Subgraph Mining for Anomalous Pattern Discovery in Event Logs

Abstract

Abstract. Conformance checking allows organizations to verify whether their IT system complies with the prescribed behavior by comparing process executions recorded by the IT system against a process model (representing the normative behavior). However, most of the existing techniques are only able to identify low-level deviations, which provide a scarce support to investigate what actually happened when a process execution deviates from the specification. In this work, we introduce an approach to extract recurrent deviations and generate anomalous patterns from them, which are able to provide meaningful diagnostics of what happened in the system. To detect anomalous behaviors, we apply frequent subgraph mining techniques together with an ad-hoc conformance checking technique. Anomalous patterns are then derived by applying frequent items algorithms to determine highly-correlated deviations, among which ordering relations are inferred. The approach has been validated by means of a set of experiments.

Mining Local Process Models and Their Correlations

“…Specifically, we extended the LPM algorithm in [32] to account for ordering constraints mined using SUBDUE subtraces. Moreover, we proposed an approach (adapting the approach of [13]) to derive ordering relations between LPMs to infer partial orders between them. We evaluated our approach on four real-world event logs.…”

“…In this section, we present an approach to discover partially ordered sets of Local Process Models (LPMs), which we will refer to as PO-LPMs. We adopt the approach in [13] for the mining of partial order relations between subtraces and adapt it to mine such relations between LPMs. We extract the following ordering relations between pairs of LPMs:…”

“…For instance, the work in [9] constructs hierarchies of patterns where subtraces are ordered with respect to the inclusion relation. Genga et al [13] apply frequent itemset mining techniques to mine partial order relations between subtraces.…”

Mining Attributed Interaction Networks on Industrial Event Logs

“…One task of process mining is conformance checking [19,22] which has been introduced to check the matching of an existing business process model with a segmentation of the log entries. Furthermore, for process mining and anomaly analysis there have been approaches based on subgroup discovery, e. g., [23], and subgraph mining, e. g., [14] based on log data; while these neglect the temporal (sequential) dimension, they only focus on the respective patterns not including a priori knowledge, while not including relational, i. e., network modeling.…”