# Anomaly Detection for Service-Oriented Business Processes Using Conformance Analysis
## 6 Setup for Conformance Analysis
### Causality Analysis for Abnormality Detection  
This section presents the methodology for anomaly detection using process mining techniques on the services-related business process data. Three conformance testing approaches from the literature are adapted in this study to be applicable to complex business processes. The first technique is 'causality analysis', presented initially by [PERSON] et al. in [PERSON] et al. (2018). _Causality analysis_ focuses on the characterisation of all possible paths in an event log. For this, process instances are required to be expressed in terms of process model notation. Causality analysis is independent of the type of notation used, e.g., Petri net, BPMN or UML activity diagrams. This work focuses primarily on Petri nets as it is the most comprehensive used notation of the process model for mining processes. Additionally, Petri nets support the heterogeneity present in service oriented business processes. We have proposed our technique using the standard concept of causality matrix to find the difference in behaviour between different variations of the process instances. Causality analysis is performed on the CDP event log for each of the two types of instances (successful and failed cases). The causality matrix is advantageous for analysing the direct relationship between activities to establish credible causal connections between events in each class. The objective is to compare the matrices of each type of instance to extract the behavioural differences between them. The behaviour of events in successful cases provides the optimal scenario for executing business operations. As indicated in unsuccessful cases, any variation from successful cases' behaviour is critical to analyse the root cause for improving the efficiency of the processes. This suggests that instances that fail to execute successfully are undesirable for business users and that fixing these deviations will indeed enhance process efficiency. The causality relationship is converted to numbers and normalised using min-max normalisation to project the value in the range of \(+1\) and \(-1\). A plug-in in ProM Lite 1.1 'Convert Data-aware Causal Net' by [PERSON] et al. is used to generate the matrix in Figure 11. For instance, the directly followed relationship is mentioned in the form of dependency measure value in Figure 11 as a causal activity matrix's strengths scaled between \(-1.0\) (weakest-red) to \(1.0\) (strongest-green). The characteristics of the causal activity matrix are as follows:  
* A value of \(1.0\) shows that a direct causal relationship exists with certainty. These values are represented as dark green in the matrix. * A score between \(0.5\) and \(0.9\) implies that there is a strong likelihood of a direct causal relationship. These values are represented with different shades of green from lighter to dark, dependent upon the value. * A value of \(0.0\) to \(0.4\) implies that it is not clear whether a direct causal relationship exists or not. These values are represented with different shades of green from lighter to dark, dependent upon the value. * A score between \(-0.1\) and \(-0.5\) implies that there is a high probability that no direct causal relationship exists. These values are represented with different shades of yellow from lighter to dark, dependent upon the value. * A value of \(-0.6\) to \(-1.0\) indicates that there is a certainty that no direct causal relationship exists. These values are represented with different shades of red from lighter to dark, dependent upon the value. By using the plug-in 'Discovery of Resources Causal Matrix' plugin in the ProM tool, causality matrices are generated for each of the variants of the event log, i.e., successful and failed cases. Figure 11 presents the behaviour of events directly following each other in the successful cases.