Graph Autoencoder for Business Process Anomaly Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current autoencoder-based approaches for anomaly detection in business processes fail to consider structural information and treat event logs as simple flat data, lacking the ability to capture key relationships among activity occurrences.

Innovation Solution

The use of a Graph Autoencoder (GAE) approach that converts business process logs into a graphical data structure, applying an unsupervised machine learning method with a graph neural network (GNN) and edge-conditioned convolution to generate optimized graph encodings for anomaly detection, enabling the computation of anomaly scores based on process-aware metrics.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If current autoencoder-based approaches are used for anomaly detection, then the implementation is simple, but the detection accuracy is low due to ignoring structural information

Engineering Contradiction:
Improveanomaly detection accuracyVSAvoidmodel complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent transforms the flat event log data into a graph structure by adding a spatial dimension that represents structural relationships between activities. This graph structure captures the hierarchical and relational information that is lost in traditional flat representations, thereby improving anomaly detection accuracy without excessively increasing model complexity.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

Solution Approach 2:

The patent introduces graph neural networks as an intermediary component between the input data and the autoencoder. This intermediary transforms the raw event logs into graph representations that preserve structural information, enabling the subsequent autoencoder to achieve better detection accuracy while managing complexity through modular architecture.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Loss of information

If Graph Autoencoder with GNN is applied, then structural information is captured effectively, but the training convergence becomes more difficult

Engineering Contradiction:
Improvestructural information retentionVSAvoidtraining convergence ease
Core Design Contradiction:
Loss of informationVSEase of manufacture

Solution Approach 1:

The patent performs preliminary construction of the graph structure from event logs before feeding data into the GNN model. By pre-processing the data into graph format with properly defined nodes, edges, and attributes, the model receives well-structured input that facilitates faster and more stable training convergence while effectively capturing structural information.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent optimizes training convergence by adjusting key parameters including learning rate, batch size, and graph construction parameters. These parameter changes help balance the complexity of GNN training with the need to preserve structural information, enabling effective training of the Graph Autoencoder model.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS11928629B2Graph encoders for business process anomaly detection
Publication Date: 2024.03.12 INTERNATIONAL BUSINESS MACHINE CORPORATION
  • US11928629B2 patent drawing
  • US11928629B2 patent drawing
  • US11928629B2 patent drawing

AI summary

A method, computer system, and a computer program product for anomaly detection is provided. The present invention may include converting business process logs into a graphical data structure. The present invention may include generating an optimized graph encoding for anomaly detection using an unsupervised machine learning model. The present invention may include computing an anomaly score for each activity of the business process log using a process aware metric based on feature representation. The present invention may include labeling each of the one or more data points with a high anomaly score.