Neuro-Symbolic Process Anomaly Detection
Process anomaly detection is an essential application of process mining, focusing on identifying deviations from the normal behavior of a process. Recent advancements in artificial intelligence, particularly in neural network-based methods, have shown promise for this task by learning directly from event logs without the necessity of a predefined process model. However, these models often overlook the importance of human domain knowledge, which can lead to significant misclassifications.
Challenges in Current Methods
The primary challenge with traditional neural network approaches in anomaly detection lies in their statistical nature. Anomalies are identified based on frequency analysis, which can result in rare but valid traces being incorrectly flagged as anomalies. This misclassification limits the overall effectiveness of detection systems, as it fails to utilize the contextual understanding that domain knowledge can provide.
Neuro-Symbolic AI: A Hybrid Approach
To address these limitations, recent developments in neuro-symbolic AI have introduced Logic Tensor Networks (LTN). These networks aim to combine the strengths of neural networks with symbolic reasoning, allowing for the integration of human domain knowledge into the anomaly detection process. By leveraging LTN, we can incorporate soft logical constraints that guide the learning process, enhancing the model’s ability to discern between true anomalies and rare but conformant behavior.
Proposed Methodology
In this work, we propose a neuro-symbolic approach that employs Logic Tensor Networks alongside Declare constraints. Specifically, we use autoencoder models as the foundation for our anomaly detection framework. By encoding Declare constraints into soft logical guiderails, we can better navigate the complexity of distinguishing between anomalous activities and rare, yet valid, traces within the data.
Evaluation and Results
Our methodology has been rigorously evaluated on both synthetic and real-world datasets, demonstrating significant improvements in performance metrics. Notably, our approach has shown to enhance F1 scores even with a limited number of conformant traces—specifically, as few as 10. This underscores the capability of our neuro-symbolic framework to effectively integrate domain knowledge into the anomaly detection process.
Influence of Domain Knowledge
One of the critical findings from our evaluations is the substantial impact that the choice of Declare constraints—and by extension, human domain knowledge—has on the overall performance of the anomaly detection system. This highlights the importance of incorporating expert insights into the design of AI models to improve their accuracy and reliability.
Conclusion
The integration of symbolic knowledge through Logic Tensor Networks presents a promising avenue for enhancing process anomaly detection in AI systems. By bridging the gap between statistical learning and human expertise, our neuro-symbolic approach paves the way for more robust and accurate detection methods. Future research will focus on refining these methodologies and exploring further applications within the realm of process mining.