Detecting anomalous process behavior

Patent metadata

Field	Value
Publication number	US-9633198-B2
Application number	US-201414181188-A
Country	US
Kind code	B2
Filing date	Feb 14, 2014
Priority date	Jul 13, 2007
Publication date	Apr 25, 2017
Grant date	Apr 25, 2017

Abstract

A method for learning a process behavior model based on a process past instances and on one or more process attributes, and a method for detecting an anomalous process using the corresponding process behavior model.

First claim

The invention claimed is:

1. A method for monitoring executed process instances of a business process workflow, each process instance indicating an occurrence of the business process workflow and a sequence of events of a first process instance indicating a behavior of the first process instance, the method comprising:
identifying, by a server computer, a learned behavior model of the business process workflow, wherein the learned behavior model is a Weighted Finite State Transducer;
determining, by the server computer, based on the learned behavior model, the first process instance, wherein the first process instance is running;
determining, by the server computer, for the first process instance, a sequence of events for a second process instance;
calculating, by the server computer, a likelihood as a sum of weights along the sequence of events, the likelihood including only the weights associated with already executed activities;
determining, by the server computer, whether the likelihood is above a threshold value;
responsive to determining the likelihood is not above the threshold value, reporting, by the server computer, the sequence of events as anomalous behavior.

2. The method of claim 1 , further comprising:
responsive to determining the likelihood is above the threshold value, proceeding, by the server computer, to a first step on a third process instance.

3. The method of claim 1 , wherein the learned behavior is associated with at least one attribute value, and comprises a set of paths, wherein a path comprises a set of nodes and a set of transitions and a union of the paths form a directed graph corresponding to the business process workflow.

4. The method of claim 1 , wherein the likelihood is obtained by multiplying the weights together.

5. The method of claim 1 , further comprising:
determining, by the server computer, a plurality of attributes of the first process instance;
determining, by the server computer, a cluster to which the first process instance belongs;
determining, by the server computer, whether the first process instance enters a new state;
responsive to determining the first process instance enters the new state, calculating, by the server computer, a probability that each of a plurality of process instances in the cluster proceed through each of a same set of states that the first process instance proceeds through;
determining, by the server computer, whether the probability is above a threshold value; and
responsive to determining the probability is not above the threshold value, alerting, by the server computer, a user that the first process instance is anomalous.

Assignees

• IBM

Inventors

• El-Rafei Sherif M E
• Farahat Ahmed K
• Hassan Hany M
• Mahfouz Tamer A

Classifications

• G06Q10/00

  Administration; Management · CPC title

• G06N7/00

  Computing arrangements based on specific mathematical models · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/0715 Primary

  in a system implementing multitasking (multitasking per se G06F9/46) · CPC title

• G06F21/50 Primary

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title