Inter
national
J
our
nal
of
Adv
ances
in
A
pplied
Sciences
(IJ
AAS)
V
ol.
15,
No.
2,
June
2026,
pp.
656
∼
663
ISSN:
2252-8814,
DOI:
10.11591/ijaas.v15.i2.pp656-663
❒
656
Anomaly
detection
in
containerized
virtual
en
vir
onments
using
a
pr
ocess
mining
appr
oach
Richard
Angkawinata,
I
Made
Murwantara
Master
of
Informatics,
F
aculty
of
Articial
Intelligence
and
Data
Science,
Uni
v
ersitas
Pelita
Harapan,
Jakarta,
Indonesia
Article
Inf
o
Article
history:
Recei
v
ed
May
4,
2025
Re
vised
Apr
23,
2026
Accepted
May
22,
2026
K
eyw
ords:
AIOps
Anomaly
Container
Process
mining
V
irtual
en
vironment
ABSTRA
CT
The
gro
wing
adoption
of
container
-based
virtual
en
vironments
in
cloud
computing
introduces
ne
w
challenges
in
anomaly
detection
due
to
the
systems’
dynamic
nature.
T
raditional
monitoring
approaches
often
f
ail
to
capture
inef
ciencies
or
securi
ty
risks
ef
fecti
v
ely
.
This
study
proposes
a
process
mining
approach
to
identify
anomalies
by
analyzing
e
v
ent
logs
from
containerized
systems.
Ev
ent
data
from
the
AIOps
challenge
2020
w
as
con
v
erted
into
e
xtensible
e
v
ent
stream
(XES)
format
and
processed
using
the
inducti
v
e
visual
miner
in
the
ProM
tool
to
ge
nerate
Petri
Net
models,
accurately
visualizing
container
acti
vity
o
ws.
A
conformance
checking
analysis
w
as
conducted
to
e
v
aluate
the
alignment
between
modeled
and
actual
beha
vior
.
Results
demonstrated
a
high
tness
score,
conrming
the
model’
s
precision
in
reecting
true
operational
processes
and
its
ability
to
re
v
eal
minor
de
viations
indicati
v
e
of
potential
anomalies.
These
ndings
highlight
process
mining
as
a
promising
method
to
enhance
security
,
transparenc
y
,
and
performance
monitoring
in
virtual
en
vironments.
The
research
also
recommends
inte
grating
process
mining
with
real-time
monitoring
systems
for
proacti
v
e
anomaly
detection,
thereby
impro
ving
responsi
v
eness
and
resilience
in
cloud-based
infrastructures.
This
is
an
open
access
article
under
the
CC
BY
-SA
license
.
Corresponding
A
uthor:
I
Made
Murw
antara
Master
of
Informatics,
F
aculty
of
Articial
Intelligence
and
Data
Science,
Uni
v
ersitas
Pelita
Harapan
Jakarta,
Indonesia
Email:
made.murw
antara@uph.edu
1.
INTR
ODUCTION
Containerization
has
become
a
fundamental
technology
in
modern
cloud
computing
[1],
[2],
of
fering
scalable
and
ef
ci
ent
solutions
for
application
deplo
yment.
Containers
pro
vide
lightweight
virtualization,
enabling
f
aster
pro
visioning
and
impro
v
ed
resource
util
ization.
In
researchers
[3],
[4]
concern
about
container
performances
within
virtualization
en
vironment
because
of
lo
w
pack
et
processing.
Ho
we
v
er
,
their
dynamic
and
distrib
uted
nature
poses
challenges
in
performance
monitoring
[5],
anomaly
detection,
scheduling
[6],
and
process
optimization.
T
raditional
monitoring
tools
often
f
ail
to
capture
hidden
inef
ciencies,
bottlenecks,
and
security
risks
within
containerized
en
vironments
[7],
[8],
making
it
crucial
to
e
xplore
ne
w
methodologies
for
comprehensi
v
e
analysis.
Process
mining
[9]
has
emer
ged
as
a
po
werful
approach
for
analyzing
e
v
ent
logs
to
g
ain
insights
into
system
beha
vi
o
r
,
unco
v
er
de
viations,
and
optimize
b
usiness
process
models.
By
applying
process
mining
techniques,
or
g
anizations
can
systematically
e
v
aluate
containerized
w
orko
ws,
detect
inef
ciencies,
and
enhance
o
v
erall
system
performance.
This
study
focuses
on
le
v
eraging
process
mining,
particularly
the
inducti
v
e
miner
[10]
technique,
to
analyze
e
v
ent
logs,
identify
anomalies,
and
impro
v
e
operational
ef
cienc
y
J
ournal
homepage:
http://ijaas.iaescor
e
.com
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Adv
Appl
Sci
ISSN:
2252-8814
❒
657
within
virtualized
container
en
vironments.
