Discovering and Analyzing Contextual Behavioral Patterns From Event Logs

The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. Given a definition of a process in form of a process model, conformance checking can be used to test whether the executions of a process contained in a so-called event log data structure are conforming with the process as it was defined. The result is a comparison of the execution traces and their respective correct execution, according to the process model. This technique provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. However, a problem is that it requires a process model to be available. Process models in the correct format are not always available. Contrary to conformance checking, process anomaly detection aims to find anomalous executions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Though process anomaly detection provides the benefit of not relying on a process model, it typically does not provide the level of detail that conformance checking does. A process execution can either be normal or it can be anomalous. This dissertation proposes process anomaly correction, a novel approach that combines the benefits of conformance checking and process anomaly detection. Given only an event log, process anomaly correction detects anomalous executions, clearly indicates where the anomaly has occurred during the execution and suggests possible corrective measures. The solution presented in this work is based on a new concept to the field of process anomaly detection: Process learning. In process learning, the task of understanding the process based on the example data is transformed into a learning problem in which a neural network is trained to predict the very next activity in a running process execution. The resulting machine learning model thus represents an approximation of the real process that created the data. This cumulative dissertation consists of five contributions to the field of business process management that demonstrate how, starting from a process anomaly detection, process anomaly correction is achieved in a series of four steps. (1) Process learning is employed to generate an approximated model of the process logic. (2) The limitation of only distinguishing between normal and anomalous process executions is overcome by employing the process learning model which processes the process executions on a finer level of detail than existing approaches. (3) The necessity of providing manual threshold settings, as it is typical for process anomaly detection algorithms, is replaced by an automatic parameterization utilizing the process learning model. (4) The predictive capabilities of the process learning model are exploited to generate possible corrections of detected anomalies. The resulting process anomaly correction approach can be employed in scenarios where classic conformance checking would be infeasible, due to the restriction of relying on a process model. Furthermore, it can be employed alongside classical conformance checking, for it incorporates more information coming from the event log than classical conformance checking (such as employees executing a process step, in which country the process is executed, etc.), and thus provides a new perspective for the process analyst.

Event logs recorded during the execution of business processes constitute a valuable source of information. Applying process mining techniques to them, event logs may reveal the actual process execution and enable reasoning on quantitative or qualitative process properties. However, event logs often contain sensitive information that could be related to individual process stakeholders through background information and cross-correlation. We therefore argue that, when publishing event logs, the risk of such re-identification attacks must be considered. In this paper, we show how to quantify the re-identification risk with measures for the individual uniqueness in event logs. We also report on a large-scale study that explored the individual uniqueness in a collection of publicly available event logs. Our results suggest that potentially up to all of the cases in an event log may be re-identified, which highlights the importance of privacy-preserving techniques in process mining.

Exploring the Relationship between Business Processes and Contextual Information in Manufacturing and Logistics Based on Event Logs

The applicability of process mining techniques hinges on the availability of event logs capturing the execution of a business process. In some use cases, particularly those involving customer-facing processes, these event logs may contain private information. Data protection regulations restrict the use of such event logs for analysis purposes. One way of circumventing these restrictions is to anonymize the event log to the extent that no individual can be singled out using the anonymized log. This paper addresses the problem of anonymizing an event log in order to guarantee that, upon disclosure of the anonymized log, the probability that an attacker may single out any individual represented in the original log, does not increase by more than a threshold. The paper proposes a differentially private disclosure mechanism, which oversamples the cases in the log and adds noise to the timestamps to the extent required to achieve the above privacy guarantee. The paper reports on an empirical evaluation of the proposed approach using 14 real-life event logs in terms of data utility loss and computational efficiency.

Optimal event log sanitization for privacy-preserving process mining

Outcome-oriented predictive process monitoring aims at classifying a running process execution according to a given set of categorical outcomes, leveraging data on past process executions. Most previous studies employ Recurrent Neural Networks to encode the sequence of events, without taking the structure of the process into account. However, process executions typically involve complex control-flow constructs, like parallelism and loops. Different executions of these constructs can be recorded as different event sequences in the event log. This makes it challenging for a recurrent classifier to detect potential relations between a high-level control-flow construct and the prediction target. This is especially true in the presence of high variability in process executions and lack of data. In this paper, we propose a novel approach which encodes the control-flow construct each event belongs to. First, we exploit Local Process Model mining techniques to extract frequently occurring control-flow patterns from the event log. Then, we employ different encoding techniques to enrich an on-going process execution with information related to the extracted control-flow patterns. We tested the proposed method on nine real-life event logs. The obtained results show consistent improvements in the prediction performance.

Process mining, especially process discovery, has been utilized to extract process models from event logs. One challenge faced by process discovery is to identify concurrency effectively. State-of-the-art approaches employ activity orders in traces to undertake process discovery and they require stringent completeness notions of event logs. Thus, they may fail to extract appropriate processes when event logs cannot meet the completeness criteria. To address this problem, we propose in this paper a novel technique which leverages activity dependences in traces. Based on the observation that activities with no dependencies can be executed in parallel, our technique is in a position to discover processes with concurrencies even if the logs fail to meet the completeness criteria. That is, our technique calls for a weaker notion of completeness. We evaluate our technique through experiments on both real-world and synthetic event logs, and the conformance checking results demonstrate the effectiveness of our technique and its relative advantages compared with state-of-the-art approaches.

