Optimal event log sanitization for privacy-preserving process mining

The applicability of process mining techniques hinges on the availability of event logs capturing the execution of a business process. In some use cases, particularly those involving customer-facing processes, these event logs may contain private information. Data protection regulations restrict the use of such event logs for analysis purposes. One way of circumventing these restrictions is to anonymize the event log to the extent that no individual can be singled out using the anonymized log. This paper addresses the problem of anonymizing an event log in order to guarantee that, upon disclosure of the anonymized log, the probability that an attacker may single out any individual represented in the original log, does not increase by more than a threshold. The paper proposes a differentially private disclosure mechanism, which oversamples the cases in the log and adds noise to the timestamps to the extent required to achieve the above privacy guarantee. The paper reports on an empirical evaluation of the proposed approach using 14 real-life event logs in terms of data utility loss and computational efficiency.

Event logs recorded during the execution of business processes constitute a valuable source of information. Applying process mining techniques to them, event logs may reveal the actual process execution and enable reasoning on quantitative or qualitative process properties. However, event logs often contain sensitive information that could be related to individual process stakeholders through background information and cross-correlation. We therefore argue that, when publishing event logs, the risk of such re-identification attacks must be considered. In this paper, we show how to quantify the re-identification risk with measures for the individual uniqueness in event logs. We also report on a large-scale study that explored the individual uniqueness in a collection of publicly available event logs. Our results suggest that potentially up to all of the cases in an event log may be re-identified, which highlights the importance of privacy-preserving techniques in process mining.

The automatic detection of divergences from a desired process behavior is a common research topic in the business process management community. An established technique to analyze processes is called conformance checking. Given a definition of a process in form of a process model, conformance checking can be used to test whether the executions of a process contained in a so-called event log data structure are conforming with the process as it was defined. The result is a comparison of the execution traces and their respective correct execution, according to the process model. This technique provides insights into where the divergence has occurred and how the execution must be altered to conform to the process model. However, a problem is that it requires a process model to be available. Process models in the correct format are not always available. Contrary to conformance checking, process anomaly detection aims to find anomalous executions without relying on a predefined process model. A process anomaly detection algorithm derives the process logic from the event log itself and exploits the patterns found within the event log to distinguish normal from anomalous process executions. Though process anomaly detection provides the benefit of not relying on a process model, it typically does not provide the level of detail that conformance checking does. A process execution can either be normal or it can be anomalous. This dissertation proposes process anomaly correction, a novel approach that combines the benefits of conformance checking and process anomaly detection. Given only an event log, process anomaly correction detects anomalous executions, clearly indicates where the anomaly has occurred during the execution and suggests possible corrective measures. The solution presented in this work is based on a new concept to the field of process anomaly detection: Process learning. In process learning, the task of understanding the process based on the example data is transformed into a learning problem in which a neural network is trained to predict the very next activity in a running process execution. The resulting machine learning model thus represents an approximation of the real process that created the data. This cumulative dissertation consists of five contributions to the field of business process management that demonstrate how, starting from a process anomaly detection, process anomaly correction is achieved in a series of four steps. (1) Process learning is employed to generate an approximated model of the process logic. (2) The limitation of only distinguishing between normal and anomalous process executions is overcome by employing the process learning model which processes the process executions on a finer level of detail than existing approaches. (3) The necessity of providing manual threshold settings, as it is typical for process anomaly detection algorithms, is replaced by an automatic parameterization utilizing the process learning model. (4) The predictive capabilities of the process learning model are exploited to generate possible corrections of detected anomalies. The resulting process anomaly correction approach can be employed in scenarios where classic conformance checking would be infeasible, due to the restriction of relying on a process model. Furthermore, it can be employed alongside classical conformance checking, for it incorporates more information coming from the event log than classical conformance checking (such as employees executing a process step, in which country the process is executed, etc.), and thus provides a new perspective for the process analyst.

