The Analysis of Online Event Streams: Predicting the Next Activity for Anomaly Detection

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    Abstract

    Anomaly detection in process mining focuses on identifying anomalous cases or events in process executions. The resulting diagnostics are used to provide measures to prevent fraudulent behavior, as well as to derive recommendations for improving process compliance and security. Most existing techniques focus on detecting anomalous cases in an offline setting. However, to identify potential anomalies in a timely manner and take immediate countermeasures, it is necessary to detect event-level anomalies online, in real-time. In this paper, we propose to tackle the online event anomaly detection problem using next-activity prediction methods. More specifically, we investigate the use of both ML models (such as RF and XGBoost) and deep models (such as LSTM) to predict the probabilities of next-activities and consider the events predicted unlikely as anomalies. We compare these predictive anomaly detection methods to four classical unsupervised anomaly detection approaches (such as Isolation forest and LOF) in the online setting. Our evaluation shows that the proposed method using ML models tends to outperform the one using a deep model, while both methods outperform the classical unsupervised approaches in detecting anomalous events.
    Original languageEnglish
    Title of host publicationResearch Challenges in Information Science
    Subtitle of host publication16th International Conference, RCIS 2022, Barcelona, Spain, May 17–20, 2022, Proceedings
    EditorsRenata Guizzardi, Jolita Ralyté, Xavier Franch
    PublisherSpringer
    Pages248-264
    Number of pages17
    ISBN (Electronic)978-3-031-05760-1
    ISBN (Print)978-3-031-05760-1, 978-3-031-05759-5
    DOIs
    Publication statusPublished - 2022

    Publication series

    NameLecture Notes in Business Information Processing
    Volume446 LNBIP
    ISSN (Print)1865-1348
    ISSN (Electronic)1865-1356

    Keywords

    • Process mining
    • Event stream
    • Anomaly detection

    Fingerprint

    Dive into the research topics of 'The Analysis of Online Event Streams: Predicting the Next Activity for Anomaly Detection'. Together they form a unique fingerprint.

    Cite this