An
anomaly
[11],
[12],
also
referred
to
as
an
outlier
,
is
a
data
point
or
pattern
that
de
viates
signi
cantly
from
the
e
xpected
distrib
ution
within
a
dataset.
These
de
viations
are
of
particular
interest
as
the
y
may
indicate
critical
phenomena
such
as
fraudulent
acti
vities,
system
malfunctions,
or
security
breaches.
Anomaly
detection
is
the
process
of
identifying
such
irre
gularities
using
a
range
of
methodologies,
including
statistical
analysis,
machine
l
earning
algorithms,
and
process
mining
techniques.
Ho
we
v
er
,
in
hi
gh-dimensional
datasets,
the
detection
process
becomes
increasingly
comple
x
due
to
the
“curse
of
dimensionality
,
”
which
leads
to
data
sparsity
and
challenges
in
distinguishing
genuine
anomalies
from
noise.
T
o
address
thes
e
limitations,
ef
fecti
v
e
strate
gies
such
as
feature
selection,
dimensionality
reduction,
and
specialized
anomaly
de
tection
techniques
are
essential
to
enhance
detection
accurac
y
and
reliability
[13].
The
primary
objecti
v
e
of
this
researc
h
is
t
o
bridge
t
he
g
ap
between
anomaly
det
ection
and
pe
rformance
optimization
[14]
in
containerized
en
vironments.
By
identifying
de
viations
from
e
xpected
w
orko
ws,
this
study
aims
to
enhance
system
reliability
,
mitig
ate
ri
sks,
and
pro
vide
actionable
insights
for
optimizing
b
usiness
process
models.
The
ability
to
detect
and
address
anomalies
not
only
strengthens
security
and
enables
or
g
anizations
to
impro
v
e
resource
allocation,
w
orkload
balancing,
and
process
ef
cienc
y
.
2.
METHOD
2.1.
Resear
ch
design
This
research
adopts
a
quantitati
v
e
methodology
,
utilizing
process
mining
techniques
to
identify
anomalies
within
virtual
container
en
vironments.
Ev
ent
log
data,
representing
the
e
x
ecution
of
containerized
processes,
is
systematically
collected
and
prepared
for
analysis.
The
inducti
v
e
visual
miner
method,
implemented
through
the
ProM
frame
w
ork,
is
emplo
yed
to
transform
the
e
v
ent
logs
into
process
models
that
accurately
capture
the
actual
beha
vior
of
the
system.
By
constructing
detailed
Petri
Net
models,
the
study
visualizes
the
operational
o
w
of
container
acti
vities
and
f
acilitates
the
identication
of
de
viations
from
e
xpected
beha
vior
.
These
de
viations,
often
subtle
and
easily
o
v
erlook
ed
by
traditional
monitoring
tools,
are
critical
indicators
of
potential
inef
ciencies,
operational
bottlenecks,
or
security
vulnerabilities.
Through
conformance
checking
between
the
deri
v
ed
models
and
recorded
e
v
ent
data,
the
research
e
v
aluates
the
alignment
and
unco
v
ers
instances
where
anomalies
are
present.
The
ndings
demonstrate
the
ef
fecti
v
eness
of
process
mining
in
pro
viding
deep
insights
into
the
dynamic
and
comple
x
nature
of
containerized
virtual
en
vironments.
Ultimatel
y
,
this
study
highlights
the
v
alue
of
inte
grating
process
m
ining
into
the
monitoring
frame
w
orks
of
cloud
computing
systems
to
enhance
transparenc
y
,
impro
v
e
performance,
and
support
proacti
v
e
anomaly
detection.
2.2.
Data
collection
Dataset
for
this
study
consists
of
e
v
ent
logs
e
xtract
ed
from
virtualized
container
en
vironments.
Thes
e
logs
capture
k
e
y
process
e
x
ecution
details,
including
item
id,
name,
bomcid,
timestamp,
v
alue,
and
cmbdid.
Data
sets
are
collected
from
AIOps
challenge
2020
[15].
2.3.
Data
pr
epr
ocessing
The
collected
datasets
ha
v
e
been
preprocessed
to
f
acili
tate
analysis.
The
timestamps,
initially
re
corded
in
UNIX
format,
ha
v
e
been
con
v
erted
to
greenwich
mean
time
(GMT)
to
ensure
consistenc
y
and
compatibility
with
analytical
methods.
Additionally
,
the
v
alue
eld
has
been
remo
v
ed
due
to
the
presence
of
null
v
alues,
which
are
not
suitable
for
the
applied
analysis
techniques.
2.4.
Analysis
methods
The
analysis
is
performed
using
the
ProM
frame
w
ork
to
f
acilitat
e
process
mining
and
anomaly
detection.
This
process
in
v
olv
es
le
v
eraging
ProM’
s
capabiliti
es
to
con
v
ert
CSV
data
into
an
e
xtensible
e
v
ent
stream
(XES)
e
v
ent
log,
construct
a
Petri
Net
from
the
XES
log,
and
perform
conformance
checks
to
enable
complete
performance
analysis.
