Explainable conformance checking: Understanding patterns of anomalous behavior

Abstract

Anomaly detection in the execution of business processes in the organizations has a high level of complexity due to the consideration of various process perspectives and their constraints, business rules, privacy policies, and regulations. Furthermore, only detection of anomalies is not sufficient. There is a crucial need for the results of anomaly detection to be explainable and interpretable, enabling users to adapt the decision making process and handle the detected anomalies. The work presented in this paper aims to provide business process owners with human-interpretable explanations for patterns of deviations found between process models and event data recorded during the execution of business processes, while traditional conformance checking methods only report low-level deviations found. First, by introducing an automated approach for multi-perspective conformance checking and anomaly detection in business process executions, we extract expected and unexpected behavior from event logs and identify patterns in deviations. Finally, by focusing on identifying the context involved in patterns of unexpected behavior, our approach facilitates the interpretations of detected patterns. The approach has been implemented in the open source ProM framework and its applicability is evaluated through a real-life dataset from a financial organization. The experiment not only shows that we can automatically detect more complex anomalies such as spurious data processing and misusage of authorizations, but also that we can explain these deviations in context.

Cite this work

No public copy is stored for this record, so only the metadata is cited.

Stored only when both papers are in the corpus — 8 citations exist upstream.