Pith. sign in

REVIEW 3 major objections 5 minor 59 references

Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Alignment-based conformance checking extracts per-activity mismatch statistics that, after dimensionality reduction, detect control-flow anomalies far more accurately than fitness-threshold baselines.

desk verdict The per-activity alignment-cost feature is a real contribution, but the headline F1 gap over fitness-threshold baselines mostly reflects an unfair threshold comparison, not feature superiority. read the letter →

arxiv 2502.10211 v1 pith:I4ZIAXG6 submitted 2025-02-14 cs.LG

Francesco Vitale , Marco Pegoraro , Wil M. P. van der Aalst , Nicola Mazzocca This is my paper · ORCID
classification cs.LG
keywords processminingconformancecheckingalignment-basedcontrol-flowanomalydetectionfeatureextractiondimensionalityreductionreconstructionerroreventlogs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the reason fitness-threshold conformance checking fails is that normal and anomalous event logs often have overlapping fitness distributions, so a single threshold cannot separate them. Its proposal is to use alignment-based conformance checking not as a scorer but as a feature extractor: from each event log, compute alignment-based fitness and per-activity costs, which count how often each activity caused a mismatch against a reference Petri net. These tabular features are fed to dimensionality reduction techniques (PCA, SPCA, KPCA, autoencoder), and an event log is anomalous if its reconstruction error exceeds a threshold derived from normal validation logs. On four datasets the resulting techniques reach F1 scores of 97.3%, 87.2%, 85.2%, and 88.5%, against best baseline F1 scores of 36.1%, 56.6%, 78.8%, and 79.1%, while SHAP values still trace each anomaly back to specific model transitions. A sympathetic reader would take the core claim to be that explainable conformance checking can be competitive with black-box anomaly detection once its diagnostics are used as features rather than collapsed into a fitness number.

What carries the argument

The load-bearing object is the alignment-based conformance checking diagnosis: a matrix with one row per event log and one column per activity, holding the per-activity cost under the optimal alignment, together with the alignment-based fitness column. The per-activity cost for a trace is the sum of alignment move costs involving that activity, so it localizes deviations to model transitions such as t21 or t75. This matrix is then the input to a dimensionality reduction technique whose encoder/decoder pair defines reconstruction error; the classification rule is simply whether the reconstruction error of a test event log exceeds a threshold computed from validation event logs, and SHAP values on the reconstruction error connect the decision back to specific activities and model elements.

What would settle it

Re-run the ABCC framework techniques on PDC 2020 and COVAS with the anomaly threshold set to a different rule, such as the 95th percentile of validation reconstruction errors, or a threshold fixed on a separate calibration split that was not used for hyperparameter selection. If F1 drops toward the baseline values, the mean-threshold rule is doing the detection work rather than the alignment-based features.

Watch

Extended reading notes

Core claim

The central discovery is that the information produced by alignment-based conformance checking is enough to separate normal from anomalous event logs, provided it is represented as per-activity cost features and processed by a reconstruction-based detector. The paper defines alignment-based conformance checking diagnoses as tabular data whose columns are the alignment-based fitness plus, for each activity appearing in the event logs or the model, the total cost contributed by that activity in optimal alignments. When these features are projected and reconstructed by PCA, SPCA, KPCA, or an autoencoder, normal event logs are reconstructed with small error while anomalous event logs produce large reconstruction error. The reported F1 values on PDC 2020, PDC 2021, ERTMS, and COVAS are 97.3%, 87.2%, 85.2%, and 88.5%, versus 36.1%, 56.6%, 78.8%, and 79.1% for the best fitness-threshold baseline, with the single exception of recall on COVAS for one baseline. The paper also shows that the overlap between normal and anomalous fitness distributions explains why threshold-based baselines fail, and that no single feature-extraction approach dominates across all datasets.

Load-bearing premise

The detection pipeline assumes that the mean reconstruction error over the validation set is a reliable boundary between normal and anomalous event logs, and the same validation set is used to pick the dimensionality-reduction hyperparameters; if normal validation errors are not concentrated below that mean, the reported accuracy depends on this threshold rule rather than on the alignment features.

