the total number of events Take 0.1, the number of graph convolution layers in the graph convolution encoding stage Take 3, the number of graph convolution layers in the graph convolution decoding stage Take 1, the hyperparameter in the quartile method Take 1.5. During the model training process, the AdamW optimizer updates all trainable parameters of the neural network model, and the learning rate Pick , decay weight Take 0.00001.

[0115] The experiment of this embodiment compares the method of the present invention with several prediction methods. The prediction methods used as comparisons are: (1) AE: a neural network using a common autoencoder model, which is applicable to common event logs; (2) LSTMAE: an autoencoder model based on LSTM, which is applicable to common event logs; (3) GCNAE: an autoencoder model based on GCN, which is applicable to object-oriented event logs; (4) WAKE: a neural network that extracts trajectory feature representation based on a pre-trained autoencoder and generates anomaly scores using an anomaly score generator based on a multi-layer perceptron, which is applicable to common event logs; and (5) Model: an event log anomaly detection model trained using the method of the present invention.

[0116] Considering that several of the above-mentioned anomaly detection methods are applicable to ordinary event logs, this embodiment flattens the order management process event logs. For the flattened ordinary event logs, anomaly detection methods applicable to ordinary event logs can be used for control experiments.

[0117] The experimental results of the method of the present invention and each pair of control methods on the data set are shown in Table 2.

[0118] Table 2 Performance of all methods on order management process event logs

[0119]

[0120] As shown in Table 2, the method of the present invention is generally better than GCNAE in detecting object-centric event logs. This is because the event log contains not only instance information of individual objects, but also time series information of events. After the present invention adds the long short-term memory network module and the bidirectional gated recurrent unit module, it can be seen that the F1 score index for anomaly detection has been significantly improved. In addition, the WAKE method performs poorly on this dataset. The WAKE method is based on weak supervision, and the dataset of the present invention is marked as abnormal after preprocessing, so the method is not highly compatible with the dataset, resulting in poor results. It can be seen that the object-oriented event log anomaly detection method proposed by the present invention is effective.

[0121] In addition, this example also conducts ablation studies on a financial institution loan dataset (BPIC2017) and a sales process dataset (OM) to verify the effectiveness of the key structures in the model. The names of the various ablation variant experiments are as follows:

[0122] w / o GCN: The model does not include a graph convolution module. That is, only the long short-term memory network module LSTM and the bidirectional gated recurrent unit BiGRU are used to train the preprocessed event logs.

[0123] w / o LSTM: The model does not include LSTM, that is, only the preprocessed event logs are trained using BiGRU and the graph convolution module is used to train the graph encoded data.

[0124] w / o BiGRU: The model does not include BiGRU, that is, only the preprocessed event logs are trained using LSTM and the graph encoded data are trained using the graph convolution module.

[0125] This example experiments with different ablation variants, and the performance on two datasets is shown in Tables 3 and 4:

[0126] Table 3 Effects of ablation variants on the BPIC2017 dataset

[0127]

[0128] Table 4 Effects of ablation variants on the OM dataset

[0129]

[0130] Comparing experiments with different ablation variants shows that the BiGRU module significantly improves the model's anomaly detection accuracy. It enables the model's output to incorporate temporal information from the original input (i.e., the temporal dependencies between previous and subsequent events). When the detection model of the present invention does not use BiGRU, the model's anomaly detection accuracy decreases significantly.

[0131] Comparing the proposed model with that without LSTM, when only the pre-processed event logs and the graph convolution module are used for training the graph encoded data, the anomaly detection indicators are somewhat reduced. This indicates that the long-term temporal information extracted by the LSTM network has a certain positive impact on anomaly detection, but its importance is not as great as the temporal dependencies between previous and subsequent events extracted by the BiGRU.

[0132] Comparing our model with a model trained without GCN, using only LSTM and BiGRU on preprocessed event logs, the anomaly detection results without GCN also degrade. This phenomenon can be attributed to the lack of implicit relationships in OCEL, which deprives critical structural information in the event logs. Furthermore, the introduction of graph convolutional layers improves the accuracy of the model's output by allowing nodes to capture the overall information about the implicit relationships in the event logs from their neighbors.

[0133] The embodiment described above is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Persons skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, any technical solution obtained by equivalent substitution or equivalent transformation falls within the scope of protection of the present invention.