An
anomaly
,
also
referred
to
as
an
outlier
,
is
a
data
point
or
pattern
that
de
viates
signicantly
from
the
e
xpected
distrib
ution
within
a
dat
aset.
These
de
viations
are
of
particular
interes
t
as
the
y
may
indicate
critical
phenomena
such
as
fraudulent
acti
vities,
system
malfunctions,
or
security
breaches.
Anomaly
detection
is
the
process
of
identifying
such
irre
gularities
using
a
range
of
methodologies,
including
statistical
analysis,
machine
learning
algorithms,
and
process
mining
techniques.
Ho
we
v
er
,
in
high-dimensional
datasets,
the
detection
process
becomes
increasingly
comple
x
due
to
the
“curse
of
dimensionality
,
”
which
leads
Anomaly
detection
in
containerized
virtual
en
vir
onments
using
a
pr
ocess
...
(Ric
har
d
Angkawinata)
Evaluation Warning : The document was created with Spire.PDF for Python.
658
❒
ISSN:
2252-8814
to
data
sparsity
and
challenges
in
distinguishing
genuine
anomalies
from
noise.
T
o
address
these
limitations,
ef
fecti
v
e
strate
gies
such
as
feature
selection,
dimensionality
reduction,
and
specialized
anomaly
detection
techniques
are
essential
to
enhance
detection
accurac
y
and
reliability
[13].
2.4.1.
Inducti
v
e
visual
miner
Process
mining
is
a
po
werful
technique
for
e
xtracting
v
aluable
insights
from
recorded
e
v
ent
data,
enabling
a
more
comprehensi
v
e
understanding
of
real-w
orld
w
orko
ws.
By
analyzing
e
v
ent
logs,
it
f
acilitates
the
disco
v
ery
,
e
v
aluation,
and
optimization
of
processes
across
v
arious
elds,
including
b
usiness
operations,
IT
infrastructure,
and
virtual
en
vironments.
At
its
core,
process
mining
relies
on
disco
v
ery
algorithms
to
generate
process
models
from
e
v
ent
data.
Ho
we
v
er
,
ensuring
these
models
accurately
represent
real
processes
requires
multiple
iterations
of
renement
and
e
v
aluation
—
a
practice
kno
wn
as
process
e
xploration.
This
phase
in
v
olv
es
adjusting
algorithm
parameters
to
produce
a
model
that
correctly
reects
the
recorded
e
v
ents.
T
o
o
v
ercome
these
limitations,
the
inducti
v
e
visual
miner
[16]
w
as
de
v
eloped
as
an
adv
anced
process
e
xploration
tool
that
combines
the
strengths
of
both
commercial
and
academic
approaches.
By
inte
grating
e
x
ecutable
semantics
with
enhanced
e
xploration
features
,
it
pro
vides
a
balance
between
usability
and
analytical
rigor
.
In
addition,
it
introduces
animation
and
de
viation
visualization
functionalities,
allo
wing
us
ers
to
observ
e
process
o
ws
interacti
v
ely
and
identify
de
viations
from
e
xpected
beha
vior
.
These
capabilities
signicantly
impro
v
e
the
ef
cienc
y
of
process
disco
v
ery
,
making
it
easier
to
detect
and
address
anomalies.
As
process
mining
continues
to
e
v
olv
e,
tools
such
as
the
inducti
v
e
visual
miner
play
a
crucial
role
in
optimizing
w
orko
ws,
ensuring
compliance,
and
enhancing
decision-making
across
v
arious
domains
[17].
The
inducti
v
e
visual
miner
result
of
dcos
container
in
this
research
sho
wn
in
Figure
1.
3.
RESUL
TS
AND
DISCUSSION
3.1.
Data
pr
eparation
The
e
v
ent
log
data
used
in
this
study
originates
from
the
AIOps
challenge
2020
[15]
com
petition.
The
dataset
contains
v
arious
types
of
data,
b
ut
this
research
will
focus
specically
on
container
data.
The
pro
vided
data
is
in
the
form
of
CSV
l
es,
with
a
s
ample
attached
in
T
able
1.
In
c
reating
e
v
ent
l
ogs
for
proces
s
mining,
as
sho
wn
in
T
able
1,
the
data
must
include
the
follo
wing
attrib
utes:
i)
name,
representing
the
container
performing
a
specic
process,
ii)
timestamp,
recording
the
t
ime
when
a
process
is
successf
u
l
ly
e
x
ecuted,
and
iii)
bomc
id,
representing
a
single
container
process
that
includes
multiple
e
v
ents
in
a
structured
sequence.
T
able
1.
