Process anomaly detection is an important application of process mining for identifying deviations from the normal behavior of a process. Neural network-based methods have recently been applied to this task, learning directly from event logs without requiring a predefined process model. However, since anomaly detection is a purely statistical task, these models fail to incorporate human domain knowledge. As a result, rare but conformant traces are often misclassified as anomalies due to their low frequency, which limits the effectiveness of the detection process. Recent developments in the field of neuro-symbolic AI have introduced Logic Tensor Networks (LTN) as a means to integrate symbolic knowledge into neural networks using real-valued logic. In this work, we propose a neuro-symbolic approach that integrates domain knowledge into neural anomaly detection using LTN and Declare constraints. Using autoencoder models as a foundation, we encode Declare constraints as soft logical guiderails within the learning process to distinguish between anomalous and rare but conformant behavior. Evaluations on synthetic and real-world datasets demonstrate that our approach improves F1 scores even when as few as 10 conformant traces exist, and that the choice of Declare constraint and by extension human domain knowledge significantly influences performance gains.
Figures & tables
Figure 1: Comparison of classification of frequent and conformant traces (green tiles), rare but conformant traces (blue tile) and infrequent anomalous traces (red tiles).
Figure 2: Overview of the proposed method. The event log is used both to pretrain an autoencoder for trace reconstruction and to mine Declare constraints. Domain knowledge guides the selection of constraints representing rare but conformant behavior, which are then injected into the autoencoder via LTN for fine-tuning. The enhanced model performs anomaly detection based on reconstruction error.
Figure 3: Example from the Paper event log showing the Response Declare constraint. If activity Develop Method occurs, then Final Decision must eventually follow.
Figure 4: Learning a binary classifier predicate Aθ using LTN. The neural network outputs are interpreted as truth values and aggregated using logical quantifiers to compute overall satisfiability, which guides parameter learning.
Figure 5: Fine-tuning the autoencoder AEθ with LTN. Predicates P1 to Pn extract activity probabilities from reconstructed traces, which are used to evaluate Declare constraint satisfiability and guide learning.
Classification
Event Log
Max. Trace Length
#Activities
#Users
#Cases
#Events
Synthetic
Paper
17
29
77
5000
60536
P2P
16
27
91
5000
53193
Small
15
41
89
5000
53437
Medium
13
65
105
5000
41991
Large
17
85
78
5000
67524
Huge
16
109
93
5000
53210
Table 1: Event logs used in evaluations
Event Log
Method
Anomaly detection F1 scores w.r.t. # rare conformant traces
10
25
50
100
150
200
250
300
Paper
Baseline
0.38
0.38
0.39
0.38
0.4
0.42
0.39
0.43
Our approach
0.58
0.59
0.6
0.6
0.56
0.58
0.51
0.55
P2P
Baseline
0.39
0.38
0.38
0.38
0.39
0.36
0.41
0.41
Our approach
0.46
0.48
0.51
0.49
0.46
0.48
0.46
0.44
Small
Baseline
0.49
0.48
0.47
0.5
0.45
0.46
0.46
0.47
Table 2: Evaluation of synthetic event logs
Event Log
Method
Anomaly detection F1 scores w.r.t. # rare conformant traces
10
25
50
100
150
200
250
300
BPIC12
Baseline
0.61
0.57
0.65
0.42
0.52
0.55
0.52
0.53
Our approach
0.66
0.75
0.78
0.53
0.62
0.61
0.62
0.63
BPIC13
Baseline
0.27
0.29
0.26
0.28
0.29
0.29
0.28
0.3
Our approach
0.36
0.4
0.38
0.41
0.36
0.39
0.38
0.35
BPIC17
Baseline
0.52
0.5
0.5
0.51
0.52
0.5
0.51
0.5
Table 3: Evaluation of real-world event logs
Figure 6: Impact of Declare constraints for the best performing models for Paper event log.
Figure 7: Impact of Declare constraints for the best performing models for BPIC12 event log.
Existing approaches for predictive process monitoring are sub-symbolic, meaning that they learn correlations between descriptive features and a target feature fully based on data, e.g., predicting the surgical needs of a patient based on historical events and biometrics. However, such approaches fail to incorporate domain-specific process constraints (knowledge), e.g., surgery can only be planned if the patient was released more than a week ago, limiting the adherence to compliance and providing less accurate predictions. In this paper, we present a neuro-symbolic approach for predictive process monitoring, leveraging Logic Tensor Networks (LTNs) to inject process knowledge into predictive models. The proposed approach follows a structured pipeline consisting of four key stages: 1) feature extraction; 2) rule extraction; 3) knowledge base creation; and 4) knowledge injection. Our evaluation shows that, in addition to learning the process constraints, the neuro-symbolic model also achieves better performance, demonstrating higher compliance and improved accuracy compared to baseline approaches across all compliance-aware experiments.
Fabrizio De Santis, Gyunam Park, Wil M. P. van der Aalst +1
University of Parma, Parma, Italy · Eindhoven University of Technology, Eindhoven, Netherlands · RWTH Aachen University, Aachen, Germany
We propose SYRAN, an unsupervised anomaly detection method based on symbolic regression. Instead of encoding normal patterns in an opaque, high-dimensional model, our method learns an ensemble of human-readable equations that describe symbolic invariants: functions that are approximately constant on normal data. Deviations from these invariants yield anomaly scores, so that the detection logic is interpretable by construction, rather than via post-hoc explanation. Experimental results demonstrate that SYRAN is highly interpretable, providing equations that correspond to known scientific or medical relationships, and maintains strong anomaly detection performance comparable to that of state-of-the-art methods.
Md Maruf Hossain, Tim Katzke, Simon Klüttermann +1
TU Dortmund University, Dortmund, Germany · Research Center Trustworthy Data Science and Security, UA Ruhr, Germany
Predictive modeling on sequential event data is critical for fraud detection and healthcare monitoring. Existing data-driven approaches learn correlations from historical data but fail to incorporate domain-specific sequential constraints and logical rules governing event relationships, limiting accuracy and regulatory compliance. For example, healthcare procedures must follow specific sequences, and financial transactions must adhere to compliance rules. We present a neuro-symbolic approach integrating domain knowledge as differentiable logical constraints using Logic Networks (LTNs). We formalize control-flow, temporal, and payload knowledge using Linear Temporal Logic and first-order logic. Our key contribution is a two-stage optimization strategy addressing LTNs' tendency to satisfy logical formulas at the expense of predictive accuracy. The approach uses weighted axiom loss during pretraining to prioritize data learning, followed by rule pruning that retains only consistent, contributive axioms based on satisfaction dynamics. Evaluation on four real-world event logs shows that domain knowledge injection significantly improves predictive performance, with the two-stage optimization proving essential knowledge (without it, knowledge can severely degrade performance). The approach excels particularly in compliance-constrained scenarios with limited compliant training examples, achieving superior performance compared to purely data-driven baselines while ensuring adherence to domain constraints.
Fabrizio De Santis, Gyunam Park, Francesco Zanichelli
University of Parma, Parma, Italy · Eindhoven University of Technology, Eindhoven, Netherlands