Low-code process anomaly detection method, device, equipment and readable storage medium

Abstract

A low-code process anomaly detection method, device and equipment and readable storage medium, relating to the technical field of business process anomaly detection, including preprocessing target log data corresponding to a to-be-detected process instance to obtain target time series features; preprocessing target process definition data corresponding to the to-be-detected process instance to obtain target process topology features; performing feature engineering processing on the target time series features and the target process topology features to obtain target key features, which are used to reflect process behavior; inputting the target key features into a preset target process anomaly detection model, so that the target process anomaly detection model performs anomaly detection based on the target key features to output a target anomaly detection result corresponding to the to-be-detected process instance. The present application can effectively realize anomaly detection of low-code processes to improve detection accuracy and efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of business process anomaly detection, and in particular to a low-code process anomaly detection method, device and equipment and readable storage medium. BACKGROUND

[0002] Process management plays a crucial role in enterprise operations, and the emergence of low-code platforms has greatly reduced the threshold for process construction. However, various anomalies may occur during process execution, such as process blocking, timeout, data errors, etc., which will affect business efficiency and even cause serious losses. Therefore, it is very important to effectively detect process anomalies.

[0003] In related technologies, the following three methods are often used to detect process anomalies: (1) rule-based detection, i.e., using predefined rules (such as time thresholds, data ranges, etc.) to determine whether the process has occurred; (2) log-based analysis, i.e., manually analyzing process execution logs to find abnormal patterns; (3) statistical methods, i.e., using mean, standard deviation, etc. statistical indicators to determine whether the process execution is abnormal. However, due to the diversity and complexity of the processes constructed by low-code platforms and the non-linear, high-dimensional characteristics of process data, it is difficult to completely cover all possible abnormal situations by predefined rules, and the maintenance cost of rules is high. In addition, statistical methods are also difficult to effectively detect anomalies in low-code processes because they are difficult to handle multi-dimensional data in complex processes. Furthermore, the amount of log data generated by low-code platforms is huge, and if manual analysis of a large number of logs is used to detect whether low-code processes have anomalies, not only is the efficiency low, but manual analysis is also difficult to find hidden and complex abnormal patterns.

[0004] Therefore, how to effectively detect anomalies in low-code processes to improve detection accuracy and efficiency is a problem that needs to be solved. SUMMARY

[0005] The present application provides a low-code process anomaly detection method, device, equipment and readable storage medium, which can effectively detect anomalies in low-code processes to improve detection accuracy and efficiency.

[0006] In a first aspect, the present application provides a low-code process anomaly detection method, which comprises:

[0007] preprocessing target log data corresponding to a process instance to be detected to obtain target time series features;

[0008] preprocessing target process definition data corresponding to a process instance to be detected to obtain target process topology features;

[0009] The target key features are input into a preset target process anomaly detection model, so that the target process anomaly detection model performs anomaly detection based on the target key features, to output a target anomaly detection result corresponding to the process instance to be detected.

[0010] The target key features are input into a preset target process anomaly detection model, so that the target process anomaly detection model performs anomaly detection based on the target key features, to output a target anomaly detection result corresponding to the process instance to be detected.

[0011] In combination with the first aspect, in an implementation manner, the pre-processing of the target log data corresponding to the process instance to be detected to obtain the target time sequence features comprises:

[0012] The obtained all initial log data are grouped based on instance identifiers, to determine a plurality of target log data corresponding to the process instance to be detected.

[0013] The plurality of target log data are sorted in the order of event occurrence time, to generate target time sequence features.

[0014] In combination with the first aspect, in an implementation manner, the sorting of the plurality of target log data in the order of event occurrence time to generate the target time sequence features comprises:

[0015] The plurality of target log data are sorted in the order of event occurrence time, to obtain initial time sequence features.

[0016] The initial time sequence features are enhanced based on preset event information, to obtain target time sequence features, the event information comprising process definition information.

[0017] In combination with the first aspect, in an implementation manner, the pre-processing of the target process definition data corresponding to the process instance to be detected to obtain the target process topology features comprises:

[0018] The XML file corresponding to the process instance to be detected is parsed, to obtain target process definition data, the target process definition data comprising process nodes and sequential flows.

[0019] The target graph is constructed based on the target process definition data, to obtain a target graph.

[0020] The target graph is subjected to feature engineering processing, to obtain target process topology features.

[0021] In combination with the first aspect, in an implementation manner, the target process anomaly detection model is an isolation forest model, and the target process anomaly detection model performs anomaly detection based on the target key features to output a target anomaly detection result corresponding to the to-be-detected process instance, including:

[0022] The isolation forest model calculates a path length corresponding to each isolated tree based on the target key features and obtains an average path length.

