Distributed Process Discovery and Conformance Checking

Process mining is an emerging discipline incorporating methods and tools for the analysis of system/process executions captured in the form of event logs [1]. Traditionally process mining can be divided into three research areas: discovery (construction of process models from event logs), conformance checking (finding log and model deviations), and enhancement of existing process models with additional event log data.BPMN (Business Process Model and Notation) 2.0 [2] is a widely used process modeling notation, supported by various process modeling and analysis tools, and is a de-facto process modeling standard. Using BPMN within process mining opens perspectives for applicability of the existing process mining techniques: for instance discovered process models can be analyzed or enacted using existing BPMN-based software, and vice versa, manually created models can be imported to a process mining tool, verified against event logs, and enhanced with additional data.In this work we bridge the gap between conventional process modeling formalisms used in the context of process mining (e.g., Petri nets, causal nets, process trees) and BPMN. For that purpose we developed a suite of conversion algorithms and provide formal guarantees relating the behavior of Petri nets (including non-free-choice nets) to the corresponding BPMN models (and vice versa). The derived relations are used to enhance the BPMN models with information learned from the event logs.The developed conversion techniques are described in detail in [3] and have been implemented [4] as a part of ProM (Process Mining Framework) [5] -- an open source tool for process mining and verified on real event log data. Moreover, cases for which conversion algorithms give more compact process models in comparison with the initial models are identified. Although the developed algorithms deal with basic control flow constructs only, they can be applied in the discovery of advanced BPMN modeling elements [2], including subprocesses [6-7], cancellations [8], conditional branching and data objects, swimlanes, message flows, and others.

Background: Standard operating procedure (SOP) is a series of business activities to achieve organisational goals, with each activity carried to be recorded and stored in the information system together with its location (e.g., SCM, ERP, LMS, CRM). The activity is known as event data and is stored in a database known as an event log.Objective: Based on the event log, we can calculate the fitness to determine whether the business process SOP is following the actual business process.Methods: This study obtains the event log from a terminal operating system (TOS), which records the dwelling time at the container port. The conformance checking using token-based replay method calculates fitness by comparing the event log with the process model.Results: The findings using the Alpha algorithm resulted in the most traversed traces (a, b, n, o, p). The fitness calculation returns 1.0 were produced, missing, and remaining tokens are replied to each of the other traces.Conclusion: Thus, if the process mining produces a fitness of more than 0.80, this shows that the process model is following the actual business process. Keywords: Conformance Checking, Dwelling time, Event log, Fitness, Process Discovery, Process Mining

Healthcare processes are inherently complex as each patient is unique and medical staff deviate from protocols, often for valid reasons. Event logs collected by modern process-aware (healthcare) information systems provide a wealth of data and can be used to analyze the adherence to these protocols. Process mining is a young research area combining data science (machine learning, data mining, etc.) and business process management. Its main contributions have been techniques for process discovery (the automatic learning of process models from event data) and conformance checking (aligning observed and modeled behavior). However, existing techniques face challenging issues discovering high-quality process models in a healthcare setting. In this chapter we introduce the key concepts of process mining such as event logs, process models, and process discovery. We then show the application of two recent process mining techniques on a public event data set from the healthcare domain to demonstrate how some of the common pitfalls can be overcome. A first presented technique projects data statistics on a process model, allowing the analysis of correlations between patient characteristics and the executed activities (e.g., type of treatment). A second technique analyzes process performance without a specific need for a process model by considering contextual information. It correlates process characteristics with process performance.

Global conformance checking measures using shallow representation and deep learning

Many organisations now seek to analyse and improve their processes using event logs from various IT systems supporting their operations. Process mining aims to obtain insights from such process data, using process discovery, conformance checking and performance measures. While many commercial process mining tools feature user-friendly directly follows-based process maps, they typically do not offer a way to assess the quality of the model, leaving users with potentially unreliable insights, which could lead to the wrong conclusion being drawn from these insights. In contrast, academic tools typically provide verifiable results, but are often difficult to use and understand for stakeholders, sometimes overgeneralising behaviour to fit more extensive process model formalisms. In this paper, we bridge this well-known gap between commercial and academic tools by combining sound process discovery, conformance checking and performance capabilities with user-friendly directly follows-based process models. We implemented these techniques in a new process mining tool and applied them to analyse several business processes in a Queensland Government department. We discovered sound directly follows-based process models from their logs, compared them with prescribed models and analysed the performance of these processes. In particular, our conformance checking techniques allowed to pinpoint deviations between prescribed processes and actual recorded behaviour. The outcomes of this case study are now being used to document, review, improve and automate processes.

