11institutetext: Kühne Logistics University, Hamburg, Germany
11email<EMAIL_ADDRESS>
22institutetext: SAP Signavio, Berlin, Germany
22email<EMAIL_ADDRESS>
# xSemAD: Explainable Semantic Anomaly Detection in Event Logs Using Sequence-
to-Sequence Models

Kiran Busch 11 Timotheus Kampik 22 Henrik Leopold 11

###### Abstract

The identification of undesirable behavior in event logs is an important
aspect of process mining that is often addressed by anomaly detection methods.
Traditional anomaly detection methods tend to focus on statistically rare
behavior and neglect the subtle difference between rarity and undesirability.
The introduction of semantic anomaly detection has opened a promising avenue
by identifying semantically deviant behavior. This work addresses a gap in
semantic anomaly detection, which typically indicates the occurrence of an
anomaly without explaining the nature of the anomaly. We propose xSemAD, an
approach that uses a sequence-to-sequence model to go beyond pure
identification and provides extended explanations. In essence, our approach
learns constraints from a given process model repository and then checks
whether these constraints hold in the considered event log. This approach not
only helps understand the specifics of the undesired behavior, but also
facilitates targeted corrective actions. Our experiments demonstrate that our
approach outperforms existing state-of-the-art semantic anomaly detection
methods.

###### Keywords:

semantic anomaly detection, large language model, event log, explainability

##  1 Introduction

In many domains, the execution of business processes must adhere to certain
rules. For example, a bank clerk can only grant a loan to a client after
performing a number of specific checks and a doctor can only prescribe certain
medicine after investigating possible side effects with other drugs the
patient is currently prescribed to. A common strategy to detect violations
against such rules is the use of conformance checking techniques [7, 29]. In
essence, these techniques compare the actual behavior, as recorded by
information systems, to the desired behavior that is captured using a
normative process model. While such techniques have been found to be valuable
for both detecting and preventing violations [25], they are only applicable if
a process model specifying the normative behavior is available.

Recognizing that such normative process models are not always available in
practice, several authors have introduced so-called anomaly detection
techniques. The core idea of anomaly detection techniques is to discover
violations, i.e. anomalous behavior, by solely analyzing the contents of an
event log. Traditional anomaly detection methods, e.g. [5, 28, 27], build on
the assumption that anomalous behavior is rare, and hence take a statistical
angle. More recent work [1, 8] both acknowledges and illustrates that there is
difference between rarity and undesirability, and that several violations can
only be identified by considering the semantics of the executed events.
However, depending on the chosen strategy, existing semantic anomaly detection
techniques are either very inaccurate in terms of recall or suffer from a lack
of explainability, i.e., it is not transparent to the user why a trace or
event pair is considered anomalous.

In this paper, we set out to address the limitation of explainability while
still providing a reasonable accuracy. To this end, we propose a novel
semantic anomaly detection technique that builds on a sequence-to-sequence
(seq2seq) model. The core idea behind our technique is to fine-tune a language
model based on a given process model repository. In this way, we are able to
learn execution patterns that later help us to detect anomalous behavior in
event logs. Our technique does not only help to understand the specifics of
the undesired behavior, but also facilitates targeted corrective actions. To
demonstrate the feasibility and performance of our approach, we conduct an
evaluation on a large dataset from industry and compare our approach against
the state of the art.

The remainder of this paper is organized as follows. Section 2 explains the
problem we are addressing in this paper and highlights the research gap.
Section 3 introduces our novel semantic anomaly detection technique. Section 4
presents the results from our evaluation experiments. Section 5 reflects on
related work before Section 6 concludes the paper.

##  2 Motivation

To illustrate the capability and potential of semantic anomaly detection
techniques, consider a simplified loan application process. A regular
execution of this process starts by receiving a loan application (A). Next,
the credit history of the customer is checked (B) before the application is
either approved (C) or rejected (D). Depending on the decision, the customer
is informed about the approval (E) or the rejection (F). In case the
application is approved, the funds are disbursed (G). In either case, the case
is archived (H).

Trace $\sigma_{1}$
---
A Receive loan application
C Approve application
B Check credit history
E Send approval
G Disburse funds
Trace $\sigma_{2}$
---
A Receive loan application
C Approve application
D Reject application
F Send rejection
H Archive case

Figure 1: Anomalous traces in a loan application process

Now consider the two recorded execution traces depicted in Figure 1. Upon
closer inspection, several execution anomalies can be detected by considering
the labels of the recorded events. In trace $\sigma_{1}$, the application is
approved (C) before the credit history is checked (B) and the archiving case
activity (H) is missing. In trace $\sigma_{2}$, the application is both
approved (C) and rejected (D) in the same trace. The automated detection of
such anomalies can be conducted on three different levels:

  1. 1.

An anomaly can be detected on the trace level, i.e. a trace is marked as
anomalous as a whole. In the example above, both $\sigma_{1}$ and $\sigma_{2}$
would be marked as anomalous respectively.

  2. 2.

An anomaly can be detected on the event level, i.e. a particular event or pair
of events is marked as anomalous. In the example above, we would, for
instance, mark the event H from $\sigma_{1}$ as anomalous (as it is missing)
as well as the event pair C and B from $\sigma_{1}$.

  3. 3.

An anomaly can be detected on the constraint level, i.e. a particular event or
pair of events is marked as anomalous including the violated constraint. In
the example above, event H from $\sigma_{1}$ is marked as missing and event
pair C and B are marked as violating the exclusive choice constraint.

While prior work on semantic anomaly detection generally addresses all three
levels, they have a number of important limitations. The work from Van der Aa
et al. [1] is able to detect anomalies on the constraint level, distinguishing
three types of constraints: order, exclusion, and co-occurrence. It, however,
can only detect anomalies for events that share the same business object. From
the three violations discussed above, it therefore would only be able to
correctly recognize the event pair C and D as exclusion violation, since only
these events share the business object “application”. The more recent work
from Caspary et al. [8] overcomes the limitation of the same business object,
but can only detect anomalies on the event level, i.e. it cannot explain what
is wrong with an anomalous event pair. By strictly focusing on events pairs,
it can also not detect missing events, such as H in $\sigma_{1}$.

In this work, we aim to overcome these limitations of existing semantic
anomaly detection techniques. We argue that a useful semantic anomaly
detection technique needs to target the constraint level in order to explain
to the user what is wrong about a considered event or event pair. In the
following we focus on control flow based constraints. It should further be
able to generalize from the behavior it was trained on and appropriately
consider the context of a trace. The latter is important since an event pair
that is considered anomalous in one trace might not necessarily be considered
anomalous in every trace. To address these challenges, we adopt a seq2seq
model and combine it with the recognition of declarative execution
constraints. The next section introduces our technique in detail.

