基于自注意力和Bi-LSTM的业务流程异常检测模型  

Anomaly Detection Model for Business Process Based on Self-attention and Bi-LSTM

作　　者：陈国威 卢可 CHEN Guowei;LU Ke(School of Mathematics and Big Data,Anhui University of Science and Technology,Anhui Huainan 232001,China;Anhui Province Engineering Laboratory for Big Data Analysis and Early Warning Technology of Coal Mine Safety,Anhui Huainan 232001,China)

机构地区：[1]安徽理工大学数学与大数据学院,安徽淮南232001 [2]安徽省煤矿安全大数据分析和预警技术工程实验室,安徽淮南232001

出　　处：《重庆工商大学学报(自然科学版)》2025年第2期112-119,共8页Journal of Chongqing Technology and Business University:Natural Science Edition

基　　金：国家自然科学基金资助项目(61402011);安徽省重点研究与开发计划项目(2022A05020005).

摘　　要：业务流程中的一项重要工作是进行数据的异常检测,它可以用于监控和识别企业或组织中出现的异常情况。目的针对目前业务流程异常检测方法大多数只考虑控制流,并未考虑事件日志中其他数据属性对业务流程影响的情况,提出一个多视角无监督异常检测模型。方法首先,将控制流和数据流分别进行处理,然后拼接形成可以输入到模型中的数据类型;其次,利用自注意力机制和Bi-LSTM自编码器组合成的模型,分别对控制流视角和数据流视角进行业务流程事件日志的特征提取,并进行拼接和异常检测,异常阈值由自编码器的重构误差来确定;最后将提出的模型在公共数据集上进行了验证。结果用真实事件日志对提出的方法进行评估,与其他方法进行对比分析可知,所提出的方法在精确度、召回率和F1分数3个方面都有较好的表现,且所提出的模型AUC在所有数据集上都达到了较大的值。结论实验结果表明:所提出的方法可以更好地检测过程事件日志中的异常;通过在模型中加入注意力机制并且将控制流和数据流视角进行结合,更好地表示了过程数据,使得模型的分类性能得到了较大的提升,在业务流程异常检测方面具有明显的优势。An important task in business processes is anomaly detection of business process data,which can be used to monitor and identify abnormal situations in enterprises or organizations.Objective Most current methods for business process anomaly detection only consider the control flow and do not consider the influence of other data attributes in event logs on business processes.Therefore,an unsupervised anomaly detection model with multiple perspectives was proposed.Methods Firstly,the control flow and data flow were processed separately and then spliced to form the input data type for the model.Secondly,a model combining the self-attention mechanism and Bi-LSTM autoencoder was used to extract features from the perspectives of control flow and data flow of business process event logs respectively,and then splicing was carried out for anomaly detection,with the anomaly threshold determined by the reconstruction error of the autoencoder.Finally,the proposed model was validated on public datasets.Results The proposed method was evaluated using real event logs,and a comparative analysis with other methods showed that the proposed method performed better in three aspects:precision,recall,and F1 score,and the AUC of the proposed model reached large values on all datasets.Conclusion Experimental results show that the proposed method can better detect anomalies in process event logs.By incorporating attention mechanisms into the model and combining control flow and data flow perspectives,a better representation of process data is achieved,leading to significantly improved classification performance and clear advantages in business process anomaly detection.

关 键 词：自注意力机制 Bi-LSTM神经网络 业务流程 异常检测 

分 类 号：TP391.9[自动化与计算机技术—计算机应用技术]