The presence of anomalous information in a business process event log, such as missing, duplicated or swapped events, hampers the possibility of extracting useful insights from event log analysis. A number of approaches exist in the literature to detect anomalous cases in event logs based on different paradigms, such as probabilistic, distance-based or reconstruction-based anomaly detection. This paper proposes a novel method for anomaly detection in event logs based on the information-theoretic paradigm, which has not been considered before in event log anomaly detection. In particular, we propose an anomaly score for cases of a process based on statistical leverage and three different methods to set the anomaly detection threshold. The proposed approach does not require large data sets to train machine learning models, which are necessary for instance in reconstruction-based approaches. The proposed approach shows remarkable anomaly detection capability in experiments conducted using publicly available event logs in respect of existing methods in the literature. One of the proposed anomaly detection thresholds also shows to handle variable case anomaly ratios more effectively than other methods in the literature.

业务流程事件日志中异常信息的存在，例如丢失，重复或交换的事件，阻碍了从事件日志分析中提取有用的见解的可能性。文献中存在许多基于不同范例来检测事件日志中异常情况的方法，例如概率，基于距离或基于重建的异常检测。本文提出了一种基于信息论范式的事件日志异常检测新方法，这在事件日志异常检测中还没有被考虑过。特别是，我们基于统计杠杆作用和三种不同的方法来设置异常检测阈值，从而为流程案例提供异常评分。提出的方法不需要大量的数据集来训练机器学习模型，例如，在基于重建的方法中这是必需的。相对于文献中的现有方法，所提出的方法在使用公开事件日志进行的实验中显示出卓越的异常检测能力。提出的异常检测阈值之一也显示出比文献中的其他方法更有效地处理各种情况下的异常率。