##  3 Approach

In this section, we present the xSemAD approach for explainable semantic
anomaly detection. First, Section 3.1 gives an overview of our approach. Then,
Sections 3.2 and 3.3 explain the phases and components in detail.

###  3.1 Overview

The xSemAD approach consists of a training phase and a detection phase, and
three core components.

Figure 2 visualizes the xSemAD approach. In the training phase, the overall
idea is to use an existing process model repository to learn the execution
relations between activities and capture those by fine-tuning a seq2seq model
(see component 1). In the anomaly detection phase, we then use the fine-tuned
model, which we refer to as events2constraints model, to determine the
constraints that have to hold for a considered event log (see component 2). To
illustrate this, consider the traces $\sigma_{1}$ and $\sigma_{2}$ from Figure
1. Even without knowing the order of the involved activities, we are
intuitively able to determine an order for several events. Among others, we
could argue that the process should always start with the “Receive loan
application” event or that the event “Check credit history” must precede
either the event “Approve application” or “Reject application”. The xSemAD
approach uses the knowledge encoded in the events2constraints model to derive
such constraints for the given event log. Finally, we check whether the
constraints generated for the event log violate the actual execution relations
in the event log (see component 3). The final outcome is, respectively, a set
of semantic violations. Since the xSemAD approach is able to specify which
constraints have been violated, it can use these constraints to explain the
violations, thus enhancing explanatory capabilities in semantic anomaly
detection.

Figure 2: Overview of our xSemAD approach.

###  3.2 Training phase

In the training phase, we use a process model repository as input to fine-tune
a seq2seq model. The output is the fine-tuned model, i.e., the
events2constraints model.

Input. Process models define execution dependencies between the activities of
a process. For the purpose of this paper, it is sufficient to abstract from
specific process modeling languages, such as BPMN or Petri nets, by focusing
on the relationships of activities. We use $\mathcal{P}$ to refer to a set of
process models, i.e. a process model repository. Then, a process model
$P\in\mathcal{P}$ defines a set of activity execution sequences $\Pi$ that
lead the process to its final state. For a given execution sequence
$\pi=\langle a_{1},\dots,a_{n}\rangle\in\Pi$ of length $n$, we use $a_{j}$,
$1\leq j\leq n$, to refer to the $j^{th}$ activity in $\pi$.

Fine-tuning. To capture the execution constraints that must hold between
activities, we fine-tune the seq2seq model Flan-T5 [9], which is a pre-trained
language model trained on various supervised and unsupervised tasks. To fine-
tune Flan-T5 for constraint generation, we train it using the process model
repository $\mathcal{P}$, specifically focusing on input-target pairs. This
results in the development of a task-specific seq2seq model, the
events2constraints model. After training, the events2constraints model can be
employed for checking the execution constraints of any input event log.

To create the training dataset, we first need to define the input-target pairs
for each training sample. The input value of a training sample contains all
activities $P_{A}$ of a process model $P\in\mathcal{P}$. The target value of a
training sample is determined based on a specific constraint associated with
the set $P_{A}$ during its training phase. To obtain these target values, we
employ the declarative process language declare [14] which provides
abstractions on top of finite-trace linear temporal logic that are useful for
the process domain. Below, we give an informal overview of the declare
constraints that we use111For a more comprehensive introduction to declare, we
refer to [14]..

  1. 1.

Initiation constraint: $\text{{Init}}(a)$ – The process starts with activity
$a$.

  2. 2.

Termination constraint: $\text{{End}}(a)$ – The process ends with activity
$a$.

  3. 3.

Succession constraint: $\text{{Succ}}({a_{j}},{a_{k}})$ – Activity ${a_{j}}$
(${a_{k}}$) occurs if and only if it is followed (preceded) by activity
${a_{k}}$ (${a_{j}}$) in the process.

  4. 4.

Alternate succession constraint: $\text{{AltSucc}}({a_{j}},{a_{k}})$ –
Activities ${a_{j}}$ and ${a_{k}}$ occur in the process if and only if the
latter follows the former, and they alternate each other in the trace.

  5. 5.

Choice constraint: $\text{{Ch}}({a_{j}},{a_{k}})$ – Activity ${a_{j}}$ or
activity ${a_{k}}$ must be in the process.

  6. 6.

Co-existence constraint: $\text{{CoEx}}({a_{j}},{a_{k}})$ – Both activities
${a_{j}}$ and ${a_{k}}$ must be in the process.

  7. 7.

Exclusive choice constraint: $\text{{ExCh}}({a_{j}},{a_{k}})$ – Either
activity ${a_{j}}$ or activity ${a_{k}}$ (but not both) must be in the
process.

  8. 8.

Response constraint: $\text{{Resp}}({a_{j}},{a_{k}})$ – If activity ${a_{j}}$
occurs in the process, then activity ${a_{k}}$ occurs after ${a_{j}}$.

  9. 9.

Alternate response constraint: $\text{{AltResp}}({a_{j}},{a_{k}})$ – Each time
activity ${a_{j}}$ occurs in the process instance, activity ${a_{k}}$ occurs
afterwards, before ${a_{j}}$ recurs.

  10. 10.

Precedence constraint: $\text{{Prec}}({a_{j}},{a_{k}})$ – Activity ${a_{k}}$
occurs in the process instance only if preceded by activity ${a_{j}}$.

  11. 11.

Alternate precedence constraint: $\text{{AltPrec}}({a_{j}},{a_{k}})$ – Each
time activity ${a_{k}}$ occurs in the process instance, it is preceded by
activity ${a_{j}}$, and no other ${a_{k}}$ can recur in between.

Note that while we employ declare in this paper, our approach can analogously
be used with other constraint types, i.e., the declare constraint types can be
exchanged with other constraint types.

For each process $P_{i}$ in the model repository $\mathcal{P}$, the set of
constraints is given by
$\mathcal{C}_{i}=\\{C_{i_{1}},C_{i_{2}},\ldots,C_{i_{m_{i}}}\\}$, where
$m_{i}$ is the total number of constraints associated with $P_{i}$. Each
constraint $C_{i_{k}}$ is categorized into a specific constraint type (e.g.,
initiation, choice or response), denoted as $T_{i_{k}}$. We define a training
sample as a input-target pair
$(T_{i_{k}}:\text{{shuffle}}(P_{i_{A}}),C_{i_{k}})$, where $1\leq k\leq
m_{i}$, representing the set of activities in $P_{i}$ and one constraint
$C_{i_{k}}$ with type $T_{i_{k}}$. Here, the colon “:” separates the
constraint type from the shuffled list of activities. We randomize the order
of $(P_{i_{A}})$ in each training sample using $\text{{shuffle}}(P_{i_{A}})$
to ensure that the model remains unbiased by the order of the activity labels,
forcing it to focus on learning the intrinsic relationships among these
labels. The training dataset is then defined as the union of all training
samples:
$\mathcal{M}_{train}=\bigcup_{i=1}^{n}\bigcup_{k=1}^{m_{i}}(T_{i_{k}}:\text{{shuffle}}(P_{i_{A}}),C_{i_{k}})$,
where $n$ is the number of process models in $\mathcal{P}$. We use this
training dataset $\mathcal{M}_{train}$ to fine-tune Flan-T5 and thus obtain
our events2constraints model.

