Better understanding anomalous behavior through Multi-Perspective Conformance Checking

The need for detecting and understanding anomalous behavior

A company runs optimally when its business processes run exactly as they are intended. However, deviations from the norm can always occur. There can be many reasons for this: consider system errors, resource misrepresentations, non-compliance with regulations, or even deliberate fraudulent activities. To maintain control, mitigate risks, and make informed decisions, it is imperative for organizations to spot these deviations and interpret them correctly. Process mining, a family of techniques used to analyze event data in order to understand and improve operational processes, is a powerful tool to help in this regard: by extracting valuable insights from event logs, process mining techniques enable organizations to gain a comprehensive understanding of their processes, identify bottlenecks and uncover inefficiencies. But detecting and interpreting anomalous behavior in business processes is often challenging, and requires a broader approach that takes into account various aspects of a business process and related constraints.

Consider a healthcare organization that follows a standardized patient admission process. This process involves multiple steps, such as patient registration, medical examination, treatment, and discharge. Each step has specific dependencies and requirements, ensuring that patients receive appropriate care. However, in practice, deviations from the expected process can occur. For instance, a medical professional may skip a necessary examination, leading to a delay in diagnosis and treatment. But detecting the anomaly is often not so obvious. Therefore, it is essential to develop a framework that encompasses multiple perspectives and provides explanations for deviations, allowing users to understand the context and reasoning behind the detected anomalies.

A new approach to Multi-Perspective Conformance Checking

To meet these challenges, Azadeh Mozafari Mehr introduces a novel approach to Multi-Perspective Conformance Checking. Her aim is to build a foundation for automatically identifying and interpreting patterns of deviating behavior from multiple perspectives, while explaining these deviations in their respective contexts. By considering the process, data, and privacy perspectives simultaneously, the proposed approach introduces a novel method for computing alignments that captures deviations and provides explanations for the observed behavior. It identifies patterns and respective contexts with reference to the process, data, and organizational models, thereby facilitating a comprehensive understanding of anomalous behavior.

Moving beyond traditional methods

The framework presented by Azadeh Mozafari Mehr goes beyond traditional anomaly detection techniques. First of all, it is capable of detecting anomalies from multiple perspectives in each process instance (case level) and providing insights at the level of the entire process execution (log level). But in addition, it can automate the interpretation of anomalous patterns and categorizing them into roles, users, and system deviating patterns. This framework thereby enhances the understanding of detected anomalies.

Title of PhD thesis: Multi-perspective Conformance Checking: Identifying and Understanding Patterns of Anomalous Behavior
Supervisors: prof.dr.ir. B.F. van Dongen, dr. R. Medeiros de Carvalho