Editorial extensions

If this is right

  • Conformance checking can be repurposed from a pass/fail scorer into a feature source, so low-quality reference models and noisy logs no longer make fitness thresholding a bottleneck.
  • Anomaly explanations are available at the level of individual model transitions: SHAP values on per-activity costs tell which activities were responsible for the anomalous reconstruction error.
  • The framework supports fair comparison of conformance checking-based and conformance checking-independent feature extraction, and the variance analysis shows the dataset and feature-extraction interaction matters, so practitioners should not expect one best combination.
  • On the PDC 2020 benchmark the gap is large, 97.3% F1 versus 36.1% for the strongest baseline, suggesting the feature-based route captures signal that fitness discards.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct extension the paper does not run: replace the mean validation reconstruction error with a threshold quantile chosen on a separate calibration split; if the reported F1 numbers persist, the alignment features themselves are doing the work, rather than the threshold rule.
  • Per-activity costs are natural input for root-cause localization in live monitoring: the same features that drive classification could flag which transitions to inspect when an event log is declared anomalous.
  • Because no feature extraction dominates all datasets, a portfolio or ensemble across ABCC, TBCC, NG, and DF with per-dataset selection would likely smooth the 85-97% F1 range, at the cost of some explainability.
  • The weakly-supervised setting uses only normal training data; if labeled anomalies are available, the same tabular diagnoses could be fed to supervised classifiers, which may exceed the reconstruction-based results reported here.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a framework for control-flow anomaly detection in event logs that combines process mining-based feature extraction with dimensionality reduction. The central novelty is an alignment-based conformance checking (ABCC) feature extraction that records per-activity alignment costs from alignments between traces and a reference Petri net. The framework is evaluated on four datasets (PDC 2020, PDC 2021, ERTMS, COVAS) with four feature extractors and four dimensionality reduction techniques. The main empirical claim is that the four ABCC-based framework techniques outperform two fitness-thresholding baselines (Table 5) while providing SHAP-based explanations linked to model elements. A secondary claim is that no single feature extractor works best across all datasets (Table 7).

Significance. The framework is well-motivated and the paper is clearly written. If the baseline comparison were made like-for-like, the framework would be a valuable contribution to explainable process mining anomaly detection. Strengths include the public release of code and batch scripts for replication, the use of four datasets including a real-world healthcare case study, the SHAP-based explanation tying per-activity costs to Petri net transitions, and a systematic comparison of framework techniques under a common threshold rule. The analysis of variance (Table 7) appropriately supports the 'no one-size-fits-all' conclusion. However, the headline claim of outperforming baseline conformance checking is currently undermined by a calibration confound.

major comments (3)
  1. [Section 5.2.1 and Table 5] The baseline threshold is set to the minimum fitness over the validation set, while the framework threshold is the mean reconstruction error (Section 4.4, Definition 4.3). These are fundamentally different statistics: the minimum is an extreme order statistic that lies in the far left tail of the validation fitness distribution, whereas the mean is a central tendency. Given the substantial overlap of normal and anomalous fitness distributions shown in Figure 8, the baseline threshold will classify only logs with fitness below the least-fitting normal validation log as anomalous, guaranteeing low recall regardless of the quality of the underlying conformance checking features. The large F1 gaps in Table 5 (e.g., 97.3% vs 36.1% on PDC 2020) therefore conflate the choice of threshold statistic and the absence of baseline hyperparameter tuning with the contribution of the proposed ABCC feature extraction. To support the claim that ABCC-based framework techniques outperform baseline conformance checking, the authors should hold the threshold calibration mechanism fixed across methods (e.g., use the same quantile of the validation score distribution for both, or report a sensitivity analysis over threshold choices) and give the baselines a comparable tuning budget.
  2. [Sections 4.3 and 4.4] The validation set is used twice: first for exhaustive search of dimensionality reduction hyperparameters that minimize reconstruction error (Section 4.3, Table 4), and then as the basis for the reconstruction error threshold Eth (Section 4.4). This double use means the threshold is calibrated on the same data used to select the model, so the reported detection performance is not an unbiased estimate for a new test set. Moreover, Definition 4.3 sets Eth from a central tendency (mean error) of validation data, but there is no evidence that normal validation reconstruction errors are concentrated below this mean; if they are not, a large fraction of normal test logs will be misclassified. The authors should either use a separate calibration split or report results across a range of threshold percentiles to demonstrate robustness.
  3. [Section 4.4, Definition 4.3] The anomaly score is defined as Et = ||t - t_hat|| (an L2 norm), while the threshold example is Eth = sum_i ||v_i - v_hat_i||^2 / nV (a mean squared error). These quantities are on different scales, so the comparison Et < Eth is not dimensionally consistent. The authors should clarify whether the implementation uses the L2 norm for both the threshold and the score, or squared errors for both; this affects the reproducibility of the reported results.
minor comments (5)
  1. [Section 5.3.1 and Table 6] The comparison in Table 5 includes only ABCC-based framework techniques; the corresponding comparison for TBCC, NG, and DF is not shown in the same table. Since Table 6 shows, for example, (TBCC, AE) also achieves 95.0% F1 on PDC 2020, the claim that ABCC feature extraction specifically drives the improvement over baselines is not established; the authors should state that the improvement is a property of the framework and compare ABCC against the other extractors under identical conditions with appropriate statistical tests.
  2. [Figure 8] The histograms have different bin widths and are not normalized, making visual comparison of overlap difficult; quantitative overlap measures (e.g., Bhattacharyya distance or AUC of the fitness distributions) would strengthen the explanation.
  3. [Section 5.3.2 and Table 7] The Friedman test p-values are reported but the effect size measure I is not defined; the authors should define how the percentage of explained variance is computed.
  4. [Section 3.2, Definition 3.5] The phrase 'worst-case alignment' is introduced before the cost function delta is described; define the cost function explicitly before using it.
  5. [Throughout] There are several typographical issues, including 'absoulte' in the Figure 7 caption, 'di fferent' in multiple places, and 'outperformed by by' in Section 5.3.2; these should be corrected.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the central claim is an empirical comparison, and the few self-citations supply data artifacts rather than load-bearing premises.