Illustration. To illustrate that, consider one possible training sample with
input-target pair for a simplified loan application process:

  1. 1.

(Exclusive choice: archive case, reject application, check credit history,
approve application, receive loan application, send approval, send rejection,
disburse fund; Exclusive choice(approve application, reject application))

###  3.3 Detection phase

The detection phase consists of the constraint generation and the constraint
checking components. Below, we explain each component in detail along with a
respective illustration.

Constraint generation. The constraint generation component takes as input the
events2constraints model and an event log $L$. The former stems from the
training phase. The latter is provided by the user and will be checked for
semantic anomalies. For our purposes, we consider an event log $L$ as a
multiset of traces. Given the universe of events $\mathcal{E}$, a trace
$\sigma$ is defined as a sequence of events, i.e., $\sigma=\langle
e_{1},\dots,e_{n}\rangle$. We use $e_{j},1\leq j\leq n$, to refer to the
$j^{th}$ event in $\sigma$.

The first step of the constraint generation component involves the extraction
of event labels from $L$. In a second step, we then use these labels as input
for the events2constraints model to generate constraints. The input of the
events2constraints model is defined by the format that we used in the training
phase, i.e., the input sequence is composed of a constraint type and the event
labels.

Our model employs a strategy which generates $n$ output sequences
corresponding to $n$ potential constraints for a given input. This is
accomplished through the use of beam search, a decoding algorithm applied to
our fine-tuned model. The beam search algorithm generates output sequences,
i.e. constraints, auto-regressively by selecting words such that the resulting
sequences have high probabilities. However, the words originate from the large
vocabulary of the language model and therefore may not match the vocabulary of
the event log. To address this limitation, we refine our selection process to
include only constraints with event labels that were originally found in the
input sequence. Additionally, we introduce a threshold parameter $\theta$ to
further improve the output. The parameter $\theta$ is crucial in determining
the set of constraints, as only those with probabilities exceeding the defined
$\theta$ are considered for the output. This process enhances the precision of
the generated constraints by filtering out those with lower probabilities. As
a result of this procedure, the constraint generation component produces a set
of possible and probable constraints for the given event log.

Illustration. Consider an event log consisting of the traces $\sigma_{1}$ and
$\sigma_{2}$ from Figure 1 with the event labels “approve application”,
“reject application”, “check credit history”, “receive loan application”,
“send approval”, “send rejection”, “archive case”, and “disburse fund”. If the
goal is to determine possible start events (i.e., the declare constraint Init)
based on the event labels, the corresponding input sequence for our model is
(Init: approve application, reject application, check credit history, receive
loan application, send approval, send rejection, archive case, disburse fund).
In this example, the input sequence specifies the constraint type as Init and
provides a list of the log’s unique event labels. Our model uses the beam
search algorithm to generate potential constraints based on this input
sequence:

  1. 1.

Init(receive loan application)

  2. 2.

Init(check credit history)

  3. 3.

Init(receive application)

Our method automatically filters out the third output sequence as it contains
the event label “receive application”, which was not provided in the input
sequence. The beam search algorithm uses conditional probabilities to track
the most likely output sequences at each generation step. Suppose the
probabilities for the remaining two constraints are:

  1. 1.

Init(receive loan application) \- Probability: 0.95

  2. 2.

Init(check credit history) \- Probability: 0.40

Given a threshold $\theta=0.7$, the second constraint is filtered out, and the
final generated constraint is Init(receive application), defining that the
process should begin with the event “receive application”. By altering the
constraint type in the input sequence, a variety of constraints $\mathcal{C}$
can be produced.

Constraint checking. In the constraint checking component, we apply the
generated constraints $\mathcal{C}$ to the event log $\mathcal{L}$ to identify
semantic anomalies. These anomalies then represent cases where the observed
behavior deviates from the found constraints. To accomplish this, we check for
each trace whether its sequence of events contradicts the constraints
$\mathcal{C}$. As a result, we obtain a set of anomalies and the specific
constraints these anomalies violate. The violated constraint is important
feedback to the user as it explains what exactly is considered to be anomalous
and facilitates addressing and correcting the detected issues. Our approach is
specifically designed to detect anomalies at the constraint level; however, it
can be readily adapted for anomaly detection at the trace and event levels as
well.

Illustration. Again consider the traces $\sigma_{1}$ and $\sigma_{2}$ from
Figure 1. Further, consider the trace $\sigma_{3}=\langle$ Check credit
history (B), Accept application (C), Send approval (E), Disburse fund (G)
$\rangle$. Suppose we have already generated the Init constraint as explained
above. In this case, the anomaly detector, using the generated constraints
$\mathcal{C}$, would identify that the trace $\sigma_{3}$ violates the Init
constraint. Specifically, it violates the constraint that the process should
start with the “receive loan application” event.

##  4 Experimental Evaluation

In our experimental evaluation222We provide the source code of the
implementation under this link: https://github.com/KiriBu10/xSemAD., we assess
the performance of xSemAD and compare it to state-of-the-art approaches. We
first describe the used dataset in Section 4.1 and then the experimental setup
in Section 4.2. Finally, we present the results of our experiments in Section
4.3.

###  4.1 Dataset

For training and evaluating our approach, we require a large number of event
logs, coming with ground-truth constraints that describe how the process
should be executed. As such constraints are difficult to obtain for a generic
event log, we created a new dataset from the real-world process models found
in the SAP Signavio Academic Models (SAP-SAM) collection [30], which is the
largest publicly accessible collection of business process models to date.
Several models included in SAP-SAM have already been published in [32]. SAP-
SAM comprises over one million333This number includes duplicates. processes
and other business models in various modeling notations and languages from a
wide range of domains. We applied a series of filtering and cleaning
operations to the raw dataset to improve its quality and suitability for our
analysis. Following the guidance in [30], we excluded vendor-provided examples
that are likely duplicates. Additionally, we filtered the dataset to include
only models that are represented in the BPMN 2.0 notation, have English
language labels, and can be converted into sound workflow nets. The latter
ensures that the process models are structurally suitable for the creation of
event logs. In addition to the filtering operations, we applied label cleaning
techniques to improve the consistency of the models’ labels. Specifically, we
removed non-alphanumeric characters in the labels, handled special cases such
as line breaks, converted all letters to lowercase, and removed unnecessary
spaces in the labels. This results in a set of 38,312 process models
$\mathcal{P}$. To generate the declare constraints from the process models, we
used the converter from BPMN to constraints presented in [2].

