Detecting anomalous patterns in process executions

The detection of anomalies in process executions is crucial for the accurate analysis of organizational processes. In recent years, deep learning models, particularly reconstruction-based approaches, have emerged as the dominant technique for this task, identifying a trace as anomalous if its reconstruction error exceeds a set threshold. However, the existing approaches may result in suboptimal detection accuracy in some real-world scenarios where trace lengths vary and anomalies differ in nature. To address this drawback, this paper presents a novel approach for anomaly detection in processes based on two hypotheses: ( h1 ) analyzing execution patterns on a set of events is more effective than examining the entire trace, and ( h2 ) identifying anomalies in the specific execution contexts of each activity improves accuracy compared to using the same parameters for entire traces. This approach applies a sliding window and a conditional variational autoencoder to segment the trace and examine the execution context of each activity, defining individual thresholds for each. The results obtained on 32 real event logs, with different anomaly configurations, demonstrate that the proposed approach consistently improves the state of the art, validating both hypotheses and providing a robust and generalizable solution for anomaly detection in process executions.