Temporal anomaly detection is a critical task in business process management, aiming to identify process instances whose temporal behavior deviates from expected specifications. Unlike activity-sequence compliance checking, temporal anomaly detection focuses on temporal attributes such as waiting times and event intervals during actual execution. Some instances may exhibit abnormal temporal behavior even when their control flow remains compliant, making such deviations difficult to uncover from control-flow information alone. Existing methods typically model activity transition relationships or treat temporal information merely as auxiliary neural-network features, while few methods jointly incorporate process structural constraints and temporal deviation signals into anomaly scoring. This paper proposes NSP-AE, a neural-symbolic process autoencoder for temporal anomaly detection. First, each event trace is represented using activity, resource, and local delta-time information. Second, a Petri net is discovered from the training log using Inductive Miner, and prefix replay is used to derive the set of activities reachable at the current process state. Third, this reachable activity set is transformed into a dynamic compliance mask and embedded into the decoder to constrain the activity prediction space. Finally, NSP-AE performs trace-level anomaly scoring by combining activity prediction deviation, compliance-constraint signals, and log-space time-interval deviation. Controlled timestamp perturbation experiments on four public event logs show that NSP-AE outperforms comparison baselines on most logs, with statistically significant advantages on multiple logs.

Anomalies in business processes can lead to significant losses, making timely detection and handling of these anomalies essential for business process management and optimization. Although current methods in business processes might uncover abnormal cases or attributes in logs, they fail to provide adequate explanations for the anomalies detected. To enable reliable detection, a multi-perspective anomaly detection and explanation method for business processes based on graph neural networks is proposed. Firstly, a graph structure is constructed to reveal the dependencies between various attributes. On this basis, a multiple-graph neural network predictor is trained to predict each attribute of the next event separately. Then, according to the probability distribution of the prediction results, the anomaly score is calculated, and the anomalous attributes and cases are identified. In addition, when an anomaly is detected, a relevance score is assigned to the event attributes in the prefix trace. This score explains the rationale for anomaly detection. The experimental results demonstrate the method's efficacy in detecting anomalies in business processes, providing practical explanations, and enhancing the transparency and credibility of the model.

Predictive process monitoring is a log analysis technique that combines data and processes. It predicts the future behavior of ongoing cases based on historical process execution records, thereby supporting rational resource allocation and intelligent process decision making. Existing methods based on deep learning techniques mainly rely on single-case trends to predict the next activity or remaining time, neglecting the impact of global structural context on the prediction of currently ongoing cases. To address this limitation, this paper proposes a Predictive Business Process Monitoring framework based on Graph contrastive Learning and Attention Mechanism (BPMGLAM). The framework focuses on both direct and indirect relationships between activities to construct a global graph structure. Through a contrastive learning strategy between global graph-related subgraphs and local graphs, it enhances the structural representation capability of ongoing cases and integrates multi-level event attribute information to generate reliable predictions of future activities. Experiments conducted on multiple real-world event logs demonstrate that the proposed method achieves superior prediction performance.

Privacy-preserving process mining (PPPM) is a technology that analyses and optimises processes while safeguarding sensitive information. Earlier research on PPPM mainly focused on the data perspective, employing techniques such as noise insertion and data generalisation to protect the sensitive personal information of process executors. However, these studies overlooked the behavioural relationships between activities in the process. Attackers can exploit domain knowledge and certain behavioural information of executors to carry out re-identification attacks, leading to the leakage of personal sensitive information. To address this issue, a behaviour anonymous method of business process based on a log skeleton is proposed. This method begins with the individual process model of the executor, clustering based on the similarity between models and utilising K-anonymity and the log skeleton technology to achieve cluster division and the construction of behaviour constraint sets. Furthermore, the generation of privacy models is standardised by the behaviour constraint set to achieve global behaviour anonymization. To evaluate the effectiveness of this method, experiments were conducted using multiple real and synthetic datasets. The experimental results indicate that this method significantly outperforms the comparison methods.