full rationale

The paper's central claim is that framework techniques using alignment-based conformance checking diagnoses outperform baseline fitness-thresholding techniques on four datasets. This is an experimental result, not a derivation. The feature extraction (Definitions 3.5-3.7) computes alignment-based fitness and per-activity costs from alignments; the anomaly decision (Definition 4.3) compares reconstruction error to a validation-derived threshold. Neither definition makes the test prediction equal to a fitted input by construction. The baselines use a minimum-validation-fitness threshold while the framework uses a mean-reconstruction-error threshold, so the comparison is not perfectly like-for-like; however, this is a validity or calibration concern, not circularity, because the framework's classification rule is not logically forced by its inputs. The paper cites prior work by overlapping authors for the ERTMS simulation setup [16] and the COVAS reference Petri net [10], but these are external data and model artifacts, not unverified premises that carry the argument. The paper also explicitly acknowledges that no feature-extraction approach dominates on all datasets, further indicating that the results are empirical rather than constructed. No load-bearing equation reduces to its own input, and no fitted parameter is renamed as a prediction. The appropriate finding is 'no significant circularity.'

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claim depends on standard process mining and ML background, plus several dataset-specific settings chosen by the authors. There are no invented entities. The main hand-chosen ingredients are the per-activity cost extraction, the reconstruction-error threshold, the DR hyperparameter grid, and the synthetic injection and augmentation settings.

free parameters (7)
  • Dimensionality reduction hyperparameters = fR in {2,4,8,16}; SPCA regularization in {0.01,0.1,0.25,0.5,0.75,1.0} and sparsity in {0.1,0.5,1,2,3}; KPCA kernels…
    Selected by exhaustive search on the validation set to minimize reconstruction error (Table 4); these choices affect every framework technique's reported performance.
  • Reconstruction error threshold Eth = mean validation reconstruction error, sum over validation rows of ||vi - vi_hat||^2 divided by nV
    Computed from validation data after DR fitting and used to classify test event logs (Section 4.4, Definition 4.3).
  • ERTMS anomaly injection probabilities = 5% per anomaly type in normal traces, 25% per anomaly type in anomalous traces
    Hand-set simulation parameters that define the difficulty of the ERTMS dataset (Section 5.1).
  • COVAS augmentation resampling size = 1000 normal and 1000 anomalous traces
    Random resampling of 106, 59, and 22 real traces to match the other datasets (Section 5.1, Table 3).
  • Event log grouping size = 5 traces per event log
    All feature vectors and labels are computed on groups of five traces (Section 5.1).
  • Baseline fitness threshold = minimum fitness over the validation event logs
    Chosen for the ABCCB and TBCCB baselines in Section 5.2.1; this very permissive threshold influences the size of the claimed performance gap.
  • Unitary alignment cost function delta = delta((a,b)) = 1 for every move
    Hand-chosen standard cost; per-activity costs are sums of delta over best alignment moves (Definitions 3.5 and 3.6).
assumptions (6)
  • domain assumption Alignment-based conformance checking returns a best alignment and the per-activity costs derived from it are meaningful control-flow diagnostics.
    The proposed feature extraction is built directly on alignments and per-activity costs (Section 3.2).
  • domain assumption Weakly supervised training with only normal event logs is the relevant operational scenario.
    Justifies training and validation sets containing only normal event logs (Section 4.1).
  • domain assumption Reconstruction error under dimensionality reduction separates normal from anomalous event logs.
    The anomaly detector classifies by comparing reconstruction error to Eth (Definition 4.3).
  • domain assumption A reference Petri net of adequate quality is available or can be discovered for the process.
    Conformance checking feature extraction requires a reference model (Section 4.2).
  • ad hoc to paper The unitary cost function delta for alignment moves is appropriate for defining fitness and per-activity cost.
    Different cost functions would change the features and the results (Definitions 3.5 and 3.6).
  • standard math Standard properties of PCA, SPCA, KPCA, and autoencoders hold as described.
    Section 4.3 relies on these standard dimensionality reduction formulations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction." pith.science (2026). https://pith.science/paper/I4ZIAXG6

@misc{pith2026250210211,
  author       = {Pith},
  title        = {Pith review of: Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I4ZIAXG6}},
  note         = {Machine review of arXiv:2502.10211}
}
read the original abstract

