Online anomaly detection using statistical leverage for streaming business process events

While several techniques for detecting trace-level anomalies in event logs in offline settings have appeared recently in the literature, such techniques are currently lacking for online settings. Event log anomaly detection in online settings can be crucial for discovering anomalies in process execution as soon as they occur and, consequently, allowing to promptly take early corrective actions. This paper describes a novel approach to event log anomaly detection on event streams that uses statistical leverage. Leverage has been used extensively in statistics to develop measures to identify outliers and it has been adapted in this paper to the specific scenario of event stream data. The proposed approach has been evaluated on both artificial and real event streams.Comment: 12 pages, 4 figures, conference (Proceedings of the 1st International Workshop on Streaming Analytics for Process Mining (SA4PM 2020) in conjunction with International Conference on Process Mining, Accepted for publication (Sep 2020)

Scalable Online Conformance Checking Using Incremental Prefix-Alignment Computation

Conformance checking techniques aim to collate observed process behavior with normative/modeled process models. The majority of existing approaches focuses on completed process executions, i.e., offline conformance checking. Recently, novel approaches have been designed to monitor ongoing processes, i.e., online conformance checking. Such techniques detect deviations of an ongoing process execution from a normative process model at the moment they occur. Thereby, countermeasures can be taken immediately to prevent a process deviation from causing further, undesired consequences. Most online approaches only allow to detect approximations of deviations. This causes the problem of falsely detected deviations, i.e., detected deviations that are actually no deviations. We have, therefore, recently introduced a novel approach to compute exact conformance checking results in an online environment. In this paper, we focus on the practical application and present a scalable, distributed implementation of the proposed online conformance checking approach. Moreover, we present two extensions to said approach to reduce its computational effort and its practical applicability. We evaluate our implementation using data sets capturing the execution of real processes

Online predicting conformance of business process with recurrent neural networks

Conformance Checking is a problem to detect and describe the differences between a given process model representing the expected behaviour of a business process and an event log recording its actual execution by the Process-aware Information System (PAIS). However, such existing conformance checking techniques are offline and mainly applied for the completely executed process instances, which cannot provide the real-time conformance-oriented process monitoring for an on-going process instance. Therefore, in this paper, we propose three approaches for online conformance prediction by constructing a classification model automatically based on the historical event log and the existing reference process model. By utilizing Recurrent Neural Networks, these approaches can capture the features that have a decisive effect on the conformance for an executed case to build a prediction model and then use this model to predict the conformance of a running case. The experimental results on two real datasets show that our approaches outperform the state-of-the-art ones in terms of prediction accuracy and time performance

Conformance checking of a longwall shearer operation based on low-level events

Conformance checking is a process mining technique that compares a process model with an event log of the same process to check whether the current execution stored in the log conforms to the model and vice versa. This paper deals with the conformance checking of a longwall shearer process. The approach uses place-transition Petri nets with inhibitor arcs for modeling purposes. We use event log files collected from a few coal mines located in Poland by Famur S.A., one of the global suppliers of coal mining machines. One of the main advantages of the approach is the possibility for both offline and online analysis of the log data. The paper presents a detailed description of the longwall process, an original formal model we developed, selected elements of the approach’s implementation and the results of experiments

Conformance checking: A state-of-the-art literature review

Conformance checking is a set of process mining functions that compare process instances with a given process model. It identifies deviations between the process instances' actual behaviour ("as-is") and its modelled behaviour ("to-be"). Especially in the context of analyzing compliance in organizations, it is currently gaining momentum -- e.g. for auditors. Researchers have proposed a variety of conformance checking techniques that are geared towards certain process model notations or specific applications such as process model evaluation. This article reviews a set of conformance checking techniques described in 37 scholarly publications. It classifies the techniques along the dimensions "modelling language", "algorithm type", "quality metric", and "perspective" using a concept matrix so that the techniques can be better accessed by practitioners and researchers. The matrix highlights the dimensions where extant research concentrates and where blind spots exist. For instance, process miners use declarative process modelling languages often, but applications in conformance checking are rare. Likewise, process mining can investigate process roles or process metrics such as duration, but conformance checking techniques narrow on analyzing control-flow. Future research may construct techniques that support these neglected approaches to conformance checking

