No Time to Dice: Learning Execution Contexts from Event Logs for Resource-Oriented Process Mining

Event logs recorded during the execution of business processes constitute a valuable source of information. Applying process mining techniques to them, event logs may reveal the actual process execution and enable reasoning on quantitative or qualitative process properties. However, event logs often contain sensitive information that could be related to individual process stakeholders through background information and cross-correlation. We therefore argue that, when publishing event logs, the risk of such re-identification attacks must be considered. In this paper, we show how to quantify the re-identification risk with measures for the individual uniqueness in event logs. We also report on a large-scale study that explored the individual uniqueness in a collection of publicly available event logs. Our results suggest that potentially up to all of the cases in an event log may be re-identified, which highlights the importance of privacy-preserving techniques in process mining.

The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. Given a definition of a process in form of a process model, conformance checking can be used to test whether the executions of a process contained in a so-called event log data structure are conforming with the process as it was defined. The result is a comparison of the execution traces and their respective correct execution, according to the process model. This technique provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. However, a problem is that it requires a process model to be available. Process models in the correct format are not always available. Contrary to conformance checking, process anomaly detection aims to find anomalous executions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Though process anomaly detection provides the benefit of not relying on a process model, it typically does not provide the level of detail that conformance checking does. A process execution can either be normal or it can be anomalous. This dissertation proposes process anomaly correction, a novel approach that combines the benefits of conformance checking and process anomaly detection. Given only an event log, process anomaly correction detects anomalous executions, clearly indicates where the anomaly has occurred during the execution and suggests possible corrective measures. The solution presented in this work is based on a new concept to the field of process anomaly detection: Process learning. In process learning, the task of understanding the process based on the example data is transformed into a learning problem in which a neural network is trained to predict the very next activity in a running process execution. The resulting machine learning model thus represents an approximation of the real process that created the data. This cumulative dissertation consists of five contributions to the field of business process management that demonstrate how, starting from a process anomaly detection, process anomaly correction is achieved in a series of four steps. (1) Process learning is employed to generate an approximated model of the process logic. (2) The limitation of only distinguishing between normal and anomalous process executions is overcome by employing the process learning model which processes the process executions on a finer level of detail than existing approaches. (3) The necessity of providing manual threshold settings, as it is typical for process anomaly detection algorithms, is replaced by an automatic parameterization utilizing the process learning model. (4) The predictive capabilities of the process learning model are exploited to generate possible corrections of detected anomalies. The resulting process anomaly correction approach can be employed in scenarios where classic conformance checking would be infeasible, due to the restriction of relying on a process model. Furthermore, it can be employed alongside classical conformance checking, for it incorporates more information coming from the event log than classical conformance checking (such as employees executing a process step, in which country the process is executed, etc.), and thus provides a new perspective for the process analyst.

Real-life business process event logs may suffer from significant data quality problems negatively influencing process mining analysis. Over time, a range of approaches has been developed to detect and repair these quality problems. Validation of these approaches tends to be challenging due to the lack of a ground truth. Moreover, the identification and definition of event log quality problems have been tackled mainly through a pattern-based approach, with systematic and extensible methods currently lacking. In this article, we present FLAWD , a formal language for describing event log data quality issues that enables solutions addressing the shortcomings of process mining data quality research identified above. FLAWD can be used to formally describe and possibly reason over event log data quality errors, as well as to guide the development of tools for controlled and sophisticated “polluting” of event logs through which benchmark datasets may be systematically created. We present the abstract syntax grammar of FLAWD and an open-source software tool based on it that allows for the insertion of all so-called event log imperfection patterns in a stochastic manner. We show how FLAWD has been used in our research to generate benchmark datasets and how it can be used to formally describe and replicate a range of errors found in real-life event logs.

Most actual information systems save transactions in event logs. These logs are not often used to improve the quality of the process model. The area of Process Mining provides techniques and tools which allow the extraction of persistent information about the business process model from event logs in order to incorporate them in a decisional system, and optimise the future executions of the business processes. In this paper, we present an approach using (in addition of event logs) some properties of the tasks composing the business processes like minimum and maximum durations. These properties are used to improve the quality of the underlying processes by a best detection of parallelism, loops and duplicated tasks.

Management of interactive business processes in decentralized service infrastructures through event processing

Everything at the proper time: Repairing identical timestamp errors in event logs with Generative Adversarial Networks

In previous chapters, we have discussed the use of the multilevel business artifact (MBA) for multilevel business process modeling in order to better represent the interactions between the different hierarchy levels within a company. As the preparation for a proof-of-concept implementation, in Chapter 6, we have introduced an XML-based logical representation for MBAs. Relying on this XML representation, in this chapter, we present the implementation concept for a business process management system that enables the MBA-based (semi-)automated execution of multilevel business processes. A business process management system manages process-related data and allows for the event-driven execution of business processes; a business process management system also records event data. The recording of event data in event logs is a pre-requisite for business process intelligence which allows for performance analysis and the subsequent improvement of business processes based on the analysis results.