Process mining is rapidly growing in the industry. Consequently, privacy concerns regarding sensitive and private information included in event data, used by process mining algorithms, are becoming increasingly relevant. State-of-the-art research mainly focuses on providing privacy guarantees, e.g., differential privacy, for trace variants that are used by the main process mining techniques, e.g., process discovery. However, privacy preservation techniques for releasing trace variants still do not fulfill all the requirements of industry-scale usage. Moreover, providing privacy guarantees when there exists a high rate of infrequent trace variants is still a challenge. In this paper, we introduce TraVaG as a new approach for releasing differentially private trace variants based on Generative Adversarial Networks (GANs) that provides industry-scale benefits and enhances the level of privacy guarantees when there exists a high ratio of infrequent variants. Moreover, TraVaG overcomes shortcomings of conventional privacy preservation techniques such as bounding the length of variants and introducing fake variants. Experimental results on real-life event data show that our approach outperforms state-of-the-art techniques in terms of privacy guarantees, plain data utility preservation, and result utility preservation.

Event logs that are recorded by information systems provide a valuable starting point for the analysis of processes in various domains, reaching from healthcare, through logistics, to e-commerce. Specifically, behavioral patterns discovered from an event log enable operational insights, even in scenarios where process execution is rather unstructured and shows a large degree of variability. While such behavioral patterns capture frequently recurring episodes of a process’ behavior, they are not limited to sequential behavior but include notions of concurrency and exclusive choices. Existing algorithms to discover behavioral patterns are context-agnostic, though. They neglect the context in which patterns are observed, which severely limits the granularity at which behavioral regularities are identified. In this paper, we therefore present an approach to discover contextual behavioral patterns. Contextual patterns may be frequent solely in a certain partition of the event log, which enables fine-granular insights into the aspects that influence the conduct of a process. Moreover, we show how to analyze the discovered contextual behavioral patterns in terms of causal relations between context information and the patterns, as well as correlations between the patterns themselves. A complete analysis methodology leveraging all the tools presented in the paper and supplemented by interpretations guidelines is also provided. Finally, experiments with real-world event logs demonstrate the effectiveness of our techniques in obtaining fine-granular process insights.

Process mining uses event logs to improve business processes, but such logs may contain privacy information. One popular research problem is the privacy protection of event logs. Publishing logs with differential privacy is one of major research directions. Existing research achieves privacy protection primarily by injecting random noise into event logs, or merging similar information. The former ignores the fact that injecting random noise will produce apparently unreasonable activity traces, and the latter will cause a loss of process information in the process mining perspective. To solve the above problems, this article proposes a differential algorithm based on randomized response to model Petri nets for the original event logs, select the important labels in the logs by the weak sequential relationship of control flow between activities, inject noise into the Petri net model based on the important labels using the randomized response approach, and establish a differential Petri net model. Experiments on public datasets show that the event logs produced by the approach proposed do not contain unreasonable traces. Compared with the baseline approach, the proposed approach performs better on Fitness metrics with consistent privacy requirements and retains more process variants, reducing the loss of original event log process information.

Outcome-oriented predictive process monitoring aims at classifying a running process execution according to a given set of categorical outcomes, leveraging data on past process executions. Most previous studies employ Recurrent Neural Networks to encode the sequence of events, without taking the structure of the process into account. However, process executions typically involve complex control-flow constructs, like parallelism and loops. Different executions of these constructs can be recorded as different event sequences in the event log. This makes it challenging for a recurrent classifier to detect potential relations between a high-level control-flow construct and the prediction target. This is especially true in the presence of high variability in process executions and lack of data. In this paper, we propose a novel approach which encodes the control-flow construct each event belongs to. First, we exploit Local Process Model mining techniques to extract frequently occurring control-flow patterns from the event log. Then, we employ different encoding techniques to enrich an on-going process execution with information related to the extracted control-flow patterns. We tested the proposed method on nine real-life event logs. The obtained results show consistent improvements in the prediction performance.

Process mining refers to the extraction process models from event logs. Traditional process mining algorithms have problems dealing with event logs that are produced from unstructured real-life processes and generate spaghetti-like and incomprehensible process models. One means making traces more structural is to extract commonly used process model constructs (common patterns) in the event log and transform traces basing on such constructs. Another way of pre-processing traces is to categorize traces in event log into clusters such that process traces in each cluster can be adequately represented by a process model. Nevertheless, current approaches for trace clustering have many problems such as ignoring context process and huge computational overhead. In this paper, suffix-tree is firstly utilized for discovering common patterns. The traces in event log are transformed with common patterns. Thereafter suffix-trees are applied to categorize transformed traces. The trace clustering algorithm has a linear-time computational complexity. The process models mined from the clustered traces show a high degree of fitness and comprehensibility.

