Explainable conformance checking: Understanding patterns of anomalous behavior

Anomaly detection in the execution of business processes in the organizations has a high level of complexity due to the consideration of various process perspectives and their constraints, business rules, privacy policies, and regulations. Furthermore, only detection of anomalies is not sufficient. There is a crucial need for the results of anomaly detection to be explainable and interpretable, enabling users to adapt the decision making process and handle the detected anomalies. The work presented in this paper aims to provide business process owners human-interpretable explanations for patterns of deviations found between process models and event data recorded during the execution of business processes, while traditional conformance checking methods only report the low-level deviations found. First, by introducing an automated approach for multi-perspective conformance checking and anomaly detection in business process executions, we extract expected and unexpected behavior from event logs and identify patterns in deviations. Finally, by focusing on identifying the context involved in patterns of unexpected behavior, our approach facilitates the interpretations of detected patterns. The approach has been implemented in the open source ProM framework and its applicability is evaluated through a real-life dataset from a financial organization. The experiment not only shows that we can automatically detect more complex anomalies such as spurious data processing and misusage of authorizations, but also that we can explain these deviations in context. •Introduction of an automated approach for detecting expected and unexpected behavioral patterns in business process executions.•Providing a guideline for explaining unexpected behavioral patterns in the context of the business processes at the process level.•Extended explanation of how to create a synchronous product with context indication.•Description on how the context identification can help on explaining deviations.•Discussion on how the context identification facilitates to distinguish hidden violations and better reflect reality.•Enumeration of patterns that provide explanations for different kinds of violations.