[0023] The isolation forest model calculates an anomaly score based on the average path length, and outputs the target anomaly detection result corresponding to the to-be-detected process instance based on the anomaly score.

[0024] In combination with the first aspect, in an implementation manner, the target key features include target context features, and the target context features include time window features, process stage features, activity sequence context features, and resource context features.

[0025] In combination with the first aspect, in an implementation manner, when the isolation forest model constructs an isolated tree, feature selection and split value selection are performed based on the target context features, and the isolated tree is constructed according to the selection result.

[0026] Secondly, the embodiment of the present application provides a low-code process anomaly detection device, which includes:

[0027] A preprocessing module is configured to preprocess target log data corresponding to a to-be-detected process instance to obtain target time series features, and preprocess target process definition data corresponding to the to-be-detected process instance to obtain target process topology features.

[0028] A feature engineering module is configured to perform feature engineering processing on the target time series features and the target process topology features to obtain target key features, and the target key features are used to reflect process behavior.

[0029] An anomaly detection module is configured to input the target key features into a preset target process anomaly detection model, so that the target process anomaly detection model performs anomaly detection based on the target key features to output a target anomaly detection result corresponding to the to-be-detected process instance.

[0030] In combination with the second aspect, in an implementation manner, the preprocessing module is specifically configured to:

[0031] Group all the obtained initial log data based on instance identifiers to determine a plurality of target log data corresponding to the to-be-detected process instance.

[0032] The plurality of target log data are sorted according to the chronological order of the event occurrence time to generate a target time series feature.

[0033] With reference to the second aspect, in an implementation manner, the preprocessing module is specifically further configured to:

[0034] The plurality of target log data are sorted according to the chronological order of the event occurrence time to obtain an initial time series feature;

[0035] The initial time series feature is subjected to context information enhancement based on preset event information to obtain a target time series feature, and the event information includes process definition information.

[0036] With reference to the second aspect, in an implementation manner, the preprocessing module is specifically further configured to:

[0037] An XML file corresponding to the process instance to be detected is parsed to obtain target process definition data, and the target process definition data includes process nodes and sequential flows;

[0038] Graph construction is performed based on the target process definition data to obtain a target graph;

[0039] Feature engineering processing is performed on the target graph to obtain a target process topology feature.

[0040] With reference to the second aspect, in an implementation manner, the target process anomaly detection model is an isolation forest model, and the isolation forest model is specifically configured to:

[0041] A path length corresponding to each isolated tree is calculated based on a target key feature, and an average path length is obtained;

[0042] An anomaly score is calculated according to the average path length, and a target anomaly detection result corresponding to the process instance to be detected is output based on the anomaly score.

[0043] With reference to the second aspect, in an implementation manner, the target key feature includes a target context feature, and the target context feature includes a time window feature, a process stage feature, an activity sequence context feature, and a resource context feature.

[0044] With reference to the second aspect, in an implementation manner, when the isolation forest model constructs an isolated tree, feature selection and split value selection are performed based on the target context feature, and the isolated tree is constructed according to the selection result.

[0045] Thirdly, embodiments of this application provide a low-code flow anomaly detection device, which includes a processor, a memory, and a low-code flow anomaly detection program stored in the memory and executable by the processor. When the low-code flow anomaly detection program is executed by the processor, it implements the steps of the aforementioned low-code flow anomaly detection method.

[0046] Fourthly, embodiments of this application provide a computer-readable storage medium storing a low-code flow exception detection program, wherein when the low-code flow exception detection program is executed by a processor, it implements the steps of the aforementioned low-code flow exception detection method.

[0047] The beneficial effects of the technical solutions provided in this application include:

[0048] By preprocessing the target log data and target process definition data corresponding to the process instance to be detected, target time series features and target process topology features are obtained. Feature engineering is then performed on these features to obtain key target features reflecting process behavior. These key features are then input into a pre-defined target process anomaly detection model for automatic anomaly detection, outputting the anomaly detection results. This application uses machine learning algorithms to automatically learn complex patterns in low-code process data, effectively handling nonlinear, high-dimensional, and other complex low-code process data. This not only improves the accuracy of low-code process anomaly detection and its adaptability to complex processes, overcoming the limitations of rule-based methods, but also eliminates the need for manual analysis of large amounts of log data, effectively improving the detection efficiency of low-code processes. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating an embodiment of the low-code flow anomaly detection method of this application;

[0050] Figure 2 For this application Figure 1 A detailed flowchart of step S10;

[0051] Figure 3 For this application Figure 1 A detailed flowchart of step S20;

[0052] Figure 4 This is a schematic diagram of the functional modules of an embodiment of the low-code process anomaly detection device of this application;

[0053] Figure 5 This is a schematic diagram of the hardware structure of the low-code flow anomaly detection device involved in the embodiments of this application. Detailed Implementation

[0054] In order for those skilled in the art to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0055] In order to make the purpose, technical solutions and advantages of the present application clearer, the embodiments of the present application will be described in further detail below in conjunction with the drawings.