Outcome-oriented predictive process monitoring aims at classifying a running process execution according to a given set of categorical outcomes, leveraging data on past process executions. Most previous studies employ Recurrent Neural Networks to encode the sequence of events, without taking the structure of the process into account. However, process executions typically involve complex control-flow constructs, like parallelism and loops. Different executions of these constructs can be recorded as different event sequences in the event log. This makes it challenging for a recurrent classifier to detect potential relations between a high-level control-flow construct and the prediction target. This is especially true in the presence of high variability in process executions and lack of data. In this paper, we propose a novel approach which encodes the control-flow construct each event belongs to. First, we exploit Local Process Model mining techniques to extract frequently occurring control-flow patterns from the event log. Then, we employ different encoding techniques to enrich an on-going process execution with information related to the extracted control-flow patterns. We tested the proposed method on nine real-life event logs. The obtained results show consistent improvements in the prediction performance.

Process mining is a discipline that uses techniques to extract knowledge from event logs recorded by information systems in most companies these days. Among main perspectives of process mining, organizational and time perspectives focus on information about resources stored on the event logs and timing and frequency of the events, respectively. In this paper we introduce a method that combines organizational and time perspectives of process mining with a decision support tool called decision trees. The method takes the information of historical process data by means of an event log, generates a decision tree, annotates the decision tree with processing times, and recommends the best performer for a given running instance of the process. We finally illustrate the method through several experiments using a developed plug-in for the process mining framework ProM, first using synthetic data and then using a real-life event log.

비즈니스 프로세스 및 워크플로우 기술의 국제표준화기구인 WfMCl)에서는 최근 비즈니스 프로세스 인텔리전스 마이닝 분야에 대한 산업체의 관심이 증가함에 따라 프로세스 실행이벤트로그 표준포맷인 비즈니스 프로세스 분석로그 포맷, BPAF2) 1.0을 공식적으로 발표한 바 있다. 즉, 비즈니스 프로세스 인텔리전스 마이닝 기술은 비즈니스 프로세스 모델의 실행이벤트로그로부터 제어흐름, 데이터흐름, 역할흐름, 수행자흐름 등의 흐름중심의 인텔리전스와 최근에 관심이 집중되는 프로세스기반 소셜네트워크, 소속성네트워크 등의 관계중심의 인텔리전스를 마이닝하는 일련의 알고리즘들과 분석기법들로 구성되는데 현재의 표준포맷인 BPAF 1.0은 비즈니스 프로세스의 제어흐름 인텔리전스 마이닝에 초점 맞추고 있어 최근에 관심이 집중되는 관계중심의 인텔리전스 마이닝을 지원할 수가 없다. 따라서, 본 표준화 논문에서는 제어흐름 인텔리전스 이외에 데이터흐름, 역할흐름, 수행자흐름의 흐름 중심 인텔리전스 뿐만 아니라 프로세스기반 소셜네트워크, 소속성 네트워크의 관계중심 인텔리전스의 마이닝을 지원할 수 있도록 기존의 BPAF 1.0 표준포맷을 확장한 BPAF 2.0 표준포맷을 제안한다. 특히, 본 논문에서 제안하는 BPAF 2.0은 한국정보통신기술협회 표준총회의 e 비즈니스 프로젝트 그룹을 통한 국내 표준안의 기반기술이 될 뿐 만 아니라 BPAF 1.0을 제정한 WfMC 국제표준화기구의 국제 표준안의 확장에 기여할 것이라고 판단한다. WfMC, which is one of the international standardization organizations leading the business process and workflow technologies, has been officially released the BPAF1.0 that is a standard format to record process instances' event logs according as the business process intelligence mining technologies have recently issued in the business process and workflow literature. The business process mining technologies consist of two groups of algorithms and their analysis techniques; one is to rediscover flow-oriented process-intelligence, such as control-flow, data-flow, role-flow, and actor-flow intelligence, from process instances' event logs, and the other has something to do with rediscovering relation-oriented process-intelligence like process-driven social networks and process-driven affiliation networks from the event logs. The current standardized format of BPAF1.0 aims at only supporting the control-flow oriented process-intelligence mining techniques, and so it is unable to properly support the relation-oriented process-intelligence mining techniques. Therefore, this paper tries to extend the BPAF1.0 so as to reasonably support the relation-oriented process-intelligence mining techniques, and the extended BPAF is termed BPAF2.0. Particularly, we have a plan to standardize the extended BPAF2.0 as not only the national standard specifications through the e-Business project group of TTA, but also the international standard specifications of WfMC.

