Encoding High-Level Control-Flow Construct Information for Process Outcome Prediction

Real-life business process event logs may suffer from significant data quality problems negatively influencing process mining analysis. Over time, a range of approaches has been developed to detect and repair these quality problems. Validation of these approaches tends to be challenging due to the lack of a ground truth. Moreover, the identification and definition of event log quality problems have been tackled mainly through a pattern-based approach, with systematic and extensible methods currently lacking. In this article, we present FLAWD , a formal language for describing event log data quality issues that enables solutions addressing the shortcomings of process mining data quality research identified above. FLAWD can be used to formally describe and possibly reason over event log data quality errors, as well as to guide the development of tools for controlled and sophisticated “polluting” of event logs through which benchmark datasets may be systematically created. We present the abstract syntax grammar of FLAWD and an open-source software tool based on it that allows for the insertion of all so-called event log imperfection patterns in a stochastic manner. We show how FLAWD has been used in our research to generate benchmark datasets and how it can be used to formally describe and replicate a range of errors found in real-life event logs.

Process discovery aims at building process models using information retrieved from logs. Process characteristics play a significant role in the selection of a suitable process modeling language for describing process discovery results. Business processes characterized by high variability, in which participants have a lot of autonomy and flexibility in executing the process, are difficult to be described with procedural process modeling languages,since they explicitly represent in a model every possible path. Declarative languages, like Declare, alleviate this issue by defining a set of constraints between activities that must not be violated during the process execution instead of describing what to do step by step. Recently, several process discovery techniques have been proposed for extracting a set of Declare constraints from a log. However, no one of these techniques allows the user to exploit the time perspective often available in a log to discover “time-aware” Declare constraints. Timed Declare has already previously been introduced to monitor metric temporal constraints at runtime. In this paper, we use this semantics for discovering a set of Timed Declare constraints from an event log. We have implemented the proposed approach as a plug-in of the process mining tool ProM. We have validated the approach by using our plug-in to mine two real-life event logs.

Process mining, which aims to mine a high-quality process model from event log, provides a powerful tool to support the design, enactment, management, and analysis of operational business processes. However, the task is not easy because the algorithm needs to discover various complex process structures, handle noisy and incomplete event logs and balance multiple performance indicators. In this paper, a novel algorithm (called PSOMiner) for process mining is proposed, which consists of a discrete particle swarm optimization algorithm and guided local mutation. The former is in charge of searching the solution space of causal matrix and the latter is used to help the algorithm skip out the local optimum when it suffers from premature. A fine-grained scoring strategy which used to assign a score to each position of a particle (i.e. causal matrix) is presented to direct the mutation. The experiments were performed on 28 synthetic event logs with/without noise and 4 real-life event logs, and three classical algorithms of process mining (ETM, Hybrid ILP Miner, HM) were chosen for comparison. The results show that (1) PSOMiner achieved the best f-score on 25 synthetic event logs; (2) The average f-score of PSOMiner is 0.825 on 4 real-life event logs, which is superior to ETM whose average f-score is 0.703.

Real-life event logs are typically much less structured and more complex than the predefined business activities they refer to. Most of the existing process mining techniques assume that there is a one-to-one mapping between process model activities and events recorded during process execution. Unfortunately, event logs and process model activities are defined at different levels of granularity. The challenges posed by this discrepancy can be addressed by means of log-lifting. In this work we develop a machine-learning-based framework aimed at bridging the abstraction level gap between logs and process models. The proposed framework operates of two main phases: log segmentation and machine-learning-based classification. The purpose of the segmentation phase is to identify the potential segment separators in a flow of low-level events, in which each segment corresponds to an unknown high-level activity. For this, we propose a segmentation algorithm based on maximum likelihood with n-gram analysis. In the second phase, event segments are mapped into their corresponding high-level activities using a supervised machine learning technique. Several machine learning classification methods are explored including ANNs, SVMs, and random forest. We demonstrate the applicability of our framework using a real-life event log provided by the SAP company. The results obtained show that a machine learning approach based on the random forest algorithm outperforms the other methods with an accuracy of 96.4%. The testing time was found to be around 0.01s, which makes the algorithm a good candidate for real-time deployment scenarios.