[0056] In a first aspect, the embodiments of the present application provide a low-code process anomaly detection method.

[0057] In an embodiment, with reference to Figure 1 , Figure 1 The flowchart of the low-code process anomaly detection method embodiment of the present application is shown. As shown in Figure 1 The low-code process anomaly detection method comprises:

[0058] Step S10: preprocessing target log data corresponding to a process instance to be detected to obtain a target time series feature.

[0059] For example, in the present embodiment, raw data is collected from data sources such as execution logs and process definitions generated by a low-code process platform, and basic preprocessing operations such as cleaning and conversion are performed on the raw data, such as removing duplicate logs, handling missing values, standardizing time formats, filtering irrelevant log levels, etc.; then the results of the basic preprocessing operations are grouped according to the process instance identifier (i.e. Id number) to reconstruct the event execution sequence of each process instance, thereby generating the target time series feature. It can be seen that the present embodiment not only cleans the log data, but also converts discrete log events into structured event stream data, i.e. structures the log data into event trajectories of process instances, to lay a foundation for subsequent advanced analysis such as process behavior analysis, process mining, anomaly detection, path analysis, performance bottleneck identification, etc., while conventional log cleaning cannot provide such structured event sequence information.

[0060] Further, with reference to Figure 2 The preprocessing of the target log data corresponding to the process instance to be detected to obtain the target time series feature comprises:

[0061] Step S101: grouping all the initial log data obtained based on the instance identifier to determine a plurality of target log data corresponding to the process instance to be detected;

[0062] Step S102: Sort the plurality of target log data according to the chronological order of the occurrence time of the events to generate a target time series feature.

[0063] For example, in this embodiment, after obtaining all the initial log data through the basic preprocessing operation, all the initial log data are grouped according to the instance Id number of the process to obtain a group of log data corresponding to each process instance. Therefore, for the process instance to be detected, a group of log data corresponding to it can be found according to its instance Id number, i.e. a plurality of target log data corresponding to the process instance to be detected is obtained. Then, the plurality of target log data corresponding to the process instance to be detected is extracted for relevant features, such as process execution time, task completion time, data change, etc., to determine the occurrence time of each log event, so that the plurality of target log data can be sorted according to the chronological order of the occurrence time of the events to generate a target time series feature.

[0064] It can be understood that for structured logs containing process or activity events, the data is usually recorded in an easily parsed format (such as JSON format). Assuming that each log records the occurrence of an event and contains the time of the event, the identifier of a specific instance to which the event belongs, the event type and other related detailed information, i.e. the structure is as follows: [

[0066] {"timestamp": "2023-10-27 10:00:00", "instanceId": "instance-123", "eventType": "process start", "process definition identifier": "purchase process", "user": "userA"},

[0067] {"timestamp": "2023-10-27 10:05:00", "instanceId": "instance-123", "eventType": "task assignment", "task name": "approval", "approver": "userB"},

[0068] {"timestamp": "2023-10-27 10:15:00", "instanceId": "instance-456", "eventType": "process start", "process definition identifier": "vacation application", "user": "userC"},

[0069] {"timestamp": "2023-10-27 10:20:00", "instanceId": "instance-123", "eventType": "task completion", "task name": "approval", "user": "userB", "result": "pass"}

[0070] {"timestamp": "2023-10-27 10:25:00", "instanceId": "instance-456", "eventType": "task assignment", "taskName": "fill in leave form", "applicant": "userD"}

[0071] / / ... more logs ]

[0073] Based on the above log, the target time series feature is constructed: first, load data, that is, read the structured log data from the place where the log is stored (such as a log file or a database) and perform basic preprocessing operations; then group by instance identifier, that is, group all log records obtained after basic preprocessing according to the specific instanceId to which each event belongs, so as to collect all related events belonging to the same process instance together; then sort by time within the group, that is, within each group that has been divided, sort the logs according to the time record (timestamp) of event occurrence, to ensure that all events within the same process instance are arranged in the order of their actual occurrence; finally, construct an event sequence, that is, convert the event records within each group that have been sorted by time into a sequence or list representing the event occurrence process, that is, obtain the target time series feature; for example, for a specific process instance, its target time series feature is "process start" -> "task assignment - approval" -> "task completion - approval".