The business processes of organizations may deviate from normal control flow due to disruptive anomalies, including unknown, skipped, and wrongly-ordered activities. To identify these control-flow anomalies, process mining can check control-flow correctness against a reference process model through conformance checking, an explainable set of algorithms that allows linking any deviations with model elements. However, the effectiveness of conformance checking-based techniques is negatively affected by noisy event data and low-quality process models. To address these shortcomings and support the development of competitive and explainable conformance checking-based techniques for control-flow anomaly detection, we propose a novel process mining-based feature extraction approach with alignment-based conformance checking. This variant aligns the deviating control flow with a reference process model; the resulting alignment can be inspected to extract additional statistics such as the number of times a given activity caused mismatches. We integrate this approach into a flexible and explainable framework for developing techniques for control-flow anomaly detection. The framework combines process mining-based feature extraction and dimensionality reduction to handle high-dimensional feature sets, achieve detection effectiveness, and support explainability. The results show that the framework techniques implementing our approach outperform the baseline conformance checking-based techniques while maintaining the explainable nature of conformance checking. We also provide an explanation of why existing conformance checking-based techniques may be ineffective.

Figures

Figures reproduced from arXiv: 2502.10211 by the authors.

Figure 1
Figure 1. An example event log footprint with six traces, of which five exhibit [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. A high-level view of the proposed framework for combining [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The distribution of fitness values of case-study traces of a normal [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Generation of alignment-based conformance checking diagnoses by replaying the n-tuple of event logs L against a Petri net N. and γ ∗ c,σ,N the set of moves of γ ∗ σ,N such that ∀(a, b) ∈ γ ∗ c,σ,N , c = a ∨ c = b. The per-activity cost for σ is defined as uc,σ = X (a,b…
Figure 5
Figure 5. Figure 5: The connection between alignment-based conformance checking diagnoses of three traces and the reference Petri net of one of the datasets we use in Section 5. wrongly-ordered (t51→t62), skipped (t21→t32, t44→t54, t76→t82), and unknown (t75) control-flow anomalies. As a …
Figure 6
Figure 6. Figure 6: The refined view of the proposed framework for combining [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: SHAP (absoulte) values related to the additive feature-based explanation of the four [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: The normal and anomalous histograms that show the frequency of occurrence of the fitness measures of normal and anomalous event logs per dataset for [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: The mean A, R, P and F1 per dataset of the best-performing dimensionality reduction technique for each process mining-based feature extraction approach [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 51 canonical work pages

  1. [1]

    Process Mining: Data Science in Action

    van der Aalst, W.M.P., 2016. Process Mining: Data Science in Action. 2 ed., Springer, Berlin, Heidelberg. doi:10.1007/978-3-662-49851-4

    doi:10.1007/978-3-662-49851-4 2016

  2. [2]

    Object-Centric Process Mining: Unrav- eling the Fabric of Real Processes

    van der Aalst, W.M.P., 2023. Object-Centric Process Mining: Unrav- eling the Fabric of Real Processes. Mathematics 11. doi: 10.3390/ math11122691

    work page 2023

  3. [3]

    Process Mining Handbook

    van der Aalst, W.M.P., Carmona, J., 2022. Process Mining Handbook. Springer, Cham, Switzerland. doi:10.1007/978-3-031-08848-3

    doi:10.1007/978-3-031-08848-3 2022

  4. [4]

    Principal component analysis

    Abdi, H., Williams, L.J., 2010. Principal component analysis. Wiley interdisciplinary reviews: computational statistics 2, 433–459. doi: 10. 1002/wics.101

    work page 2010

  5. [5]

    Accorsi, R., Stocker, T., 2012. On the Exploitation of Process Mining for Security Audits: The Conformance Checking Case, in: Proceedings of the 27th Annual ACM Symposium on Applied Computing, Association for Computing Machinery, New York, NY , USA. p. 1709–1716. doi:10. 1145/2245276.2232051

    work page arXiv 2012

  6. [6]

    An Experimental Evaluation of Process Concept Drift Detection

    Adams, J.N., Pitsch, C., Brockho ff, T., van der Aalst, W.M.P., 2023. An Experimental Evaluation of Process Concept Drift Detection. Pro- ceedings of the VLDB Endowment 16, 1856–1869. doi: 10.14778/ 3594512.3594517

    work page arXiv 2023

  7. [7]

    Explaining anomalies detected by autoencoders using Shapley Additive Explana- tions

    Antwarg, L., Miller, R.M., Shapira, B., Rokach, L., 2021. Explaining anomalies detected by autoencoders using Shapley Additive Explana- tions. Expert Systems with Applications 186, 115736. doi: 10.1016/ j.eswa.2021.115736

    work page arXiv 2021

  8. [8]

