Graph encoders for business process anomaly detection

Patent metadata

Field	Value
Publication number	US-11928629-B2
Application number	US-202217664719-A
Country	US
Kind code	B2
Filing date	May 24, 2022
Priority date	May 24, 2022
Publication date	Mar 12, 2024
Grant date	Mar 12, 2024

Abstract

A method, computer system, and a computer program product for anomaly detection is provided. The present invention may include converting business process logs into a graphical data structure. The present invention may include generating an optimized graph encoding for anomaly detection using an unsupervised machine learning model. The present invention may include computing an anomaly score for each activity of the business process log using a process aware metric based on feature representation. The present invention may include labeling each of the one or more data points with a high anomaly score.

First claim

What is claimed is:

1. A method for anomaly detection, the method comprising:
converting, by a processor, business process logs into a graphical data structure;
generating, by the processor, an optimized graph encoding for anomaly detection using an unsupervised machine learning method, wherein the optimized graph encoding is a result of continuously altering a graph encoding throughout a training process;
updating, by the processor, one or more hyperparameters of a graph autoencoder (GAE) using at least one or more learning rate optimization algorithms and a set of anomalous data, wherein the GAE simplifies the training process by recreating abstract structural process information;
computing, by the processor, an anomaly score for each activity of the business process log using a process aware metric-based on a feature representation; and
labeling, by the processor, each of one or more data points with a high anomaly score.

2. The method of claim 1 , wherein generating the optimized graph encoding for anomaly detection includes applying a graph neural network (GNN) with an edge-conditioned convolution (ECC).

3. The method of claim 2 , wherein computing the anomaly score includes a reconstruction loss from the GAE, wherein the reconstruction loss is minimized through backpropagation.

4. The method of claim 1 , wherein the high anomaly score is determined in comparison to an anomaly threshold value, wherein the anomaly threshold value is determined based on an average reconstruction error in a validation phase.

5. The method of claim 4 , further comprising:
alerting, by the processor, a user using one or more notifications for each of the one or more data points with the high anomaly score, wherein the one or more notifications are presented to the user utilizing one or more different methods depending on a difference between the high anomaly score and the anomaly threshold for each of the one or more data points.

6. The method of claim 1 , further comprising:
utilizing, by the processor, a reconstructed process graph with edge probability to interpret an anomaly case; wherein the reconstructed process graph is displayed to a user in an anomaly detection user interface.

7. The method of claim 1 , wherein converting the business process logs into the graphical data structure further comprises:
building, by the processor, a directed graph, wherein activities from the business process logs are utilized as nodes and edges within the directed graph correspond to every pair of adjacent events in a time ordered trace.

8. The method of claim 1 , further comprising:
providing, by the processor, one or more insights as to the nature of the one or more data points labeled as anomalies, wherein the one or more insights are provided to a user within an anomaly user interface.

9. The method of claim 8 , wherein the one or more insights includes at least a recommendation detailing how to resolve the one or more datapoints labeled as anomalies based on a comparison of publicly available business process event logs stored in a knowledge corpus with the business process event logs received from the user.

10. A computer system for anomaly detection, comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
converting business process logs into a graphical data structure;
generating an optimized graph encoding for anomaly detection using an unsupervised machine learning method, wherein the optimized graph encoding is a result of continuously altering a graph encoding throughout a training process;
updating one or more hyperparameters of a graph autoencoder (GAE) using at least one or more learning rate optimization algorithms and a set of anomalous data, wherein the GAE simplifies the training process by recreating abstract structural process information;
computing an anomaly score for each activity of the business process log using a process aware metric-based on a feature representation; and
labeling each of one or more data points with a high anomaly score.

11. The computer system of claim 10 , wherein generating the optimized graph encoding for anomaly detection includes applying a graph neural network (GNN) with an edge-conditioned convolution (ECC).

12. The computer system of claim 11 , wherein computing the anomaly score includes a reconstruction loss from the GAE, wherein the reconstruction loss is minimized through backpropagation.

13. The computer system of claim 10 , wherein the high anomaly score is determined in comparison to an anomaly threshold value, wherein the anomaly threshold value is determined based on an average reconstruction error in a validation phase.

14. The computer system of claim 10 , further comprising:
program instructions, stored on at least one of the one or more computer-readable storage media for execution by at least one of the one or more processors via at least one of the one or more memories, to utilize a reconstructed process graph with edge probability to interpret an anomaly case; wherein the reconstructed process graph is displayed to a user in an anomaly detection user interface.

15. The computer system of claim 10 , further comprising:
program instructions, stored on at least one of the one or more computer-readable storage media for execution by at least one of the one or more processors via at least one of the one or more memories, to build a directed graph, wherein activities from the business process logs are utilized as nodes and edges within the directed graph correspond to every pair of adjacent events in a time ordered trace.

16. A computer program product for anomaly detection, comprising:
one or more non-transitory computer-readable storage media and program instructions stored on at least one of the one or more tangible storage media, the program instructions executable by a processor to cause the processor to perform a method comprising:
converting business process logs into a graphical data structure;
generating an optimized graph encoding for anomaly detection using an unsupervised machine learning method, wherein the optimized graph encoding is a result of continuously altering a graph encoding throughout a training process;
updating one or more hyperparameters of a graph autoencoder (GAE) using at least one or more learning rate optimization algorithms and a set of anomalous data, wherein the GAE simplifies the training process by recreating abstract structural process information;
computing an anomaly score for each activity of the business process log using a process aware metric-based on a feature representation; and
labeling each of one or more data points with a high anomaly score.

17. The computer program product of claim 16 , wherein generating the optimized graph encoding for anomaly detection includes applying a graph neural network (GNN) with an edge-conditioned convolution (ECC).

18. The computer program product of claim 17 , wherein computing the anomaly score includes a reconstruction loss from the GAE, wherein the reconstruction loss is minimized through backpropagation.

19. The computer program product of claim 16 , wherein the high anomaly score is determined in comparison to an anomaly threshold value, wherein the an

Assignees

• IBM

Inventors

• Huo Siyu
• Reddy Prabhat Maddikunta
• Isahagian Vatche
• Muthusamy Vinod
• Agarwal Prerna

Classifications

• G06Q10/0633 Primary

  Workflow analysis · CPC title

• G06N3/088

  Non-supervised learning, e.g. competitive learning · CPC title

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title

• G06N3/0455

  Auto-encoder networks; Encoder-decoder networks · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title