Sample
log
from
AIOps
challenge
2020
itemid
name
bomc
id
t
imestamp
v
alue
cmdb
id
999999996470837
container
f
ail
percent
ZJ-004-065
1587312034000
0.000000
container
001
999999996470922
container
f
ail
percent
ZJ-004-065
1587312035000
0.000000
container
002
999999996470922
container
f
ail
percent
ZJ-004-065
1587312092000
0.000000
container
002
999999996470837
container
f
ail
percent
ZJ-004-065
1587312092000
0.000000
container
001
999999996470837
container
f
ail
percent
ZJ-004-065
1587312143000
0.000000
container
001
999999996470922
container
f
ail
percent
ZJ-004-065
1587312143000
0.000000
container
002
999999996470837
container
f
ail
percent
ZJ-004-065
1587312211000
0.000000
container
001
999999996470922
container
f
ail
percent
ZJ-004-065
1587312263000
0.000000
container
002
In
process
mining,
a
case
ID
uniquely
identies
a
process
instance,
grouping
related
e
v
ents
in
a
sequential
manner
.
Each
e
v
ent
ID
represents
an
acti
vity
within
the
process
and
is
associated
with
attrib
utes
such
as
timestamp,
resource,
and
acti
vity
description.
In
container
en
vironments,
the
bomc
id
serv
es
as
the
case
ID,
enabling
the
tracking
of
container
e
x
ecution
and
detecting
anomalies.
F
or
e
xample,
a
container
(bomc
id
=
ZJ-004-063)
can
transition
through
e
v
ents
such
as
container
cpu
used,
container
thread
idle,
and
container
session
used,
each
recorded
with
timestamps.
By
structuring
e
v
ent
logs
this
w
ay
,
process
mining
tools
lik
e
ProM
can
reconstruct
w
orko
ws
and
identify
de
viations
from
normal
beha
vior
,
f
acilitating
the
detection
of
performance
bottlenecks
or
security
risks
in
virtualized
en
vironments
[18].
A
sequence
of
e
v
ents
that
represents
a
single
process
instance
in
an
e
v
ent
log
is
referred
to
as
a
trace.
A
trace
contains
a
sequence
of
e
v
ents
from
the
initial
e
x
ecution
of
the
process
to
its
completion,
such
as
the
trace
[abc],
which
indicates
that
e
v
ents
a,
b,
and
c
are
related.
A
→
B
→
C
,
indicates
that
e
v
ent
A
must
be
completed
before
e
v
ent
B
be
gins
and
e
v
ent
B
must
be
e
x
ecuted
before
e
v
ent
C.
This
sequence
ensures
that
the
e
v
ent
log
follo
ws
the
predened
process
case
in
a
structured
manner
[19].
Int
J
Adv
Appl
Sci,
V
ol.
15,
No.
2,
June
2026:
656–663
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Adv
Appl
Sci
ISSN:
2252-8814
❒
659
3.2.
Pr
ocess
disco
v
ery
Process
dis
co
v
ery
methods
deri
v
e
process
models
from
e
v
ent
logs,
typically
using
Petri
Nets,
which
consist
of
places
and
transitions.
The
model’
s
state
is
dened
by
ho
w
tok
ens
are
distrib
uted,
and
transitions
are
triggered
based
on
tok
en
presence.
V
arious
models
may
capture
dif
ferent
le
v
els
of
trace
beha
vior
,
with
some
f
ailing
to
generalize
properly
(o
v
ertting)
and
others
allo
wing
too
man
y
v
ariations
(undertting).
The
objecti
v
e
of
process
disco
v
ery
is
to
generat
e
a
well-structured
model
that
ef
fecti
v
ely
represents
observ
ed
processes
while
maintaining
a
balance
between
accurac
y
and
simplicity
[20].
The
data
from
dcos
containers
are
processed
through
XES
e
v
ent
logs
and
ltered
using
the
inducti
v
e
visual
miner
method
to
generate
a
Petri
Net,
as
sho
wn
in
Figure
1.
Figure
1.
Inducti
v
e
miner
result
of
dcos
container
3.3.
Conf
ormance
checking
Conformance
checking
[21]
is
a
process
mining
technique
used
to
e
v
aluate
the
accurac
y
of
an
e
v
ent
log
aligned
with
a
gi
v
en
process
model.
It
helps
identify
and
measure
de
viations
between
the
e
xpected
and
actual
process
beha
vior
,
pro
viding
insights
into
process
accurac
y
and
compliance.
The
main
focus
of
the
conformance
checking
is
to
assess
tness
[22],
which
determines
whether
the
observ
ed
e
x
ecution
traces
can
be
replayed
within
the
model.
A
model
with
perfect
tness
(v
alue
of
1)
which
means
all
traces
align,
while
lo
wer
Anomaly
detection
in
containerized
virtual
en
vir
onments
using
a
pr
ocess
...
(Ric
har
d
Angkawinata)
Evaluation Warning : The document was created with Spire.PDF for Python.
660
❒
ISSN:
2252-8814
tness
v
alues
indicate
discrepancies.
V
arious
alignment
techniques
are
used
to
quantify
these
de
viations,
such
as
optimal
trace
matching,
which
identies
the
corresponding
beha
vior
closest
to
the
model
for
each
trace
in
the
e
v
ent
log
[23].