    The biggest busi- ness process management problems to solve before we die

    Beerepoot, I., Di Ciccio, C., Reijers, H.A., Rinderle-Ma, S., Bandara, W., Burattin, A., Calvanese, D., Chen, T., Cohen, I., Depaire, B., Di Federico, G., Dumas, M., van Dun, C., Fehrer, T., Fischer, D.A., Gal, A., Indul- ska, M., Isahagian, V ., Klinkm ¨uller, C., Kratsch, W., Leopold, H., Van Looy, A., Lopez, H., Lukumbuzya, S., Mendling, J., Meyers, L....

    work page arXiv 2023

Show all 59 references
  1. [9]

    Automated optimized parameters for T-distributed stochastic neighbor embedding improve visualization and analysis of large datasets

    Belkina, A.C., Ciccolella, C.O., Anno, R., Halpert, R., Spidlen, J., Snyder-Cappione, J.E., 2019. Automated optimized parameters for T-distributed stochastic neighbor embedding improve visualization and analysis of large datasets. Nature Communications 10. doi: 10.1038/ s41467...

    2019

  2. [10]

    Process Modeling and Conformance Checking in Healthcare: A COVID-19 Case Study, in: Montali, M., Senderovich, A., Weidlich, M

    Benevento, E., Pegoraro, M., Antoniazzi, M., Beyel, H.H., Peeva, V ., Balfanz, P., van der Aalst, W.M.P., Martin, L., Marx, G., 2023. Process Modeling and Conformance Checking in Healthcare: A COVID-19 Case Study, in: Montali, M., Senderovich, A., Weidlich, M. (Eds.), Process ...

    2023 doi

  3. [11]

    Anomaly Detection Using Process Mining, in: Halpin, T., Krogstie, J., Nurcan, S., Proper, E., Schmidt, R., Soffer, P., Ukor, R

    Bezerra, F., Wainer, J., van der Aalst, W.M.P., 2009. Anomaly Detection Using Process Mining, in: Halpin, T., Krogstie, J., Nurcan, S., Proper, E., Schmidt, R., Soffer, P., Ukor, R. (Eds.), Enterprise, Business-Process and Information Systems Modeling, Springer Berlin Heidelbe...

    2009 doi

  4. [12]

    An Alignment Cost-Based Classification of Log Traces Using Machine-Learning, in: Leemans, S., Leopold, H

    Boltenhagen, M., Chetioui, B., Huber, L., 2021. An Alignment Cost-Based Classification of Log Traces Using Machine-Learning, in: Leemans, S., Leopold, H. (Eds.), Process Mining Workshops, Springer International Publishing, Cham. pp. 136–148. doi: 10.1007/ 978-3-030-72693-5_11

    2021

  5. [13]

    Robust PCA via Principal Compo- nent Pursuit: A review for a comparative evaluation in video surveillance

    Bouwmans, T., Zahzah, E.H., 2014. Robust PCA via Principal Compo- nent Pursuit: A review for a comparative evaluation in video surveillance. Computer Vision and Image Understanding 122, 22 – 34. doi: 10.1016/ j.cviu.2013.11.009

    2014

  6. [14]

    Anomaly Detection: A Sur- vey

    Chandola, V ., Banerjee, A., Kumar, V ., 2009. Anomaly Detection: A Sur- vey. ACM Computing Surveys 41. doi:10.1145/1541880.1541882

    2009

  7. [15]

    PMiner: Process Mining using Deep Autoencoder for Anomaly Detection and Re- construction of Business Processes

    Chinnaiah, V ., Veerabhadram, V ., Aavula, R., Aluvala, S., 2024. PMiner: Process Mining using Deep Autoencoder for Anomaly Detection and Re- construction of Business Processes. International Journal of Electrical and Computer Engineering Systems 15, 531–542. doi: 10.32985/ije...

    2024 doi

  8. [16]

    De Benedictis, A., Flammini, F., Mazzocca, N., Somma, A., Vitale, F.,

  9. [17]

    Du, M., Li, F., Zheng, G., Srikumar, V ., 2017. DeepLog: Anomaly De- tection and Diagnosis from System Logs through Deep Learning, in: Pro- ceedings of the 2017 ACM SIGSAC Conference on Computer and Com- munications Security, Association for Computing Machinery, New York, NY ,...

    2017

  10. [18]

    Deep reinforcement learn- ing for data-efficient weakly supervised business process anomaly detec- tion

    Elaziz, E.A., Fathalla, R., Shaheen, M., 2023. Deep reinforcement learn- ing for data-efficient weakly supervised business process anomaly detec- tion. Big Data 10, 1–35. doi: 10.1186/s40537-023-00708-5

    2023 doi

  11. [19]

    GRASPED: A GRU- AE Network Based Multi-Perspective Business Process Anomaly Detec- tion Model

    Guan, W., Cao, J., Gu, Y ., Qian, S., 2023. GRASPED: A GRU- AE Network Based Multi-Perspective Business Process Anomaly Detec- tion Model. IEEE Transactions on Services Computing 16, 3412–3424. doi:10.1109/TSC.2023.3262405

