Anomaly detection in SAP S/4HANA using hybrid deep learning for multivariate time series data

Abstract

Inhomogeneous data structure, very sparse abnormal events, non-stationary temporal behaviour, and multifaceted cross-module relationships are some of the main challenges facing anomaly detection of an enterprise application like SAP S/4HANA. The current multivariate time-series anomaly detection methods, mostly designed to handle industrial sensors or cyber-physical devices, do not support the semantics of enterprise processes and have little to offer in terms of explanation, which could be used in an audit and compliance context. The present paper suggests a hybrid deep learning architecture, which incorporates Process-Aware Graph Neural Network (P-GNN) to encode SAP business semantics, a Transformer-based temporal encoder to represent long-range dependencies in non-stationary transactional sequences, and a Variational Autoencoder (VAE) to acquire uncertainty-aware latent representations. An interpretability layer based on attention-aid fine-grained root-cause attribution across SAP characteristics and process stages, and the proposed hybrid model features and integrates reconstruction error, KL divergence and temporal deviation for anomaly detection. The proposed model is tested on the SAP-synthetic datasets and Numenta Anomaly Benchmark (NAB), and is additionally illustrated on actual SAP S/4HANA audit logs, a qualitative case study. It is experimentally demonstrated that the methods perform better than LSTM-Autoencoder, Transformer-Autoencoder, Isolation Forest, TS-VAE and GDN, MTAD-GAT based in terms of ROC-AUC, PR-AUC, detection delay, and false-positive rate. The model generates semantically adequate explanations that can help in the automation of audit, risk management, and compliance in SAP S/4HANA environments that would form the basis of providing the model with practical application in the monitoring of intelligent enterprises.