Discovering anomalous frequent patterns from partially ordered event logs

Laura Genga, Mahdi Alizadeh, Domenico Potena, Claudia Diamantini, Nicola Zannone

Research output: Contribution to journalArticleAcademicpeer-review

4 Citations (Scopus)
22 Downloads (Pure)

Abstract

Conformance checking allows organizations to compare process executions recorded by the IT system against a process model representing the normative behavior. Most of the existing techniques, however, are only able to pinpoint where individual process executions deviate from the normative behavior, without considering neither possible correlations among occurred deviations nor their frequency. Moreover, the actual control-flow of the process is not taken into account in the analysis. Neglecting possible parallelisms among process activities can lead to inaccurate diagnostics; it also poses some challenges in interpreting the results, since deviations occurring in parallel behaviors are often instantiated in different sequential behaviors in different traces. In this work, we present an approach to extract anomalous frequent patterns from historical logging data. The extracted patterns can exhibit parallel behaviors and correlate recurrent deviations that have occurred in possibly different portions of the process, thus providing analysts with a valuable aid for investigating nonconforming behaviors. Our approach has been implemented as a plug-in of the ESub tool and evaluated using both synthetic and real-life logs.

Original languageEnglish
Pages (from-to)257–300
Number of pages44
JournalJournal of Intelligent Information Systems
Volume51
Issue number2
DOIs
Publication statusPublished - 1 Oct 2018

Fingerprint

Flow control

Keywords

  • Association mining
  • Conformance checking
  • Partially ordered logs
  • Subgraph mining

Cite this

Genga, Laura ; Alizadeh, Mahdi ; Potena, Domenico ; Diamantini, Claudia ; Zannone, Nicola. / Discovering anomalous frequent patterns from partially ordered event logs. In: Journal of Intelligent Information Systems. 2018 ; Vol. 51, No. 2. pp. 257–300.
@article{efcd8cd228624fc9b4f01bc9f9354d7f,
title = "Discovering anomalous frequent patterns from partially ordered event logs",
abstract = "Conformance checking allows organizations to compare process executions recorded by the IT system against a process model representing the normative behavior. Most of the existing techniques, however, are only able to pinpoint where individual process executions deviate from the normative behavior, without considering neither possible correlations among occurred deviations nor their frequency. Moreover, the actual control-flow of the process is not taken into account in the analysis. Neglecting possible parallelisms among process activities can lead to inaccurate diagnostics; it also poses some challenges in interpreting the results, since deviations occurring in parallel behaviors are often instantiated in different sequential behaviors in different traces. In this work, we present an approach to extract anomalous frequent patterns from historical logging data. The extracted patterns can exhibit parallel behaviors and correlate recurrent deviations that have occurred in possibly different portions of the process, thus providing analysts with a valuable aid for investigating nonconforming behaviors. Our approach has been implemented as a plug-in of the ESub tool and evaluated using both synthetic and real-life logs.",
keywords = "Association mining, Conformance checking, Partially ordered logs, Subgraph mining",
author = "Laura Genga and Mahdi Alizadeh and Domenico Potena and Claudia Diamantini and Nicola Zannone",
year = "2018",
month = "10",
day = "1",
doi = "10.1007/s10844-018-0501-z",
language = "English",
volume = "51",
pages = "257–300",
journal = "Journal of Intelligent Information Systems",
issn = "0925-9902",
publisher = "Springer",
number = "2",

}

Discovering anomalous frequent patterns from partially ordered event logs. / Genga, Laura; Alizadeh, Mahdi; Potena, Domenico; Diamantini, Claudia; Zannone, Nicola.

In: Journal of Intelligent Information Systems, Vol. 51, No. 2, 01.10.2018, p. 257–300.

Research output: Contribution to journalArticleAcademicpeer-review

TY - JOUR

T1 - Discovering anomalous frequent patterns from partially ordered event logs

AU - Genga, Laura

AU - Alizadeh, Mahdi

AU - Potena, Domenico

AU - Diamantini, Claudia

AU - Zannone, Nicola

PY - 2018/10/1

Y1 - 2018/10/1

N2 - Conformance checking allows organizations to compare process executions recorded by the IT system against a process model representing the normative behavior. Most of the existing techniques, however, are only able to pinpoint where individual process executions deviate from the normative behavior, without considering neither possible correlations among occurred deviations nor their frequency. Moreover, the actual control-flow of the process is not taken into account in the analysis. Neglecting possible parallelisms among process activities can lead to inaccurate diagnostics; it also poses some challenges in interpreting the results, since deviations occurring in parallel behaviors are often instantiated in different sequential behaviors in different traces. In this work, we present an approach to extract anomalous frequent patterns from historical logging data. The extracted patterns can exhibit parallel behaviors and correlate recurrent deviations that have occurred in possibly different portions of the process, thus providing analysts with a valuable aid for investigating nonconforming behaviors. Our approach has been implemented as a plug-in of the ESub tool and evaluated using both synthetic and real-life logs.

AB - Conformance checking allows organizations to compare process executions recorded by the IT system against a process model representing the normative behavior. Most of the existing techniques, however, are only able to pinpoint where individual process executions deviate from the normative behavior, without considering neither possible correlations among occurred deviations nor their frequency. Moreover, the actual control-flow of the process is not taken into account in the analysis. Neglecting possible parallelisms among process activities can lead to inaccurate diagnostics; it also poses some challenges in interpreting the results, since deviations occurring in parallel behaviors are often instantiated in different sequential behaviors in different traces. In this work, we present an approach to extract anomalous frequent patterns from historical logging data. The extracted patterns can exhibit parallel behaviors and correlate recurrent deviations that have occurred in possibly different portions of the process, thus providing analysts with a valuable aid for investigating nonconforming behaviors. Our approach has been implemented as a plug-in of the ESub tool and evaluated using both synthetic and real-life logs.

KW - Association mining

KW - Conformance checking

KW - Partially ordered logs

KW - Subgraph mining

UR - http://www.scopus.com/inward/record.url?scp=85045073644&partnerID=8YFLogxK

U2 - 10.1007/s10844-018-0501-z

DO - 10.1007/s10844-018-0501-z

M3 - Article

AN - SCOPUS:85045073644

VL - 51

SP - 257

EP - 300

JO - Journal of Intelligent Information Systems

JF - Journal of Intelligent Information Systems

SN - 0925-9902

IS - 2

ER -