T
o
obtain
the
conformance
checking
in
the
ProM
application,
an
XES
e
v
ent
log
[24]
and
a
Petri
Net
are
required.
The
Petri
Net
[25]
is
obtained
during
the
process
mining
step
using
the
inducti
v
e
visual
miner
,
while
the
XES
e
v
ent
log
is
ltered
using
the
conformance
checking
lter
in
the
ProM
application.
The
results
obtained
are
as
sho
wn
in
Figure
2.
3.4.
P
erf
ormance
analysis
Through
the
conformance
checking
results
obtained,
the
process
of
replaying
the
log
on
the
net
can
be
performed
to
e
v
aluate
performance.
The
results
of
this
e
v
aluation
can
then
be
further
analyzed.
The
log-replay
process,
as
sho
wn
in
Figure
3,
can
be
implemented
in
the
ProM
application
with
adv
anced
ltering
based
on
the
pre
vious
conformance
checking
results.
Figure
2.
Conformance
checking
Figure
3.
Replay
net
log
dcos
container
Int
J
Adv
Appl
Sci,
V
ol.
15,
No.
2,
June
2026:
656–663
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Adv
Appl
Sci
ISSN:
2252-8814
❒
661
From
a
time
performance
perspecti
v
e,
the
replay
computation
w
as
completed
ef
ciently
,
requi
ring
approximately
46.66
milliseconds
as
depicted
in
T
able
2.
This
result
demonstrates
that
the
system
is
capable
of
handling
the
alignment
process
between
the
e
v
ent
log
and
the
process
model
with
high
computational
ef
cienc
y
.
Such
a
f
ast
computation
time
suggests
the
feasibility
of
applying
this
method
e
v
en
in
en
vironments
that
require
fre
qu
e
nt
or
near
real-time
conformance
checking.
Ho
we
v
er
,
it
is
crucial
to
emphasize
that
this
measurement
reects
only
the
computation
time
needed
for
log
replay
within
the
ProM
tool,
not
the
actual
e
x
ecution
or
throughput
time
of
the
processes
being
monitor
ed.
T
o
obtain
deeper
insights
into
process
performance,
s
uch
as
identifying
potential
delays,
bottlenecks,
or
process
inef
ciencies,
a
detailed
analysis
of
e
v
ent
timestamp
data
w
ould
be
necessary
.
Incorporating
timestamp-based
performance
analysis
w
ould
enable
the
identication
of
slo
w
process
paths
and
contrib
ute
to
a
more
comprehensi
v
e
e
v
aluation
of
containerized
system
beha
vior
.
T
able
2.
Result
replay
log
Property
V
alue
T
ra
v
ersal
arcs
19658.66
Calculation
time
(ms)
46.66
Ra
w
Fitness
cost
316
Max
mo
v
e-log
cost
2843
Num.
states
8255.77
T
race
tness
0.88
Mo
v
e-model
tness
0.88
Mo
v
e-log
tness
0.88
Max
tness
cost
2844
T
race
length
2843
Queued
states
14383.55
In
terms
of
cost,
the
analysis
sho
ws
a
ra
w
tness
cost
of
316
out
of
a
maximum
possible
cost
of
2843.
This
relati
v
ely
lo
w
number
of
de
viations
indicates
that
the
model
closely
follo
ws
the
beha
vior
recorded
in
the
e
v
ent
log.
A
lo
wer
cost
signies
fe
wer
mismatches
or
corrections
needed
during
the
alignment,
which
implies
the
model
is
ef
fecti
v
e
in
reecting
the
real-w
orld
process
with
minimal
inef
ciencies.
Looking
at
the
quality
dimension,
the
results
are
also
strong,
with
trace
tness,
mo
v
e-log
tness,
and
mo
v
e-model
tness
all
scori
ng
approximately
88.89%.
These
v
alues
suggest
that
most
of
the
observ
ed
beha
vior
in
the
log
can
be
reproduced
by
the
model,
sho
wing
a
high
le
v
el
of
conformance.
While
there
are
some
discrepancie
s,
the
y
are
minor
and
lik
ely
represent
e
xceptions
or
rare
process
v
ariants
not
ful
ly
captured
by
the
model.
Further
renement
could
in
v
olv
e
capturing
a
broader
range
of
process
v
ariations
for
e
v
en
higher
model
delity
.
4.
CONCLUSION
This
study
successfully
demonstrates
t
he
application
of
process
mining
techniques
to
detect
anomali
es
in
containerized
virtual
en
vironments.
By
focusing
on
container
data
from
the
AIOps
challenge
2020
and
structuring
it
into
e
v
ent
logs
with
appropriate
attrib
utes
such
as
bomc
id,
timestamp,
and
name,
the
research
accurately
modeled
process
beha
vior
using
the
inducti
v
e
visual
miner
in
the
ProM
frame
w
ork.
