Generating Process Anomalies with Markov Chains: A Pattern-Driven Approach

Generating anomalies for process executions helps to train anomaly detection methods and evaluate their performance. Anomalous behavior tends to be diverse and very infrequent. Generating process anomalies can help compare detection models and select the suited ones. However, little research has been focused on generating anomalous behavior in a systematic and also stochastic way. In this paper, we built on the idea of training a Markov chain using an event log to capture regular process behavior. We then use a set of predefined anomaly patterns to adapt the Markov chain to generate anomalous traces. To evaluate the quality of our generated anomalies, we use them in the downstream task training a detection model. For each pattern, we vary the quantity of injected anomalous traces and their deviation rate. Unsurprisingly, the results show that the models trained with the generated anomalies have a significant improvement in detecting these anomalies. The AUC score increased from 0.63 to reaching a maximum of 0.98 or higher for all three patterns. This confirms our expectation that generating anomalies can help train and evaluate detection models.