Neuro-Symbolic Process Anomaly Detection

Devashish Gaikwad, Wil M. P. Van Der Aalst, Gyunam Park
June, 2026
PDF Cite DOI

Abstract

Process anomaly detection is an important application of process mining for identifying deviations from the normal behavior of a process. Neural network-based methods have recently been applied to this task, learning directly from event logs without requiring a predefined process model. However, since anomaly detection is a purely statistical task, these models fail to incorporate human domain knowledge. As a result, rare but conformant traces are often misclassified as anomalies due to their low frequency, which limits the effectiveness of the detection process. Recent developments in the field of neuro-symbolic AI have introduced Logic Tensor Networks (LTN) as a means to integrate symbolic knowledge into neural networks using real-valued logic. In this work, we propose a neuro-symbolic approach that integrates domain knowledge into neural anomaly detection using LTN and Declare constraints. Using autoencoder models as a foundation, we encode Declare constraints as soft logical guiderails within the learning process to distinguish between anomalous and rare but conformant behavior. Evaluations on synthetic and real-world datasets demonstrate that our approach improves F1 scores even when as few as 10 conformant traces exist, and that the choice of Declare constraint and by extension human domain knowledge significantly influences performance gains.

Type
Conference paper
Publication
Advanced Information Systems Engineering - 38th International Conference, CAiSE 2026, Verona, Italy, June 8-12, 2026, Proceedings, Part II

Practical problem

Organizations screen their event logs for anomalous process executions to catch compliance breaches and inefficiencies. When no trustworthy process model exists, neural networks such as autoencoders learn what normal behaviour looks like from the log and flag traces they cannot reconstruct well. Because this is a purely statistical judgement, executions that are legitimate but rare, such as an uncommon but permitted approval path, get the same high reconstruction error as real deviations and are reported as anomalies, creating false alarms and raising the amount of data needed. Domain experts know which rare paths are allowed, but current neural detectors offer no way to feed that knowledge into the model.

Research questions

  1. How can human domain knowledge about rare but conformant behaviour be injected into a neural anomaly detector without abandoning learning from the event log?
  2. Does combining an autoencoder with Declare constraints through Logic Tensor Networks improve anomaly detection on synthetic and real-world logs, and how many rare conformant traces are needed for the gain to appear?
  3. How much does the choice of Declare constraint, and therefore the quality of the injected domain knowledge, influence the improvement?

Contributions

  • A neuro-symbolic anomaly detection approach that fine-tunes a pretrained denoising autoencoder with Logic Tensor Networks (LTN), a framework that grounds first-order logic in real-valued fuzzy logic.
  • A knowledge base construction step that mines Declare constraints, keeps low-support high-confidence constraints, selects them with domain knowledge and translates them into first-order logic over positional activity predicates.
  • A training objective that combines reconstruction loss with the satisfiability of the constraint on constraint-satisfying traces and its violation on violating traces, reusing established threshold heuristics for detection.
  • An evaluation protocol on eight synthetic logs and BPIC12, BPIC13 and BPIC17 with 30 percent injected anomalies, varying the number of rare conformant traces from 10 to 300, plus an ablation over seven Declare templates.
  • An open-source implementation, LTNcoder, on GitHub.

Key findings

  • On synthetic logs the approach beats the autoencoder baseline in 7 of 8 logs; on the Large log F1 moves from a baseline range of 0.27–0.36 to 0.57–0.66, and on Paper from 0.38–0.43 to 0.51–0.60, with absolute F1 between 0.23 and 0.66.
  • On real-world logs it wins in 2 of 3: BPIC12 F1 moves from a baseline range of 0.42–0.65 to 0.53–0.78 and BPIC13 from 0.26–0.30 to 0.35–0.41, while BPIC17 stays level at about 0.50–0.52.
  • The gain is already present with only 10 rare but conformant traces and stems from higher recall with a negligible drop in precision.
  • The ablation on Paper and BPIC12 shows that the F1 improvement and the post-training satisfiability vary strongly with the Declare template used; a succession constraint with low confidence reaches low satisfiability yet still yields a slight F1 gain.
  • The approach does not help on the Wide synthetic log and BPIC17, whose many variants exceed the autoencoder’s capacity, and fine-tuning there can even lower F1 through lost generalization.