Ontology Based Log Analysis of Web Servers Using Process Mining Techniques

Process mining facilitates the discovery, conformance, and enhancement of business processes using event logs. However, incomplete event logs and the complexities of concurrent activities present significant challenges in achieving accurate process models that fulfill the completeness condition required in process mining. This paper introduces a Timed Genetic-Inductive Process Mining (TGIPM) algorithm, a novel approach that integrates the strengths of Timed Genetic Process Mining (TGPM) and Inductive Mining (IM). TGPM extends traditional Genetic Process Mining (GPM) by incorporating time-based analysis, while the IM is widely recognized for producing sound and precise process models. For the first time, these two algorithms are combined into a unified framework to address both missing activity recovery and structural correctness in process discovery. This study evaluates two scenarios: a sequential approach, in which TGPM and IM are executed independently and sequentially, and the TGIPM approach, where both algorithms are integrated into a unified framework. Experimental results using real-world event logs from a health service in Indonesia demonstrate that TGIPM achieves higher fitness, precision, and generalization compared to the sequential approach, while slightly compromising simplicity. Moreover, the TGIPM algorithm exhibits lower computational cost and more effectively captures parallelism, making it particularly suitable for large and incomplete datasets. This research underscores the potential of TGIPM to enhance process mining outcomes, offering a robust framework for accurate and efficient process discovery while driving process innovation across industries.

Increasingly organizations are using process mining to understand the way that operational processes are executed. Process mining can be used to systematically drive innovation in a digitalized world. Next to the automated discovery of the real underlying process, there are process-mining techniques to analyze bottlenecks, to uncover hidden inefficiencies, to check compliance, to explain deviations, to predict performance, and to guide users towards “better” processes. Dozens (if not hundreds) of process-mining techniques are available and their value has been proven in many case studies. However, process mining stands or falls with the availability of event logs. Existing techniques assume that events are clearly defined and refer to precisely one case (i.e. process instance) and one activity (i.e., step in the process). Although there are systems that directly generate such event logs (e.g., BPM/WFM systems), most information systems do not record events explicitly. Cases and activities only exist implicitly. However, when creating or using process models “raw data” need to be linked to cases and activities. This paper uses a novel perspective to conceptualize a database view on event data. Starting from a class model and corresponding object models it is shown that events correspond to the creation, deletion, or modification of objects and relations. The key idea is that events leave footprints by changing the underlying database. Based on this an approach is described that scopes, binds, and classifies data to create “flat” event logs that can be analyzed using traditional process-mining techniques.

Process mining techniques have matured over the last decade and more and more organization started to use this new technology. The two most important types of process mining are process discovery (i.e., learning a process model from example behavior recorded in an event log) and conformance checking (i.e., comparing modeled behavior with observed behavior). Process mining is motivated by the availability of event data. However, as event logs become larger (say terabytes), performance becomes a concern. The only way to handle larger applications while ensuring acceptable response times, is to distribute analysis over a network of computers (e.g., multicore systems, grids, and clouds). This paper provides an overview of the different ways in which process mining problems can be distributed. We identify three types of distribution: replication, a horizontal partitioning of the event log, and a vertical partitioning of the event log. These types are discussed in the context of both procedural (e.g., Petri nets) and declarative process models. Most challenging is the horizontal partitioning of event logs in the context of procedural models. Therefore, a new approach to decompose Petri nets and associated event logs is presented. This approach illustrates that process mining problems can be distributed in various ways.

Process mining is an emerging discipline incorporating methods and tools for the analysis of system/process executions captured in the form of event logs [1]. Traditionally process mining can be divided into three research areas: discovery (construction of process models from event logs), conformance checking (finding log and model deviations), and enhancement of existing process models with additional event log data.BPMN (Business Process Model and Notation) 2.0 [2] is a widely used process modeling notation, supported by various process modeling and analysis tools, and is a de-facto process modeling standard. Using BPMN within process mining opens perspectives for applicability of the existing process mining techniques: for instance discovered process models can be analyzed or enacted using existing BPMN-based software, and vice versa, manually created models can be imported to a process mining tool, verified against event logs, and enhanced with additional data.In this work we bridge the gap between conventional process modeling formalisms used in the context of process mining (e.g., Petri nets, causal nets, process trees) and BPMN. For that purpose we developed a suite of conversion algorithms and provide formal guarantees relating the behavior of Petri nets (including non-free-choice nets) to the corresponding BPMN models (and vice versa). The derived relations are used to enhance the BPMN models with information learned from the event logs.The developed conversion techniques are described in detail in [3] and have been implemented [4] as a part of ProM (Process Mining Framework) [5] -- an open source tool for process mining and verified on real event log data. Moreover, cases for which conversion algorithms give more compact process models in comparison with the initial models are identified. Although the developed algorithms deal with basic control flow constructs only, they can be applied in the discovery of advanced BPMN modeling elements [2], including subprocesses [6-7], cancellations [8], conditional branching and data objects, swimlanes, message flows, and others.

Towards interactive event log forensics: Detecting and quantifying timestamp imperfections

Since IoT devices supporting business processes (BPs) in sectors like manufacturing, logistics or healthcare can collect data on the execution of the processes, there is a growing awareness of the opportunity to use IoT data for process mining (PM). However, several challenges need to be addressed to enable IoT-enhanced PM, among which the need for a standard IoT-enhanced event log model. In this paper, we identify four main challenges for the integration of IoT data in event logs, from which 10 requirements for an IoT-enhanced event log model are derived. We then analyse the two main current event log models, the extensible event stream (XES) and the object-centric event log (OCEL), and confront them with the requirements, showing that both present important limitations to storing IoT-enhanced event logs. Based on this analysis, we conclude that a comprehensive data model is required to develop more advanced IoT-enhanced PM techniques .KeywordsProcess miningIoTIoT-enhanced event log

The increasing availability of digital data offers new opportunities for analyzing business processes. Process aware information systems like Enterprise Resource Planning systems store data in the course of transaction processing. This data can be exploited by using process mining techniques. Process mining algorithms produce process models by analyzing recorded event logs. A fundamental challenge in process mining is the creation of purpose-oriented and useful process models. Process mining algorithms commonly refer to the temporal ordering of events for determining the control flow in reconstructed process models. We show how the logical sequence of events can be used instead of the temporal for reconstructing the control flow in mined process models. The exploitation of the logical structure of available event log records opens up new ways to receive purpose-oriented, less complex, and more informative process models.

Process mining techniques allow for extracting information from event logs. For example, the audit trails of a workflow management system or the transaction logs of an enterprise resource planning system can be used to discover models describing processes, organizations, and products. ProM is a generic tool for implementing process mining tools in a standard environment. Prom aims at improving this by providing techniques and tools for discovering process, organizational, social, and performance information from event logs. In this paper we introduce the challenging process mining domain and discuss a heuristics driven process mining algorithm; the so-called “Heuristics Miner" in detail. Heuristics Miner is an applied applicable mining algorithm that can deal with noise, and can be used to express the main behavior registered in an event log. In the “case study” section of this paper, we used an students' registration event log consisted of 299 cases and 569 events. The data was received from one of the universities in Thailand. Finally, the HM algorithm focused on the control flow perspective and generated a process model in the form of a Heuristics Net for the given event log.

Process mining techniques enable the analysis of a wide variety of processes using event data. For example, event logs can be used to automatically learn a process model (e.g., a Petri net or BPMN model). Next to the automated discovery of the real underlying process, there are process mining techniques to analyze bottlenecks, to uncover hidden inefficiencies, to check compliance, to explain deviations, to predict performance, and to guide users towards “better” processes. Dozens (if not hundreds) of process mining techniques are available and their value has been proven in many case studies. However, existing techniques focus on the analysis of a single process rather than the comparison of different processes. In this paper, we propose comparative process mining using process cubes. An event has attributes referring to the dimensions of the process cube. Through slicing, dicing, rolling-up, and drilling-down we can view event data from different angles and produce process mining results that can be compared. To illustrate the process cube concept, we focus on educational data. In particular, we analyze data of students watching video lectures given by the first author. The dimensions of the process cube allow us to compare the process of students that passed the course versus the process of students that failed. We can also analyze differences between male and female students, between different parts of the course, and between Dutch students and international students. The initial analysis provided in this paper is used to elicit requirements for better tool support facilitating comparative process mining.

Process discovery aims to derive a process model that accurately represents the observed behavior in an event log. As a state-of-the-art process discovery technique, Inductive Miner (IM) generates sound process models (i.e., free of deadlocks) while ensuring optimal replay fitness. However, IM may sometimes produce over-generalized process models with locally imprecise structures, often resulting in the creation of so-called flower structures. To address this limitation, this paper presents a novel technique that refines the process model generated by IM by optimizing its imprecise sub-processes. Specifically, the technique begins by identifying and extracting sub-logs corresponding to imprecise sub-processes in the initial IM-generated process model. Then, these imprecise sub-processes are iteratively optimized using a frequency-based filtering mechanism applied to the sub-logs. Once optimized, the imprecise sub-processes in the initial process model are replaced by the optimized ones, generating a set of candidates process models. Finally, the candidate with the best quality, in terms of fitness and precision, is selected as the final optimized process models. The proposed technique has been implemented as a plugin for the open-source process mining platform ProM. Through comparisons with state-of-the-art process discovery techniques using 10 publicly available real-life event logs, the experimental results demonstrate that the proposed method achieves an average absolute improvement of 0.173 in F-measure over its IMi variant, while also exhibiting competitive performance relative to other state-of-the-art approaches.