[0074] Further, in an embodiment, the sorting the plurality of target log data in the order of the time of event occurrence to generate a target time series feature comprises:

[0075] sorting the plurality of target log data in the order of the time of event occurrence to obtain an initial time series feature;

[0076] enhancing the initial time series feature based on preset event information to obtain a target time series feature, the event information including process definition information.

[0077] Exemplarily, in the embodiment, the log data will be contextually enhanced, i.e. more details related to the events will be extracted from other related information sources (such as definition information describing the process structure) and added to the corresponding event description in the event sequence to supplement the information such as semantics, timing and association of the log, thereby realizing enrichment and enhancement of the time sequence features and improving the accuracy of process detection. Specifically, the plurality of target log data are sorted according to the chronological order of the event occurrence to obtain initial time sequence features; and the initial time sequence features are enhanced by the preset event information to enrich the context of the event, thereby generating target time sequence features. It should be noted that the event information includes but is not limited to process definition information, and the specific information contained therein can be determined according to actual needs, which is not limited here; and the process definition information can be obtained by analyzing and extracting the preset process definition, such as including but not limited to task type and node ID.

[0078] For example, a simple "task allocation - approval" event description can be enhanced to a detailed description containing more information such as task type and process node identification, i.e. it can be enhanced to "task allocation - approval (task type: manual task, process node ID: task_approval)", thereby more clearly presenting the background and details of the event.

[0079] Step S20: preprocessing target process definition data corresponding to the process instance to be detected to obtain target process topology features.

[0080] Exemplarily, it should be understood that for process definition data (such as BPMN XML), the conventional processing usually only performs XML / JSON parsing to extract relevant information, which can only provide original element information of the process and is difficult to be directly used for quantitative analysis and comparison of the process structure; and the embodiment performs preprocessing such as graph structuring and feature engineering on the target process definition data corresponding to the process instance to be detected, i.e. converts the process definition data into graph structure and performs graph feature engineering to convert the process definition data from XML / JSON text into structured graph data and extract quantitative graph features, i.e. converts the structure information of the process into numerical features (i.e. target process topology features), thereby better capturing the structure information of the process.

[0081] Further, referring to Figure 3 , the preprocessing of the target process definition data corresponding to the process instance to be detected to obtain the target process topology features comprises:

[0082] Step S201: parsing an XML file corresponding to the process instance to be detected to obtain target process definition data, the target process definition data comprising process nodes and sequential flows;

[0083] Step S202: graph construction based on the target process definition data to obtain a target graph.

[0084] Step S203: feature engineering processing on the target graph to obtain target process topology features.

[0085] Exemplarily, in the present embodiment, first, the target process definition data (such as a BPMN XML (Business Process Model and Notation) file) is parsed using an XML parsing library to extract process nodes and sequential flows; then graph construction is performed, i.e., a process graph (i.e., a target graph) is constructed using a graph database or graph computing library, wherein elements such as tasks, gateways and events in the BPMN XML are taken as nodes of the graph, and sequential flows in the BPMN XML are taken as edges of the graph to connect the process nodes, while attributes of the BPMN nodes (such as name, task type, gateway type, etc.) are taken as attributes of the graph nodes; then graph feature engineering processing is performed, i.e., various features in the target graph are calculated, and target process topology features are generated based thereon. Among them, the features in the target graph include but are not limited to: (1) node degree centrality, which is used to measure the connection degree of a node in the process graph, and a node with high node degree centrality may be a key node of the process; (2) closeness centrality, which is used to measure the average distance of a node to other nodes, and a node with high closeness centrality may be more likely to affect the entire process; (3) betweenness centrality, which is used to measure the ability of a node as a bridge of the shortest path between other nodes, and a node with high betweenness centrality may be a bottleneck or a node on the critical path of the process; (4) process complexity indicators, such as loop number, node number, average path length, etc., to measure the complexity of the process; (5) specific node type count, such as the number of manual task nodes, the number of automatic task nodes, the number of gateway nodes, etc., to reflect the automation degree and decision complexity of the process.

[0086] Step S30: feature engineering processing on the target time series features and the target process topology features to obtain target key features, which are used to reflect the process behavior.

[0087] Exemplarily, in this embodiment, feature engineering is performed on the target time sequence features and the target process topology features based on the characteristics of the process to generate target key features capable of reflecting the behavior of the process; for example, the execution path of the process instance can be extracted as a key feature to reflect the execution mode of the process. It should be noted that the target key features include but are not limited to: (1) activity frequency features, i.e., the number of times each activity appears in the process instance is counted; (2) activity duration features, i.e., the execution time of each activity is calculated; (3) activity sequence features, i.e., the activity sequence of the process instance is extracted; (4) resource features, i.e., the resource type and quantity participating in the activity; and (5) time features, i.e., the timestamp and time interval of the activity.