Recommender System Based on Process Mining

Automation of repetitive tasks can be achieved with Robotic Process Automation (RPA) using scripts that encode fine-grained interactions with software applications on desktops and the web. Automating these processes can be achieved through several applications. It is possible for users to record desktop activity, including metadata, with these tools. The very fine-grained steps in the processes contain details about very small steps that the user takes. Several steps are involved in this process, including clicking on buttons, typing text, selecting the text, and changing the focus. Automating these processes requires connectors connecting them to the appropriate applications. Currently, users choose these connectors manually rather than automatically being linked to processes. In this thesis, we propose a method for recommending the top-k suitable connectors based on event logs for each process. This method indicates that we can use process discovery, create the process models of the train processes with identified connectors, and calculate the conformance checking between the process models and test event logs (unknown connectors). Then we select top-k maximum values of the conformance checking results and observe that we have the suitable connector with 80% accuracy among the top-3 recommended connectors. This solution can be configurable by changing the parameters and the methods of process discovery and conformance checking.Automation of repetitive tasks can be achieved with Robotic Process Automation (RPA) using scripts that encode fine-grained interactions with software applications on desktops and the web. Automating these processes can be achieved through several applications. It is possible for users to record desktop activity, including metadata, with these tools. The very fine-grained steps in the processes contain details about very small steps that the user takes. Several steps are involved in this process, including clicking on buttons, typing text, selecting the text, and changing the focus. Automating these processes requires connectors connecting them to the appropriate applications. Currently, users choose these connectors manually rather than automatically being linked to processes. In this thesis, we propose a method for recommending the top-k suitable connectors based on event logs for each process. This method indicates that we can use process discovery, create the process models of the train processes with identified connectors, and calculate the conformance checking between the process models and test event logs (unknown connectors). Then we select top-k maximum values of the conformance checking results and observe that we have the suitable connector with 80% accuracy among the top-3 recommended connectors. This solution can be configurable by changing the parameters and the methods of process discovery and conformance checking

Prefix Imputation of Orphan Events in Event Stream Processing

In the context of process mining, event logs consist of process instances called cases. Conformance checking is a process mining task that inspects whether a log file is conformant with an existing process model. This inspection is additionally quantifying the conformance in an explainable manner. Online conformance checking processes streaming event logs by having precise insights into the running cases and timely mitigating non-conformance, if any. State-of-the-art online conformance checking approaches bound the memory by either delimiting storage of the events per case or limiting the number of cases to a specific window width. The former technique still requires unbounded memory as the number of cases to store is unlimited, while the latter technique forgets running, not yet concluded, cases to conform to the limited window width. Consequently, the processing system may later encounter events that represent some intermediate activity as per the process model and for which the relevant case has been forgotten, to be referred to as orphan events. The naïve approach to cope with an orphan event is to either neglect its relevant case for conformance checking or treat it as an altogether new case. However, this might result in misleading process insights, for instance, overestimated non-conformance. In order to bound memory yet effectively incorporate the orphan events into processing, we propose an imputation of missing-prefix approach for such orphan events. Our approach utilizes the existing process model for imputing the missing prefix. Furthermore, we leverage the case storage management to increase the accuracy of the prefix prediction. We propose a systematic forgetting mechanism that distinguishes and forgets the cases that can be reliably regenerated as prefix upon receipt of their future orphan event. We evaluate the efficacy of our proposed approach through multiple experiments with synthetic and three real event logs while simulating a streaming setting. Our approach achieves considerably higher realistic conformance statistics than the state of the art while requiring the same storage.</p

Conformance checking of process event streams with constraints on data retention

Conformance checking (CC) techniques in process mining determine the conformity of cases, by means of their event sequences, with respect to a business process model. Online conformance checking (OCC) techniques perform such analysis for cases in event streams. Cases in streams may essentially not be concluded. Therefore, OCC techniques usually neglect the memory limitation and store all the observed cases whether seemingly concluded or unconcluded. Such indefinite storage of cases is inconsistent with the spirit of privacy regulations, such as GDPR, which advocate the retention of minimal data for a definite period of time. Catering to the aforementioned constraints, we propose two classes of novel approaches that partially or fully forget cases but can still properly estimate the conformance of their future events. All our proposed approaches bound the number of cases in memory and forget those in excess of the defined limit on the basis of prudent forgetting criteria. One class of these proposed approaches retains a meaningful summary of the forgotten events in order to resume the CC of their cases in the future, while the other class leverages classification for this purpose. We highlight the effectiveness of all our proposed approaches compared to a state of the art OCC technique lacking any forgetting mechanism through experiments using real-life as well as synthetic event data under a streaming setting. Our approaches substantially reduce the amount of data required to be retained while minimally impacting the accuracy of the conformance statistics