kth.sePublications KTH
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Leveraging Petri Nets for Workflow Anomaly Detection in Microservice Architectures
KTH, School of Engineering Sciences in Chemistry, Biotechnology and Health (CBH), Biomedical Engineering and Health Systems, Health Informatics and Logistics.
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Theoretical Computer Science, TCS.ORCID iD: 0000-0002-3656-1614
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Theoretical Computer Science, TCS.ORCID iD: 0000-0002-8069-6495
University of Illinois Urbana-Champaign, Chicago, USA.
Show others and affiliations
2025 (English)In: Application and Theory of Petri Nets and Concurrency - 46th International Conference, PETRI NETS 2025, Proceedings, Springer Nature , 2025, p. 219-241Conference paper, Published paper (Refereed)
Abstract [en]

Modern microservice architectures pose challenges in understanding and managing the complex workflows within these decentralized services. In particular, it is difficult to identify anomalous behavior that could indicate a bug or attack. We use traces of microservice application activity (requests and responses) to infer a model of the application’s normal behavior. Our approach mines Petri nets to formally represent concurrent operations and their temporal dependencies with a targeted delay injection approach that accurately and efficiently learns these dependencies. The models produced are both explainable and easy to inspect, which offers more transparency and control. Our evaluation shows that injecting delays during model training allows us to achieve perfect model and log fitness (Move-Model and Move-Log fitness of 1) with just 29 traces. In contrast, a straightforward approach requires over 10,000 traces to achieve similar accuracy. Our models successfully identify anomalies in various experiments, such as traces with one missing or multiple missing activities, and reordered sequences to simulate issues in real-world scenarios. Our approach outperforms the state-of-the-art method, demonstrating higher accuracy.

Place, publisher, year, edition, pages
Springer Nature , 2025. p. 219-241
Keywords [en]
Alignments, Conformance Checking, Cost function, Delay, Microservices, Process discovery, Process mining
National Category
Computer Sciences Computer Systems Robotics and automation
Identifiers
URN: urn:nbn:se:kth:diva-368632DOI: 10.1007/978-3-031-94634-9_11ISI: 001584539300011Scopus ID: 2-s2.0-105008762714OAI: oai:DiVA.org:kth-368632DiVA, id: diva2:1990022
Conference
46th International Conference on Applications and Theory of Petri Nets and Concurrency, PETRI NETS 2025, Paris, France, Jun 22 2025 - Jun 27 2025
Note

Part of ISBN 9783031946332

QC 20250819

Available from: 2025-08-19 Created: 2025-08-19 Last updated: 2026-05-29Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Kamboj, PriyankaArtho, CyrilleGuanciale, Roberto

Search in DiVA

By author/editor
Kamboj, PriyankaArtho, CyrilleGuanciale, Roberto
By organisation
Health Informatics and LogisticsTheoretical Computer Science, TCS
Computer SciencesComputer SystemsRobotics and automation

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 72 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf