Analysing Business Process Anomalies Using Discrete-time Markov chains

Within a business context, anomalies can be viewed as indicators for inefficiencies or fraud, which impact upon product quality and customer satisfaction. The development of approaches to monitor, detect and predict anomalous business processes remains an important research topic. In this paper, we propose a method, combining Discrete-Time Markov chains (DTMCs) and hitting probabilities (HP), for detecting anomalies occurring in the execution of business processes. Our method extends standard DTMCs to be able to estimate the probability of occurring for a process instance even though it is partially recorded (i.e., the initial executions are missing). The proposed method, denoted as HPDTMC, does not rely on prior knowledge about anomalies and the business process and can be trained on datasets already consisting of anomalies. A Šidák correction is applied to balance the probability of instances of varying length since naturally, process instances with more executions have lower sequence probability and more likely to be detected as anomalies by using DTMCs. We demonstrate the effectiveness of the method by evaluating it on two artificial datasets and one real-life dataset against seven classic anomaly detection methods. In the experiments, our approach reached an F1 score of 0.904 on average. Moreover, the proposed method outperforms competitors under noisy conditions. The main contribution of this paper is the proposed noise-robust method which is able to detect fully or partially recorded process instances of varying lengths.