Dataset split. To evaluate the effectiveness of our approach in an unbiased
way, we randomly split the dataset $\mathcal{P}$ into a training dataset
$\mathcal{P}_{train}$, encompassing 75% of the models, a validation dataset
$\mathcal{P}_{validation}$, consisting of 15% of the models, and a test
dataset $\mathcal{P}_{test}$, including the remaining 10% of the models. We
trained our approach using $\mathcal{P}_{train}$ (see Section 3.2), while
$\mathcal{P}_{validation}$ played a crucial role in validating and determining
the optimal configuration for the hyperparameter $\theta$ in our model. The
separately held $\mathcal{P}_{test}$ was used exclusively to evaluate the
performance of our approach without any influence from the training or
validation process. For all process models in $\mathcal{P}$, we parsed the set
of ground-truth constraints $\mathcal{C}_{true}$. In addition to that, to get
our test event logs $\mathcal{L}_{test}$, we converted the process models in
$\mathcal{P}_{test}$ into workflow nets to automatically generate event logs
using the PM4Py[3] playout functionality. To create an experimental setting
that is as realistic as possible, we then created a noisy version of each
event log by expanding it to 1,000 traces and introducing random noise by
adding, removing or swapping events in selected traces, inspired by prior
works such as [5, 1, 4].

###  4.2 Experimental setup

Implementation. We implemented our approach in Python, using the Huggingface
library [33]. To perform sequence tokenization, we used the efficient T5
tokenizer, provided by the Huggingface tokenzizer library, which is based on
Unigram[19] in conjunction with SentencePiece[20]. We fine-tuned
FLAN-T5-small[9] using the Adam algorithm[17] with a constant learning rate of
$4\times 10^{-5}$. To enhance training stability, we utilized weight decay
fix[21]. Our fine-tuning process included 12 epochs with a batch size of 64
and an evaluation of model performance at 400-step intervals during the
evaluation. To reduce the risk of overfitting, we employed an early stopping
mechanism, terminating the fine-tuning process if the validation loss showed
no improvement for 20 consecutive steps. The experiments were conducted
utilizing two Nvidia RTX A6000 GPUs.

Baseline. We evaluate our method by comparing it to two semantic anomaly
detection and two declarative process discovery techniques.

In the domain of semantic anomaly detection, there are only two noteworthy
works, namely [1] and [8]. We benchmark our approach against the state-of-the-
art techniques introduced by Caspary et al. [8] that are based on BERT and
SVMs, respectively. For our experiments, we adhered to the recommended
hyperparameters. For the SVM-based approach, we employed an RBF kernel with a
C-value of 2 and a vector size of 600. In the case of the BERT-based approach,
we set the learning rate to $5\times 10^{-5}$ with 500 warm-up steps.

Component 2 of our approach involves transforming event logs into declarative
constraints, which allows our method to be compared to any declarative process
discovery technique. To evaluate our approach comprehensively, we therefore
also benchmark it against two established methods in this field: Declare Miner
[22] and MINERful [10]. For the Declare Miner, our experiments used the
implementation described in [15]. We adhered to standard hyperparameters for
our experiments: For the Declare Miner, we set a minimum support of 0.2, an
itemsets support of 0.9, and a maximum declare cardinality of 3. For MINERful,
our configuration included a support threshold of 0.95, a confidence level
threshold of 0.25, and an interest factor threshold of 0.125. Here and
henceforth, we refer to the four approaches as “SVM”, “BERT”, “DecM” and
“MINERful”, respectively, for the sake of simplicity.

Evaluation procedure. Regarding the evaluation procedure, we highlight the
following two aspects.

First, anomaly detection approaches are typically evaluated by assessing their
performance in classifying a trace or event pair as either anomalous or not
anomalous. However, we are interested in explaining undesired behavior using
the defined types of constraints. Therefore, we evaluate our approach based on
its performance in the constraint generation component. Specifically, we
assess how well the approach performs in generating constraints that match the
ground-truth constraints. The results of the constraint generation component
reflect the overall performance of the approach, as the effectiveness of
anomaly detection is directly dependent on the quality of the generated
constraints.

Second, existing semantic anomaly detection approaches, including those from
Caspary et al.[8], are only able to recognize eventually-follows (EvF)
interrelations “$\rightarrow$” between pairs of event labels from an event
log. We use $e_{i}\rightarrow e_{k}$ to denote that event $e_{i}$ occurs
directly or indirectly before event $e_{k}$ in a trace. If the events $e_{i}$
and $e_{k}$ can follow each other in this specific order, this is referred to
as a constraint $e_{i}\rightarrow e_{k}$. However, xSemAD, DecM, MINERful are
able to recognize different types of EvF relationships, represented by the
constraints, and are therefore more fine-grained. In order to still be able to
compare these approaches with Caspary et al.’s approaches, we need to remove
the fine granularity represented by the different constraints and generalize
to EvF constraints. We achieve this by interpreting all constraints that can
express an EvF relationship in an event log as EvF constraint, i.e., Response,
Precedence, Succession, Alternate Succession, Alternate Precedence, Alternate
Response, and Co-Existence444Note that for the comparison with state of the
art in the EvF scenario, every Co-existence constraint is transformed into two
disjunctively chained EvF relationships. In contrast, _Exclusive Choice_ and
_Choice_ constraints cannot be transformed into EvF relationships by any
meaningful interpretation. constraints are interpreted as EvF constraints. For
instance, if the constraint generation component creates the constraints
$Response(e_{i},e_{k})$ and $Succession(e_{j},e_{l})$, we interpret them as
two EvF constraints, namely $e_{i}\rightarrow e_{k}$ and $e_{j}\rightarrow
e_{l}$. To be able to compare all approaches, we can thus compare their
performance in generating EvF constraints. Note that our interpretation of the
declare constraints in terms of EvF relationships is merely a (somewhat naive)
approximation, for the sole purpose to achieve comparability. Still, as the
experiments will show, even with this approximation xSemAD achieves results
that are competitive and outperform the state of the art.

Metrics. We evaluate our approach by comparing the generated constraints
$\mathcal{C}_{pred}$ with the ground-truth constraints $\mathcal{C}_{true}$ in
$\mathcal{L}_{test}$ using precison, recall, and $F_{1}$ score. Let $tp$ be
constraints that are correctly generated and are present in the ground-truth
constraint set, $fp$ the constraints that are incorrectly generated and are
not present in the ground-truth constraint set, and $fn$ be constraints that
are incorrectly not generated but are present in the ground-truth constraint
set. Then precision, recall and $F_{1}$ score are defined as
$\textit{precision}:=\frac{tp}{tp+fp}$, $\textit{recall}:=\frac{tp}{tp+fn}$,
and $\textit{$F_{1}$
score}:=\frac{2\times\textit{precision}\times\textit{recall}}{\textit{precision}+\textit{recall}}$.