The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. Given a definition of a process in form of a process model, conformance checking can be used to test whether the executions of a process contained in a so-called event log data structure are conforming with the process as it was defined. The result is a comparison of the execution traces and their respective correct execution, according to the process model. This technique provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. However, a problem is that it requires a process model to be available. Process models in the correct format are not always available. Contrary to conformance checking, process anomaly detection aims to find anomalous executions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Though process anomaly detection provides the benefit of not relying on a process model, it typically does not provide the level of detail that conformance checking does. A process execution can either be normal or it can be anomalous. This dissertation proposes process anomaly correction, a novel approach that combines the benefits of conformance checking and process anomaly detection. Given only an event log, process anomaly correction detects anomalous executions, clearly indicates where the anomaly has occurred during the execution and suggests possible corrective measures. The solution presented in this work is based on a new concept to the field of process anomaly detection: Process learning. In process learning, the task of understanding the process based on the example data is transformed into a learning problem in which a neural network is trained to predict the very next activity in a running process execution. The resulting machine learning model thus represents an approximation of the real process that created the data. This cumulative dissertation consists of five contributions to the field of business process management that demonstrate how, starting from a process anomaly detection, process anomaly correction is achieved in a series of four steps. (1) Process learning is employed to generate an approximated model of the process logic. (2) The limitation of only distinguishing between normal and anomalous process executions is overcome by employing the process learning model which processes the process executions on a finer level of detail than existing approaches. (3) The necessity of providing manual threshold settings, as it is typical for process anomaly detection algorithms, is replaced by an automatic parameterization utilizing the process learning model. (4) The predictive capabilities of the process learning model are exploited to generate possible corrections of detected anomalies. The resulting process anomaly correction approach can be employed in scenarios where classic conformance checking would be infeasible, due to the restriction of relying on a process model. Furthermore, it can be employed alongside classical conformance checking, for it incorporates more information coming from the event log than classical conformance checking (such as employees executing a process step, in which country the process is executed, etc.), and thus provides a new perspective for the process analyst.

The goal of process mining is to discover the process behavior from the runtime information of process executions. Having labeled process logs is crucial for process mining research. However, real life event logs at process-aware information systems are mostly partially assigned to case identifiers, known as unlabeled event log problem. As a remedy to labeled data need in process mining research, we propose an approach to generate synthetic event logs according to the provided process profile, which outlines the activity vocabulary and structure of the corresponding business process. We evaluate the performance of our prototypical implementation in term of compatible log generation under varying parameter setting complexities.

The applicability of process mining techniques hinges on the availability of event logs capturing the execution of a business process. In some use cases, particularly those involving customer-facing processes, these event logs may contain private information. Data protection regulations restrict the use of such event logs for analysis purposes. One way of circumventing these restrictions is to anonymize the event log to the extent that no individual can be singled out using the anonymized log. This paper addresses the problem of anonymizing an event log in order to guarantee that, upon disclosure of the anonymized log, the probability that an attacker may single out any individual represented in the original log, does not increase by more than a threshold. The paper proposes a differentially private disclosure mechanism, which oversamples the cases in the log and adds noise to the timestamps to the extent required to achieve the above privacy guarantee. The paper reports on an empirical evaluation of the proposed approach using 14 real-life event logs in terms of data utility loss and computational efficiency.

Automated process discovery techniques allow us to generate a process model from an event log. The quality of automatically discovered process models can be assessed with respect to several criteria, including fitness, which captures the degree to which the process model is able to recognize the traces in the event log, and precision, which captures the extent to which the behavior allowed by the process model is observed in the event log. Many fitness and precision measures have been proposed in the literature. However, recent studies have shown that none of the existing measures fulfil a set of intuitive properties. In addition, existing fitness and precision measures suffer from scalability issues when applied to models discovered from real-life event logs. This article presents a family of fitness and precision measures based on the idea of comparing the k-th order Markovian abstractions of a process model and of an event log. We show that our family of measures fulfils the aforementioned properties for suitable values of k. An empirical evaluation shows that our proposed measures yield intuitive results on a synthetic dataset of model-log pairs, while outperforming existing measures in terms of execution times in real-life context.

