Algoritmos de Detecção de Anomalias em Logs de Sistemas Baseados em Processos de Negócios

Abstract

Nowadays, many business processes are supported by information systems (e.g. WfMS, CRM, ERP, SCM, etc.). Many of these systems have a strong characteristic of coordination of activities defined in the business processes, mainly for ensuring that these activities are performed as specified in the process model. However, there are domains that demand more flexible systems, for example, hospital and health domains, whose behavior can vary for each patient. Such domains of applications require an information system in which the business processes are weakly defined, supporting more flexible and dynamic executions. For example, the execution of some common activities may be violated, or some unusual activity may be enforced for execution. Therefore, in domains of applications in which the systems support a high levei of flexibility the business processes are susceptible to exceptional or even fraudulent executions. Thus, the provision of flexibility can not be considered without improving the security issues, since there is clearly a trade-off between flexibility and security requirements. Therefore, it is necessary to develop a mechanism to allow the combination of these two requirements in a system, that is, a mechanism that promotes a balance between flexibility and security. This thesis aims to design, implement and evaluate methods for detecting anomalies in logs of process-aware information systems, that is, the development of methods to find out which process instances may be an anomalous execution. Thus, when incorporating a method for detecting anomalies in such systems, it would be possible to offer a flexible and safer execution environment, since the system is also able to identify anomalous executions, which could be a simple exception or a harmful fraud attempt. Thus, the study of methods for detecting anomalous events will fill an area largely unexplored by the community of process mining, which has been mainly interested in understanding the common behavior in business processes. Furthermore, although this thesis does not discuss the meaning of an anomalous instance, the methods and algorithms presented here are important because they allow us to identify those instances.