Unexpected behavior in business process executions can be identified to give industrial internet systems security assurance for reliable operation. Current research primarily employs consistency analysis or outlier detection of data points to recognize aberrant behavior, neglecting the relationship between behavior and data properties. This work presents a multiperspective association rule-based approach for detecting anomalous behavior in industrial processes. Initially, a log transaction table with behavior relationships is constructed by mining behavior associations and related properties from the data Petri net. Subsequently, through the application of context awareness, behavior-attribute-time associations of frequently occurring itemsets are generated, and pruning procedures are used to mine multiperspective behavior rules under attribute associations. This approach facilitates the identification of anomalous behavior by comparing the support between logs and rules. Ultimately, the proposed method is implemented using the pm4py open-source framework, and evaluations are performed on both simulated and real event logs using multiple metrics. Experimental comparison results demonstrate that the proposed anomaly behavior detection method achieves higher performance.

Predictive business process monitoring discovers anomalies in business execution by predicting the next activity of a business process in real time, thereby helping enterprises to adjust and optimize business processes in a timely manner. Existing research usually focuses on the sequence information of a single trace in event logs or the structural information of process models, while ignoring the contextual correlation information in the process and the impact of existing and potential operational conflicts on the accuracy of the next activity prediction. To address these issues, we propose a next activity prediction method that combines trace case reorganization and expansion with a fine-grained image cube constraint action engine. This method addresses the problem of limited case numbers in a single trace and the lack of sparse pixel information in the encoded image. First, the labels of cases are removed, and cases are reorganized based on context dependencies, expanding the number of cases in the trace. Then, Gramian Angular Field (GAF) is used for fine-grained image encoding to enrich the content of the encoded image. A constraint cube constraint action engine is constructed, and Online Analytical Processing (OLAP) operations are used to constrain the process direction, monitor operational conflicts, and select the correct process direction. Finally, experimental results on four real event logs show that the proposed method outperforms the baseline methods in terms of the accuracy of next activity prediction.

In executing business processes, issues like information system failures or manual recording errors may lead to data loss in event logs, resulting in missing event logs. Utilizing such missing logs could seriously impact the quality of business process analysis results. To address this scenario, current advanced repair methods rely primarily on deep learning technology to provide intelligent solutions for business processes. However, deep learning technology is often considered a "black-box" model, lacking sufficient interpretability. No method is currently available to provide particular interpretability, especially in repairing specific missing values within the logs. This paper proposes the deep fusion interpretability framework based on artificial intelligence technology to address this issue. In the task of event log repair, this framework gradually transitions from the overall framework's local to global interpretability. It provides local interpretability from the attribute-level data flow perspective, semi-local interpretability from the event-level behavioral control-flow perspective, and global interpretability from the trace-level perspective. Next, we present various modes of multi-head attention within the framework and visualize the process of attention distribution calculation to explain how the framework repairs missing values through the profound combination of multi-head attention mode and context. Finally, Experimental results in real public event logs show that the DFI framework can effectively repair the missing values in event logs and explain the missing value repair process.

Abstract Relying only on the cost function to calculate the optimal alignment between the model and the log may cause the alignment results to fail to accurately reflect the deviation between the actual process and the modeled process. In order to solve this problem, an optimal alignment selection strategy combining conformance log probability distribution and the cost function is proposed. Firstly, a log probability automata is constructed based on the conformance event log. Then, all possible execution sequences of the model are obtained and pre-aligned with the non-conformance log based on the cost function. Finally, all asynchronous moving left and right associative event pairs in pre-alignment are determined, and the average confidence value of the direct following dependency relationship of these event pairs is obtained according to the log probability automata. The concept of credibility value is proposed by combining the average confidence value with the pre-aligned cost value, and the alignment with the highest credibility value is considered as the optimal alignment. In the evaluation section, a large number of alignment results are evaluated, and the results show that compared with the existing two alignment methods that only based on cost function, the average alignment accuracy of the proposed method is improved by 5.55% and 10.97% respectively under various noises, and the alignment accuracy is the most stable.

