Detecting and repairing anomalies in business process event logs is essential for maintaining process integrity. Building on the observation that real-world anomalies often exhibit specific patterns and extending our earlier semi-supervised, rule-based approach to detect and repair common basic patterns, this paper presents an anomaly detection and repair framework powered by reinforcement learning. The proposed approach automatically learns an intelligent policy to identify and correct typical basic anomaly patterns, moving beyond the limitations of heuristic, rule-based methods. Furthermore, thanks to the flexibility provided by reinforcement learning, the approach can handle more complex patterns formed by combinations of the basic ones. Extensive evaluation using both synthetic and realworld logs demonstrates that the proposed method outperforms traditional trace alignment, edit distance-based techniques, and unsupervised deep learning in the accuracy of anomalous trace repair. It also shows consistent performance across various anomaly types and offers a pattern categorization capability that baseline methods lack.

Predictive Process Monitoring aims to forecast the future progress of process instances using historical event data. As predictive process monitoring is increasingly applied in online settings to enable timely interventions, evaluating the performance of the underlying models becomes crucial for ensuring their consistency and reliability over time. This is especially important in high risk business scenarios where incorrect predictions may have severe consequences. However, predictive models are currently usually evaluated using a single, aggregated value or a time-series visualization, which makes it challenging to assess their performance and, specifically, their stability over time. This paper proposes an evaluation framework for assessing the stability of models for online predictive process monitoring. The framework introduces four performance meta-measures: the frequency of significant performance drops, the magnitude of such drops, the recovery rate, and the volatility of performance. To validate this framework, we applied it to two artificial and two real-world event logs. The results demonstrate that these meta-measures facilitate the comparison and selection of predictive models for different risk-taking scenarios. Such insights are of particular value to enhance decision-making in dynamic business environments.

There is a growing need for empirical benchmarks that support researchers and practitioners in selecting the best machine learning technique for given prediction tasks. In this article, we consider the next event prediction task in business process predictive monitoring, and we extend our previously published benchmark by studying the impact on the performance of different encoding windows and of using ensemble schemes. The choice of whether to use ensembles and which scheme to use often depends on the type of data and classification task. While there is a general understanding that ensembles perform well in predictive monitoring of business processes, next event prediction is a task for which no other benchmarks involving ensembles are available. The proposed benchmark helps researchers to select a high-performing individual classifier or ensemble scheme given the variability at the case level of the event log under consideration. Experimental results show that choosing an optimal number of events for feature encoding is challenging, resulting in the need to consider each event log individually when selecting an optimal value. Ensemble schemes improve the performance of low-performing classifiers in this task, such as SVM, whereas high-performing classifiers, such as tree-based classifiers, are not better off when ensemble schemes are considered.

Runtime monitoring of Service Based Systems (SBSs) usually relies on information derived from I/O messages exchanged within business processes implementing services. When service provisioning is regulated by complex Service Level Agreements (SLAs) between service requesters, (composed) services, and infrastructure providers, monitoring may require additional features, such as (i) coordination among events captured at different sources involved in service provisioning and (ii) delegation of properties monitoring to local sites. This paper discusses an architecture and engagement protocol supporting the two aforementioned requirements for monitoring complex SLA-driven service provisioning.

The extensive adoption of Web service-based applications in dynamic business scenarios, such as on-demand computing or highly reconfigurable virtual enterprises, advocates for methods and tools for the management of Web service nonfunctional aspects, such as Quality of Service (QoS). Concerning contracts on Web service QoS, the literature has mostly focused on the contract definition and on mechanisms for contract enactment, such as the monitoring of the satisfaction of negotiated QoS guarantees. In this context, this article proposes a framework for the automation of the Web service contract specification and establishment. An extensible model for defining both domain-dependent and domain-independent Web service QoS dimensions and a method for the automation of the contract establishment phase are proposed. We describe a matchmaking algorithm for the ranking of functionally equivalent services, which orders services on the basis of their ability to fulfill the service requestor requirements, while maintaining the price below a specified budget. We also provide an algorithm for the configuration of the negotiable part of the QoS Service-Level Agreement (SLA), which is used to configure the agreement with the top-ranked service identified in the matchmaking phase. Experimental results show that, in a utility theory perspective, the contract establishment phase leads to efficient outcomes. We envision two advanced application scenarios for the Web service contracting framework proposed in this article. First, it can be used to enhance Web services self-healing properties in reaction to QoS-related service failures; second, it can be exploited in process optimization for the online reconfiguration of candidate Web services QoS SLAs.