The
creation
of
Petri
Nets
enabled
a
clear
visualization
of
container
w
orko
ws,
while
conformance
checking
v
alidated
the
alignment
between
modeled
and
actual
e
v
ent
traces.
The
system
sho
wed
strong
tness
sc
ores,
minimal
de
viations,
and
high
trace
quality
,
indicating
that
the
model
closely
mirrors
real-w
orld
container
acti
vities
with
fe
w
inef
ciencies.
The
performance
analysis
further
af
rmed
the
model’
s
computational
ef
cienc
y
and
lo
w
alignment
cost,
suggesting
its
practical
viability
for
real-time
monitoring
applications.
Although
minor
discrepancies
were
identied,
the
y
are
attrib
uted
to
rare
process
v
ariations
rather
than
systemic
a
ws.
As
seen
as
the
whole
perspecti
v
e,
the
inte
gration
of
process
disco
v
ery
,
conformance
checking,
and
performance
analysis
pro
vides
a
comprehensi
v
e
approach
to
enhancing
transparenc
y
,
security
,
and
operational
ef
cienc
y
in
virtual
container
en
vironments.
Future
research
is
recommended
to
incorporate
real-time
e
v
ent
monitoring
and
timestamp
analysis
to
further
optimize
anomaly
detection
and
to
e
xplore
bottleneck
identication
in
dynamic
cloud
computing
infrastructures.
Anomaly
detection
in
containerized
virtual
en
vir
onments
using
a
pr
ocess
...
(Ric
har
d
Angkawinata)
Evaluation Warning : The document was created with Spire.PDF for Python.
662
❒
ISSN:
2252-8814
A
CKNO
WLEDGMENTS
This
w
ork
has
been
supported
by
the
Ministry
of
Education,
Culture,
Research
and
T
echnology
of
The
Republic
of
Indonesia
and
LPPM
Uni
v
ersitas
Pelita
Harapan.
FUNDING
INFORMA
TION
This
w
ork
has
funding
supported
by
the
M
inistry
of
Education,
Culture,
Research,
and
T
echnology
of
Indonesia
project,
no.
0999/LL3/AL.04/2025
and
LPPM
Uni
v
ersitas
Pelita
Harapan
project
no.
022/LPPM-UPH/VI/2025.
A
UTHOR
CONTRIB
UTIONS
ST
A
TEMENT
This
journal
uses
the
Contrib
utor
Roles
T
axonomy
(CRediT)
to
recognize
indi
vidual
author
contrib
utions,
reduce
authorship
disputes,
and
f
acilitate
collaboration.
Name
of
A
uthor
C
M
So
V
a
F
o
I
R
D
O
E
V
i
Su
P
Fu
Richard
Angka
winata
✓
✓
✓
✓
✓
✓
✓
I
Made
Murw
antara
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
C
:
C
onceptualization
I
:
I
n
v
estig
ation
V
i
:
V
i
sualization
M
:
M
ethodology
R
:
R
esources
Su
:
Su
pervision
So
:
So
ftw
are
D
:
D
ata
Curation
P
:
P
roject
Administration
V
a
:
V
a
lidation
O
:
Writing
-
O
riginal
Draft
Fu
:
Fu
nding
Acquisition
F
o
:
F
o
rmal
Analysis
E
:
Writing
-
Re
vie
w
&
E
diting
CONFLICT
OF
INTEREST
ST
A
TEMENT
Authors
state
no
conict
of
interest.
D
A
T
A
A
V
AILABILITY
The
data
that
support
the
ndings
of
this
study
are
a
v
ailable
on
request
from
the
corr
esponding
author
,
[IMM].
REFERENCES
[1]
A.
Bho
wmik,
M.
Sannigrahi,
D.
Cho
wdhury
,
A.
De
y
,
and
S.
S.
Gill,
“CloudAISim:
a
toolkit
for
modelling
and
simulation
of
modern
applications
in
AI-dri
v
en
cloud
computing
en
vironments,
”
Benc
hCouncil
T
r
ansacti
ons
on
Benc
hmarks,
Standar
ds
and
Evaluations
,
v
ol.
3,
no.
4,
Dec.
2023,
doi:
10.1016/j.tbench.2024.100150.
[2]
I.
M.
Murw
antara,
B.
Bordbar
,
and
J.
B.
F
.
Filho,
“
A
self-adapti
v
e
architecture
with
ener
gy
management
in
virtualized
en
vironments,
”
in
2017
International
Confer
ence
on
Soft
Computing
,
Intellig
ent
System
and
Information
T
ec
hnolo
gy
(ICSIIT)
,
Sep.
2017,
pp.
124–130,
doi:
10.1109/ICSIIT
.2017.18.
[3]
L.
Abeni,
“V
irtualized
real-time
w
orkloads
in
containers
and
virtual
machines,
”
J
ournal
of
Systems
Ar
c
hitectur
e
,
v
ol.