This study introduces a novel multimodal deep learning model for detecting Covid-19, uniquely combining chest X-ray images and cough sound features. We incorporated an attention layer to effectively influence the inputs from both features to enhance the detection process. The integration of time and frequency domain cough features with chest X-ray images represents a significant advancement in Covid-19 detection methodologies, offering promising results and potential applications in the medical field. In the proposed model, we modified vgg16 and a faster region-based convolutional neural network (FRCNN). The modified vgg16 is used to extract the features from both datasets, whereas the modified FRCNN is used for detection. Utilizing the Vgg16 model for feature extraction and faster-rcnn for Covid-19 detection allows for a robust and efficient approach. We analyzed the performance of the proposed methodology using a dataset of 2059 Covid-19 positive chest X-ray images and a diverse collection of 25,000 cough recordings, including 716 positive, 7693 negative, and 1591 symptomatic cases. The datasets were divided into 80% for training and 20% for testing. The model achieves 99.80% accuracy, an f1-score of 99.70%, and 0.0132 validation loss. We further performed an extensive ablation experiment on the features. We compared the results of the proposed model to already existing networks using chest X-rays and coughs as datasets, and the proposed model outperformed them. Experiments also show that the trained model resists training data quantity and quality and can effectively detect Covid-19 in chest X-rays and coughs.

Process mining algorithms essentially reflect the execution behavior of events in an event log for conformance checking, model discovery, or enhancement. Domain experts have developed several process mining algorithms based on theoretical frameworks such as linear integer programming, heuristics, and genetic algorithms, region-based and semantic-based approaches. The idea is to generate insightful representations of these processes of information systems to enable process mining practitioners to gain insight into their systems. Recently, there has been a shift toward semantic-based approaches for process mining since they not only discover enhanced models but also emphasize context. To this effect, this paper conducts a comprehensive review of 30 articles on semantic process mining techniques. It was found that 44.7% of all works used semantics for process discovery, 23.7% for model enhancement, and conformance checking was the least with 10.5%. We further indicate the benefits and contributions of these methods to process mining. Challenges, opportunities, and prospective future research areas are also discussed.

Predictive Business Process Monitoring (PBPM) is a significant research area in Business Process Management (BPM) aimed at accurately forecasting future behavioral events.At present, deep learning methods are widely cited in PBPM research, but no method has been effective in fusing data information into the control flow for multi-perspective process prediction.Therefore, this paper proposes a process prediction method based on the hierarchical BERT and multi-perspective data fusion.Firstly, the first layer BERT network learns the correlations between different category attribute data.Then, the attribute data is integrated into a weighted event-level feature vector and input into the second layer BERT network to learn the impact and priority relationship of each event on future predicted events.Next, the multi-head attention mechanism within the framework is visualized for analysis, helping to understand the decision-making logic of the framework and providing visual predictions.Finally, experimental results show that the predictive accuracy of the framework surpasses the current state-ofthe-art research methods and significantly enhances the predictive performance of BPM.

Process mining has piqued the interest of researchers and technology manufacturers. Process mining aims to extract information from event activities and their interdependencies from events recorded by some enterprise systems. An enterprise system's transactions are labeled based on their information content, such as an activity that causes the occurrence of another, the timestamp between events, and the resource from which the transaction originated. This paper describes a novel process of parsing event-log activities based on information content (IC). The information content of attributes, especially activity names, which are used to describe the flow processes of enterprise systems, is grouped hierarchically as hypernyms and hyponyms in a subsume tree. The least common subsume (LCS) values of these activity names are calculated, and the corresponding relatedness values between them are obtained. These values are used to create a fuzzy causal matrix (FCM) for parsing the activities, from which a process mining algorithm is designed to mine the structural and semantic relationships among activities using an enhanced gray wolf optimizer and backpropagation algorithm. The proposed approach is resistant to noisy and incomplete event logs and can be used for process mining to reflect the structure and behavior of event logs.

