Neuro-Symbolic Process Anomaly Detection

Devashish Gaikwad; Wil M. P. van der Aalst; Gyunam Park

cs.LGMar 27, 2026

Neuro-Symbolic Process Anomaly Detection

Authors: Devashish Gaikwad, Wil M. P. van der Aalst, Gyunam Park

Organizations: RWTH Aachen University, Aachen, Germany · Eindhoven University of Technology, Eindhoven, The Netherlands

Abstract

Process anomaly detection is an important application of process mining for identifying deviations from the normal behavior of a process. Neural network-based methods have recently been applied to this task, learning directly from event logs without requiring a predefined process model. However, since anomaly detection is a purely statistical task, these models fail to incorporate human domain knowledge. As a result, rare but conformant traces are often misclassified as anomalies due to their low frequency, which limits the effectiveness of the detection process. Recent developments in the field of neuro-symbolic AI have introduced Logic Tensor Networks (LTN) as a means to integrate symbolic knowledge into neural networks using real-valued logic. In this work, we propose a neuro-symbolic approach that integrates domain knowledge into neural anomaly detection using LTN and Declare constraints. Using autoencoder models as a foundation, we encode Declare constraints as soft logical guiderails within the learning process to distinguish between anomalous and rare but conformant behavior. Evaluations on synthetic and real-world datasets demonstrate that our approach improves F1 scores even when as few as 10 conformant traces exist, and that the choice of Declare constraint and by extension human domain knowledge significantly influences performance gains.

Figures & tables

Figure 1: Comparison of classification of frequent and conformant traces (green tiles), rare but conformant traces (blue tile) and infrequent anomalous traces (red tiles).

Figure 2: Overview of the proposed method. The event log is used both to pretrain an autoencoder for trace reconstruction and to mine Declare constraints. Domain knowledge guides the selection of constraints representing rare but conformant behavior, which are then injected into the autoencoder via LTN for fine-tuning. The enhanced model performs anomaly detection based on reconstruction error.

Figure 3: Example from the Paper event log showing the Response Declare constraint. If activity Develop Method occurs, then Final Decision must eventually follow.

Figure 4: Learning a binary classifier predicate $A_{\theta}$ using LTN. The neural network outputs are interpreted as truth values and aggregated using logical quantifiers to compute overall satisfiability, which guides parameter learning.

Figure 5: Fine-tuning the autoencoder $AE_{\theta}$ with LTN. Predicates $P_{1}$ to $P_{n}$ extract activity probabilities from reconstructed traces, which are used to evaluate Declare constraint satisfiability and guide learning.

Classification	Event Log	Max. Trace Length	#Activities	#Users	#Cases	#Events
Synthetic	Paper	17	29	77	5000	60536
	P2P	16	27	91	5000	53193
	Small	15	41	89	5000	53437
	Medium	13	65	105	5000	41991
	Large	17	85	78	5000	67524
	Huge	16	109	93	5000	53210

Table 1: Event logs used in evaluations

Event Log	Method	Anomaly detection F1 scores w.r.t. # rare conformant traces
Event Log	Method	10	25	50	100	150	200	250	300
Paper	Baseline	0.38	0.38	0.39	0.38	0.4	0.42	0.39	0.43
Paper	Our approach	0.58	0.59	0.6	0.6	0.56	0.58	0.51	0.55
P2P	Baseline	0.39	0.38	0.38	0.38	0.39	0.36	0.41	0.41
P2P	Our approach	0.46	0.48	0.51	0.49	0.46	0.48	0.46	0.44
Small	Baseline	0.49	0.48	0.47	0.5	0.45	0.46	0.46	0.47

Table 2: Evaluation of synthetic event logs

Event Log	Method	Anomaly detection F1 scores w.r.t. # rare conformant traces
Event Log	Method	10	25	50	100	150	200	250	300
BPIC12	Baseline	0.61	0.57	0.65	0.42	0.52	0.55	0.52	0.53
BPIC12	Our approach	0.66	0.75	0.78	0.53	0.62	0.61	0.62	0.63
BPIC13	Baseline	0.27	0.29	0.26	0.28	0.29	0.29	0.28	0.3
BPIC13	Our approach	0.36	0.4	0.38	0.41	0.36	0.39	0.38	0.35
BPIC17	Baseline	0.52	0.5	0.5	0.51	0.52	0.5	0.51	0.5

Table 3: Evaluation of real-world event logs

Figure 6: Impact of Declare constraints for the best performing models for Paper event log.

Figure 7: Impact of Declare constraints for the best performing models for BPIC12 event log.

Explore similar work

Compliance-Aware Predictive Process Monitoring: A Neuro-Symbolic Approach
Mar 27, 2026Fabrizio De Santis, Gyunam Park, Wil M. P. van der Aalst +1Predictive Process Monitoring Neurosymbolic Learning
University of Parma, Parma, Italy · Eindhoven University of Technology, Eindhoven, Netherlands · RWTH Aachen University, Aachen, Germany
Unsupervised Symbolic Anomaly Detection
Mar 18, 2026Md Maruf Hossain, Tim Katzke, Simon Klüttermann +1Unsupervised Anomaly Detection Anomaly Detection
TU Dortmund University, Dortmund, Germany · Research Center Trustworthy Data Science and Security, UA Ruhr, Germany
Neuro-Symbolic Learning for Predictive Process Monitoring via Two-Stage Logic Tensor Networks with Rule Pruning
Mar 27, 2026Fabrizio De Santis, Gyunam Park, Francesco ZanichelliPredictive Process Monitoring Neurosymbolic Learning
University of Parma, Parma, Italy · Eindhoven University of Technology, Eindhoven, Netherlands

Mar 27, 2026J/K move · Enter open · S save

Compliance-Aware Predictive Process Monitoring: A Neuro-Symbolic Approach

Fabrizio De Santis, Gyunam Park, Wil M. P. van der Aalst, Francesco Zanichelli

University of Parma, Parma, Italy · Eindhoven University of Technology, Eindhoven, Netherlands · RWTH Aachen University, Aachen, Germany

Predictive Process Monitoring Neurosymbolic Learning

Open paper AskPDF arXiv

Existing approaches for predictive process monitoring are sub-symbolic, meaning that they learn correlations between descriptive features and a target feature fully based on data, e.g., predicting the surgical needs of a patient based on historical events and biometrics. However, such approaches fail to incorporate domain-specific process constraints (knowledge), e.g., surgery can only be planned if the patient was released more than a week ago, limiting the adherence to compliance and providing less accurate predictions. In this paper, we present a neuro-symbolic approach for predictive process monitoring, leveraging Logic Tensor Networks (LTNs) to inject process knowledge into predictive models. The proposed approach follows a structured pipeline consisting of four key stages: 1) feature extraction; 2) rule extraction; 3) knowledge base creation; and 4) knowledge injection. Our evaluation shows that, in addition to learning the process constraints, the neuro-symbolic model also achieves better performance, demonstrating higher compliance and improved accuracy compared to baseline approaches across all compliance-aware experiments.

Abstract

Explore similar work

Compliance-Aware Predictive Process Monitoring: A Neuro-Symbolic Approach

Unsupervised Symbolic Anomaly Detection

Neuro-Symbolic Learning for Predictive Process Monitoring via Two-Stage Logic Tensor Networks with Rule Pruning