Detecting anomalous process behavior
A method for learning a process behavior model based on a process past instances and on one or more process attributes, and a method for detecting an anomalous process using the corresponding process behavior model.
1. A method for monitoring executed process instances of a business process workflow, each process instance indicating an occurrence of the business process workflow and a sequence of events of a first process instance indicating a behavior of the first process instance, the method comprising:
identifying, by a server computer, a learned behavior model of the business process workflow, wherein the learned behavior model is a Weighted Finite State Transducer;
determining, by the server computer, based on the learned behavior model, the first process instance, wherein the first process instance is running;
determining, by the server computer, for the first process instance, a sequence of events for a second process instance;
calculating, by the server computer, a likelihood as a sum of weights along the sequence of events, the likelihood including only the weights associated with already executed activities;
determining, by the server computer, whether the likelihood is above a threshold value;
responsive to determining the likelihood is not above the threshold value, reporting, by the server computer, the sequence of events as anomalous behavior.
2. The method of claim 1 , further comprising:
responsive to determining the likelihood is above the threshold value, proceeding, by the server computer, to a first step on a third process instance.
3. The method of claim 1 , wherein the learned behavior is associated with at least one attribute value, and comprises a set of paths, wherein a path comprises a set of nodes and a set of transitions and a union of the paths form a directed graph corresponding to the business process workflow.
4. The method of claim 1 , wherein the likelihood is obtained by multiplying the weights together.
5. The method of claim 1 , further comprising:
determining, by the server computer, a plurality of attributes of the first process instance;
determining, by the server computer, a cluster to which the first process instance belongs;
determining, by the server computer, whether the first process instance enters a new state;
responsive to determining the first process instance enters the new state, calculating, by the server computer, a probability that each of a plurality of process instances in the cluster proceed through each of a same set of states that the first process instance proceeds through;
determining, by the server computer, whether the probability is above a threshold value; and
responsive to determining the probability is not above the threshold value, alerting, by the server computer, a user that the first process instance is anomalous.