154,
Sep.
2024,
doi:
10.1016/j.sysarc.2024.103238.
[4]
F
.
W
iedner
,
M.
Helm,
A.
Daichendt,
J.
Andre,
and
G.
Carle,
“Performance
e
v
aluation
of
containers
for
lo
w-latenc
y
pack
et
processing
in
virtualized
netw
ork
en
vironments,
”
P
erformance
Evaluation
,
v
ol.
166,
No
v
.
2024,
doi:
10.1016/j.pe
v
a.2024.102442.
[5]
D.
A.
T
amb
urri,
M.
Miglierina,
and
E.
D.
Nitto,
“Cloud
applications
monitoring:
an
industrial
study
,
”
Information
and
Softwar
e
T
ec
hnolo
gy
,
v
ol.
127,
No
v
.
2020,
doi:
10.1016/j.infsof.2020.106376.
[6]
N.
Zhao
e
t
al
.,
“Scheduling
virtual
machines
and
containers:
a
comparati
v
e
re
vie
w
of
techniques,
performance,
and
future
trends,
”
J
ournal
of
Systems
Ar
c
hitectur
e
,
v
ol.
168,
No
v
.
2025,
doi:
10.1016/j.sysarc.2025.103583.
[7]
M.
Thompson
and
M.
A.
K
yer
,
“Securing
the
containerized
en
vironment
along
the
CI/CD
pipeline,
”
in
2025
IEEE
15th
Annual
Computing
and
Communication
W
orkshop
and
Confer
ence
(CCWC)
,
Jan.
2025,
pp.
00250–00256,
doi:
10.1109/CCWC62904.2025.10903704.
[8]
D.
Mubanda,
N.
Mandela,
T
.
Mbinda,
and
C.
A
yesig
a,
“Ev
aluating
dock
er
container
security
through
penetration
testing:
a
smart
computer
security
,
”
in
2023
International
Confer
ence
on
C
ommunication,
Security
and
Articial
Intellig
ence
(ICCSAI)
,
No
v
.
2023,
pp.
415–419,
doi:
10.1109/ICCSAI59793.2023.10421124.
[9]
W
.
M.
P
.
V
.
D.
Aalst,
H.
A.
Reijers,
and
L.
Maruster
,
“Process
mining
be
yond
w
orko
ws,
”
Computer
s
in
Industry
,
v
ol.
161,
Oct.
2024,
doi:
10.1016/j.compind.2024.104126.
[10]
S.
N.
Araghi,
F
.
F
ontanili,
E.
Lamine,
U.
Ok
ongwu,
and
F
.
Benaben,
“Stable
heuristic
miner:
applying
statistical
stability
to
disco
v
er
the
common
patient
pathw
ays
from
location
e
v
ent
logs,
”
Intellig
ent
Systems
with
Applications
,
v
ol.
14,
May
2022,
doi:
10.1016/j.isw
a.2022.200071.
Int
J
Adv
Appl
Sci,
V
ol.
15,
No.
2,
June
2026:
656–663
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Adv
Appl
Sci
ISSN:
2252-8814
❒
663
[11]
Z.
Zhang,
Z.
Zhu,
C.
Xu,
J.
Zhang,
and
S.
Xu,
“T
o
w
ards
accurate
anomaly
detection
for
cloud
system
via
graph-enhanced
contrasti
v
e
learning,
”
Comple
x
&
Intellig
ent
Systems
,
v
ol.
11,
no.
1,
No
v
.
2024,
doi:
10.1007/s40747-024-01659-x.
[12]
Y
.
Song,
R.
Xin,
P
.
Chen,
R.
Zhang,
J.
Chen,
and
Z.
Zhao,
“Identifying
perform
ance
anomalies
in
uctuating
cloud
en
vironments:
a
rob
ust
correlati
v
e-GNN-based
e
xplainable
approach,
”
Futur
e
Gener
ation
Computer
Systems
,
v
ol.
145,
pp.
77–86,
Aug.
2023,
doi:
10.1016/j.future.2023.03.020.
[13]
S.
Thudumu,
P
.
Branch,
J.
Jin,
and
J.
Singh,
“
A
comprehensi
v
e
surv
e
y
of
anomaly
detection
techniques
for
high
dimensional
big
data,
”
J
ournal
of
Big
Data
,
v
ol.
7,
no.
1,
Dec.
2020,
doi:
10.1186/s40537-020-00320-x.
[14]
G.
Soliman,
K.
Mostaf
a,
and
O.
Y
ounis,
“Reinforcement
learning
for
process
mining:
b
usiness
process
optimization
with
a
v
oiding
bottlenecks,
”
Egyptian
Informatics
J
ournal
,
v
ol.
29,
Mar
.
2025,
doi:
10.1016/j.eij.2024.100595.
[15]
Z.
Li,
“
AIOps
challenge
2020
data,
”
GitHub
,
2022.
