Process mining-based anomaly detection of additive manufacturing process activities using a game theory modeling approach

•Presenting a new extension of uncertain BPMS architecture,•Developing a new component as anomaly detector,•Defining highly accurate and simple algorithms in process mining-based proposed method,•Optimizing anomaly detection efficiency through game theory modeling approach. As a new production procedure Additive Manufacturing will present a time-effective production system when adopted in distributed 3D printing mode. In this case, the distributed manufacturing leads to different challenges such as control between production sites. Based on the cloud infrastructure usage for distributed production systems, the product reliability handling is vital. Moreover, AM is used to produce safety–critical systems components and this product type defines AM as an interesting attack target. This study presents a new extension of uncertain Business Process Management System (uncertain BPMS) architecture for detecting anomaly using this extension capability. This extension has a new component as event-based anomaly detector, where intrusion detection can take place through an integration of process mining and game theory techniques. The proposed component could operate based on pre-processor, conformance checker, and anomaly detection optimizer modules. These modules can intelligently control the AM process activities between expected behavior and actual behavior using distributed event logs, a hybrid of highly accurate algorithms such as Improved Particle Swarm Optimization (IPSO), firefly, and AdaBoost algorithms inside the game theory modeling approach. In this case, the game theory technique as an optimizer provides optimal selection strategies for the proposed component to detect untrusted behaviors. The results of the new extension execution on a case study and its evaluation using Nash Equilibrium (NE) solution indicate that the proposed anomaly detector component is highly accurate in anomaly detection for AM process activities and can detect more attacks successfully through guidance of the game theory framework in the system.