###  4.3 Results

This section presents the results of our evaluation experiments. First, we
focus on the role of the threshold parameter $\theta$ in our xSemAD approach.
Then, we conduct a comprehensive performance evaluation comparing xSemAD with
state-of-the-art methods in different scenarios.

(a) Precision

(b) Recall

(c) $F_{1}$-Measure

(d) Legend

Figure 3: Precision, recall, and $F_{1}$ scores for each constraint type and
different $\theta$ values

The role of the threshold parameter in xSemAD. To assess the effectiveness of
our approach, we conducted a comparison of the constraint generation
performance across various constraint types and thresholds $\theta$, as
depicted in Figure 3. The x-axis represents the different $\theta$ values,
while the y-axis shows the precision, recall, and $F_{1}$ scores. Each line
represents a specific constraint type. As shown in Figure 3, precision and
$F_{1}$ scores increase for all types of constraints with an initial rise in
the threshold value up to approximately $\theta=0.8$, followed by a decrease.
Recall decreases continuously with an increase in the threshold value, which
is due to the fact that a higher threshold value leads to fewer generated
constraints. Interestingly, certain constraint types are easier to learn than
others, as shown by the noticeable differences in precision, recall, and
$F_{1}$ scores. In particular, the init and end constraints achieve the best
results, suggesting that our model can effectively recognize start and end
violations within process executions. However, the model has difficulties with
constraint types involving split operations, such as co-existence and choice
constraints, which have significantly lower precision and recall values.
Considering the $F_{1}$ score, the ideal threshold value for all constraint
types lies between 0.7 and 0.85.

Comparison with state of the art. The results presented in Table 1 demonstrate
the performance of xSemAD compared to state-of-the-art semantic anomaly
detection and declarative process discovery methods across two different
scenarios. The comparison includes the SVM and BERT approaches from Caspary et
al.[8], MINERful[10], DecM[22], and our xSemAD approach. To evaluate xSemAD on
the test set $\mathcal{P}_{test}$, we determined the threshold $\theta^{*}$ by
choosing $\theta$ such that it maximizes the $F_{1}$ score on the validation
set $\mathcal{P}_{validation}$. The table outlines the average precision,
recall, and $F_{1}$ scores on $\mathcal{L}_{test}$ for each approach,
providing insights on their effectiveness and differences. The scenarios
covered in the table can be broadly categorized into two groups: (i) EvF
interrelations: In this scenario, we evaluate the ability of each approach to
identify interrelations between event labels in the form of EvF constraints.
(ii) Specific constraint: This group of scenarios evaluates the performance of
each approach in identifying different types of constraints (e.g., _Init,
Choice, Exclusive Choice_ , etc.). In Section 2, we described how anomaly
detection can be performed at three different levels. Scenario (i) focuses on
detecting anomalies at the event level, while scenario (ii) focuses on
detecting anomalies at the constraint level. When analyzing the results across
the different scenarios shown in Table 1, several important findings can be
made.

First, for the EvF scenario (i), xSemAD significantly outperforms the other
methods, achieving the highest precision (0.63), recall (0.78), and $F_{1}$
scores (0.67). This indicates xSemAD’s superior capability in identifying EvF
constraints, highlighting its effectiveness in capturing semantic
relationships between events. The SVM and BERT approaches both record
identical precision, recall, and $F_{1}$ scores (0.37, 0.70, and 0.46,
respectively). MINERful and DecM also exhibit similar performances when
compared to each other.

Second, in the detailed analysis of specific constraint types (scenario (ii)),
the performance varies across different types of constraints. For initiation
(Init) and end (End) constraints, DecM shows the best performance overall.
However, for the End constraint, xSemAD leads slightly in precision and
matches closely in recall and $F_{1}$ score with DecM. This underscores the
strength of xSemAD and DecM in capturing the beginning and end characteristics
of event logs. xSemAD consistently outperforms other approaches on more
complex constraints, i.e., Response (Resp), Alternate Response (AltResp),
Succession (Succ), Alternate Succession (AltSucc), Precedence (Prec),
Alternate Precedence (AltPrec), Choice (Ch), Exclusive Choice (ExCh) and Co-
Existence (CoEx). Overall, it achieves the highest values for precision,
recall and $F_{1}$ for these complex constraint types, demonstrating its
comprehensive ability to model various relationships between events.

Third, comparing the performance of MINERful, DecM, and xSemAD in generating
complex constraints, we observe that MINERful and DecM often achieve high
recall at the expense of precision. This indicates their tendency to over-
generalize, identifying many constraints as relevant, which leads to a higher
number of false positives. xSemAD, however, demonstrates a balanced
performance with consistently high precision and recall across various
constraint types, showing its effectiveness in accurately identifying true
constraints without over-generalizing. The difference in performance can be
partly attributed to the hyperparameter settings of MINERful and DecM, which
influence the precision-recall trade-off. Adjusting these parameters might
improve one metric at the cost of the other. As a result, it is unlikely that
MINERful and DecM with other hyperparameters will achieve better results than
xSemAD.

In summary, while MINERful and DecM might show promise in recall, their low
precision in complex constraint types highlights a significant limitation. In
contrast, xSemAD’s consistent and balanced performance underscores its
superior capability in semantic anomaly detection, suggesting that even with
optimal hyperparameter adjustments, MINERful and DecM are unlikely to match
xSemAD’s overall effectiveness in accurately detecting and explaining
anomalies in process executions.

