# Anomaly Detection for Service-Oriented Business Processes Using Conformance Analysis
## 6 Setup for Conformance Analysis
### Trace-Level Alignment for Abnormality Detection  
In this section, trace-level alignment details are used to measure the variation between the optimal process model and the replay of the event log with the failed cases (Section 6). Control flow-based approaches, like the one in Section 6.2, usually do not look at the timestamps of the events or other event properties that are usually found in real-world logs. All of the properties of events in the log are important for a thorough process mining analysis. One such aspect of the analysis is observing the 'overall behaviour' of the complete trace, which is discussed in this section. At the trace level, several types of deviations are possible from an optimal process, as presented by [PERSON] in [PERSON] (2018). The trace-level analysis is performed on following characteristics:  
1. _Model move_: an activity that should have occurred in accordance with the ideal process model but is not recorded in the log. 2. _Log move_: an event which is present in the log but cannot be mapped to any activity in the process model, _incorrect data_: data which are there in the log but not possible to map with a process model,
3. _Missing data_: refers to some missing data in the log. Separate cost functions can be specified for each type of deviation identified because of the conformance analysis. The default value of _cost function_ is used, which is 1 for all  
Figure 14: Difference between two causality matrices. A small portion of the matrix is presented. Matrix’s strengths scaled between 0.00 (No difference-Blue) to 2.00 (Max difference-red). type of deviations [25]. A screenshot of the ProM plug-in 'Multi-perspective Conformance Analysis' for alignment calculation is shown in Figure 15.  
For each of the traces which are part of the event log with failed cases, the corresponding alignment is calculated over the Petri net discovered for the successful cases. In Figure 15, a coloured view of the log presents the alignment checking results generated through the ProM 6.10 tool. Each row represents a group of an end-to-end execution of similarly executed traces with events classes highlighted with a specific colour. The green colour represents the exact alignment of the event with the optimal process model, whereas log moves and model moves are highlighted with yellow and purple. Model moves (grey and purple) identify those events present in the log with successful cases; thus, this behaviour is replicated in the optimal process model. There may be several reasons for missing events in the log with failed cases, such as failed cases miss those essential events which must be present in the instance for successful execution. The start of the process is generally misaligned as the model is expected to have a starting point with an event 'Asset selection', but failed instances (highlighted as grey in Figure 15) are skipping the starting event. This information may not always be helpful to consider such behaviour as an abnormality as the process starting point for failed cases could deliberately be different. Yet this information is useful for further in-depth analysis of each specific case. Similarly, model moves (highlighted as yellow in Figure 15) are explicitly such events that are present in the failed cases but never observed in the successful log. These events could be the most important to analyse as they could lead to the failure of the process. Detailed analysis of the trace alignment is presented with several other matrices for the conformance in Table 4.  
Three different subsets of real-world logs captured at different timings, including successful and failed cases, are used for detailed experiments. Each log is mentioned in Table 4 as A, B, C. For each of the logs, an optimal process model is generated, and failed cases are used to analyse the conformance. In Table 4, 'A' presents the results from the log containing cases for customers with a mixture of BT product services.