[0088] Step S40: inputting the target key features into a preset target process anomaly detection model, so that the target process anomaly detection model performs anomaly detection based on the target key features to output a target anomaly detection result corresponding to the process instance to be detected.

[0089] Exemplarily, in this embodiment, a machine learning algorithm such as support vector machine (SVM), isolation forest (IsolationForest), long short-term memory network (LSTM), etc. can be selected as the process anomaly detection model, and the model is trained using historical data to enable the model to automatically learn the complex patterns in the low-code process data and effectively process complex low-code process data such as non-linear and high-dimensional data, thereby generating a target process anomaly detection model; it can be understood that different machine learning algorithms can be selected to construct the target process anomaly detection model for different anomaly types. Therefore, after obtaining the target key features, they are input into the target process anomaly detection model, so that the target process anomaly detection model can determine whether the process instance to be detected is abnormal based on the target key features to generate a target anomaly detection result, and the target anomaly detection result is displayed to the user in a visual manner (such as in the form of a dashboard, a chart, etc.). In addition, an alarm can be sent according to a preset threshold, such as an email, a short message, etc.

[0090] As can be seen, this embodiment automatically learns the complex patterns in the low-code process data using a machine learning algorithm to effectively process complex low-code process data such as non-linear and high-dimensional data, thereby effectively implementing automatic detection of low-code process anomalies. This not only improves the accuracy of low-code process anomaly detection and the adaptability to complex processes, overcomes the limitations of rule-based methods, and does not require manual analysis of a large amount of log data, thereby effectively improving the detection efficiency of low-code processes; in addition, this embodiment also fully considers the characteristics of the low-code platform, such as the visualization of process definition and the dynamics of process execution, to improve the effectiveness of detection.

[0091] Further, in an embodiment, the target process anomaly detection model is an Isolation Forest model, and the target process anomaly detection model performs anomaly detection based on the target key features to output a target anomaly detection result corresponding to the process instance to be detected, including:

[0092] The Isolation Forest model calculates a path length corresponding to each isolated tree based on the target key features and obtains an average path length;

[0093] The Isolation Forest model calculates an anomaly score based on the average path length, and outputs the target anomaly detection result corresponding to the process instance to be detected based on the anomaly score.

[0094] For example, in the present embodiment, an Isolation Forest model is preferably used as the process anomaly detection model; wherein the core architecture of the Isolation Forest model is a forest composed of a plurality of isolated trees, and each isolated tree is a random binary tree for randomly dividing data samples until each sample is isolated. It should be noted that the Isolation Forest model in the present embodiment includes an isolated tree constructor, a path length calculator, and an anomaly score calculator; wherein the isolated tree constructor includes a random feature selection unit, a random split value selection unit, and a recursive division unit, the random feature selection unit randomly selects a feature dimension when constructing each node, the random split value selection unit randomly selects a split value on the selected feature dimension, and the recursive division unit divides the data set into left and right child nodes according to the selected feature and split value, and recursively constructs the sub-tree until the stop condition is met (for example: the maximum depth of the tree is reached, the number of node samples is less than a threshold, or all samples in the node are the same), thereby constructing a plurality of isolated trees; for each data sample, the path length calculator calculates the path length in each isolated tree, and the anomaly score calculator calculates the anomaly score of the data sample based on the average path length of the data sample in all isolated trees in the forest, and determines whether the low-code process is abnormal according to the size relationship between the anomaly score and a preset score threshold. Therefore, training the above Isolation Forest model can generate a target process anomaly detection model; it should be noted that the training process of the Isolation Forest model mainly learns the structure of the forest, and its parameters are relatively small, usually only a few hyperparameters such as the number of trees and the size of the sub-sample need to be set.

[0095] Based on this, after inputting the target key features into the isolation forest model, the isolation forest model will calculate the path length of the sample on each isolated tree based on the target key features, and calculate the average path length based on the path length. Then, the average path length is used to calculate the anomaly score. It can be understood that the shorter the path length, the easier the sample is to be isolated, and the higher the anomaly score, which means that it is more likely to be an anomaly. Finally, based on the size relationship between the anomaly score and the score threshold, it is determined whether the low-code process is abnormal, so as to output the target anomaly detection result corresponding to the process instance to be detected. For example, when the anomaly score exceeds the score threshold, the process instance to be detected is determined to be an abnormal process instance. It should be noted that the specific value of the score threshold can be adjusted according to the actual application scene and the false positive rate and false negative rate requirements, and is not limited herein.

