Detecting anomalous process behavior

1. A method for learning a behavior model of a business process workflow, the behavior model being associated with at least one attribute value, and comprising a set of paths, wherein a path comprises a set of nodes and a set of transitions and a union of the paths form a directed graph corresponding to the business process workflow, and wherein the learned behavior model is a Weighted Finite State Transducer, the method comprising:

employing at least one computer device for:

for each path in the behavior model;

determining a process definition for the business process workflow, the process definition generating process instances that each include a plurality of attribute values;

identifying a plurality of process instances of the business process workflow among all process instances of the business process workflow, wherein each process instance belonging to the plurality of process instances is associated with at least one similar attribute value and any process instance belonging to the plurality of process instances corresponds to the path;

clustering the plurality of process instances into a single node, the node representing each process instance associated with the at least one similar attribute value;

computing a likelihood of the path as a function of the frequency of occurrence of the plurality of process instances so identified; and

assigning a weight to each transition of the set of transitions as a function of the likelihood of the paths comprising the transition, the weight indicating a likelihood of each transition occurring based, at least in part, on the frequency of occurrence of the clustered plurality of process instances corresponding to the determined process definition.

2. The method of claim 1 , wherein the weight assigned to a transition is set to an arbitrary value if the frequency of occurrence of the plurality of process instances so identified is zero, and wherein the arbitrary value is small with respect to the weight assigned to a transition computed with a positive frequency of occurrence of the plurality of process instances.

3. The method of claim 1 , further comprising:

storing the learned behavior model.

4. The method of claim 1 , further comprising:

identifying an additional plurality of process instances of the process definition, the additional plurality of process instances associated with the at least one similar attribute value;

determining the node to which the additional plurality of process instances corresponds; and

clustering the additional plurality of process instances into the determined node.

5. The method of claim 4 , wherein the additional plurality of process instances are running process instances.