Anomaly and Interestingness Detection in Timed Hierarchical Business Processes

Anomaly detection is assumed to be an efficient means of probing cyber-attacks upon business processes, and frequent pattern recognition (referred as interestingness) is complementary to anomaly detection for providing insights about processes. Current studies on anomalies and interestingness focus mostly on measurement design and discovery methods. However, parameterized evaluation from a time dimension has not been well-explored to satisfy personalized demands of edge users. To fill this gap, this article proposes to detect temporal anomalies and interestingness leveraging time-constrained and granularity-aware signatures. Specifically, a
Timed Hierarchical Business Process Model
(
TH-BPM
) is constructed by exploiting temporal constraints and granularities thoroughly, and composing activities from fine granularities to coarser ones. Temporal anomalies are estimated with prescribed signatures upon
TH-BPM
through parameterizing acceptance of deviant executions. Temporal interestingness, as the complement to temporal anomalies, is specified as the most probable execution time that is partitioned into user-defined granules and ranked by the probability leveraging the parameterized signatures. Consequently, various acceptance of anomaly deviations is allowed, and parameterized needs of interestingness detection can be satisfied. Experimental results upon real-life event logs and a real edge network demonstrate that our approach outperforms the state-of-the-art techniques in relevant performance metrics.