面向业务过程异常检测的深度学习模型BPAD-LS

Deep Learning Model BPAD-LS for Business Process Anomaly Detection

近年来,越来越多的企业组织使用业务过程管理系统管理和控制他们的业务过程.然而,在业务过程的执行过程中,容易出现各种各样的异常,如控制流异常、数据流异常、时间异常和资源异常等.控制流是业务过程的主干,检测控制流异常对业务过程的正常执行具有至关重要的作用.为了检测业务过程在执行过程中出现的控制流异常,本文提出了一种基于自注意力机制与长短期记忆网络(LSTM)相结合的神经网络模型预测业务过程的下一个活动,将预测的活动与实际发生的活动进行比较以检测业务过程是否发生控制流异常,其中自注意力用于建模活动序列中活动之间的依赖关系,而LSTM仅用于编码活动的位置信息.此外,为了解决假阳性的问题,本文提出了一种通过计算异常分数并基于阈值的方法确定实际发生的活动是否异常.为了验证方法检测异常的性能,实验中选用了5种典型的方法进行比较.实验结果表明,所提出的方法能有效检测控制流异常.

In recent years,more and morebusinessorganizations use business process management systems to manage and control their business processes.However,in the execution of business processes,various anomalies are prone to occur,such as control flow anomalies,data flow anomalies,time anomalies,and resource anomalies.The control flow is the backbone of the business process,and the detection of control flow anomalies is of vital importance to the normal execution of the business process.In order to detect the control flow anomalies during the execution of the business process,this paper proposes a neural network model based on the combination of self-attention mechanism and long short-term memory networks(LSTMs)to predict the next activity of the business processes,and the predicted activity is compared with the actual occurrence to detect whether there is a control flow anomaly in the business process.Self-attention is used to model the dependencies between activities in the activity sequence,and the LSTM is only used to encode the position information of the activities.In addition,in order to solve the problem of false positives,this paper proposes a method to determine whether the actual activity is an abnormal by calculating anomaly scores and based on a threshold.In order to verify the performance of the method to detect abnormalities,five typical methods are selected for comparison in the experiment.Experimental results show that the proposed method can effectively detect control flow anomalies.