International Journal of Advances in Applied Sciences (IJAAS) Vol.
No.
June 2026, pp.
656O663
ISSN: 2252-8814.
DOI: 10.
11591/ijaas.
Anomaly detection in containerized virtual environments using a process mining approach Richard Angkawinata.
I Made Murwantara Master of Informatics.
Faculty of Artificial Intelligence and Data Science.
Universitas Pelita Harapan.
Jakarta.
Indonesia
Article Info
ABSTRACT
Article history:
The growing adoption of container-based virtual environments in cloud computing introduces new challenges in anomaly detection due to the systemsAo dynamic nature.
Traditional monitoring approaches often fail to capture inefficiencies or security risks effectively.
This study proposes a process mining approach to identify anomalies by analyzing event logs from containerized Event data from the AIOps challenge 2020 was converted into extensible event stream (XES) format and processed using the inductive visual miner in the ProM tool to generate Petri Net models, accurately visualizing container activity flows.
A conformance checking analysis was conducted to evaluate the alignment between modeled and actual behavior.
Results demonstrated a high fitness score, confirming the modelAos precision in reflecting true operational processes and its ability to reveal minor deviations indicative of potential anomalies.
These findings highlight process mining as a promising method to enhance security, transparency, and performance monitoring in virtual environments.
The research also recommends integrating process mining with real-time monitoring systems for proactive anomaly detection, thereby improving responsiveness and resilience in cloud-based infrastructures.
Received May 4, 2025 Revised Apr 23, 2026 Accepted May 22, 2026 Keywords:
AIOps Anomaly Container Process mining Virtual environment This is an open access article under the CC BY-SA license.
Corresponding Author:
I Made Murwantara Master of Informatics.
Faculty of Artificial Intelligence and Data Science.
Universitas Pelita Harapan Jakarta.
Indonesia Email: made.
murwantara@uph.
INTRODUCTION
Containerization has become a fundamental technology in modern cloud computing .
, .
, offering scalable and efficient solutions for application deployment.
Containers provide lightweight virtualization, enabling faster provisioning and improved resource utilization.
In researchers .
, .
concern about container performances within virtualization environment because of low packet processing.
However, their dynamic and distributed nature poses challenges in performance monitoring .
, anomaly detection, scheduling .
, and process optimization.
Traditional monitoring tools often fail to capture hidden inefficiencies, bottlenecks, and security risks within containerized environments .
, .
, making it crucial to explore new methodologies for comprehensive analysis.
Process mining .
has emerged as a powerful approach for analyzing event logs to gain insights into system behavior, uncover deviations, and optimize business process models.
By applying process mining techniques, organizations can systematically evaluate containerized workflows, detect inefficiencies, and enhance overall system performance.
This study focuses on leveraging process mining, particularly the inductive miner .
technique, to analyze event logs, identify anomalies, and improve operational efficiency Journal homepage: http://ijaas.
Int J Adv Appl Sci
ISSN: 2252-8814
ye within virtualized container environments.
An anomaly .
, .
, also referred to as an outlier, is a data point or pattern that deviates significantly from the expected distribution within a dataset.
These deviations are of particular interest as they may indicate critical phenomena such as fraudulent activities, system malfunctions, or security breaches.
Anomaly detection is the process of identifying such irregularities using a range of methodologies, including statistical analysis, machine learning algorithms, and process mining techniques.
However, in high-dimensional datasets, the detection process becomes increasingly complex due to the Aucurse of dimensionality,Ay which leads to data sparsity and challenges in distinguishing genuine anomalies from noise.
To address these limitations, effective strategies such as feature selection, dimensionality reduction, and specialized anomaly detection techniques are essential to enhance detection accuracy and reliability .
The primary objective of this research is to bridge the gap between anomaly detection and performance optimization .
in containerized environments.
By identifying deviations from expected workflows, this study aims to enhance system reliability, mitigate risks, and provide actionable insights for optimizing business process models.
The ability to detect and address anomalies not only strengthens security and enables organizations to improve resource allocation, workload balancing, and process efficiency.
