# Anomaly Detection for Service-Oriented Business Processes Using Conformance Analysis
## 5 Optimal Process Discovery
The overall precision of the model is presented in the range of 0-1, where 1 is the highest precision average. A precision close to zero refers to the underfitting behaviour of the model where not all possible traces can be mapped into the model. In contrast, the model allows the behaviour in the process that does not exist in the log. If precision is too high, equal or close to 1, the process model does not allow more behaviours than the one already observed in the log. To define precision, the approach presented in [22] is used. Let \(E\subseteq\mathcal{E}\) be the set of events in an event log \(L\). \(M\) is the corresponding process model having a set of states \(S\). Let \(A\) be the set of activities and assume the default classifier \(\underline{e}=\#_{activity}(e)\in A\) is the _activity_ associated with event \(e\in E\). Precision of overall can be defined as follows in Equation (3): assume that \(M\) is the process model that represents the event log \(L\), such that each event fits into the \(M\). The _state_ before occurrence of \(e\) can be computed as \(\#_{state}(e)\in S\). Now, let \(en_{M}(e)\subseteq A\) be the set of activities enabled in \(M\) in \(\#_{state}(e)\). Similarly, \(en_{L}(e)\) is the set of activities that were earlier executed in the model M, thus having the same history. \[precision(L,N)=\frac{1}{|E|}\sum\frac{|en_{L}(e)|}{|en_{M}(e)|} \tag{3}\]  
The precision of the trace is calculated based on the behaviour which is observed vs. the behaviour which is possible. If the precision is very high then model does not allow for much more behaviour then originally observed in the log, thus \(|en_{M}(e)|\approx|en_{L}(e)|\). If the precision is very low then it means that model allows for much more behaviour than observed in the log, thus \(|en_{M}(e)|\gg|en_{L}(e)|\). Figure 7 presents the two trace variations from CDP with 40 and 41 instances respectively, generated through ProM tool. Possible behaviour in the given trace variant is 193, 198, 195, 197, 196, 194 and 192 whereas observed behaviour is 198. Optimal Model for Service-Oriented Business ProcessesIt is vital that the process model used for compliance analysis be of the highest possible quality. This section applies four well-known process discovery algorithms from the literature to discover the model encapsulating the behaviour of log instances. Alpha miner is one of the earliest algorithms developed for detecting concurrency in event logs. It was the first in kind algorithm to discover several properties of event log such as loops, parallel parts, and the conditional joins [23]. Heuristic miner mines the perspective of the control flow in the event log. It focuses on the order of events with a specific case, irrespective of the order of events in the overall event log. The timestamp of the events identifies the control-flow perspective. The Inductive miner identifies the behavioural split in the control flow of an event log and marks it with an operator. For the split sub-logs, the same step is repeated, thus forming a process tree. The formation of a process tree allows improved soundness of a process model. ILP Miner, derived from integer linear programming (ILP) based replay algorithm. It uses the strategy of decomposing, which merges the smaller fragments of decomposed event logs into a single event log [8]. A comparison of the average fitness and precision of the four process models discovered using successful cases from the event log is shown in Figure 8. Based on the best quality parameters, one of these models is selected, representing the behaviour of process instances. A fitness close to 1 indicates that the maximum number of behaviours observed in the log is re-playable from the process model. Precision should ideally be between 0.7 and 0.8, which shows that model is not too precise to reject any new legitimate behaviour nor too general to allow any possible behaviours.