Semi-supervised Streaming Anomaly Detection Using Next Activity Prediction: STAMP

Abstract

Business process execution can deviate from expected behavior, resulting in anomalous events or cases. Detecting such anomalies is important for ensuring compliance, reducing risks, and improving process reliability. Existing research has mainly addressed this problem in offline settings using unsupervised learning approaches. However, such approaches detect anomalies retrospectively on complete logs and do not leverage the anomaly labels provided by domain experts. In this paper, we propose STAMP, an approach for Semi-supervised sTreaming AnoMaly detection using next activity Prediction. STAMP integrates a next-activity prediction model with an anomaly classification model trained on a limited number of anomaly labels from domain experts. Both models are continuously updated in a streaming setting to capture recent process executions. We evaluate STAMP on benchmark event logs generated with three different noise levels. Our findings demonstrate that STAMP can improve recall in early anomaly detection compared with a fixed-threshold baseline while requiring only a modest number of labeled anomalies. These findings show how semi-supervised learning can leverage scarce expert feedback for anomaly detection in streaming process monitoring.