METHOD
Research design This research adopts a quantitative methodology, utilizing process mining techniques to identify anomalies within virtual container environments.
Event log data, representing the execution of containerized processes, is systematically collected and prepared for analysis.
The inductive visual miner method, implemented through the ProM framework, is employed to transform the event logs into process models that accurately capture the actual behavior of the system.
By constructing detailed Petri Net models, the study visualizes the operational flow of container activities and facilitates the identification of deviations from expected behavior.
These deviations, often subtle and easily overlooked by traditional monitoring tools, are critical indicators of potential inefficiencies, operational bottlenecks, or security vulnerabilities.
Through conformance checking between the derived models and recorded event data, the research evaluates the alignment and uncovers instances where anomalies are present.
The findings demonstrate the effectiveness of process mining in providing deep insights into the dynamic and complex nature of containerized virtual Ultimately, this study highlights the value of integrating process mining into the monitoring frameworks of cloud computing systems to enhance transparency, improve performance, and support proactive anomaly detection.
Data collection Dataset for this study consists of event logs extracted from virtualized container environments.
These logs capture key process execution details, including itemid, name, bomcid, timestamp, value, and cmbdid.
Data sets are collected from AIOps challenge 2020 .
Data preprocessing The collected datasets have been preprocessed to facilitate analysis.
The timestamps, initially recorded in UNIX format, have been converted to greenwich mean time (GMT) to ensure consistency and compatibility with analytical methods.
Additionally, the value field has been removed due to the presence of null values, which are not suitable for the applied analysis techniques.
Analysis methods The analysis is performed using the ProM framework to facilitate process mining and anomaly This process involves leveraging ProMAos capabilities to convert CSV data into an extensible event stream (XES) event log, construct a Petri Net from the XES log, and perform conformance checks to enable complete performance analysis.
An anomaly, also referred to as an outlier, is a data point or pattern that deviates significantly from the expected distribution within a dataset.
These deviations are of particular interest as they may indicate critical phenomena such as fraudulent activities, system malfunctions, or security breaches.
Anomaly detection is the process of identifying such irregularities using a range of methodologies, including statistical analysis, machine learning algorithms, and process mining techniques.
However, in high-dimensional datasets, the detection process becomes increasingly complex due to the Aucurse of dimensionality,Ay which leads Anomaly detection in containerized virtual environments using a process .
(Richard Angkawinat.
ISSN: 2252-8814
to data sparsity and challenges in distinguishing genuine anomalies from noise.
To address these limitations, effective strategies such as feature selection, dimensionality reduction, and specialized anomaly detection techniques are essential to enhance detection accuracy and reliability .
Inductive visual miner Process mining is a powerful technique for extracting valuable insights from recorded event data, enabling a more comprehensive understanding of real-world workflows.
By analyzing event logs, it facilitates the discovery, evaluation, and optimization of processes across various fields, including business operations.
IT infrastructure, and virtual environments.
At its core, process mining relies on discovery algorithms to generate process models from event data.
However, ensuring these models accurately represent real processes requires multiple iterations of refinement and evaluation Ai a practice known as process exploration.
This phase involves adjusting algorithm parameters to produce a model that correctly reflects the recorded events.
To overcome these limitations, the inductive visual miner .
was developed as an advanced process exploration tool that combines the strengths of both commercial and academic approaches.
By integrating executable semantics with enhanced exploration features, it provides a balance between usability and analytical In addition, it introduces animation and deviation visualization functionalities, allowing users to observe process flows interactively and identify deviations from expected behavior.
These capabilities significantly improve the efficiency of process discovery, making it easier to detect and address anomalies.
As process mining continues to evolve, tools such as the inductive visual miner play a crucial role in optimizing workflows, ensuring compliance, and enhancing decision-making across various domains .
The inductive visual miner result of dcos container in this research shown in Figure 1.
RESULTS AND DISCUSSION
Data preparation The event log data used in this study originates from the AIOps challenge 2020 .
