  Business Process Management Systems (BPMS) log events and traces of
activities during the execution of a process. Anomalies are defined as
deviation or departure from the normal or common order. Anomaly detection in
business process logs has several applications such as fraud detection and
understanding the causes of process errors. In this paper, we present a novel
approach for anomaly detection in business process logs. We model the event
logs as a sequential data and apply kernel based anomaly detection techniques
to identify outliers and discordant observations. Our technique is unsupervised
(does not require a pre-annotated training dataset), employs kNN (k-nearest
neighbor) kernel based technique and normalized longest common subsequence
(LCS) similarity measure. We conduct experiments on a recent, large and
real-world incident management data of an enterprise and demonstrate that our
approach is effective.