[0096] Further, in an embodiment, the target key features include target context features, and the target context features include time window features, process stage features, activity sequence context features, and resource context features. When the isolation forest model constructs an isolated tree, feature selection and split value selection are performed based on the target context features, and the isolated tree is constructed according to the selection results.

[0097] It can be understood that, although the isolation forest algorithm itself has the advantages of high efficiency and easy to use, when performing anomaly detection, each data point is usually treated as an independent individual, so that the context relationship between data points is ignored. In process anomaly detection, the execution of the process often has time series characteristics and context dependence. For example, the execution time of a certain activity may fluctuate within a certain range under normal circumstances, but the normal range may change under certain process stages or certain upstream and downstream activity combinations. However, the traditional isolation forest model is difficult to capture such context information, resulting in false positives or false negatives. Based on this, the embodiment integrates context information into the isolation forest model to construct a context-aware isolation forest, which can perform context-aware anomaly detection, thereby improving its performance and applicability, especially in the low-code process anomaly detection scenario.

[0098] Specifically, in addition to extracting basic activity features, the embodiment can explicitly introduce context features in the feature engineering stage; for example, by feature engineering processing, target context features including but not limited to time window features, process stage features, activity sequence context features and resource context features are extracted as target key features. Among them, the time window feature refers to the frequency, duration, etc. of activities in the past period of time (for example, the past 5 minutes, 1 hour); the process stage feature refers to the introduction of process stage identification as a feature if the process can be divided into different stages (for example, the "order" stage, "payment" stage, "delivery" stage of the order process); the activity sequence context feature refers to the activity sequence feature extracted using the sliding window or n-gram method (which is a feature extraction technology based on sliding window), such as the previous n activity sequence of the current activity; the resource context feature refers to considering the role and behavior pattern of resources in the process, for example, the activity frequency and duration of different role resources may be different.

[0099] In addition, context information can also be integrated into the process of constructing isolated trees in the Isolation Forest model, that is, considering feature selection and split value selection based on context information. Among them, for context-aware conditional feature selection, when selecting features, the weight of the feature can be dynamically adjusted according to the context information (such as time window features, process stage features, activity sequence context features and resource context features, etc.) of the current node, so as to achieve the purpose of preferentially selecting features more relevant to the current context; specifically, a pre-defined context and feature association rule can be used to calculate a priority score or weight for each available feature, and feature selection is performed according to the priority score or weight size. For context-aware split value selection, when selecting the split value, the context information of the current node can be considered, for example, according to the split value selection of different process stages, the current node is more suitable for selecting the split value range.

[0100] It is worth noting that context information can also be considered in the process of calculating the anomaly score of the Isolation Forest model, that is, when calculating the anomaly score, the contributions of different isolated trees are weighted according to the context information; for example, according to the performance of the isolated tree under a specific context (such as anomaly detection accuracy, speed and robustness in a specific process stage), different weights are assigned to it, so that when calculating the anomaly score, the path length of the isolated tree with higher weight is given higher weight.

[0101] Based on this, the embodiment introduces context information to enable the isolation forest model to more accurately capture the normal behavior pattern of the process, thereby improving the abnormality detection accuracy and reducing false positives and false negatives. In addition, the context information can help understand the reason for the occurrence of the abnormality, i.e., enhance the interpretability of the abnormality. For example, if an activity is abnormal at a specific process stage or in a specific context combination, the context information will be carried in the abnormality, thereby facilitating abnormality analysis. At the same time, the context awareness capability also makes the isolation forest model more robust to changes in the process environment. For example, when the process behavior pattern evolves over time or the external environment changes, the model can better adapt, thereby improving the robustness of the model. In summary, the embodiment can effectively improve the abnormality detection capability of the low-code process platform and ensure the stable operation of the process.

[0102] In a second aspect, the embodiment of the present application also provides a low-code process abnormality detection device.

[0103] In an embodiment, the preprocessing module is specifically configured to: Figure 4 Figure 4 The function module diagram of the low-code process abnormality detection device embodiment of the present application is shown in FIG. 1. As shown in FIG. 1, the low-code process abnormality detection device comprises: Figure 4

[0104] The preprocessing module is configured to preprocess target log data corresponding to the process instance to be detected to obtain target time series features; and preprocess target process definition data corresponding to the process instance to be detected to obtain target process topology features.

[0105] The feature engineering module is configured to perform feature engineering processing on the target time series features and the target process topology features to obtain target key features, wherein the target key features are used to reflect process behavior.

[0106] The abnormality detection module is configured to input the target key features into a preset target process abnormality detection model, so that the target process abnormality detection model performs abnormality detection based on the target key features to output a target abnormality detection result corresponding to the process instance to be detected.