In a real-world environment, business processes are complex and challenging to monitor for potential irregularities. Service-oriented organisations rely primarily on the effectiveness of their processes to maintain the quality of their offered services and prefer to be notified in advance if an ongoing business process is not executing as expected. Process mining techniques analyse business processes, but heterogeneity & variability in the real-world event logs make it challenging and time-consuming to mine using standard methods. Trace clustering divides event logs into sub-logs with similar properties based on the case and event attributes. However, given the size of the event logs collected from heterogeneous information systems, it is difficult to identify meaningful clusters in actual business process logs. This paper proposes a hybrid technique to decompose large event logs into several smaller sub-logs, making it easier and more time efficient to analyse. Each sub-log is independently investigated to gain valuable insights into the process's underlying behaviour. Non-traditional process mining techniques are applied to identify possible behavioural correlations and discrepancies between simulated and observed process execution by extracting features from the log segment. We used a real-world case study to depict our framework's usefulness in prediction accuracy and timeliness. Furthermore, we compared our findings to those of previously proposed methodologies from the literature. We demonstrated that the framework improved the fitness quality of the resultant business process models.

Business processes are implemented in an organization. When a business process is run, it generates event log. One type of event log is double timestamp event log. Double timestamp has the start and complete time of each activity executed in the business process and has a close relationship with temporal pattern. In this paper, seven types of temporal pattern between activities were presented as extended version of relations used in the double timestamp event log. Since the event log was not always executed in sequential way, therefore using temporal pattern, event log was divided into several small groups to mine the business process both sequential and parallel. Both temporal pattern and Time-based α+ Miner algorithm were used to mine process model, determined sequential and parallel relations and then evaluated the process model using fitness value. This paper was focused on the advantages of temporal pattern implemented in Time-based α+ Miner algorithm to mine business process. The results also clearly stated that the proposed method could present better result rather than that of original α+ Miner algorithm.

The current business environment has no room for inefficiency as it can cause companies to lose out to their competitors, to lose customer trust, and to experience cost overruns. Business processes within the company continue to grow and cause them to run more complex. The large scale and complexity of business processes pose a challenge in improving the quality of process model because the effectiveness of time and the efficiency of existing resources are the biggest challenges. In the context of optimizing business processes with a process mining approach, most current process models are optimized with a trace clustering approach to explore the model and to perform analysis on the resulting process model. Meanwhile, in the event log data, not only the activities but also the other resources, such as records of employee or staff working time, process service time, and processing costs, are recorded. This article proposes a mechanism alternative to optimize business processes by exploring the resources that occur in the process. The mechanism is carried out in three stages. The first stage is optimizing the job shop scheduling method from the generated event log. Scheduling the time becomes a problem in the job shop. Utilizing the right time can increase the effectiveness of performance in order to reduce costs. Scheduling can be defined as the allocation of multiple jobs in a series of machines, in which each machine only does one job at a time. In general, scheduling becomes a problem when sequencing the operations and allocating them into specific time slots without prolonging the technical and capacity constraints. The second stage is generating the resource value that is recorded in the event log from the results of analysis of the previous stage, namely, job shop scheduling. The resource values are multivariate and then clustered to determine homogeneous clusters. The last stage is optimizing the nonlinear multipolynomials in the homogeneous cluster formed by using the Hessian solution. The results obtained are analyzed to get recommendations on business processes that are appropriate for the company’s needs. The impact of long waiting times will increase service costs, but by improving workload, costs can be reduced. The process model and the value of service costs resulting from the mechanism in the research can be a reference for process owners in evaluating and improving ongoing processes.

Real-life event logs are typically much less structured and more complex than the predefined business activities they refer to. Most of the existing process mining techniques assume that there is a one-to-one mapping between process model activities and events recorded during process execution. Unfortunately, event logs and process model activities are defined at different levels of granularity. The challenges posed by this discrepancy can be addressed by means of log-lifting. In this work we develop a machine-learning-based framework aimed at bridging the abstraction level gap between logs and process models. The proposed framework operates of two main phases: log segmentation and machine-learning-based classification. The purpose of the segmentation phase is to identify the potential segment separators in a flow of low-level events, in which each segment corresponds to an unknown high-level activity. For this, we propose a segmentation algorithm based on maximum likelihood with n-gram analysis. In the second phase, event segments are mapped into their corresponding high-level activities using a supervised machine learning technique. Several machine learning classification methods are explored including ANNs, SVMs, and random forest. We demonstrate the applicability of our framework using a real-life event log provided by the SAP company. The results obtained show that a machine learning approach based on the random forest algorithm outperforms the other methods with an accuracy of 96.4%. The testing time was found to be around 0.01s, which makes the algorithm a good candidate for real-time deployment scenarios.

The applicability of process mining techniques hinges on the availability of event logs capturing the execution of a business process. In some use cases, particularly those involving customer-facing processes, these event logs may contain private information. Data protection regulations restrict the use of such event logs for analysis purposes. One way of circumventing these restrictions is to anonymize the event log to the extent that no individual can be singled out using the anonymized log. This paper addresses the problem of anonymizing an event log in order to guarantee that, upon disclosure of the anonymized log, the probability that an attacker may single out any individual represented in the original log, does not increase by more than a threshold. The paper proposes a differentially private disclosure mechanism, which oversamples the cases in the log and adds noise to the timestamps to the extent required to achieve the above privacy guarantee. The paper reports on an empirical evaluation of the proposed approach using 14 real-life event logs in terms of data utility loss and computational efficiency.