# The Analysis of Online Event Streams: Predicting the Next Activity for Anomaly Detection

arXiv: https://arxiv.org/abs/2203.09619 · HTML: https://mlsanity.com/paper/2203.09619/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 23 references that are in the map.
- First posted on arXiv 17 Mar 2022.

## Builds on (most cited first, 5 of 5)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Outcome-Oriented Predictive Process Monitoring: Review and Benchmark](https://mlsanity.com/paper/1707.06766/) (2017)
- [BINet: Multi-perspective Business Process Anomaly Classification](https://mlsanity.com/paper/1902.03155/) (2019)
- [Blockchain-inspired Event Recording System for Autonomous Vehicles](https://mlsanity.com/paper/1809.04732/) (2018)
- [Online anomaly detection using statistical leverage for streaming business process events](https://mlsanity.com/paper/2103.00831/) (2021)

## Built on by (most cited first, 4 of 4)

- [Machine learning in business process management: A systematic literature review](https://mlsanity.com/paper/2405.16396/) (2024)
- [Measuring the Stability of Process Outcome Predictions in Online Settings](https://mlsanity.com/paper/2310.09000/) (2023)
- [Anomaly Correction of Business Processes Using Transformer Autoencoder](https://mlsanity.com/paper/2404.10211/) (2024)
- [Foundation Models for Event Prediction Across Heterogeneous Event Logs](https://mlsanity.com/paper/2610.17503/) (2026)

## Abstract (arXiv)

Anomaly detection in process mining focuses on identifying anomalous cases or events in process executions. The resulting diagnostics are used to provide measures to prevent fraudulent behavior, as well as to derive recommendations for improving process compliance and security. Most existing techniques focus on detecting anomalous cases in an offline setting. However, to identify potential anomalies in a timely manner and take immediate countermeasures, it is necessary to detect event-level anomalies online, in real-time. In this paper, we propose to tackle the online event anomaly detection problem using next-activity prediction methods. More specifically, we investigate the use of both ML models (such as RF and XGBoost) and deep models (such as LSTM) to predict the probabilities of next-activities and consider the events predicted unlikely as anomalies. We compare these predictive anomaly detection methods to four classical unsupervised anomaly detection approaches (such as Isolation forest and LOF) in the online setting. Our evaluation shows that the proposed method using ML models tends to outperform the one using a deep model, while both methods outperform the classical unsupervised approaches in detecting anomalous events.