| Scenario | SVM[8] | BERT[8] | MINERful[10] | DecM[22] | xSemAD($\theta^{*})$
---|---|---|---|---|---|---
|  | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$
(i) | EvF | 0.37 | 0.70 | 0.46 | 0.37 | 0.70 | 0.46 | 0.37 | 0.69 | 0.46 | 0.37 | 0.69 | 0.46 | 0.63 | 0.78 | 0.67
(ii) | Init | - | - | - | - | - | - | 0.20 | 0.85 | 0.31 | 0.76 | 0.81 | 0.76 | 0.63 | 0.76 | 0.66
| End | - | - | - | - | - | - | 0.24 | 0.84 | 0.35 | 0.69 | 0.76 | 0.70 | 0.70 | 0.73 | 0.69
| Resp | - | - | - | - | - | - | 0.07 | 0.68 | 0.12 | 0.10 | 0.68 | 0.16 | 0.55 | 0.64 | 0.56
| AltResp | - | - | - | - | - | - | 0.07 | 0.68 | 0.12 | 0.02 | 0.06 | 0.02 | 0.52 | 0.68 | 0.54
| Succ | - | - | - | - | - | - | 0.14 | 0.68 | 0.22 | - | - | - | 0.55 | 0.65 | 0.55
| AltSucc | - | - | - | - | - | - | 0.14 | 0.68 | 0.22 | - | - | - | 0.51 | 0.70 | 0.54
| Prec | - | - | - | - | - | - | 0.09 | 0.70 | 0.14 | 0.13 | 0.70 | 0.20 | 0.51 | 0.74 | 0.56
| AltPrec | - | - | - | - | - | - | 0.09 | 0.70 | 0.14 | 0.03 | 0.06 | 0.03 | 0.47 | 0.75 | 0.52
| Ch | - | - | - | - | - | - | - | - | - | 0.15 | 0.70 | 0.24 | 0.47 | 0.57 | 0.46
| ExCh | - | - | - | - | - | - | - | - | - | - | - | - | 0.43 | 0.69 | 0.48
| CoEx | - | - | - | - | - | - | 0.31 | 0.68 | 0.39 | - | - | - | 0.58 | 0.74 | 0.60
Table 1: Performance comparison of SVM, BERT, Minerful, DecM, and xSemAD
across different scenarios on $\mathcal{L}_{test}$.

Generalizability of xSemAD. To address concerns of circularity—where a model’s
performance is artificially inflated due to its familiarity with the training
data— we evaluated the robustness of xSemAD on a test set
$\mathcal{P^{*}}_{test}\subset\mathcal{P}_{test}$ consisting of 355 models,
which comprises entirely unseen process model labels, distinct from those in
the training and validation sets, i.e., the labels in
$\mathcal{P}_{train}\cup\mathcal{P}_{validation}$ and the labels in
$\mathcal{P^{*}}_{test}$ have no overlap. This methodological rigor ensures
that the performance reflects the actual ability of the model to generalize
and not just the characteristics of the training data.

In general, this scenario represents a considerable challenge for anomaly
detection approaches, as they face detection situations that are completely
unfamiliar to them. If xSemAD has to generate constraints for labels that it
has not yet seen in training, it is less confident in constraint generation,
so that the generated constraints have lower probabilities. In this scenario,
it may thus make sense to choose a less restrictive threshold. Therefore, in
addition to the threshold $\theta^{*}$=0.73 determined on the validation set,
we also tested the model with the heuristically determined threshold
$\theta=0.65$.

While the results on the unseen data are naturally lower, due to the
challenging nature of this scenario, the results, shown in Table 2, confirm
that xSemAD effectively generalizes from the training set. It demonstrates
superior performance compared to SVM, BERT, MINERful, and DecM, particularly
in scenarios assessing EvF interrelations and various specific constraint
types. Overall, the experiments in this scenario validate xSemAD’s
capabilities in detecting complex semantic anomalies, establishing its
efficacy for industrial applications where model adaptability is crucial.

| Scenario | SVM/BERT[8] | MINERful[10] | DecM[22] |  xSemAD($\theta^{*}$) |  xSemAD($\theta=0.65$)
---|---|---|---|---|---|---
|  | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$ | Prec. | Rec. | $F_{1}$
(i) | EvF | 0.32 | 0.61 | 0.40 | 0.32 | 0.60 | 0.40 | 0.32 | 0.60 | 0.40 | 0.53 | 0.74 | 0.58 | 0.50 | 0.79 | 0.57
(ii) | Init | - | - | - | 0.20 | 0.79 | 0.31 | 0.70 | 0.77 | 0.71 | 0.37 | 0.60 | 0.43 | 0.36 | 0.71 | 0.45
| End | - | - | - | 0.24 | 0.72 | 0.34 | 0.58 | 0.64 | 0.59 | 0.50 | 0.57 | 0.49 | 0.45 | 0.68 | 0.50
| Resp | - | - | - | 0.05 | 0.50 | 0.09 | 0.08 | 0.50 | 0.12 | 0.22 | 0.36 | 0.25 | 0.19 | 0.47 | 0.25
| AltResp | - | - | - | 0.05 | 0.50 | 0.09 | 0.01 | 0.03 | 0.01 | 0.20 | 0.39 | 0.24 | 0.18 | 0.52 | 0.24
| Succ | - | - | - | 0.12 | 0.60 | 0.18 | - | - | - | 0.25 | 0.49 | 0.29 | 0.23 | 0.58 | 0.30
| AltSucc | - | - | - | 0.12 | 0.60 | 0.18 | - | - | - | 0.24 | 0.53 | 0.29 | 0.22 | 0.59 | 0.28
| Prec | - | - | - | 0.10 | 0.62 | 0.16 | 0.14 | 0.61 | 0.21 | 0.26 | 0.59 | 0.32 | 0.21 | 0.67 | 0.30
| AltPrec | - | - | - | 0.10 | 0.62 | 0.16 | 0.02 | 0.04 | 0.02 | 0.24 | 0.61 | 0.31 | 0.21 | 0.66 | 0.29
| Ch | - | - | - | - | - | - | 0.14 | 0.59 | 0.22 | 0.29 | 0.54 | 0.34 | 0.25 | 0.63 | 0.33
| ExCh | - | - | - | - | - | - | - | - | - | 0.25 | 0.59 | 0.31 | 0.18 | 0.70 | 0.26
| CoEx | - | - | - | 0.28 | 0.61 | 0.35 | - | - | - | 0.43 | 0.68 | 0.47 | 0.39 | 0.73 | 0.46
Table 2: Performance comparison of SVM, BERT, Minerful, DecM, and xSemAD across different scenarios on only unseen data. | SVM[8] | BERT[8] | MINERful[10] | DecM[22] | xSemAD
---|---|---|---|---|---
Training time (min) | 3.4 | 274.8 | - | - | 13620.1
Inference time (sec) | 11.23 | 2.98 | 1.91 | 17.26 | 3.60
Table 3: Training and average inference times of our approach and the
baselines.

Computation time. Table 3 outlines the training and inference times for xSemAD
compared to the baseline models. _Training time_ is defined as the duration
required to train the model using $\mathcal{P}_{train}$, excluding load and
preprocessing times. _Inference time_ is defined as the average time it takes
to generate the constraints per event log in $\mathcal{L}_{test}$. The SVM-
based model requires 3.4 minutes for training, while the BERT-based model
takes approximately 274.8 minutes (about 4.5 hours) to fine-tune over three
epochs. MINERful and DecM do not involve a training phase. xSemAD requires a
significantly longer training time of 13620.1 minutes (approximately 227
hours); however, this is a one-time process, after which any number of event
logs—even in several process domains and organizations—can be analyzed. It is
important to asses per use case whether the substantial performance
improvement justifies the extended training time. Also, since our
implementation is prototypical, it can be assumed that the training time can
be shortened considerably for an application in practice, e.g., by optimizing
the learning rate. Regarding inference time, all models demonstrate rapid
performance, with xSemAD averaging 3.6 seconds per constraints generation of
logs.