The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. Given a definition of a process in form of a process model, conformance checking can be used to test whether the executions of a process contained in a so-called event log data structure are conforming with the process as it was defined. The result is a comparison of the execution traces and their respective correct execution, according to the process model. This technique provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. However, a problem is that it requires a process model to be available. Process models in the correct format are not always available. Contrary to conformance checking, process anomaly detection aims to find anomalous executions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Though process anomaly detection provides the benefit of not relying on a process model, it typically does not provide the level of detail that conformance checking does. A process execution can either be normal or it can be anomalous. This dissertation proposes process anomaly correction, a novel approach that combines the benefits of conformance checking and process anomaly detection. Given only an event log, process anomaly correction detects anomalous executions, clearly indicates where the anomaly has occurred during the execution and suggests possible corrective measures. The solution presented in this work is based on a new concept to the field of process anomaly detection: Process learning. In process learning, the task of understanding the process based on the example data is transformed into a learning problem in which a neural network is trained to predict the very next activity in a running process execution. The resulting machine learning model thus represents an approximation of the real process that created the data. This cumulative dissertation consists of five contributions to the field of business process management that demonstrate how, starting from a process anomaly detection, process anomaly correction is achieved in a series of four steps. (1) Process learning is employed to generate an approximated model of the process logic. (2) The limitation of only distinguishing between normal and anomalous process executions is overcome by employing the process learning model which processes the process executions on a finer level of detail than existing approaches. (3) The necessity of providing manual threshold settings, as it is typical for process anomaly detection algorithms, is replaced by an automatic parameterization utilizing the process learning model. (4) The predictive capabilities of the process learning model are exploited to generate possible corrections of detected anomalies. The resulting process anomaly correction approach can be employed in scenarios where classic conformance checking would be infeasible, due to the restriction of relying on a process model. Furthermore, it can be employed alongside classical conformance checking, for it incorporates more information coming from the event log than classical conformance checking (such as employees executing a process step, in which country the process is executed, etc.), and thus provides a new perspective for the process analyst.

Process mining is widely adopted in organizations to gain deep insights about running business processes. This can be achieved by applying different process mining techniques like discovery, conformance checking, and performance analysis. These techniques are applied on event logs, which need to be extracted from the organization’s databases beforehand. This not only implies access to databases, but also detailed knowledge about the database schema, which is often not available. In many real-world scenarios, however, process execution data is available as redo logs. Such logs are used to bring a database into a consistent state in case of a system failure. This paper proposes a semi-automatic approach to extract an event log from redo logs alone. It does not require access to the database or knowledge of the databaseschema. The feasibility of the proposed approach is evaluated on two synthetic redo logs.

Process mining enables organizations to uncover their actual processes, provide insights, diagnose problems, and automatically trigger corrective actions. Process mining is an emerging scientific discipline positioned at the intersection between process science and data science. The combination of process modeling and analysis with the event data present in today’s information systems provides new means to tackle compliance and performance problems. This chapter provides an overview of the field of process mining introducing the different types of process mining (e.g., process discovery and conformance checking) and the basic ingredients, i.e., process models and event data. To prepare for later chapters, event logs are introduced in detail (including pointers to standards for event data such as XES and OCEL). Moreover, a brief overview of process mining applications and software is given.

Increasingly organizations are using process mining to understand the way that operational processes are executed. Process mining can be used to systematically drive innovation in a digitalized world. Next to the automated discovery of the real underlying process, there are process-mining techniques to analyze bottlenecks, to uncover hidden inefficiencies, to check compliance, to explain deviations, to predict performance, and to guide users towards “better” processes. Dozens (if not hundreds) of process-mining techniques are available and their value has been proven in many case studies. However, process mining stands or falls with the availability of event logs. Existing techniques assume that events are clearly defined and refer to precisely one case (i.e. process instance) and one activity (i.e., step in the process). Although there are systems that directly generate such event logs (e.g., BPM/WFM systems), most information systems do not record events explicitly. Cases and activities only exist implicitly. However, when creating or using process models “raw data” need to be linked to cases and activities. This paper uses a novel perspective to conceptualize a database view on event data. Starting from a class model and corresponding object models it is shown that events correspond to the creation, deletion, or modification of objects and relations. The key idea is that events leave footprints by changing the underlying database. Based on this an approach is described that scopes, binds, and classifies data to create “flat” event logs that can be analyzed using traditional process-mining techniques.