Process mining, which aims to mine a high-quality process model from event log, provides a powerful tool to support the design, enactment, management, and analysis of operational business processes. However, the task is not easy because the algorithm needs to discover various complex process structures, handle noisy and incomplete event logs and balance multiple performance indicators. In this paper, a novel algorithm (called PSOMiner) for process mining is proposed, which consists of a discrete particle swarm optimization algorithm and guided local mutation. The former is in charge of searching the solution space of causal matrix and the latter is used to help the algorithm skip out the local optimum when it suffers from premature. A fine-grained scoring strategy which used to assign a score to each position of a particle (i.e. causal matrix) is presented to direct the mutation. The experiments were performed on 28 synthetic event logs with/without noise and 4 real-life event logs, and three classical algorithms of process mining (ETM, Hybrid ILP Miner, HM) were chosen for comparison. The results show that (1) PSOMiner achieved the best f-score on 25 synthetic event logs; (2) The average f-score of PSOMiner is 0.825 on 4 real-life event logs, which is superior to ETM whose average f-score is 0.703.

Process mining techniques aim at extracting knowledge from event logs. One of the most important tasks in process mining is process model discovery. In discovering process models, an algorithm is designed to build a process model from a given event log. In this paper, a new model to discover process models has been proposed. A combination of Genetic Algorithm and Simulated Annealing has been used in this model. Genetic Algorithms has previously been used in this context. Previous approaches had drawbacks in fitness evaluation that misguided the algorithm. Another problem was that the quality of the candidates, in the population, was low such that it reduced the chance of finding a perfect answer. In this paper, a new fitness measure has been proposed to evaluate process models based on event logs. Moreover SA has been used to improve the quality of candidates in the population. It has been demonstrated that the proposed model outperformed in terms of rediscovering process models, compared to other approaches which are proposed in the literature, which was the result of better fitness evaluation and increased quality of individuals,. It came to conclusion that using GA and SA in combination with each other can be effective in this context.

Most actual information systems save transactions in event logs. These logs are not often used to improve the quality of the process model. The area of Process Mining provides techniques and tools which allow the extraction of persistent information about the business process model from event logs in order to incorporate them in a decisional system, and optimise the future executions of the business processes. In this paper, we present an approach using (in addition of event logs) some properties of the tasks composing the business processes like minimum and maximum durations. These properties are used to improve the quality of the underlying processes by a best detection of parallelism, loops and duplicated tasks.

In the paper we address the challenge of applying process mining techniques for discovering models of underground mining operations based on a sensor data. The paper presents practical approach of creation an event log based on industrial sensors data gathered in an underground mine monitoring systems. The proposed approach enables to generate event logs at different generalization levels based on several numbers of discovered stages of devices performance. For discovering process stages data mining techniques such as exploratory data analysis, clustering and classification have been applied. Created event log has been used in one of the process mining tasks - process model discovery.

Process mining uses event data recorded by information systems to reveal the actual execution of business processes in organizations. By doing this, event logs can expose sensitive information that may be attributed back to individuals (e.g., reveal information on the performance of individual employees). Due to GDPR organizations are obliged to consider privacy throughout the complete development process, which also applies to the design of process mining systems. The aim of this paper is to develop a privacy-preserving system design for process mining. The user-centered view on the system design allows to track who does what, when, why, where and how with personal data. The approach is demonstrated on an IoT manufacturing use case.

Keeping our rivers clean: Information-theoretic online anomaly detection for streaming business process events

Process mining enables extracting insights into human resources working in business processes and supports employee management and process improvement. Often, resources from the same organizational group exhibit similar characteristics in process execution, e.g., executing the same set of process activities or participating in the same types of cases. This is a natural consequence of division of labor in organizations. These characteristics can be organized along various process dimensions, e.g., case, activity, and time, which ideally are all considered in the application of resource-oriented process mining, especially analytics of resource groups and their behavior. In this paper, we use the concept of execution context to classify cases, activities, and times to enable a precise characterization of resource groups. We propose an approach to automatically learning execution contexts from process execution data recorded in event logs, incorporating domain knowledge and discriminative information embedded in data. Evaluation using real-life event log data demonstrates the usefulness of our approach.KeywordsExecution contextResource groupEvent logProcess miningWorkforce analytics