# Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction

arXiv: https://arxiv.org/abs/2502.10211 · HTML: https://mlsanity.com/paper/2502.10211/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 52 references that are in the map.
- First posted on arXiv 14 Feb 2025.

## Builds on (most cited first, 11 of 11)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Feature Encoding with AutoEncoders for Weakly-supervised Anomaly Detection](https://mlsanity.com/paper/2105.10500/) (2021)
- [A Survey on Explainable Anomaly Detection](https://mlsanity.com/paper/2210.06959/) (2022)
- [Shapley Values of Reconstruction Errors of PCA for Explaining Anomaly Detection](https://mlsanity.com/paper/1909.03495/) (2019)
- [ADMoE: Anomaly Detection with Mixture-of-Experts from Noisy Labels](https://mlsanity.com/paper/2208.11290/) (2022)
- [BINet: Multi-perspective Business Process Anomaly Classification](https://mlsanity.com/paper/1902.03155/) (2019)
- [Analyzing Business Process Anomalies Using Autoencoders](https://mlsanity.com/paper/1803.01092/) (2018)
- [Trace Encoding in Process Mining: a survey and benchmarking](https://mlsanity.com/paper/2301.02167/) (2023)
- [Recomposition vs. Prediction: A Novel Anomaly Detection for Discrete Events Based On Autoencoder](https://mlsanity.com/paper/2012.13972/) (2020)
- [DeepAlign: Alignment-based Process Anomaly Correction using Recurrent Neural Networks](https://mlsanity.com/paper/1911.13229/) (2019)
- [Process Modeling and Conformance Checking in Healthcare: A COVID-19 Case Study](https://mlsanity.com/paper/2209.10897/) (2022)

## Built on by (most cited first, 6 of 6)

- [Network Traffic Analysis with Process Mining: The UPSIDE Case Study](https://mlsanity.com/paper/2512.23718/) (2025)
- [Run-Time Monitoring of ERTMS/ETCS Control Flow by Process Mining](https://mlsanity.com/paper/2509.10419/) (2025)
- [Architecting software monitors for control-flow anomaly detection through large language models and conformance checking](https://mlsanity.com/paper/2511.10876/) (2025)
- [Adaptive Identification and Modeling of Clinical Pathways with Process Mining](https://mlsanity.com/paper/2512.03787/) (2025)
- [Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining](https://mlsanity.com/paper/2604.18066/) (2026)
- [Dynamic Risk Assessment by Bayesian Attack Graphs and Process Mining](https://mlsanity.com/paper/2604.18080/) (2026)

## Abstract (arXiv)

The business processes of organizations may deviate from normal control flow due to disruptive anomalies, including unknown, skipped, and wrongly-ordered activities. To identify these control-flow anomalies, process mining can check control-flow correctness against a reference process model through conformance checking, an explainable set of algorithms that allows linking any deviations with model elements. However, the effectiveness of conformance checking-based techniques is negatively affected by noisy event data and low-quality process models. To address these shortcomings and support the development of competitive and explainable conformance checking-based techniques for control-flow anomaly detection, we propose a novel process mining-based feature extraction approach with alignment-based conformance checking. This variant aligns the deviating control flow with a reference process model; the resulting alignment can be inspected to extract additional statistics such as the number of times a given activity caused mismatches. We integrate this approach into a flexible and explainable framework for developing techniques for control-flow anomaly detection. The framework combines process mining-based feature extraction and dimensionality reduction to handle high-dimensional feature sets, achieve detection effectiveness, and support explainability. The results show that the framework techniques implementing our approach outperform the baseline conformance checking-based techniques while maintaining the explainable nature of conformance checking. We also provide an explanation of why existing conformance checking-based techniques may be ineffective.