[0107] Further, in an embodiment, the preprocessing module is specifically configured to:

[0108] Group all the obtained initial log data based on instance identifiers to determine a plurality of target log data corresponding to the process instance to be detected;

[0109] Sort the plurality of target log data in the order of event occurrence time to generate target time series features.

[0110] Further, in an embodiment, the preprocessing module is specifically configured to:​​

[0111] sort the plurality of target log data in chronological order according to the time of occurrence of the events to obtain initial time series features;

[0112] enhance the initial time series features based on preset event information to obtain target time series features, the event information including process definition information.

[0113] Further, in an embodiment, the preprocessing module is specifically further configured to:

[0114] parse an XML file corresponding to the process instance to be detected to obtain target process definition data, the target process definition data including process nodes and sequential flows;

[0115] perform graph construction based on the target process definition data to obtain a target graph;

[0116] perform feature engineering processing on the target graph to obtain target process topology features.

[0117] Further, in an embodiment, the target process anomaly detection model is an isolation forest model, and the isolation forest model is specifically configured to:

[0118] calculate a path length corresponding to each isolated tree based on target key features and obtain an average path length;

[0119] calculate an anomaly score according to the average path length, and output a target anomaly detection result corresponding to the process instance to be detected based on the anomaly score.

[0120] Further, in an embodiment, the target key features include target context features, and the target context features include time window features, process stage features, activity sequence context features, and resource context features.

[0121] Further, in an embodiment, when the isolation forest model constructs an isolated tree, feature selection and split value selection are performed based on target context features, and the isolated tree is constructed according to the selection results.

[0122] The functions of each module in the above low-code process anomaly detection apparatus correspond to the steps in the above low-code process anomaly detection method embodiments, and the functions and implementation processes will not be described here.

[0123] In a third aspect, the embodiments of the present application provide a low-code process anomaly detection device. The low-code process anomaly detection device can be a personal computer (PC), a notebook computer, a server, or other devices with data processing functions.

[0124] Refer to Figure 5 , Figure 5 Figure 1 is a schematic diagram of a hardware structure of a low-code process anomaly detection device according to an embodiment of the present application. In the embodiment of the present application, the low-code process anomaly detection device can include a processor, a memory, a communication interface, and a communication bus.

[0125] The communication bus can be of any type, used to interconnect the processor, the memory, and the communication interface.

[0126] The communication interface includes an input / output (I / O) interface, a physical interface, and a logical interface, etc. for interconnecting devices within the low-code process anomaly detection device, and interfaces for interconnecting the low-code process anomaly detection device with other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber interface, an ATM interface, etc.; the user device can be a display (Display), a keyboard (Keyboard), etc.

[0127] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0128] The processor can be a general-purpose processor that can invoke a low-code process anomaly detection program stored in the memory and execute the low-code process anomaly detection method provided by the embodiments of the present application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed by the low-code process anomaly detection program when invoked can refer to the various embodiments of the low-code process anomaly detection method of the present application, which will not be described here.

[0129] Those skilled in the art can understand that the hardware structure shown in the above Figure 5 does not constitute a limitation on the present application, and can include more or fewer components than shown, or combine certain components, or different component arrangements.

[0130] In a fourth aspect, the embodiments of the present application also provide a computer readable storage medium.

[0131] The low-code process exception detection program is stored on the readable storage medium of the application, and when the low-code process exception detection program is executed by the processor, the steps of the low-code process exception detection method are implemented.

[0132] The method implemented when the low-code process exception detection program is executed can refer to each embodiment of the low-code process exception detection method of the application, which will not be described here.

[0133] It should be noted that the above application example serial numbers are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0134] The terms "include" and "have" and any variations thereof in the specification and claims of the application and the above drawings are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device. The terms "first", "second" and "third" and the like descriptions are used to distinguish different objects, and do not represent the order or limit the types of "first", "second" and "third".

[0135] In the description of the embodiments of the application, "exemplary", "for example", "for instance" or "such as" are used to represent an example, illustration or description. Any embodiment or design scheme described as "exemplary", "for example" or "for instance" in the embodiments of the application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. In fact, the words "exemplary", "for example", "for instance" or the like are intended to present the relevant concept in a specific manner.

[0136] In the description of the embodiments of the application, unless otherwise specified, " / " represents or, for example, A / B can represent A or B; "and / or" in the text only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, A and B together, and B alone. In addition, in the description of the embodiments of the application, "multiple" means two or more than two.