    2023

  12. [20]

    W AKE: A Weakly Supervised Business Process Anomaly Detection Framework via a Pre- Trained Autoencoder

    Guan, W., Cao, J., Zhao, H., Gu, Y ., Qian, S., 2024. W AKE: A Weakly Supervised Business Process Anomaly Detection Framework via a Pre- Trained Autoencoder. IEEE Transactions on Knowledge and Data Engi- neering 36, 2745–2758. doi: 10.1109/TKDE.2023.3322411

    2024

  13. [21]

    Weakly Supervised Anomaly Detection: A Survey

    Jiang, M., Hou, C., Zheng, A., Hu, X., Han, S., Huang, H., He, X., Yu, P.S., Zhao, Y ., 2023. Weakly Supervised Anomaly Detection: A Survey. URL: https://arxiv.org/abs/2302.04549, arXiv:2302.04549

    2023 arXiv

  14. [22]

    Event log anomaly detection method based on auto-encoder and control flow

    Kan, D., Fang, X., 2024. Event log anomaly detection method based on auto-encoder and control flow. Multimedia Systems 30, 1–15. doi: 10. 1007/s00530-023-01199-3

    2024

  15. [23]

    Auto-Encoding Variational Bayes, in: Conference Track Proceedings of 2nd International Conference on Learn- ing Representations

    Kingma, D.P., Welling, M., 2014. Auto-Encoding Variational Bayes, in: Conference Track Proceedings of 2nd International Conference on Learn- ing Representations. doi: 10.48550/arXiv.1312.6114

    2014 doi arXiv

  16. [24]

    Detecting anomalies in business process event logs using statistical leverage

    Ko, J., Comuzzi, M., 2021. Detecting anomalies in business process event logs using statistical leverage. Information Sciences 549, 53–67. doi:10. 1016/j.ins.2020.11.017

    2021

  17. [25]

    A Systematic Review of Anomaly Detec- tion for Business Process Event Logs

    Ko, J., Comuzzi, M., 2023. A Systematic Review of Anomaly Detec- tion for Business Process Event Logs. Business & Information Systems Engineering 65, 441–462. doi: 10.1007/s12599-023-00794-y

    2023 doi

  18. [26]

    Krajsic, P., Franczyk, B., 2021. Variational Autoencoder for Anomaly Detection in Event Data in Online Process Mining, in: Proceedings of the 23rd International Conference on Enterprise Information Systems - V olume 1: ICEIS, pp. 567–574. doi:10.5220/0010375905670574

    2021 doi

  19. [27]

    LSTM-Based Anomaly Detection of Process Instances: Benchmark and Tweaks, in: Mon- tali, M., Senderovich, A., Weidlich, M

    Lahann, J., Pfei ffer, P., Fettke, P., 2023. LSTM-Based Anomaly Detection of Process Instances: Benchmark and Tweaks, in: Mon- tali, M., Senderovich, A., Weidlich, M. (Eds.), Process Mining Work- 15 shops, Springer Nature Switzerland, Cham. pp. 229–241. doi: 10.1007/ 978-3-031...

    2023

  20. [28]

    A Framework for Detecting Devi- ations in Complex Event Logs

    Li, G., van der Aalst, W.M.P., 2017. A Framework for Detecting Devi- ations in Complex Event Logs. Intelligent Data Analysis 21, 759–779. doi:10.3233/IDA-160044

    2017 doi

  21. [30]

    Algorithms for anomaly detec- tion of traces in logs of process aware information systems

    de Lima Bezerra, F., Wainer, J., 2013. Algorithms for anomaly detec- tion of traces in logs of process aware information systems. Information Systems 38, 33–44. doi: 10.1016/j.is.2012.04.004

    2013 doi

  22. [31]

    Luftensteiner, S., Praher, P., 2022. Log File Anomaly Detection Based on Process Mining Graphs, in: Kotsis, G., Tjoa, A.M., Khalil, I., Moser, B., Taudes, A., Mashkoor, A., Sametinger, J., Martinez-Gil, J., Sobieczky, F., Fischer, L., Ramler, R., Khan, M., Czech, G. (Eds.), Da...

    2022 doi

  23. [32]

    A unified approach to interpreting model predictions, in: Proceedings of the 31st International Confer- ence on Neural Information Processing Systems, p

    Lundberg, S.M., Lee, S.I., 2017. A unified approach to interpreting model predictions, in: Proceedings of the 31st International Confer- ence on Neural Information Processing Systems, p. 4768–4777. URL: https://dl.acm.org/doi/10.5555/3295222.3295230

    2017

  24. [33]

    Opportunities and Challenges for Process Mining in Orga- nizations: Results of a Delphi Study

    Martin, N., Fischer, D.A., Kerpedzhiev, G.D., Goel, K., Leemans, S.J.J., Roglinger, M., van der Aalst, W.M.P., Dumas, M., La Rosa, M., Wynn, M.T., 2021. Opportunities and Challenges for Process Mining in Orga- nizations: Results of a Delphi Study. Business & Information System...