The dataset contains various types of data, but this research will focus specifically on container data.
The provided data is in the form of CSV files, with a sample attached in Table 1.
In creating event logs for process mining, as shown in Table 1, the data must include the following attributes: .
name, representing the container performing a specific process, i.
timestamp, recording the time when a process is successfully executed, and .
bomc id, representing a single container process that includes multiple events in a structured sequence.
Table 1.
Sample log from AIOps challenge 2020
container fail percent
container fail percent
container fail percent
container fail percent
container fail percent
container fail percent
container fail percent
container fail percent
bomc id
ZJ-004-065
ZJ-004-065
ZJ-004-065
ZJ-004-065
ZJ-004-065
ZJ-004-065
ZJ-004-065
ZJ-004-065
cmdb id In process mining, a case ID uniquely identifies a process instance, grouping related events in a sequential manner.
Each event ID represents an activity within the process and is associated with attributes such as timestamp, resource, and activity description.
In container environments, the bomc id serves as the case ID, enabling the tracking of container execution and detecting anomalies.
For example, a container .
omc id = ZJ-004-.
can transition through events such as container cpu used, container thread idle, and container session used, each recorded with timestamps.
By structuring event logs this way, process mining tools like ProM can reconstruct workflows and identify deviations from normal behavior, facilitating the detection of performance bottlenecks or security risks in virtualized environments .
A sequence of events that represents a single process instance in an event log is referred to as a trace.
A trace contains a sequence of events from the initial execution of the process to its completion, such as the trace .
, which indicates that events a, b, and c are related.
A Ie B Ie C, indicates that event A must be completed before event B begins and event B must be executed before event C.
This sequence ensures that the event log follows the predefined process case in a structured manner .
Int J Adv Appl Sci.
Vol.
No.
June 2026: 656Ae663
Int J Adv Appl Sci
ISSN: 2252-8814
ye Process discovery Process discovery methods derive process models from event logs, typically using Petri Nets, which consist of places and transitions.
The modelAos state is defined by how tokens are distributed, and transitions are triggered based on token presence.
Various models may capture different levels of trace behavior, with some failing to generalize properly .
and others allowing too many variations .
The objective of process discovery is to generate a well-structured model that effectively represents observed processes while maintaining a balance between accuracy and simplicity .
The data from dcos containers are processed through XES event logs and filtered using the inductive visual miner method to generate a Petri Net, as shown in Figure 1.
Figure 1.
Inductive miner result of dcos container Conformance checking Conformance checking .
is a process mining technique used to evaluate the accuracy of an event log aligned with a given process model.
It helps identify and measure deviations between the expected and actual process behavior, providing insights into process accuracy and compliance.
The main focus of the conformance checking is to assess fitness .
, which determines whether the observed execution traces can be replayed within the model.
A model with perfect fitness .
alue of .
which means all traces align, while lower Anomaly detection in containerized virtual environments using a process .
(Richard Angkawinat.
ISSN: 2252-8814
fitness values indicate discrepancies.
Various alignment techniques are used to quantify these deviations, such as optimal trace matching, which identifies the corresponding behavior closest to the model for each trace in the event log .
To obtain the conformance checking in the ProM application, an XES event log .
and a Petri Net are required.
The Petri Net .
is obtained during the process mining step using the inductive visual miner, while the XES event log is filtered using the conformance checking filter in the ProM application.
The results obtained are as shown in Figure 2.
Performance analysis Through the conformance checking results obtained, the process of replaying the log on the net can be performed to evaluate performance.
The results of this evaluation can then be further analyzed.
The log-replay process, as shown in Figure 3, can be implemented in the ProM application with advanced filtering based on the previous conformance checking results.
Figure 2.
Conformance checking Int J Adv Appl Sci.
Vol.
No.
June 2026: 656Ae663 Figure 3.
Replay net log dcos container Int J Adv Appl Sci
ISSN: 2252-8814
ye From a time performance perspective, the replay computation was completed efficiently, requiring 66 milliseconds as depicted in Table 2.