For the reliable prediction and analysis of large amounts of data, big data analytics may be applied in many disciplines. They facilitate the discovery of important information in large amounts of data that would otherwise be obscured. Almost all organizations stored their data in the cloud as event logs over the last few decades. These data can be utilized to extract useful information, which can be used to boost an organization’s productivity and effectiveness by identifying, monitoring, and optimizing its processes. Supporting operations, recognizing faults in running processes, predicting event length, and predicting the next activity are all ways of accomplishing this. As part of our strategy, we provide a data collection and machine learning technique. Process mining can help you achieve these objectives. The major enabler of data-driven approaches in process mining is predictive process monitoring. Deep learning has been used in the realm of predictive monitoring to provide accurate future activity predictions in a running trace by analyzing data from previous events. Using image-based data engineering and convolutional neural networks, the next activity in a business process has been forecast in this paper (CNN). The use of CNN in process mining and data analytics guarantees that the proposed system has high accuracy in predicting the next activity in a business process. The experimental evaluation shows that the proposed CNN algorithm is faster at training and inference than the Long Short-Term Memory (LSTM) approach, even when the process has longer traces.

Model incremental updating enhances the initial model by analysing discrepancy parts of the system to improve the model's adaptability for new scenarios. These discrepancy components originate from the deviation between the increasing business process operational state and the outdated original planning model. Considerable domain-specific knowledge is required to determine the threshold points for selecting appropriate activities, but process analysts rarely know each scenario's domain knowledge. Moreover, most analytical processes only focussed on the control flow level. Aiming at these issues, this paper proposes a Hybrid Behavioural and Resource Trusted intervals Updating algorithm (BI&RI Updating) for model enhancement based on control level and resource level of online event streams. First, analyse the reference model to construct multi-perspective trusted interval constraints in the offline stage. From a control-flow perspective, the behavioural relationships between activities are researched using a deep clustering approach. Moreover, from a data-flow standpoint, resource co-occurrence relationships are analysed based on association rules. Next, the incremental update algorithm in online scenarios is proposed to update the model by filtering the event streams and iteratively optimising the trusted intervals. Finally, the proposed algorithm is implemented based on the PM4PY framework and evaluated using real logs with both outcome model quality and execution efficiency. The results show that the algorithm can execute quickly and improve the quality of the model even in a non-ideal state where the logs contain noise.

Business process outcome prediction plays an essential role in business process monitoring. It continuously analyzes completed process events to predict the executing cases’ outcome. Most of the current outcome prediction focuses only on the activity information in historical logs and less on the embedded and implicit knowledge that has not been explicitly represented. To address these issues, this paper proposes a Deep Latent Factor Model Predictor (DLFM Predictor) for uncovering the implicit factors affecting system operation and predicting the final results of continuous operation cases based on log behavior characteristics and resource information. First, the event logs are analyzed from the control flow and resource perspectives to construct composite data. Then, the stack autoencoder model is trained to extract the data’s main feature components for improving the training data’s reliability. Next, we capture the implicit factors at the control and data flow levels among events and construct a deep implicit factor model to optimize the parameter settings. After that, an expansive prefix sequence construction method is proposed to realize the outcome prediction of online event streams. Finally, the proposed algorithm is implemented based on the mainstream framework of neural networks and evaluated by real logs. The results show that the algorithm performs well under several evaluation metrics.