    2021 doi

  25. [34]

    A comparison of proximity- based methods for detecting temporal anomalies in business processes

    Mavroudopoulos, I., Gounaris, A., 2022. A comparison of proximity- based methods for detecting temporal anomalies in business processes. Machine Learning 112, 1–28. doi: 10.1007/s10994-022-06152-5

    2022 doi

  26. [35]

    Anomaly detection for industrial control systems using process mining

    Myers, D., Suriadi, S., Radke, K., Foo, E., 2018. Anomaly detection for industrial control systems using process mining. Computers & Security 78, 103–125. doi: 10.1016/j.cose.2018.06.002

    2018 doi

  27. [36]

    Fault detection based on Kernel Principal Component Analysis

    Nguyen, V .H., Golinval, J.C., 2010. Fault detection based on Kernel Principal Component Analysis. Engineering Structures 32, 3683–3691. doi:10.1016/j.engstruct.2010.08.012

    2010 doi

  28. [37]

    Analyzing business process anomalies using autoencoders

    Nolle, T., Luettgen, S., Seeliger, A., M ¨uhlh¨auser, M., 2018. Analyzing business process anomalies using autoencoders. Machine Learning 107, 1875–1893. doi: 10.1007/s10994-018-5702-8

    2018 doi

  29. [38]

    BINet: Multi- perspective business process anomaly classification

    Nolle, T., Luettgen, S., Seeliger, A., M¨uhlh¨auser, M., 2022. BINet: Multi- perspective business process anomaly classification. Information Systems 103, 101458. doi: 10.1016/j.is.2019.101458

    2022

  30. [39]

    DeepAlign: Alignment-Based Process Anomaly Correction Using Recurrent Neu- ral Networks, in: Advanced Information Systems Engineering, Springer International Publishing, Cham

    Nolle, T., Seeliger, A., Thoma, N., M ¨uhlh¨auser, M., 2020. DeepAlign: Alignment-Based Process Anomaly Correction Using Recurrent Neu- ral Networks, in: Advanced Information Systems Engineering, Springer International Publishing, Cham. pp. 319–333. doi: 10.1007/ 978-3-030-49435-3_20

    2020

  31. [40]

    Discovering pro- cess models for the analysis of application failures under uncertainty of event logs

    Pecchia, A., Weber, I., Cinque, M., Ma, Y ., 2020. Discovering pro- cess models for the analysis of application failures under uncertainty of event logs. Knowledge-Based Systems 189, 105054. doi: 10.1016/j. knosys.2019.105054

    2020

  32. [41]

    Analyzing medical data with process min- ing: A COVID-19 case study, in: Abramowicz, W., Auer, S., Str ´ozyna, M

    Pegoraro, M., Narayana, M.B.S., Benevento, E., van der Aalst, W.M.P., Martin, L., Marx, G., 2021. Analyzing medical data with process min- ing: A COVID-19 case study, in: Abramowicz, W., Auer, S., Str ´ozyna, M. (Eds.), Business Information Systems Workshops - BIS 2021 Inter- ...

    2021 doi

  33. [42]

    Recent Advances in Trustworthy Explainable Artificial Intelligence: Sta- tus, Challenges, and Perspectives

    Rawal, A., McCoy, J., Rawat, D.B., Sadler, B.M., Amant, R.S., 2022. Recent Advances in Trustworthy Explainable Artificial Intelligence: Sta- tus, Challenges, and Perspectives. IEEE Transactions on Artificial Intel- ligence 3, 852–866. doi: 10.1109/TAI.2021.3133846

    2022

  34. [43]

    Sakurada, M., Yairi, T., 2014. Anomaly Detection Using Autoen- coders with Nonlinear Dimensionality Reduction, in: Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, Association for Computing Machinery, New York, NY , USA. pp. 4–11. doi: ...

    2014

  35. [44]

    Anomaly detection in busi- ness processes using process mining and fuzzy association rule learning

    Sarno, R., Sinaga, F., Sungkono, K.R., 2021. Anomaly detection in busi- ness processes using process mining and fuzzy association rule learning. Journal of Big Data 7. doi: 10.1186/s40537-019-0277-1

    2021 doi

  36. [45]

    Using log analytics and process mining to enable self-healing in the Internet of Things

    Singh, P., Saman Azari, M., Vitale, F., Flammini, F., Mazzocca, N., Ca- poruscio, M., Thornadtsson, J., 2022. Using log analytics and process mining to enable self-healing in the Internet of Things. Environment Sys- tems and Decisions 42, 1–17. doi: 10.1007/s10669-022-09859-x

    2022 doi

  37. [46]

    Shapley Values of Reconstruction Errors of PCA for Explaining Anomaly Detection, in: 2019 International Conference on Data Mining Workshops (ICDMW), pp

