NSP-AE: Neuro-symbolic process autoencoder for time anomaly detection

Temporal anomaly detection is a critical task in business process management, aiming to identify process instances whose temporal behavior deviates from expected specifications. Unlike activity-sequence compliance checking, temporal anomaly detection focuses on temporal attributes such as waiting times and event intervals during actual execution. Some instances may exhibit abnormal temporal behavior even when their control flow remains compliant, making such deviations difficult to uncover from control-flow information alone. Existing methods typically model activity transition relationships or treat temporal information merely as auxiliary neural-network features, while few methods jointly incorporate process structural constraints and temporal deviation signals into anomaly scoring. This paper proposes NSP-AE, a neural-symbolic process autoencoder for temporal anomaly detection. First, each event trace is represented using activity, resource, and local delta-time information. Second, a Petri net is discovered from the training log using Inductive Miner, and prefix replay is used to derive the set of activities reachable at the current process state. Third, this reachable activity set is transformed into a dynamic compliance mask and embedded into the decoder to constrain the activity prediction space. Finally, NSP-AE performs trace-level anomaly scoring by combining activity prediction deviation, compliance-constraint signals, and log-space time-interval deviation. Controlled timestamp perturbation experiments on four public event logs show that NSP-AE outperforms comparison baselines on most logs, with statistically significant advantages on multiple logs.