It has been highlighted and spread that the cutting edge system and intelligence home system raised from dramatic development of IT technology. Through the progressed Application of Home Networking Tech. and diverse multi-media, there are plenty of efforts to pursue the realization of human convenience. As a home networking services is on the increase, so is the demand for context-aware services, utilizing a profile of users as well as various context information, a sensor, and other environmental information in order to recognize a pattern of users' activities. And more enhanced services that can analyze users' pattern of behaviors and reflect individual tendency in the service should be offered so that users can obtain the information they want much faster. Thus, an intellectual control model will be discussed herein, which can offer active service based on a pattern of users' behaviors, in order to suggest a device that predicts users' activities and operates in a more intelligent way.

Most actual information systems save transactions in event logs. These logs are not often used to improve the quality of the process model. The area of Process Mining provides techniques and tools which allow the extraction of persistent information about the business process model from event logs in order to incorporate them in a decisional system, and optimise the future executions of the business processes. In this paper, we present an approach using (in addition of event logs) some properties of the tasks composing the business processes like minimum and maximum durations. These properties are used to improve the quality of the underlying processes by a best detection of parallelism, loops and duplicated tasks.

Logs are widely used by large and complex software-intensive systems for troubleshooting. There have been a lot of studies on log-based anomaly detection. To detect the anomalies, the existing methods mainly construct a detection model using log event data extracted from historical logs. However, we find that the existing methods do not work well in practice. These methods have the close-world assumption, which assumes that the log data is stable over time and the set of distinct log events is known. However, our empirical study shows that in practice, log data often contains previously unseen log events or log sequences. The instability of log data comes from two sources: 1) the evolution of logging statements, and 2) the processing noise in log data. In this paper, we propose a new log-based anomaly detection approach, called LogRobust. LogRobust extracts semantic information of log events and represents them as semantic vectors. It then detects anomalies by utilizing an attention-based Bi-LSTM model, which has the ability to capture the contextual information in the log sequences and automatically learn the importance of different log events. In this way, LogRobust is able to identify and handle unstable log events and sequences. We have evaluated LogRobust using logs collected from the Hadoop system and an actual online service system of Microsoft. The experimental results show that the proposed approach can well address the problem of log instability and achieve accurate and robust results on real-world, ever-changing log data.

Keeping our rivers clean: Information-theoretic online anomaly detection for streaming business process events

Process mining enables extracting insights into human resources working in business processes and supports employee management and process improvement. Often, resources from the same organizational group exhibit similar characteristics in process execution, e.g., executing the same set of process activities or participating in the same types of cases. This is a natural consequence of division of labor in organizations. These characteristics can be organized along various process dimensions, e.g., case, activity, and time, which ideally are all considered in the application of resource-oriented process mining, especially analytics of resource groups and their behavior. In this paper, we use the concept of execution context to classify cases, activities, and times to enable a precise characterization of resource groups. We propose an approach to automatically learning execution contexts from process execution data recorded in event logs, incorporating domain knowledge and discriminative information embedded in data. Evaluation using real-life event log data demonstrates the usefulness of our approach.KeywordsExecution contextResource groupEvent logProcess miningWorkforce analytics

Process mining aims at deriving process knowledge from event logs, which contain data recorded during process executions. Typically, event logs need to be generated from process execution data, stored in different kinds of information systems. In complex domains like healthcare, data is available only at different levels of granularity. Event abstraction techniques allow the transformation of events to a common level of granularity, which enables effective process mining. Existing event abstraction techniques do not sufficiently take into account domain knowledge and, as a result, fail to deliver suitable event logs in complex application domains.This paper presents an event abstraction method based on domain ontologies. We show that the method introduced generates semantically meaningful high-level events, suitable for process mining; it is evaluated on real-world patient treatment data of a large U.S. health system.

Process discovery aims at building process models using information retrieved from logs. Process characteristics play a significant role in the selection of a suitable process modeling language for describing process discovery results. Business processes characterized by high variability, in which participants have a lot of autonomy and flexibility in executing the process, are difficult to be described with procedural process modeling languages,since they explicitly represent in a model every possible path. Declarative languages, like Declare, alleviate this issue by defining a set of constraints between activities that must not be violated during the process execution instead of describing what to do step by step. Recently, several process discovery techniques have been proposed for extracting a set of Declare constraints from a log. However, no one of these techniques allows the user to exploit the time perspective often available in a log to discover “time-aware” Declare constraints. Timed Declare has already previously been introduced to monitor metric temporal constraints at runtime. In this paper, we use this semantics for discovering a set of Timed Declare constraints from an event log. We have implemented the proposed approach as a plug-in of the process mining tool ProM. We have validated the approach by using our plug-in to mine two real-life event logs.

Ensuring the compliance of inter-organizational business processes with security, privacy and workflow requirements poses significant challenges. For compliance checking a specification of the process model which contains important requirements like causal dependencies among actions must be compared to the available data from the process execution. Complete execution data may only become available by combining distributed event logs which are maintained and stored independently by the participants. Frequently the information in combined event logs is found to be of limited reliability and quality: the overall maturity of some event logs may be low, the temporal structure of events may be unclear/imprecise (e.g. when logs of different organizations are combined), confidentiality constraints may prevent certain activities from being logged and logs may be partially corrupted. We propose an approach using abstraction techniques based on over-approximation and under-approximation for checking the compliance of incomplete process logs with a given process specification. Such methods are widely used in Model Checking to model unmanageable information about the states of a system (state explosion). Here these techniques are applied to model unavailable information, in particular incomplete event descriptions. We show under what conditions deviations from a specification can be confirmed as anomalies and when a process can be certified as correct even in the presence of incomplete event descriptions. The methods described here can be adopted for post mortem investigation, for the prevention and detection of security anomalies and for assessing the maturity level of event logs.