Anomalous behavior detection in business processes inspects abnormal situations, such as errors and missing values in system execution records, to facilitate safe system operation. Since anomaly information hinders the insightful investigation of event logs, many approaches have contributed to anomaly detection in either the business process domain or the data mining domain. However, most of them ignore the impact brought by the interaction between activities and their related attributes. Based on this, a method is constructed to integrate the consistency degree of multi-perspective log features and use it in an isolation forest model for anomaly detection. First, a reference model is captured from the event logs using process discovery. After that, the similarity between behaviors is analyzed based on the neighborhood distance between the logs and the reference model, and the data flow similarity is measured based on the matching relationship of the process activity attributes. Then, the integration consistency measure is constructed. Based on this, the composite log feature vectors are produced by combining the activity sequences and attribute sequences in the event logs and are fed to the isolation forest model for training. Subsequently, anomaly scores are calculated and anomalous behavior is determined based on different threshold-setting strategies. Finally, the proposed algorithm is implemented using the Scikit-learn framework and evaluated in real logs regarding anomalous behavior recognition rate and model quality improvement. The experimental results show that the algorithm can detect abnormal behaviors in event logs and improve the model quality.

Business process anomalous behavior detection reveals unexpected cases from event logs to ensure the trusted operation of information systems. Anomaly behavior is mainly identified through a log-to-model alignment analysis or numerical outlier detection. However, both approaches ignore the influence of probability distributions or activity relationships in process activities. Based on this concern, this paper incorporates the behavioral relationships characterized by the process model and the joint probability distribution of nodes related to suspected anomalous behaviors. Moreover, a Petri Net-Based Bayesian Network (PN-BBN) is proposed to detect anomalous behaviors based on the probabilistic inference of behavioral contexts. First, the process model is filtered based on the process structure of the process activities to identify the key regions where the suspected anomalous behaviors are located. Then, the behavioral profile of the activity is used to prune it to position the ineluctable paths that trigger these activities. Further, the model is used as the architecture for parameter learning to construct the PN-BBN. Based on this, anomaly scores are inferred based on the joint probabilities of activities related to suspected anomalous behaviors for anomaly detection under the constraints of control flow and probability distributions. Finally, PN-BBN is implemented based on the open-source frameworks PM4PY and PMGPY and evaluated from multiple metrics with synthetic and real process data. The experimental results demonstrate that PN-BBN effectively identifies anomalous process behaviors and improves the reliability of information systems.

为了有效分析事件流之间特定的行为关系并将其融入预测过程,提出一种基于事件流行为向量的在线事件流协同过滤推荐算法来预测下一个事件.首先分析事件流之间的结构相似性和行为相似性,以确定事件流的行为轮廓关系,在此基础上捕获事件流的行为依赖关系,将事件流构建为行为向量;然后调整传统的协同过滤推荐算法以分析在线事件流,对下一个事件流进行有效预测;最后,在Pm4py框架中实现相关算法,并在合成日志和真实日志中进行仿真预测.实验结果表明,行为向量能够体现事件流的行为关系,并提高预测的有效性.

Incremental mining improves the quality of process mining by analyzing the differences between event logs and a reference model to obtain valuable information to update the reference model. Existing incremental mining methods focus on offline logs by setting thresholds for analysis, which limits process mining efforts by the domain knowledge, log completeness, and business completion time. Aiming at these problems, a real-time incremental mining algorithm based on the trusted behavior interval is proposed to analyze online event streams for updating the reference model. First, a clustering technique to analyze an existing reference model selects the core structure of the model and calculates the trusted behavior interval. Then, the behavioral and structural relationships between the online event streams and the reference model are analyzed to obtain a valid candidate set. Based on this set, an incremental update algorithm is proposed to optimize the model structure to achieve an online dynamic update of the reference model. The proposed algorithm is implemented in PM4PY and Scikit-learn frameworks; a reasonable number of clusters is determined using the elbow method and validated with artificial and real data. Experimental results show that the algorithm improves the efficiency of incremental mining and enhances the quality of the model with both complete and incomplete data.

针对在访问选课系统中的临界资源时出现的不稳定性问题,建立了一种基于Petri网的选课系统流程模型.首先使用“生产者-消费者”原理对模型进行优化,实现“发布课程”和“选课”的严格序关系;然后引入信号量机制进一步优化,实现互斥访问更新后的临界资源.最后用PIPE软件模拟运行优化后的模型并进行分析,结果表明模型具有安全性和有界性.