Skip to content

TGCAE: temporal graph convolutional autoencoder for robust anomaly detection in object-centric process mining

Sep 2026 · Computing · Vol 108 · 0 citations · 57 references
Business Process Modeling and Analysis

Abstract

With the deep integration of machine learning and cybernetics technologies in business process management (BPM), robust anomaly detection in object-centric process mining is crucial for enhancing operational efficiency and quality within enterprises. Existing anomaly detection approaches predominantly rely on flattened event logs, which overlook multi-object interactions and their complex dependency relationships, thereby limiting the capability to model intricate business processes. In contrast, Object-Centric Event Logs (OCELs) associate events with multiple objects, enabling the modeling of multi-object interactions and complex dependencies inherent in real-world processes. However, current Graph Neural Network (GNN)-based anomaly detection methods primarily focus on structural features while neglecting the critical temporal dynamics of process execution. To bridge this gap, this paper proposes a Temporal Graph Convolutional AutoEncoder (TGCAE) for robust anomaly detection in object-centric process mining. TGCAE effectively captures structural dependencies between process execution instances via Graph Convolutional Networks (GCNs), and integrates a dedicated temporal encoder with an adaptive gating mechanism to model complex temporal patterns. For anomaly detection, a data-driven Interquartile Range (IQR) method is employed to adaptively determine decision thresholds, enabling accurate identification of three typical anomaly types in event logs: attribute manipulation, timestamp perturbation, and activity insertion. Comprehensive experiments on both real and synthetic datasets demonstrate that TGCAE significantly outperforms traditional Autoencoder (AE), Long Short-Term Memory Autoencoder (LSTMAE), and Graph Convolutional Autoencoder (GCNAE) baselines, validating the efficacy of spatiotemporal information fusion for robust anomaly detection.

Read PDF

Similar papers

#machine learning Preprint Sep 2026

GNN4PPM: Multi-Target Predictive Process Monitoring with Relational Graph Convolutional Networks

GNN4PPM is introduced, an approach that predicts all next events along with their complete data payload at once and represents event information in a heterogeneous knowledge graph that captures the event log as an RDF semantics, and train the embeddings with a Relational Graph Convolutional Network (R-GCN).

Ana Costa, Johannes Mäkelburg, L. Pufahl · 0 citations

Temporal graph anomaly detection based on multi-view semi-supervised learning

Multi-View Semi-Supervised Graph Anomaly Detection (MSGAD) is introduced, an innovative framework tailored for detecting anomalies in dynamic graph environments that enhances robustness against noise and unexpected events while improving sensitivity to subtle anomalous signals distributed across time.

Yi-Fan Song, Yu Yang, Kang-Zheng Liu et al. · 0 citations
Open access Aug 2026

Anomaly detection method for business processes based on enhanced complex scenario logs

The quality of logs is crucial for the reliability of business process anomaly detection. Deployed information systems are limited by hardware and cannot generate high-quality event logs containing complex scenario information, thus requiring post-enhancement of log quality. During this process, matching the same entit...

Yang Song, Ruo-Yuan Zhang · 0 citations
#machine learning Preprint Sep 2026

FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection

FindAna is introduced, a GNN-assisted Foundation Model for Graph Anomaly Detection - the first foundation model framework designated for generalizable, cross-graph anomaly detection by combining GNNs and transformers.

Suprim Nakarmi, Chahana Dahal, Yue Zhao et al. · 0 citations
#graph neural networks Open access Oct 2026

Multi-stage attack detection in IIoT supply chains using graph neural networks

Industrial internet of things (IIoT) environments connect devices, gateways, hosts, and services in ways that increase both operational visibility and cyber-attack exposure. Conventional intrusion-detection systems commonly produce flat attack labels and may underuse relational information between communicating assets....

Williams Afrifah, Gregory Epiphaniou, H. Lallie et al. · 0 citations
Open access Aug 2026

Topo-MFP: Topology-aware multimodal propagation learning for fault detection and root cause localization in microservice systems

Fault detection and root cause localization in microservice systems are challenging because runtime failures may propagate across dependent services and appear heterogeneously in metrics, logs, and traces. Existing approaches often rely on single-modality observations, local anomaly scores, or static service topology,...

Peng Zhang, Jun-Sheng Wu, Hao He et al. · 0 citations

Related blog posts

Microsoft Research Blog Jul 13, 2026

Verifying Rust cryptography in SymCrypt, from standards to code

Cryptographic code supports vital protections in modern computing systems. Learn how a new method helps verify code as developers write it while preserving speed and adaptability as it gets implemented and evolves. The post Verifying Rust cryptography in SymCrypt, from standards to code appeared first on Microsoft Research.

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.