Anomaly detection in process mining aims to recognize outlying or unexpected behavior in event logs for purposes such as the removal of noise and identification of conformance violations. Existing techniques for this task are primarily frequency-based, arguing that behavior is anomalous because it is uncommon. However, such techniques ignore the semantics of recorded events and, therefore, do not take the meaning of potential anomalies into consideration. In this work, we overcome this caveat and focus on the detection of anomalies from a semantic perspective, arguing that anomalies can be recognized when process behavior does not make sense. To achieve this, we propose an approach that exploits the natural language associated with events. Our key idea is to detect anomalous process behavior by identifying semantically inconsistent execution patterns. To detect such patterns, we first automatically extract business objects and actions from the textual labels of events. We then compare these against a process-independent knowledge base. By populating this knowledge base with patterns from various kinds of resources, our approach can be used in a range of contexts and domains. We demonstrate the capability of our approach to successfully detect semantic execution anomalies through an evaluation based on a set of real-world and synthetic event logs and show the complementary nature of semantics-based anomaly detection to existing frequency-based techniques.

过程挖掘中的异常检测旨在识别事件日志中的异常或意外行为，以便消除噪音和识别违规行为。这项任务的现有技术主要是基于频率的，认为行为是异常的，因为它不常见。然而，这些技术忽略了记录事件的语义，因此没有考虑潜在异常的含义。在这项工作中，我们克服了这一警告并专注于从语义角度检测异常，认为当过程行为没有意义时可以识别异常. 为了实现这一点，我们提出了一种利用与事件相关的自然语言的方法。我们的关键思想是通过识别语义不一致的执行模式来检测异常进程行为。为了检测此类模式，我们首先从事件的文本标签中自动提取业务对象和操作。然后，我们将这些与独立于流程的知识库进行比较。通过用来自各种资源的模式填充这个知识库，我们的方法可以在一系列上下文和领域中使用。我们展示了我们的方法通过基于一组真实世界和合成事件日志的评估成功检测语义执行异常的能力，并展示了基于语义的异常检测与现有基于频率的技术的互补性。