基于注意力机制的业务过程异常检测方法

Anomaly detection of business processes based on attention mechanism

鉴于大多数业务过程异常检测方法能够检测业务过程实例或事件的异常,却难以定位发生异常的具体事件属性,提出一种基于注意力机制的业务过程异常检测方法。从控制流和数据流两个视角挖掘业务过程事件日志中的过程特征,构造数据集;基于注意力机制构建业务过程实例下一事件的预测模型,以预测当前过程实例的下一个执行事件及其属性的概率分布;采用过程实例中实际发生事件各属性的值和预测所得该事件各属性值的概率分布计算该事件各属性的异常评分,异常评分大于阈值的事件属性为异常属性,定位该事件属性为异常来源。仿真实验表明,与现有主流业务过程异常检测方法相比,所提异常检测方法在公开数据集上可以更准确地检测出业务过程实例事件及其属性异常,并可定位引发异常的具体事件属性,从而提高过程感知信息系统的运行平稳性。

Anomaly detection of business processes is one of the necessary functions of Process Aware Information System(PAIS). At present, most methods of detecting business processes’ anomalies can detect the anomalies of business processes’ instances or their events, but it is difficult to locate the specific event attribute causing the anomaly. Focusing on the problem, a method of detecting business processes’ anomalies based on attention mechanism was proposed, which mined process features in the event log of the business process from the perspective of control flow and data flow to construct data set. Based on the attention mechanism, the prediction model of the next event of business process instance was constructed to predict the probability distribution of the next execution event and its attributes of the current process instance. Using the attribute evalues of the actual occurrence and the probability distributions of the predicted attribute evalues of the event in the process instance, the anomaly score of each attribute of the event was calculated. The event attribute whose anomaly score was greater than the setting anomaly scoring threshold was considered as the anomaly attribute, and the event attribute was located as the source of anomaly. The experimental results showed that the proposed method could detect anomalies of the event and its attributes of business processes’ instances more accurately by comparing with the existing mainstream methods of detecting business process anomalies, and the specific event attribute causing the anomaly could be located, which played an important role in improving the running stability of Process Aware Information System(PAIS).