[0137] In some of the processes described in the embodiments of the application, a plurality of operations or steps are included in a specific order, but it should be understood that these operations or steps can be executed or executed in parallel without the order in which they appear in the embodiments of the application. The serial number of the operation is only used to distinguish each different operation, and the serial number itself does not represent any execution order. In addition, these processes can include more or fewer operations, and these operations or steps can be executed in sequence or in parallel, and these operations or steps can be combined.

[0138] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, can also be through hardware, but in many cases the former is a better implementation. Based on such understanding, the technical solutions of the present application essentially or say the part of the prior art contribution can be embodied in the form of software products, the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disc, optical disc) as described above, including a number of instructions to make a terminal device execute the method described in various embodiments of the present application.

[0139] The above is only the preferred embodiment of the present application, not therefore limit the patent scope of the present application, all use the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, including the equivalent structure or equivalent process transformation, or are included in the patent protection scope of the present application.

Claims

1. A low-code flow exception detection method, characterized in that, The low-code flow anomaly detection method includes: Preprocess the target log data corresponding to the process instance to be detected to obtain target time series features, wherein the process instance to be detected is a low-code process instance; Preprocessing is performed on the target process definition data corresponding to the process instance to be detected to obtain the target process topology features, wherein the target process definition data includes process nodes and sequence flow; Feature engineering is performed on the target time series features and the target process topology features to obtain target key features, which are used to reflect process behavior. The target key features are input into a preset target process anomaly detection model, so that the target process anomaly detection model can perform anomaly detection based on the target key features and output the target anomaly detection result corresponding to the process instance to be detected; The preprocessing of the target log data corresponding to the instance of the process to be detected to obtain target time series features includes: Based on the instance identifier, all the initial log data obtained are grouped to identify multiple target log data corresponding to the process instance to be detected; The multiple target log data are sorted according to the chronological order of the events to obtain the initial time series features; The initial time series features are enhanced with contextual information based on preset event information to obtain target time series features. The event information includes process definition information.

2. The low-code flow anomaly detection method as described in claim 1, characterized in that, The preprocessing of the target process definition data corresponding to the instance of the process to be detected to obtain the target process topology features includes: The XML file corresponding to the process instance to be tested is parsed to obtain the target process definition data; A graph is constructed based on the target process definition data to obtain the target graph; The target graph is subjected to feature engineering to obtain the target process topology features.

3. The low-code flow anomaly detection method as described in claim 1, characterized in that, The target process anomaly detection model is an isolated forest model. This model performs anomaly detection based on the target's key features, outputting anomaly detection results corresponding to the instance of the process to be detected, including: The isolated forest model calculates the path length corresponding to each isolated tree based on the key features of the target and obtains the average path length; The isolated forest model calculates anomaly scores based on the average path length and outputs target anomaly detection results corresponding to the instance of the process to be detected based on the anomaly scores.

4. The low-code flow anomaly detection method as described in claim 3, characterized in that, The target key features include target context features, which include time window features, process stage features, activity sequence context features, and resource context features.

5. The low-code flow anomaly detection method as described in claim 4, characterized in that, When constructing isolated trees in the isolated forest model, feature selection and segmentation value selection are performed based on the target context features, and the isolated trees are constructed based on the selection results.

6. A low-code flow exception detection device, characterized in that, The low-code flow anomaly detection device includes: The preprocessing module is used to preprocess the target log data corresponding to the process instance to be detected to obtain target time series features, wherein the process instance to be detected is a low-code process instance; and to preprocess the target process definition data corresponding to the process instance to be detected to obtain target process topology features, wherein the target process definition data includes process nodes and sequence flow. The feature engineering module is used to perform feature engineering processing on the target time series features and the target process topology features to obtain target key features, which are used to reflect process behavior. An anomaly detection module is used to input the target key features into a preset target process anomaly detection model, so that the target process anomaly detection model can perform anomaly detection based on the target key features and output the target anomaly detection result corresponding to the process instance to be detected. Specifically, the preprocessing module is used for: Based on the instance identifier, all the initial log data obtained are grouped to identify multiple target log data corresponding to the process instance to be detected; The multiple target log data are sorted according to the chronological order of the events to obtain the initial time series features; The initial time series features are enhanced with contextual information based on preset event information to obtain target time series features. The event information includes process definition information.

7. A low-code flow anomaly detection device, characterized in that, The low-code flow anomaly detection device includes a processor, a memory, and a low-code flow anomaly detection program stored in the memory and executable by the processor, wherein when the low-code flow anomaly detection program is executed by the processor, it implements the steps of the low-code flow anomaly detection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a low-code flow exception detection program, wherein when the low-code flow exception detection program is executed by a processor, it implements the steps of the low-code flow exception detection method as described in any one of claims 1 to 5.

Images