This result demonstrates that the system is capable of handling the alignment process between the event log and the process model with high computational Such a fast computation time suggests the feasibility of applying this method even in environments that require frequent or near real-time conformance checking.
However, it is crucial to emphasize that this measurement reflects only the computation time needed for log replay within the ProM tool, not the actual execution or throughput time of the processes being monitored.
To obtain deeper insights into process performance, such as identifying potential delays, bottlenecks, or process inefficiencies, a detailed analysis of event timestamp data would be necessary.
Incorporating timestamp-based performance analysis would enable the identification of slow process paths and contribute to a more comprehensive evaluation of containerized system behavior.
Table 2.
Result replay log Property Traversal arcs Calculation time .
Raw Fitness cost Max move-log cost Num.
Trace fitness Move-model fitness Move-log fitness Max fitness cost Trace length Queued states Value In terms of cost, the analysis shows a raw fitness cost of 316 out of a maximum possible cost of 2843.
This relatively low number of deviations indicates that the model closely follows the behavior recorded in the event log.
A lower cost signifies fewer mismatches or corrections needed during the alignment, which implies the model is effective in reflecting the real-world process with minimal inefficiencies.
Looking at the quality dimension, the results are also strong, with trace fitness, move-log fitness, and move-model fitness all scoring approximately 88.
These values suggest that most of the observed behavior in the log can be reproduced by the model, showing a high level of conformance.
While there are some discrepancies, they are minor and likely represent exceptions or rare process variants not fully captured by the model.
Further refinement could involve capturing a broader range of process variations for even higher model fidelity.
CONCLUSION
This study successfully demonstrates the application of process mining techniques to detect anomalies in containerized virtual environments.
By focusing on container data from the AIOps challenge 2020 and structuring it into event logs with appropriate attributes such as bomc id, timestamp, and name, the research accurately modeled process behavior using the inductive visual miner in the ProM framework.
The creation of Petri Nets enabled a clear visualization of container workflows, while conformance checking validated the alignment between modeled and actual event traces.
The system showed strong fitness scores, minimal deviations, and high trace quality, indicating that the model closely mirrors real-world container activities with few inefficiencies.
The performance analysis further affirmed the modelAos computational efficiency and low alignment cost, suggesting its practical viability for real-time monitoring applications.
Although minor discrepancies were identified, they are attributed to rare process variations rather than systemic flaws.
seen as the whole perspective, the integration of process discovery, conformance checking, and performance analysis provides a comprehensive approach to enhancing transparency, security, and operational efficiency in virtual container environments.
Future research is recommended to incorporate real-time event monitoring and timestamp analysis to further optimize anomaly detection and to explore bottleneck identification in dynamic cloud computing infrastructures.
Anomaly detection in containerized virtual environments using a process .
(Richard Angkawinat.
ISSN: 2252-8814
ACKNOWLEDGMENTS
This work has been supported by the Ministry of Education.
Culture.
Research and Technology of The Republic of Indonesia and LPPM Universitas Pelita Harapan.
FUNDING INFORMATION
This work has funding supported by the Ministry of Education.
Culture.
Research, and Technology of Indonesia project, no.
0999/LL3/AL.
04/2025 and LPPM Universitas Pelita Harapan project no.
022/LPPM-UPH/VI/2025.
AUTHOR CONTRIBUTIONS STATEMENT
This journal uses the Contributor Roles Taxonomy (CRediT) to recognize individual author contributions, reduce authorship disputes, and facilitate collaboration.
Name of Author Richard Angkawinata I Made Murwantara : Conceptualization : Methodology : Software : Validation : Formal Analysis ue ue ue ue ue ue ue ue : Investigation : Resources : Data Curation : Writing - Original Draft : Writing - Review & Editing ue ue ue ue ue ue ue ue ue ue : Visualization : Supervision : Project Administration : Funding Acquisition CONFLICT OF INTEREST STATEMENT Authors state no conflict of interest.
DATA AVAILABILITY
The data that support the findings of this study are available on request from the corresponding author, [IMM].
REFERENCES