CN110597686B - Noise-tolerant process mining method based on mixed event log - Google Patents
Noise-tolerant process mining method based on mixed event log Download PDFInfo
- Publication number
- CN110597686B CN110597686B CN201910761362.5A CN201910761362A CN110597686B CN 110597686 B CN110597686 B CN 110597686B CN 201910761362 A CN201910761362 A CN 201910761362A CN 110597686 B CN110597686 B CN 110597686B
- Authority
- CN
- China
- Prior art keywords
- event
- relation
- log
- sequence
- events
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a noise-tolerant process mining method based on a mixed event log, which takes the mixed event log which possibly contains sound and has point events and interval events as input, and takes a process model obtained by mining as output; in order to excavate a correct model, firstly, excavating a low-level event relation from each event sequence of an event log, wherein the low-level event relation is called a sequence-level event relation; then, establishing a heuristic rule by using the sequence level event relation and the occurrence frequency, and deducing a high-level event relation, namely a log layer event relation; and finally, calling a model generation algorithm based on the event relation of the log layer in the alpha algorithm to obtain a Petri network model. The method can effectively mine the correct process model from the mixed event log containing the noise, and compared with the existing mining method, the method has higher effectiveness and reliability in mining the obtained model.
Description
Technical Field
The invention belongs to the field of data mining, and particularly relates to a noise-tolerant process mining method based on a mixed event log.
Background
With the continuous development of internet technology, the business process of information systems becomes more and more complex. From traditional automated office systems, organizational business management systems, to big data applications in service composition and cloud environments, etc., the business logic of many applications can be abstracted into processes. How to mine the business process model of the applications becomes an important technology.
As a supplement to traditional manual modeling, automated process mining techniques have received increasing attention, and their goal is to mine useful process knowledge from event logs generated by information systems, and perform a series of processes on the knowledge to form a corresponding business process model of the system. The process model generated by the mining technology is closer to the actual business process, can provide important reference opinions for business process reconstruction and optimization, and promotes the development of computer-related technologies such as software regression testing and the like.
The event log is an important part of a computer information system, records events occurring in system execution, and relevant information such as time, operators, life cycles and the like corresponding to the events, is vital to understanding activities of a complex system, and has great value. The event log is composed of a plurality of event sequences, each event sequence records related information executed by the system once, and the event log has the characteristics of authenticity and objectivity. However, due to system problems, manual recording errors, resource limitations, and the like, the event logs in reality often contain noise, such as event loss, redundancy, and disorder, and it becomes an important technology to perform noise-tolerant process mining on the process model.
Most of the existing noise-tolerant process mining methods need the end user to input the threshold, however, the method cannot be well applied to all users because most users have little knowledge about the process of the terminal.
Disclosure of Invention
The invention aims to provide a noise-tolerant process mining method based on a mixed type event log, which is used for mining a process model corresponding to the event log under the condition that the event log is the mixed type event log possibly containing noise.
The technical solution for realizing the purpose of the invention is as follows: a noise-tolerant process mining method based on mixed event logs is used for mining a process model of the mixed event logs, the mixed event logs possibly containing noise are used as input, and a process model obtained by mining is used as an output result, and the method comprises the following steps:
and 3, acquiring a process model, and calling a model generation algorithm based on the event relation of the log layer in the alpha algorithm to obtain a final process model.
Compared with the prior art, the invention has the remarkable advantages that: the method provided by the invention can effectively mine the corresponding process model from the mixed event log containing the noise without providing a threshold value by a terminal user, and the mined process model has effectiveness and reliability.
Drawings
Fig. 1 is a flowchart of a noise tolerance process mining method based on a hybrid event log according to the present invention.
Fig. 2 is a schematic diagram of an event log file described in an XES format.
FIG. 3 is a schematic diagram of a noisy set of event log sequences.
FIG. 4 is a schematic diagram of a process model obtained by final excavation.
