Business Process Anomaly Behavior Detection Method Based on Multiperspective Association Rules

Abstract

Unexpected behavior in business process executions can be identified to give industrial internet systems security assurance for reliable operation. Current research primarily employs consistency analysis or outlier detection of data points to recognize aberrant behavior, neglecting the relationship between behavior and data properties. This work presents a multiperspective association rule-based approach for detecting anomalous behavior in industrial processes. Initially, a log transaction table with behavior relationships is constructed by mining behavior associations and related properties from the data Petri net. Subsequently, through the application of context awareness, behavior-attribute-time associations of frequently occurring itemsets are generated, and pruning procedures are used to mine multiperspective behavior rules under attribute associations. This approach facilitates the identification of anomalous behavior by comparing the support between logs and rules. Ultimately, the proposed method is implemented using the pm4py open-source framework, and evaluations are performed on both simulated and real event logs using multiple metrics. Experimental comparison results demonstrate that the proposed anomaly behavior detection method achieves higher performance.