Accessed:
May
26,
2026.
[Online].
A
v
ailable:
https://github
.com/NetManAIOps/AIOps-Challenge-2020-Data
[16]
F
.
Rabbi,
D.
Banik,
N.
U.
I.
Hossain,
and
A.
Sok
olo
v
,
“Using
process
mining
algorithms
for
process
impro
v
ement
in
healthcare,
”
Healthcar
e
Analytics
,
v
ol.
5,
Jun.
2024,
doi:
10.1016/j.health.2024.100305.
[17]
S.
J.
J.
Leemans,
D.
F
ahla
nd,
and
W
.
M.
P
.
V
.
D.
Aalst,
“Process
and
de
viation
e
xploration
with
inducti
v
e
visual
miner
,
”
in
CEUR
W
orkshop
Pr
oceedings
,
2014,
pp.
46–50.
[18]
P
.
S.
Ra
w
at
et
al
.,
“Ef
cient
virtual
machine
placement
in
cloud
computing
en
vironment
using
BSO-ANN
based
h
ybrid
technique,
”
Ale
xandria
Engineering
J
ournal
,
v
ol.
110,
pp.
145–152,
Jan.
2025,
doi:
10.1016/j.aej.2024.09.103.
[19]
Z.
T
ariq,
D.
Charles,
S.
McClean,
I.
McChesne
y
,
and
P
.
T
aylor
,
“
Anomaly
detection
for
service-oriented
b
usiness
processes
using
conformance
analysis,
”
Algorithms
,
v
ol.
15,
no.
8,
Jul.
2022,
doi:
10.3390/a15080257.
[20]
W
.
V
.
D.
Aalst,
“Process
mining,
”
Communications
of
the
A
CM
,
v
ol.
55,
no.
8,
pp.
76–83,
Aug.
2012,
doi:
10.1145/2240236.2240257.
[21]
S.
J.
J.
Leemans,
“Conformance
checking,
”
in
Rob
ust
Pr
ocess
Mining
with
Guar
antees
:
Pr
ocess
Disco
very
,
Conformance
Chec
king
and
Enhancement
,
Cham,
Switzerland:
Springer
,
2022,
pp.
327–354,
doi:
10.1007/978-3-030-96655-3
7.
[22]
J.
Carmona,
B.
v
an
Dongen,
and
M.
W
eidlich,
“Conformance
checking:
foundations,
milestones
and
challenges,
”
in
Pr
ocess
Mining
Handbook
,
Cham,
Switzerland:
Springer
,
2022,
pp.
155–190,
doi:
10.1007/978-3-031-08848-3
5.
[23]
A.
Rozinat
and
W
.
M.
P
.
V
.
D.
Aalst,
“Conformance
checking
of
processes
based
on
monitoring
real
beha
vior
,
”
Information
Systems
,
v
ol.
33,
no.
1,
pp.
64–95,
Mar
.
2008,
doi:
10.1016/j.is.2007.07.001.
[24]
L.
Abb
and
J.-R.
Rehse,
“Process-related
user
interaction
logs:
state
of
the
art,
reference
model,
and
object-centric
implementation,
”
Information
Systems
,
v
ol.
124,
Sep.
2024,
doi:
10.1016/j.is.2024.102386.
[25]
T
.
Brockhof
f,
M.
N.
Gose,
M.
S.
Uysal,
and
W
.
M.
P
.
V
.
D.
Aalst
“Process
comparison
usi
ng
Petri
Net
decomposition,
”
Application
and
Theory
of
P
etri
Nets
and
Concurr
ency
,
Cham,
Switzerland:
Springer
,
pp.
83–105,
doi:
10.1007/978-3-031-61433-0
5
BIOGRAPHIES
OF
A
UTHORS
Richard
Angkawinata
is
a
graduate
i
nformatics
student,
Uni
v
ersitas
Pelita
Harapan.
Skilled
in
fullstack
de
v
elopment,
data
science,
and
cloud
computing
system.
Strong
education
professional
with
a
ba
chelor’
s
de
gree
foc
used
in
informa
tics
from
F
ac
ulty
of
Informat
ion
T
echnology
,
Uni
v
ersitas
Pelita
Harapan.
He
can
be
contacted
at
email:
01679230012@student.uph.edu.
I
Made
Murwantara
earned
his
Ph.D.
de
gree
in
Computer
Science
from
the
Uni
v
ersity
of
Birmingham,
United
Kingdom
in
2016.
His
research
interest
includes
softw
are
product
line
engineering
for
and
in
c
loud
computing,
AI
for
biomedical
analysis,
AI-based
softw
are
automation,
and
cloud
computing
ener
gy
management.
He
can
be
contacted
at
email:
made.murw
antara@uph.edu.
Anomaly
detection
in
containerized
virtual
en
vir
onments
using
a
pr
ocess
...
(Ric
har
d
Angkawinata)
Evaluation Warning : The document was created with Spire.PDF for Python.