Neuro-Symbolic Process Anomaly Detection

2026-03-27

AI Summary

This work addresses the challenge that existing neural network approaches struggle to distinguish between rare yet compliant process behaviors and genuine anomalies in process anomaly detection, often leading to false positives due to the absence of domain knowledge. To overcome this limitation, the study introduces a neuro-symbolic method—novel in this context—by proposing an end-to-end framework that integrates an autoencoder with Logic Tensor Networks (LTNs). Declare logic constraints are encoded as differentiable soft rules and embedded into the learning process, enabling joint optimization of symbolic domain knowledge and data-driven representations. Experimental results demonstrate that the proposed approach significantly improves F1 scores on both synthetic and real-world datasets. Notably, it remains effective even with as few as ten compliant traces, underscoring the critical role of incorporating domain knowledge to enhance anomaly detection performance.

Abstract

Process anomaly detection is an important application of process mining for identifying deviations from the normal behavior of a process. Neural network-based methods have recently been applied to this task, learning directly from event logs without requiring a predefined process model. However, since anomaly detection is a purely statistical task, these models fail to incorporate human domain knowledge. As a result, rare but conformant traces are often misclassified as anomalies due to their low frequency, which limits the effectiveness of the detection process. Recent developments in the field of neuro-symbolic AI have introduced Logic Tensor Networks (LTN) as a means to integrate symbolic knowledge into neural networks using real-valued logic. In this work, we propose a neuro-symbolic approach that integrates domain knowledge into neural anomaly detection using LTN and Declare constraints. Using autoencoder models as a foundation, we encode Declare constraints as soft logical guiderails within the learning process to distinguish between anomalous and rare but conformant behavior. Evaluations on synthetic and real-world datasets demonstrate that our approach improves F1 scores even when as few as 10 conformant traces exist, and that the choice of Declare constraint and by extension human domain knowledge significantly influences performance gains.

Problem

• process anomaly detection
• neuro-symbolic AI
• domain knowledge
• rare conformant traces
• event logs

Innovation

• Neuro-Symbolic AI
• Logic Tensor Networks
• Process Anomaly Detection
• Declare Constraints
• Autoencoder