An Ensemble-Based P2P Framework for the Detection of Deviant Business Process Instances

The problem of discriminating "deviant" traces (i.e. traces diverging from normal/desired outcomes, such as frauds, faults) in the execution log of a business process can be faced by extracting a classification model for the traces, after mapping them onto some suitable feature space. An ensemble-learning approach was recently proposed that trains multiple base learners on different vector-space views of the given log, and a probabilistic meta-model that combines the predictions of the discovered base classifiers. However, the sequential centralised implementation of this learning approach makes it unsuitable for real applications, where large volumes of traces are produced continuously, while both deviant and normal behaviours tend to change over the time. We here propose an online deviance detection framework that leverages a novel incremental learning scheme, which extracts different base models from different chunks of a trace stream, and dynamically combines them in an ensemble model. Notably, the system is based on a p2p architecture that allows it to distribute the entire learning procedure among multiple nodes and to exploit the power of HPC resources (e.g. cloud computing environments). Preliminary tests on a real-life log confirmed the validity of the approach, in terms of both effectiveness and efficiency.