Event sequence anomaly detection has garnered considerable attention in research, encompassing applications such as identifying anomalies in system logs, anomalous transaction users, and so on. Yet, prevailing anomaly detection methods often rely solely on local data for training, potentially leading to imperfect detection performance. In this article, we introduce a personalized Federated anomaly detection framework for discrete event Sequences, named FeadSeq. Specifically, we propose a separate architecture for sequence reconstruction networks (SEPRE) which partitions the network into two parts: a shared part and a standalone part, better suited for federated learning schemes. In tandem, we propose a novel partial shared federated learning scheme that employs a mask strategy to alleviate communication overhead and produce personalized local models to address the statistical heterogeneity of data among clients. This scheme dictates that a subset of weights is communicated between clients and servers for collaborative training, while the remaining weights are trained exclusively locally. To evaluate the effectiveness of FeadSeq, we conduct extensive experiments on both system logs and business process event logs. The results affirm the superiority of FeadSeq over existing personalized federated learning algorithms, showcasing not only improved performance but also reduced communication overhead.

Effective management of business processes is crucial for organizational success. However, despite meticulous design and implementation, anomalies are inevitable and can result in inefficiencies, delays, or even significant financial losses. Numerous methods for detecting anomalies in business processes have been proposed recently. However, there is no comprehensive benchmark to evaluate these methods. Consequently, the relative merits of each method remain unclear due to differences in their experimental setup, choice of datasets and evaluation measures. In this paper, we present a systematic literature review and taxonomy of business process anomaly detection methods. Additionally, we select at least one method from each category, resulting in 16 methods that are cross-benchmarked against 32 synthetic logs and 19 real-life logs from different industry domains. Our analysis provides insights into the strengths and weaknesses of different anomaly detection methods. Ultimately, our findings can help researchers and practitioners in the field of process mining make informed decisions when selecting and applying anomaly detection methods to real-life business scenarios. Finally, some future directions are discussed in order to promote the evolution of business process anomaly detection.

The ability to detect anomalies in business processes is crucial for achieving success in business operations. While unsupervised anomaly detection approaches have gained popularity in recent years due to their label-free nature, in some cases, a limited number of labelled anomalies can be provided and using them can improve the performance of anomaly detection. To address this issue, we propose a novel framework for anomaly detection that uses a pre-trained autoencoder to extract feature representations of traces. An anomaly score generator based on a multi-layer perceptron is utilized to evaluate the extracted features. The entire framework is trained using a joint loss that ensures the generated anomaly scores satisfy a specific distribution without compromising the autoencoder's ability to reconstruct normal traces. The feature encoder is fine-tuned to provide insights into the cause of anomalies. Additionally, we design a novel technique for calculating anomaly scores to mitigate the effects of varying numbers of potential attribute values. We conduct extensive experiments on both synthetic and real-life logs, and our results demonstrate that our proposed method, WAKE, outperforms state-of-the-art unsupervised deep business process anomaly detection methods by a significant margin. Additionally, it outperforms other weakly supervised anomaly detection methods as well