Claims

1. An object-oriented event log anomaly detection method, characterized in that: include: S1. Obtain an object-oriented event log to be detected, perform data cleaning and attribute field standardization on the event log, and obtain a target event log in which each row represents only one event and each column represents only one independent attribute. The object-oriented event log is an object-centric event log (OCEL). S2. Extract all objects from the target event log, organize all events associated with each object into an initial event sequence according to event timestamps, and then merge all initial event sequences with common events into subgraphs using the common events as connecting nodes, thereby converting the target event log into a series of process instances in the form of subgraphs; S3. Input the target event log and all the converted process instances into the event log anomaly detection model, and perform predictions using the three prediction branches: graph convolution module, long short-term memory network module, and bidirectional gated recurrent unit module. The graph convolution module takes the subgraph set of all process instances as input, and obtains the first log feature through graph convolution autoencoding and graph convolution decoding; the long short-term memory network module takes the initial log feature obtained by encoding the target event log as input, fuses the output features of all time steps through the attention mechanism, and then splices them with the output features of the last time step to obtain the second log feature; the bidirectional gated recurrent unit module takes the initial log feature obtained by encoding the target event log as input, splices the output features of all forward time steps and reverse time steps to obtain the third log feature; finally, the log features output by each of the three prediction branches are spliced ​​and passed through a fully connected layer to obtain a log reconstruction feature, and the feature error of each event in the log reconstruction feature and the initial log feature is used as the anomaly score of the event, thereby determining whether the event is abnormal; The graph convolution module is composed of a cascade of a graph convolution autoencoder module and a graph convolution decoding module. The graph convolution autoencoder module uses two layers of graph convolution layers to perform graph convolution encoding on the node feature matrix of the complete graph composed of the subgraph set to obtain the global features of the graph structure. The graph convolution decoding module uses a single layer of graph convolution layer to decode the global features of the graph structure to obtain a first log feature with the same dimension as the initial log feature. In the long short-term memory network module, the output features of all time steps need to be spliced ​​and then passed through a fully connected layer with a tanh activation function to calculate the attention weight of each time step, and then the attention weight is normalized by the Softmax function, and the output features of all time steps are weightedly fused according to the normalized weight. The obtained fused feature is reduced in dimension through a fully connected layer and then spliced ​​with the output feature of the last time step to obtain a second log feature with the same dimension as the initial log feature.

2. The object-oriented event log anomaly detection method according to claim 1, wherein: The event log anomaly detection model needs to be trained in advance using a labeled event log dataset, and the event log dataset used for training is obtained by injecting abnormal events into normal target event logs. The injected abnormal event types include attribute exchange, timestamp errors and random activities.

3. The object-oriented event log anomaly detection method according to claim 1, wherein: The feature error used as the abnormality score of each event is the mean square error between the feature vector corresponding to the event in the log reconstruction feature and the feature vector corresponding to the event in the initial log feature.

4. The object-oriented event log anomaly detection method according to claim 1, wherein: The threshold method is used to determine whether an event is abnormal based on the anomaly score.

5. An object-oriented event log anomaly detection system, characterized in that: include: A log preprocessing module is used to obtain the object-oriented event log to be detected, and perform data cleaning and attribute field standardization on the event log to obtain a target event log in which each row represents only one event and each column represents only one independent attribute. The object-oriented event log is an object-centric log (OCEL). a process instance conversion module, configured to extract all objects from the target event log, organize all events associated with each object into an initial event sequence in sequence according to event timestamps, and then merge all initial event sequences with common events into subgraphs using the common events as connecting nodes, thereby converting the target event log into a process instance in the form of a series of subgraphs; A log anomaly detection module is used to input the target event log and all the converted process instances into the event log anomaly detection model, and perform predictions using three prediction branches: a graph convolution module, a long short-term memory network module, and a bidirectional gated recurrent unit module; The graph convolution module takes the subgraph set of all process instances as input, and obtains the first log feature through graph convolution autoencoding and graph convolution decoding; the long short-term memory network module takes the initial log feature obtained by encoding the target event log as input, fuses the output features of all time steps through the attention mechanism, and then splices them with the output features of the last time step to obtain the second log feature; the bidirectional gated recurrent unit module takes the initial log feature obtained by encoding the target event log as input, splices the output features of all forward time steps and reverse time steps to obtain the third log feature; finally, the log features output by each of the three prediction branches are spliced ​​and passed through a fully connected layer to obtain a log reconstruction feature, and the feature error of each event in the log reconstruction feature and the initial log feature is used as the anomaly score of the event, thereby determining whether the event is abnormal; The graph convolution module is composed of a cascade of a graph convolution autoencoder module and a graph convolution decoding module. The graph convolution autoencoder module uses two layers of graph convolution layers to perform graph convolution encoding on the node feature matrix of the complete graph composed of the subgraph set to obtain the global features of the graph structure. The graph convolution decoding module uses a single layer of graph convolution layer to decode the global features of the graph structure to obtain a first log feature with the same dimension as the initial log feature. In the long short-term memory network module, the output features of all time steps need to be spliced ​​and then passed through a fully connected layer with a tanh activation function to calculate the attention weight of each time step, and then the attention weight is normalized by the Softmax function, and the output features of all time steps are weightedly fused according to the normalized weight. The obtained fused feature is reduced in dimension through a fully connected layer and then spliced ​​with the output feature of the last time step to obtain a second log feature with the same dimension as the initial log feature.

6. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, it can implement the object-oriented event log anomaly detection method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by a processor, the object-oriented event log anomaly detection method according to any one of claims 1 to 4 is implemented.

8. A computer electronic device, characterized in that: including memory and processor; The memory is used to store computer programs; The processor is configured to implement the object-oriented event log anomaly detection method according to any one of claims 1 to 4 when executing the computer program.

Images