Real-world application. We also applied our approach to the international
declarations log[16] from the BPI 2020 challenge, encompassing 6449 traces and
72151 events related to travel expense claims. Although there is no gold
standard available to indicate true anomalies in this process, we conducted a
qualitative assessment using a similar approach to [8, 1]. Table 4 focuses on
key constraints that highlight notable aspects of the process. For instance,
$a_{1}$ highlights the need for approvals before the trip concludes. $a_{2}$
shows a corrective mechanism where rejected declarations are eventually
approved after adjustments. $a_{3}$ and $a_{4}$ confirm the necessity of
approvals before payment requests. In summary, this analysis reveals critical
insights into the process flow of travel expense claims, highlighting the
importance of approvals, sequential dependencies, and potential areas for
process improvement.

id | detected anomalies by xSemAD | Frequency
---|---|---
$a_{1}$ | Alternate Response(declaration approved by supervisor, end trip) | 9
$a_{2}$ | Response(declaration rejected by supervisor, declaration approved by supervisor) | 114
$a_{3}$ | Succession(declaration approved by supervisor, request payment) | 244
$a_{4}$ | Alternate Precedence(request payment, declaration approved by supervisor) | 246
Table 4: Selected anomalies detected for the international declarations
log[16].

##  5 Related Work

Our research is at the intersection of anomaly detection and declarative
process discovery, with a particular focus on the extraction of declarative
process models from event logs in the latter domain.

Declarative process discovery has been significantly advanced by methods such
as Declare Miner[22], which initially employed a brute-force strategy. It
evolved through significant enhancements [23, 24] inspired by the Apriori
algorithm and the adoption of parallel processing techniques. Following
Declare Miner, MINERful[10] emerged as a noteworthy advancement, introducing
substantial efficiency improvements. Later it has been extended with features
for better efficiency, and accuracy. This includes adding flexibility through
target-branched constraints[11], streamlining by cutting redundancies[12], and
focusing on impactful constraints by removing non-meaningful ones[13].

In the area of anomaly detection, the task of identifying undesirable behavior
in the absence of normative process models is of crucial importance. This area
of research can be roughly divided into frequency-based and semantic
approaches.

Frequency-based approaches rely on statistical analyses to detect events that
are rare or deviate significantly from established patterns within a data set.
Examples are based on autoencoders [18, 26], LSTM [18] or sampling [5]. One of
the state-of-the-art methods in this area is BINet[28], which is a deep
learning approach that uses a neural network architecture for anomaly
detection. As the authors demonstrate, BINet outperforms other available
methods like approaches based on sliding windows [31], SVMs, denoising
autoencoders [27], and likelihood graphs [6]. However, it is crucial to note
that rarity detected by these methods does not necessarily mean
undesirability. Recognizing that infrequency alone does not cover the spectrum
of anomalies led to the development of the concept of semantic anomaly
detection. In this paper, we present a novel, explainable approach targeting
the constraint level. Nevertheless, we consider frequency-based approaches as
complementary to ours, since frequency-based approaches tend to find different
types of anomalies.

Semantic approaches involve identifying behavior that stands out from a
semantic perspective, considering the meaning or context of the event labels.
As the first approach of its kind, Van der Aa et al. [1] proposed a rule-based
method for identifying undesirable behavior in event logs. However, a
limitation of this method is its ability to only detect anomalies within label
pairs that share the same business object. Addressing this limitation, Caspary
et al.[8] proposed two alternative approaches—based on BERT and SVMs—to
enhance semantic-anomaly detection. These methods offer a broader scope by
enabling the detection of semantic anomalies beyond label pairs associated
with a common business object. This approach, however, can only detect
anomalies on the event level. As discussed earlier, we set out to overcome the
limitations of these approaches. We argue that semantic anomaly detection
technique need to provide explainable results, i.e. target the constraint
level. Our approach is further able to generalize from the behavior it was
trained as it considers the context of a trace.

##  6 Conclusion and Future Work

In this paper, we introduced xSemAD, which is the first semantic anomaly
detection approach that can effectively target the trace, event, and
constraint level without imposing limiting assumptions on the input event log.
Through the use of a fine-tuned seq2seq model for constraint generation, it
provides explanatory capability. The core idea of xSemAD is to take an
existing process model repository as input and use it to fine-tune the seq2seq
model. In this way, the fine-tuned model learns constraints, i.e., in which
order certain activities should be executed. By then checking to what extent
these constraints are respected by a given event log, we are able to detect
semantic anomalies. Our approach demonstrated its effectiveness through
extensive evaluation on a large industry dataset, effectively generating
relevant constraints and outperforming existing state-of-the-art methods such
as SVM, BERT, MINERful, and Declare Miner. While our paper addresses anomaly
detection in event logs, it also represents a first step towards the discovery
of temporal patterns from event logs using seq2seq models.

However, our research is not without limitation. One potential limitation is
the dependency on the quality and comprehensiveness of the process model
repository used for fine-tuning. If the repository does not cover a wide range
of possible process variations, the model may not learn all relevant
constraints, leading to incomplete anomaly detection. Another limitation is
the computational cost associated with training the model. It is important to
consider whether the performance justifies the extended training period. In
addition, the overlap of xSemAD with the areas of temporal pattern discovery
and declarative constraints leads to several critical considerations that we
want to address in future work. To further increase effectiveness and
accuracy, future efforts will focus on ensuring that the constraints generated
by xSemAD preserve temporal semantics and do not lead to the formulation of
infeasible constraints. Furthermore, exploring xSemAD’s adaptability to
different types of constraints beyond the specific declare constraints could
provide deeper insights into the behavior of complex processes. The use of
large language models also opens up several possibilities for incorporating
the data perspective into the detection of anomalies. In addition, a promising
avenue for future research could be a hybrid approach, where frequency-based
and semantic-based approaches complement each other. While frequency-based
approaches for declarative process mining or anomaly detection completely rely
on patterns in the data, semantic approaches leverage semantic knowledge that
goes beyond the given data. Combing these approaches could lead to a more
holistic data understanding and improved anomaly detection.

Acknowledgment. Part of this research was funded by the Deutsche
Forschungsgemeinschaft (DFG, German Research Foundation) – Project No.
528177077.

