Temporal Anomaly Detection in Business Processes

  • Andreas Rogge-Solti
  • Gjergji Kasneci
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8659)


The analysis of business processes is often challenging not only because of intricate dependencies between process activities but also because of various sources of faults within the activities. The automated detection of potential business process anomalies could immensely help business analysts and other process participants detect and understand the causes of process errors.

This work focuses on temporal anomalies, i.e., anomalies concerning the runtime of activities within a process. To detect such anomalies, we propose a Bayesian model that can be automatically inferred form the Petri net representation of a business process. Probabilistic inference on the above model allows the detection of non-obvious and interdependent temporal anomalies.


outlier detection documentation statistical method Bayesian networks 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Wil, M.P.: van der Aalst. Verification of Workflow Nets. In: Azéma, P., Balbo, G. (eds.) ICATPN 1997. LNCS, vol. 1248, pp. 407–426. Springer, Heidelberg (1997)CrossRefGoogle Scholar
  2. 2.
    van der Aalst, W.M.P.: Process Mining: Discovery, Conformance and Enhancement of Business Processes. Springer (2011)Google Scholar
  3. 3.
    van der Aalst, W., et al.: Process Mining Manifesto. In: Daniel, F., Barkaoui, K., Dustdar, S. (eds.) BPM Workshops 2011, Part I. LNBIP, vol. 99, pp. 169–194. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  4. 4.
    Adriansyah, A., van Dongen, B.F., van der Aalst, W.M.P.: Conformance Checking Using Cost-Based Fitness Analysis. In: EDOC 2011, pp. 55–64. IEEE (2011)Google Scholar
  5. 5.
    Chandola, V., Banerjee, A., Kumar, V.: Anomaly Detection: A Survey. ACM Comput. Surv. 41(3), 1–58 (2009)CrossRefGoogle Scholar
  6. 6.
    Cook, J.E., He, C., Ma, C.: Measuring Behavioral Correspondence to a Timed Concurrent Model. In: ICSM 2001, pp. 332–341. IEEE (2001)Google Scholar
  7. 7.
    de Lima Bezerra, F., Wainer, J.: Algorithms for Anomaly Detection of Traces in Logs of Process Aware Information Systems. Inf. Syst. 38(1), 33–44 (2013)CrossRefGoogle Scholar
  8. 8.
    Governatori, G., Milosevic, Z., Sadiq, S.: Compliance Checking between Business Processes and Business Contracts. In: EDOC 2006, pp. 221–232 (2006)Google Scholar
  9. 9.
    Grubbs, F.E.: Procedures for Detecting Outlying Observations in Samples. Technometrics 11(1), 1–21 (1969)CrossRefGoogle Scholar
  10. 10.
    Han, J., Kamber, M.: Data Mining: Concepts and Techniques, 2nd edn. Morgan Kaufmann (2006)Google Scholar
  11. 11.
    Hao, M.C., Keim, D.A., Dayal, U., Schneidewind, J.: Business Process Impact Visualization and Anomaly Detection. Information Visualization 5(1), 15–27 (2006)CrossRefGoogle Scholar
  12. 12.
    Lohmann, N., Verbeek, E., Dijkman, R.: Petri Net Transformations for Business Processes – A Survey. In: Jensen, K., van der Aalst, W.M.P. (eds.) Transactions on Petri Nets and Other Models of Concurrency II. LNCS, vol. 5460, pp. 46–63. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  13. 13.
    Parzen, E.: On Estimation of a Probability Density Function and Mode. The Annals of Mathematical Statistics 33(3), 1065–1076 (1962)CrossRefzbMATHMathSciNetGoogle Scholar
  14. 14.
    Pearl, J.: Causality: Models, Reasoning, and Inference. Cambridge University Press, New York (2000)Google Scholar
  15. 15.
    Petri, C.A.: Kommunikation mit Automaten. PhD thesis, Technische Hochschule Darmstadt (1962)Google Scholar
  16. 16.
    Rogge-Solti, A., van der Aalst, W.M.P., Weske, M.: Discovering Stochastic Petri Nets with Arbitrary Delay Distributions From Event Logs. In: Lohmann, N., Song, M., Wohed, P. (eds.) BPM 2013 International Workshops. LNBIP, vol. 171, pp. 15–27. Springer, Heidelberg (2014)Google Scholar
  17. 17.
    Rogge-Solti, A., Mans, R.S., van der Aalst, W.M.P., Weske, M.: Improving Documentation by Repairing Event Logs. In: Grabis, J., Kirikova, M. (eds.) PoEM 2013. LNBIP, vol. 165, pp. 129–144. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  18. 18.
    Rozinat, A., van der Aalst, W.M.P.: Conformance Checking of Processes Based on Monitoring Real Behavior. Inf. Syst. 33(1), 64–95 (2008)CrossRefGoogle Scholar
  19. 19.
    Silverman, B.W.: Density Estimation for Statistics and Data Analysis. Chapman and Hall, London (1996)Google Scholar
  20. 20.
    Simpson, E.H.: The Interpretation of Interaction in Contingency Tables. Journal of the Royal Statistical Society, Series B, 238–241 (1951)Google Scholar
  21. 21.
    Weske, M.: Business Process Management: Concepts, Languages, Architectures, 2nd edn. Springer (2012)Google Scholar
  22. 22.
    Wombacher, A., Iacob, M.-E.: Estimating the Processing Time of Process Instances in Semi-structured Processes–A Case Study. In: 2012 IEEE Ninth International Conference on Services Computing (SCC), pp. 368–375. IEEE (2012)Google Scholar
  23. 23.
    Yeung, D.-Y., Chow, C.: Parzen-Window Network Intrusion Detectors. In: ICPR 2002, vol. 4, pp. 385–388. IEEE (2002)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  • Andreas Rogge-Solti
    • 1
  • Gjergji Kasneci
    • 2
  1. 1.Vienna University of Economics and BusinessAustria
  2. 2.Hasso Plattner InstituteUniversity of PotsdamGermany

Personalised recommendations