A method for detecting deviations between an event log and a process model includes converting the process model into a probability process model, the probability process model comprising multiple nodes in multiple hierarchies and probability distribution associated with the multiple nodes, a leaf node among the multiple nodes corresponding to an activity in the process model; detecting differences between at least one event sequence contained in the event log and the probability process model according to a correspondence relationship; and identifying the differences as the deviations in response to the differences exceeding a predefined threshold; wherein the correspondence relationship describes a correspondence relationship between an event in one event sequence of the at least one event sequence and a leaf node in the probability process model.