## References

  * [1] van der Aa, H., Rebmann, A., Leopold, H.: Natural language-based detection of semantic execution anomalies in event logs. Information Systems 102, 101824 (2021)
  * [2] Bergman, A., Rebmann, A., Kampik, T.: Bpmn2constraints: breaking down bpmn diagrams into declarative process query constraints. In: BPM 2023, 21st International Conference on Business Process Management, Utrecht, the Netherlands, September 11-15, 2023. pp. 137–141. Aachen University (2023)
  * [3] Berti, A., Van Zelst, S.J., van der Aalst, W.: Process mining for python (pm4py): bridging the gap between process-and data science. arXiv preprint arXiv:1905.06169 (2019)
  * [4] Bezerra, F., Wainer, J.: Anomaly detection algorithms in logs of process aware systems. In: Proceedings of the 2008 ACM symposium on Applied computing. pp. 951–952 (2008)
  * [5] Bezerra, F., Wainer, J.: Algorithms for anomaly detection of traces in logs of process aware information systems. Information Systems 38(1), 33–44 (2013)
  * [6] Böhmer, K., Rinderle-Ma, S.: Multi-perspective anomaly detection in business process execution events. In: OTM Confederated International Conferences” On the Move to Meaningful Internet Systems”. pp. 80–98. Springer (2016)
  * [7] Caron, F., Vanthienen, J., Baesens, B.: Comprehensive rule-based compliance checking and risk management with process mining. Decision Support Systems 54(3), 1357–1369 (2013)
  * [8] Caspary, J., Rebmann, A., van der Aa, H.: Does this make sense? machine learning-based detection of semantic anomalies in business processes. In: International Conference on Business Process Management. pp. 163–179. Springer (2023)
  * [9] Chung, H.W., Hou, L., Longpre, S., Zoph, B., Tay, Y., Fedus, W., Li, E.e.a.: Scaling instruction-finetuned language models (2022)
  * [10] Ciccio, C.D., Mecella, M.: On the discovery of declarative control flows for artful processes. ACM Transactions on Management Information Systems (TMIS) 5(4), 1–37 (2015)
  * [11] Di Ciccio, C., Maggi, F.M., Mendling, J.: Efficient discovery of target-branched declare constraints. Information Systems 56, 258–283 (2016)
  * [12] Di Ciccio, C., Maggi, F.M., Montali, M., Mendling, J.: Resolving inconsistencies and redundancies in declarative process models. Information Systems 64, 425–446 (2017)
  * [13] Di Ciccio, C., Maggi, F.M., Montali, M., Mendling, J.: On the relevance of a business constraint to an event log. Information Systems 78, 144–161 (2018)
  * [14] Di Ciccio, C., Montali, M.: Declarative Process Specifications: Reasoning, Discovery, Monitoring, pp. 108–152. Springer International Publishing, Cham (2022)
  * [15] Donadello, I., Riva, F., Maggi, F.M., Shikhizada, A.: Declare4py: A python library for declarative process mining. In: BPM (PhD/Demos). CEUR Workshop Proceedings, vol. 3216, pp. 117–121. CEUR-WS.org (2022)
  * [16] van Dongen, B.: Bpi challenge 2020: International declarations (2020). https://doi.org/10.4121/uuid:2bbf8f6a-fc50-48eb-aa9e-c4ea5ef7e8c5
  * [17] Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings (2015)
  * [18] Krajsic, P., Franczyk, B.: Semi-supervised anomaly detection in business process event data using self-attention based classification. Procedia Computer Science 192, 39–48 (2021)
  * [19] Kudo, T.: Subword regularization: Improving neural network translation models with multiple subword candidates. In: Gurevych, I., Miyao, Y. (eds.) ACL (1). pp. 66–75. Association for Computational Linguistics (2018)
  * [20] Kudo, T., Richardson, J.: Sentencepiece: A simple and language independent subword tokenizer and detokenizer for neural text processing. CoRR abs/1808.06226 (2018)
  * [21] Loshchilov, I., Hutter, F.: Decoupled weight decay regularization. In: International Conference on Learning Representations (2018)
  * [22] Maggi, F.M., Bose, R.J.C., van der Aalst, W.M.: Efficient discovery of understandable declarative process models from event logs. In: Advanced Information Systems Engineering: 24th International Conference, CAiSE 2012, Gdansk, Poland, June 25-29, 2012. Proceedings 24. pp. 270–285. Springer (2012)
  * [23] Maggi, F.M., Di Ciccio, C., Di Francescomarino, C., Kala, T.: Parallel algorithms for the automated discovery of declarative process models. Information Systems 74, 136–152 (2018)
  * [24] Maggi, F.M., Montali, M., Westergaard, M., Van Der Aalst, W.M.: Monitoring business constraints with linear temporal logic: An approach based on colored automata. In: Business Process Management: 9th International Conference, BPM 2011, Clermont-Ferrand, France, August 30-September 2, 2011. Proceedings 9. pp. 132–147. Springer (2011)
  * [25] Munoz-Gama, J., et al.: Conformance checking and diagnosis in process mining. Springer (2016)
  * [26] Nolle, T., Luettgen, S., Seeliger, A., Mühlhäuser, M.: Analyzing business process anomalies using autoencoders. Machine Learning 107, 1875–1893 (2018)
  * [27] Nolle, T., Seeliger, A., Mühlhäuser, M.: Unsupervised anomaly detection in noisy business process event logs using denoising autoencoders. In: International conference on discovery science. pp. 442–456. Springer (2016)
  * [28] Nolle, T., Seeliger, A., Mühlhäuser, M.: Binet: multivariate business process anomaly detection using deep learning. In: International Conference on Business Process Management. pp. 271–287. Springer (2018)
  * [29] Rozinat, A., Van der Aalst, W.M.: Conformance checking of processes based on monitoring real behavior. Information Systems 33(1), 64–95 (2008)
  * [30] Sola, D., Warmuth, C., Schäfer, B., Badakhshan, P., Rehse, J.R., Kampik, T.: Sap signavio academic models: A large process model dataset. In: International Conference on Process Mining. pp. 453–465. Springer (2022)
  * [31] Warrender, C., Forrest, S., Pearlmutter, B.: Detecting intrusions using system calls: Alternative data models. In: Proceedings of the 1999 IEEE symposium on security and privacy (Cat. No. 99CB36344). pp. 133–145. IEEE (1999)
  * [32] Weske, M., Decker, G., Dumas, M., La Rosa, M., Mendling, J., Reijers, H.A.: Model Collection of the Business Process Management Academic Initiative (Apr 2020), https://doi.org/10.5281/zenodo.3758705
  * [33] Wolf, T., Debut, L., Sanh, V., Chaumond, J., Delangue, C., Moi, A., Cistac, P., Rault, T., Louf, R., Funtowicz, M., Brew, J.: Huggingface’s transformers: State-of-the-art natural language processing. CoRR abs/1910.03771 (2019)