Event logs recorded during the execution of business processes constitute a valuable source of information. Applying process mining techniques to them, event logs may reveal the actual process execution and enable reasoning on quantitative or qualitative process properties. However, event logs often contain sensitive information that could be related to individual process stakeholders through background information and cross-correlation. We therefore argue that, when publishing event logs, the risk of such re-identification attacks must be considered. In this paper, we show how to quantify the re-identification risk with measures for the individual uniqueness in event logs. We also report on a large-scale study that explored the individual uniqueness in a collection of publicly available event logs. Our results suggest that potentially up to all of the cases in an event log may be re-identified, which highlights the importance of privacy-preserving techniques in process mining.

Process mining enables the analysis of complex systems using event data recorded during the execution of processes. Specifically, models of these processes can be discovered from event logs, i.e., sequences of events. However, the recorded events are often too fine-granular and result in unstructured models that are not meaningful for analysis. Log abstraction therefore aims to group together events to obtain a higher-level representation of the event sequences. While such a transformation shall be driven by the analysis goal, existing techniques force users to define how the abstraction is done, rather than what the result shall be. In this paper, we propose GECCO, an approach for log abstraction that enables users to impose requirements on the resulting log in terms of constraints. GECCO then groups events so that the constraints are satisfied and the distance to the original log is minimized. Since exhaustive log abstraction suffers from an exponential runtime complexity, GECCO also offers a heuristic approach guided by behavioral dependencies found in the log. We show that the abstraction quality of GECCO is superior to baseline solutions and demonstrate the relevance of considering constraints during log abstraction in real-life settings.

Determining right model of business process from event log is the purpose of process discovery. However some problems i.e the inability to discover OR, noise and event log incompleteness are emmerged while determining right model of business process. First, OR relation is often discovered as AND relation. Second, noise problem is occured when there are truncated and low frequency traces in event log. Thus control-flow pattern is used to solve issues of same noise relation frequency hence it discovers relation based on transaction function of activity. Consequently, it can refine non noise relation in business process model. Third, incompleteness leads to incorrect discovery of parallel process model; therefore we used Timed-based Process Mining which utilized non-linear dependence to solve the incompleteness. Finally this paper proposed combination of Timed-based Process Mining and control-flow pattern to discover OR and handle same frequency noise and incompleteness. From the experiment in section 3, this proposed method manages to get right process model from event log.

Comparing business process variants using event logs is a common use case in process mining. Existing techniques for process variant analysis detect statistically-significant differences between variants at the level of individual entities (such as process activities) and their relationships (e.g. directly-follows relations between activities). This may lead to a proliferation of differences due to the low level of granularity in which such differences are captured. This paper presents a novel approach to detect statistically-significant differences between variants at the level of entire process traces (i.e. sequences of directly-follows relations). The cornerstone of this approach is a technique to learn a directly-follows graph called mutual fingerprint from the event logs of the two variants. A mutual fingerprint is a lossless encoding of a set of traces and their duration using discrete wavelet transformation. This structure facilitates the understanding of statistical differences along the control-flow and performance dimensions. The approach has been evaluated using real-life event logs against two baselines. The results show that at a trace level, the baselines cannot always reveal the differences discovered by our approach, or can detect spurious differences.

In this paper we present an approach for searching sub-traces in event logs, generated by information systems. Our technique is heavily based on the Aho-Corasick algorithm, and extends it with simultaneous search on several event log traces. The computational complexity of the proposed approach was estimated. Moreover, the approach was implemented and verified on real-life event logs. It was shown that it allows to reduce the search time for event logs with a high proportion of similar traces.

Process mining is a discipline that uses techniques to extract knowledge from event logs recorded by information systems in most companies these days. Among main perspectives of process mining, organizational and time perspectives focus on information about resources stored on the event logs and timing and frequency of the events, respectively. In this paper we introduce a method that combines organizational and time perspectives of process mining with a decision support tool called decision trees. The method takes the information of historical process data by means of an event log, generates a decision tree, annotates the decision tree with processing times, and recommends the best performer for a given running instance of the process. We finally illustrate the method through several experiments using a developed plug-in for the process mining framework ProM, first using synthetic data and then using a real-life event log.

Everything at the proper time: Repairing identical timestamp errors in event logs with Generative Adversarial Networks