# Anomaly Detection for Service-Oriented Business Processes Using Conformance Analysis
## 6 Setup for Conformance Analysis
### Event-Level Alignment for Abnormality Detection  
There is a noticeable difference in the control flow and alignment of the successful and failed cases. As a business user, this information is helpful, but it does not incorporate the exact details of the abnormalities in the execution, which causes the process to be unsuccessful. To locate the exact position in the process where abnormality exists, the'multi-perspective process explorer' is used as mentioned in [25]. This plugin for ProM is developed to get insights into the process instances by measuring fitness and precision at each event level. One of the ways to find abnormalities in the overall process execution can be to look at the difference in event-level behaviour between the cases with anomalies (failed cases) and correctly executed cases (successful cases). The techniques presented in [25] are exploited in this work for the identification of the deviations at the event level from the optimal process model. For instance, consider Figure 16 showing the identified events (with life-cycle transition) in red. An event 'End Call' is a part of an optimal process model, but its transaction fitness is 0%, which means that no instance of the failed event log traversed this portion of the model. This information is useful when considering deep investigation for the abnormality analysis. It is possible to analyse the event level fitness of the process model, highlighting the impact of the alignment of failed event log on the optimal model. In Figure 17, another event, 'Event-X', is reviewed where the transition fitness is 95.45%, with 188 correct events (the events which are present in the log and expected from the model). 5.5% fitness decreases (in Figure 17) at this transition resulted due to 9 missing events. IDs of the missing events can be extracted from the ProM plug-in'multi-perspective process explorer'. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**A: All Customers**} & \multicolumn{2}{c}{**B: Product-A Customers**} & \multicolumn{2}{c}{**C: Product-B Customers**} \\ \cline{2-7}  & **Successful Cases** & **Failure Cases** & **Successful Cases** & **Failure Cases** & **Successful Cases** & **Failure Cases** \\ \hline Event classes & 64 & 64 & 64 & 64 & 62 & 62 \\ \hline Number of moves observed & 14,021 & 14,073 & 17,118 & 11,623 & 9255 & 7243 \\ \hline Number of moves possible & 57,070 & 56,140 & 69,397 & 43,704 & 22,964 & 17,748 \\ \hline Average fitness \% & 96.4 & 87.6 & 90 & 88.8 & 87.7 & 70.4 \\ \hline \% Event violations & 2.3 & 11 & 5.9 & 8.8 & 8.6 & 24.1 \\ \hline Number of correct events & 8064 & 7978 & 9532 & 6094 & 5118 & 3908 \\ \hline Number of wrong events & 36 & 762 & 200 & 178 & 264 & 960 \\ \hline Number of missing events & 150 & 220 & 394 & 408 & 216 & 278 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Trace-level alignment results from the log containing cases for customers belonging to mixture of BT productsThis analysis is helpful for business users to identify several missed events at the level of each transaction. Further assessing those cases where there are nine missing events, a behaviour can be observed, leading to the failure of the cases. Another level of analysis is place-level analysis where the fitness is measured at the places in the Petri net model where transition fitness is less than the average fitness of the overall event log. In CDP, the average fitness of the log is 96.4, as shown in Table 4. The next step is to further explore all of the event classes where event-level fitness is less than 96.4. In Figure 18, an event class 'Event-Y' has a place fitness of 94.3%, thus place level analysis is performed. It is identified that at place p15, the event violation is 52.3%. This means that for each 52  
Figure 16: Event-level alignment at the identified events (with life-cycle transition) in red. Screenshot of Multi-perspective Conformance Analysis plugin for ProM Lite 1.3.