This is the source code of our paper 'DUAL: A Federated Unsupervised Anomaly Detection Framework for Collaborative Business Processes'.

• Python==3.7
• PyTorch==1.13.0
• NumPy==1.21.5
• scikit-learn==1.0.2
• pandas==1.3.5

Eight logs simulated from process models: Paper, P2P, Small, Medium, Large, Huge, Gigantic, and Wide.

Eight commonly used publicly available datasets:

i) BPIC12: Event log of a loan application process

ii) BPIC17: This event log pertains to a loan application process of a Dutch financial institute. The data contains all applications filed through an online system in 2016 and their subsequent events until February 1st 2017, 15:11.

iii) BPIC20: The dataset, which includes * five* distinct logs, encompasses events related to two years of travel expense claims. These events were recorded in 2017 for two departments and later expanded to cover the entire university in 2018.

iv) Receipt: This log contains records of the receiving phase of the building permit application process in an anonymous municipality.

Four publicly available real-life collaborative business process logs:

i) EM_Log: Collected from an emergency patient treatment process in a hospital.

ii) FP_Log:Collected from the response process to food poisoning incidents in a hospital.

iii) ID_Log: Collected from the treatment process of infectious diseases at a disease control and prevention center.

iv) SD_Log: Collected from the response process to specially managed drug loss incidents in a hospital.

The summary of statistics for each event log is presented below:

Logs containing 10% artificial anomalies are stored in the folder 'eventlogs'. The file names are formatted as log_name-anomaly_ratio-ID.

• Revise conf.py in the root directory to configure settings such as the hyperparameters of the transformer-based autoencoder, the number of participating clients, and the level of Gaussian noise.
• Run main.py from the root directory to get the result for each dataset in the folder 'eventlogs'.
• The results will be stored in 'result.csv'.

• Average precision (AP) over synthetic logs where 'Tra.' and 'Attr.' represent trace- and attribute-level anomaly detection respectively:

• Average precision (AP) over real-life logs where 'Tra.' and 'Attr.' represent trace- and attribute-level anomaly detection respectively:

We assess the extensibility of our DUAL framework by examining whether the number of clients affects anomaly detection performance.

• Critical difference diagram over trace-level anomaly detection:

• Critical difference diagram over attribute-level anomaly detection:

The experimental results indicate that there is no significant difference in the performance of DUAL across different numbers of clients (participants), and the performance of DUAL with any number of clients shows no significant difference compared to centralized training.