In a real-world environment, business processes are complex and challenging to monitor for potential irregularities. Service-oriented organisations rely primarily on the effectiveness of their processes to maintain the quality of their offered services and prefer to be notified in advance if an ongoing business process is not executing as expected. Process mining techniques analyse business processes, but heterogeneity & variability in the real-world event logs make it challenging and time-consuming to mine using standard methods. Trace clustering divides event logs into sub-logs with similar properties based on the case and event attributes. However, given the size of the event logs collected from heterogeneous information systems, it is difficult to identify meaningful clusters in actual business process logs. This paper proposes a hybrid technique to decompose large event logs into several smaller sub-logs, making it easier and more time efficient to analyse. Each sub-log is independently investigated to gain valuable insights into the process's underlying behaviour. Non-traditional process mining techniques are applied to identify possible behavioural correlations and discrepancies between simulated and observed process execution by extracting features from the log segment. We used a real-world case study to depict our framework's usefulness in prediction accuracy and timeliness. Furthermore, we compared our findings to those of previously proposed methodologies from the literature. We demonstrated that the framework improved the fitness quality of the resultant business process models.

Medical billing is a long chain of processes that cut across different sectors and institutions, evolving into a multimillion-dollar industry. Despite the emergence of institutional involvement in the practice, the parties involved face many challenges that hinder the successful management of the diverse process. Process mining uses computer-based tools and techniques to analyze business processes and ensure best practices for improving business operations as it has a track record of success in improving business processes and procedures. As research on process driving problem solving continues to grow, there is a need to start applying the tools and techniques to specific domain areas and bridge the gap between research, development and application. We demonstrated how process mining techniques can be applied to medical billing using the L * life cycle model from a structured perspective. We developed a handmade comprehensive medical billing process flow using domain knowledge reference and established some time perspective Key Performance Indicators (KPIs) of the billing process. We then explored the hospital billing event log generated from an enterprise resource planning (ERP) system to see how the "as-is" from the event log deviate from the generally known knowledge-based (handmade) model. Taking each trace of the event log as patient visit, we discover that about 63 % of all the visit were billed and also about 3 % billed got regretted. The event log used in this research does not capture the complete activity flow for a real-world medical billing system. Hence, we were not able to directly compare the process map with the model and give precise operational support

Security is an important issue that every organisation should address. One approach to secure systems could be the use of process mining techniques. Process mining is an emerging discipline which can extract knowledge from event logs that are available in information systems. In the security context, process mining is used to analyse security trails to detect anomalies in process execution. While some of the data mining projects are already implemented in banking, insurance and telecom sector the interesting question is: What is happening in public sector? This paper investigates the research on process mining techniques in security domain and tries to discover the examples of its implementation especially in public sector. The systematic review has been conducted in order to give an overview of state-of-the-art process mining techniques used in security context, to classify the main areas of development, algorithms, tools and to identify possible future research course.

Process mining refers to the extraction process models from event logs. Traditional process mining algorithms have problems dealing with event logs that are produced from unstructured real-life processes and generate spaghetti-like and incomprehensible process models. One means making traces more structural is to extract commonly used process model constructs (common patterns) in the event log and transform traces basing on such constructs. Another way of pre-processing traces is to categorize traces in event log into clusters such that process traces in each cluster can be adequately represented by a process model. Nevertheless, current approaches for trace clustering have many problems such as ignoring context process and huge computational overhead. In this paper, suffix-tree is firstly utilized for discovering common patterns. The traces in event log are transformed with common patterns. Thereafter suffix-trees are applied to categorize transformed traces. The trace clustering algorithm has a linear-time computational complexity. The process models mined from the clustered traces show a high degree of fitness and comprehensibility.

ObjectivesThere is a need for effective processes in healthcare clinics, especially in tertiary hospitals, that consist of a set of complex steps for outpatient care, in order to provide high quality care and reduce the time cost. This study aimed to discover the potential of a process mining technique to determine an outpatient care process that can be utilized for further improvements.MethodsThe outpatient event log was defined, and the log data for a month was extracted from the hospital information system of a tertiary university hospital. That data was used in process mining to discover an outpatient care process model, and then the machine-driven model was compared with a domain expert-driven process model in terms of the accuracy of the matching rate.ResultsFrom a total of 698,158 event logs, the most frequent pattern was found to be "Consultation registration > Consultation > Consultation scheduling > Payment > Outside-hospital prescription printing" (11.05% from a total cases). The matching rate between the expert-driven process model and the machine-driven model was found to be approximately 89.01%, and most of the processes occurred with relative accuracy in accordance with the expert-driven process model.ConclusionsKnowledge regarding the process that occurs most frequently in the pattern is expected to be useful for hospital resource assignments. Through this research, we confirmed that process mining techniques can be applied in the healthcare area, and through detailed and customized analysis in the future, it can be expected to be used to improve actual outpatient care processes.