The lecture preparation process marks the start of lectures in the new semester. Telkom University has utilized online-based information technology, Integrated Academic Information System (i-Gracias). One of the applications available on i-Gracias is Outcome-Based Education (OBE). The significant increase in I-Gracias users indeed produces many data records in event logs. This data has become an opportunity to evaluate and improve the lecture preparation process already running. Data processing is needed to gain knowledge from the event log, one of which is process mining. This study starts from the discovery stage to conformance checking. Before the process mining is carried out, pre-processing of the data will be carried out to produce good quality logs and define the case id, activity, and timestamp. Existing event logs will be processed using ProM tools using the Heuristic Miner Algorithm to model the process and achieve the best fitness, precision, generalization, and simplicity values. The Heuristic Miner algorithm was adopted in this study because of its capability to manage event logs with noise and display the primary behavior of existing business processes. The conformance checking result shows a fitness value of 0.98, precision's value of 0.29, generalization's value of 0.51, and simplicity's value of 0.45 for the lecture preparation process. It means the process model has a good representation of the data event log. This study hopes to add new insight to improve the lecture preparation process at Telkom University.

The increasing availability of digital data offers new opportunities for analyzing business processes. Process aware information systems like Enterprise Resource Planning systems store data in the course of transaction processing. This data can be exploited by using process mining techniques. Process mining algorithms produce process models by analyzing recorded event logs. A fundamental challenge in process mining is the creation of purpose-oriented and useful process models. Process mining algorithms commonly refer to the temporal ordering of events for determining the control flow in reconstructed process models. We show how the logical sequence of events can be used instead of the temporal for reconstructing the control flow in mined process models. The exploitation of the logical structure of available event log records opens up new ways to receive purpose-oriented, less complex, and more informative process models.

Process mining, especially process discovery, has been utilized to extract process models from event logs. One challenge faced by process discovery is to identify concurrency effectively. State-of-the-art approaches employ activity orders in traces to undertake process discovery and they require stringent completeness notions of event logs. Thus, they may fail to extract appropriate processes when event logs cannot meet the completeness criteria. To address this problem, we propose in this paper a novel technique which leverages activity dependences in traces. Based on the observation that activities with no dependencies can be executed in parallel, our technique is in a position to discover processes with concurrencies even if the logs fail to meet the completeness criteria. That is, our technique calls for a weaker notion of completeness. We evaluate our technique through experiments on both real-world and synthetic event logs, and the conformance checking results demonstrate the effectiveness of our technique and its relative advantages compared with state-of-the-art approaches.

Process mining facilitates the discovery, conformance, and enhancement of business processes using event logs. However, incomplete event logs and the complexities of concurrent activities present significant challenges in achieving accurate process models that fulfill the completeness condition required in process mining. This paper introduces a Timed Genetic-Inductive Process Mining (TGIPM) algorithm, a novel approach that integrates the strengths of Timed Genetic Process Mining (TGPM) and Inductive Mining (IM). TGPM extends traditional Genetic Process Mining (GPM) by incorporating time-based analysis, while the IM is widely recognized for producing sound and precise process models. For the first time, these two algorithms are combined into a unified framework to address both missing activity recovery and structural correctness in process discovery. This study evaluates two scenarios: a sequential approach, in which TGPM and IM are executed independently and sequentially, and the TGIPM approach, where both algorithms are integrated into a unified framework. Experimental results using real-world event logs from a health service in Indonesia demonstrate that TGIPM achieves higher fitness, precision, and generalization compared to the sequential approach, while slightly compromising simplicity. Moreover, the TGIPM algorithm exhibits lower computational cost and more effectively captures parallelism, making it particularly suitable for large and incomplete datasets. This research underscores the potential of TGIPM to enhance process mining outcomes, offering a robust framework for accurate and efficient process discovery while driving process innovation across industries.

Since IoT devices supporting business processes (BPs) in sectors like manufacturing, logistics or healthcare can collect data on the execution of the processes, there is a growing awareness of the opportunity to use IoT data for process mining (PM). However, several challenges need to be addressed to enable IoT-enhanced PM, among which the need for a standard IoT-enhanced event log model. In this paper, we identify four main challenges for the integration of IoT data in event logs, from which 10 requirements for an IoT-enhanced event log model are derived. We then analyse the two main current event log models, the extensible event stream (XES) and the object-centric event log (OCEL), and confront them with the requirements, showing that both present important limitations to storing IoT-enhanced event logs. Based on this analysis, we conclude that a comprehensive data model is required to develop more advanced IoT-enhanced PM techniques .KeywordsProcess miningIoTIoT-enhanced event log

Towards interactive event log forensics: Detecting and quantifying timestamp imperfections