    Takeishi, N., 2019. Shapley Values of Reconstruction Errors of PCA for Explaining Anomaly Detection, in: 2019 International Conference on Data Mining Workshops (ICDMW), pp. 793–798. doi:10.1109/ICDMW. 2019.00117

    2019

  38. [47]

    Process Mining Encoding via Meta-learning for an Enhanced Anomaly Detection, in: New Trends in Database and Information Systems, pp

    Tavares, G.M., Junior, S.B., 2021. Process Mining Encoding via Meta-learning for an Enhanced Anomaly Detection, in: New Trends in Database and Information Systems, pp. 157–168. doi: 10.1007/ 978-3-030-85082-1_15

    2021

  39. [48]

    Trace encoding in process mining: A survey and benchmarking

    Tavares, G.M., Oyamada, R.S., Barbon, S., Ceravolo, P., 2023. Trace encoding in process mining: A survey and benchmarking. Engineer- ing Applications of Artificial Intelligence 126, 107028. doi: 10.1016/ j.engappai.2023.107028

    2023

  40. [49]

    Linear dis- criminant analysis: A detailed tutorial

    Tharwat, A., Gaber, T., Ibrahim, A., Hassanien, A.E., 2017. Linear dis- criminant analysis: A detailed tutorial. AI Communications 30, 169 –

    2017

  41. [50]

    Unsupervised Learning Meth- ods for Anomaly Detection and Log Quality Improvement Using Process Event Log

    Vasumathi, D., Vijayakamal, M., 2020. Unsupervised Learning Meth- ods for Anomaly Detection and Log Quality Improvement Using Process Event Log. International Journal of Advanced Science and Technology 29, 1109 – 1125. URL: http://sersc.org/journals/index.php/ IJAST/article/view/3603

    2020

  42. [51]

    Wang, X., Yang, L., Li, D., Ma, L., He, Y ., Xiao, J., Liu, J., Yang, Y .,

  43. [52]

    Recompose Event Sequences vs

    Yuan, L.P., Liu, P., Zhu, S., 2021. Recompose Event Sequences vs. Predict Next Events: A Novel Anomaly Detection Approach for Dis- crete Event Logs, in: Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, p. 336–348. doi: 10.1145/ 3433210.3453098

    2021

  44. [53]

    Fraud Detection under Multi-Sourced Extremely Noisy Annotations, in: Proceedings of the 30th ACM International Conference on Information & Knowledge Management, p

    Zhang, C., Wang, Q., Liu, T., Lu, X., Hong, J., Han, B., Gong, C., 2021. Fraud Detection under Multi-Sourced Extremely Noisy Annotations, in: Proceedings of the 30th ACM International Conference on Information & Knowledge Management, p. 2497–2506. doi: 10.1145/3459637. 3482433

    2021 doi

  45. [54]

    ADMoE: Anomaly Detection with Mixture-of-Experts from Noisy La- bels, in: Proceedings of the AAAI Conference on Artificial Intelli- gence

    Zhao, Y ., Zheng, G., Mukherjee, S., McCann, R., Awadallah, A., 2023. ADMoE: Anomaly Detection with Mixture-of-Experts from Noisy La- bels, in: Proceedings of the AAAI Conference on Artificial Intelli- gence. URL: https://ojs.aaai.org/index.php/AAAI/article/ view/25620, doi:10...

    2023 doi

  46. [55]

    Feature Encoding With Autoencoders for Weakly Supervised Anomaly Detection

    Zhou, Y ., Song, X., Zhang, Y ., Liu, F., Zhu, C., Liu, L., 2022. Feature Encoding With Autoencoders for Weakly Supervised Anomaly Detection. IEEE Transactions on Neural Networks and Learning Systems 33, 2454–

    2022

  47. [56]

    Sparse Principal Component Analysis

    Zou, H., Hastie, T., Tibshirani, R., 2006. Sparse Principal Component Analysis. Journal of Computational and Graphical Statistics 15, 265–286. doi:10.1198/106186006X113430. 16

    2006 doi

  48. [190]

    doi: 10.3233/AIC-170729

    doi

  49. [2022]

    MADDC: Multi-Scale Anomaly Detection, Diagnosis and Cor- rection for Discrete Event Logs, in: Proceedings of the 38th Annual Computer Security Applications Conference, p. 769–784. doi:10.1145/ 3564625.3567972

  50. [2023]

    IEEE Transac- tions on Industrial Informatics , 1–11doi:10.1109/TII.2023.3246983

    Digital Twins for Anomaly Detection in the Industrial Internet of Things: Conceptual Architecture and Proof-of-Concept. IEEE Transac- tions on Industrial Informatics , 1–11doi:10.1109/TII.2023.3246983

    2023

  51. [2465]

    doi: 10.1109/TNNLS.2021.3086137

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.