Detailed Description
The overall flow of the noise-tolerant process mining method based on the mixed event log is shown in fig. 1. Firstly, analyzing a mixed type event log, and solving a sequence level event relation based on an event sequence; then, according to the sequence level event relation, establishing a heuristic rule and deducing the event relation of the whole log layer; and finally, calling a model generation algorithm based on the event relation of the log layer in the alpha algorithm to obtain a Petri net process. The specific method comprises the following steps:
in the first step, a set of sequence level event relationships based on the event sequences is solved. Type of mixed event sequence e.g. σ = e 1 e 2 e 3 …e n Containing n events, e 1 …e n Represents n events, wherein e i = x represents event e i Is a point event x, e j =y s Represents an event e j Is the start event of the interval event y, e j =y e Denotes e j The end event of the interval event y, and the specific process of solving the sequence level event relation is as follows:
(1) Analyzing a mixed event log to obtain a set of all event sequences in the log, wherein the event sequence set refers to a sequencing combination of sequences of events possibly occurring in the log;
(2) And scanning each sequence in the set to obtain the sequence-level event relation contained in each sequence. σ = e for any one mixed event sequence 1 e 2 e 3 …e n The method comprises two events x and y, and the relation between the x and the y is solved according to the sequence of the events, and specifically comprises the following steps:
a. directly preceding the relationship, the symbols are represented as>: when two events e in the sequence i And e j The following five conditions are simultaneously satisfied: (1) e.g. of a cylinder i = x or e i =x e ;②e j = y or e j =y s (ii) a (3) Absence of p, i < p < j, e p = z; (4) absence of k, i < k < l < j, e k =z s ,e l =z e (ii) a Then x > y;
b. intersection, the symbol represents an agent: when several events e in the sequence i ,e j ,e p ,e q Either of the following two conditions is satisfied: (1) e.g. of the type i =x s ,e j =x e ,e p =y s ,e q =y e And p < i < q or i < p < j; (2) e.g. of the type i =y s ,e j =y e ,e k = x, and i < k < j; x | y, y | x;
c. in a phase-separated relationship, the symbols are represented asIf two events x and y in the log satisfyAnd isThen
d. Co-existing relationships, symbolically represented asIf two events x and y occur in the same sequence of events, then
Secondly, solving a set of event relations based on the log, wherein the specific steps are as follows:
(1) The number of event sequences contained in the event log L is represented by | L |, andrepresenting co-existence frequency of x and y, for setsFiltering out set S by Tukey' S scenes co Abnormal value, of two events x and y corresponding to the abnormal valueWherein, the mode of Tukey's scenes judging the abnormal value is as follows:
for a set of data constructs, Q 1 Representing the lower quartile, Q, in the set 3 Denotes the upper quartile in the set, IOR = (Q) 3 -Q 1 ) Representing a quarter-bit distance of the set, less than Q in the set 1 -1.5IQR and > Q 3 The value of +1.5IQR is identified as an abnormal value.
(2) The event relation of the log layer comprises a causal relation, an interleaving relation and an independent relation. By | x>y |, | x | y | andrespectively represent the relation x>y, x | y andthe frequency of occurrence, heuristic rules adopted to derive event relationships at the log level are as follows:
heuristic rule 1: assuming x, y ∈ T, ifThen x and y are said to be causal, symbolized as x → y; if it isAnd is Then x and y are called to be in an interleaving relation, and the symbol is represented as x | | | y; if it isThen x and y are said to be independent and the notation is x # y.
Heuristic rule 2: according to the rule of "all activities are connected", every activity that is not a starting node should have other activities as its predecessor, and every activity that is not an ending node should have other activities as its successors. Assuming that activity y of the non-initiating node lacks predecessor activity, then from all activities x that form a direct predecessor relationship with y, the value of | x > y | is chosen to be the largest, andas a precursor to y, i.e., the x and y relationships are x → y; assuming that the activity a of the non-end node lacks subsequent activities, then the value of | a > b | is selected to be the largest among all the activities b which form the immediately preceding relationship with a, andas a successor to a, the relationship a and b is a → b.
And thirdly, calling an alpha algorithm based on a model generation algorithm of the log layer event relation according to the log layer event relation obtained in the second step, obtaining the relation between transitions in the final model, and adding libraries among the transitions to generate the final Petri network model.
The present invention will be described in detail with reference to the following examples and drawings.
Examples
The invention relates to a noise-tolerant process mining method based on a mixed event log. And mining the mixed event log possibly containing noise to generate a corresponding process model, wherein the specific mining process is shown in FIG. 1. Firstly, mining a sequence level event relation based on an event sequence, then creating a heuristic rule, deducing an event relation of a log layer according to the sequence level event relation, finally calling a model generation algorithm based on the event relation of the log layer in an alpha algorithm, obtaining the relation between transitions in the model, adding a library station in the transitions, and generating a process model.
In combination with the example, the method includes:
step 1-1, analyzing the event log. Fig. 2 shows a part of a mixed type event log, and fig. 3 shows a part of a sequence set of the event log, where the event log is an XES format file, and the required information can be obtained by parsing tags, where a log tag represents the event log, a trace tag represents an event sequence, and an event represents an event, each log may contain multiple traces, and each trace may contain multiple events.
And 1-2, traversing the event sequence set, and obtaining the sequence level event relation contained in each event sequence according to each event sequence.
The event log contains 8 events, and according to the definition of the first step of the specific embodiment, the sequence-level event relationship contained in the event sequence set in fig. 3 is as follows:
(1) Directly preceding the relationship: t is t 1 >t 2 ,t 2 >t 6 ,t 2 >t 3 ,t 3 >t 4 ,t 3 >t 5 ,t 4 >t 7 ,t 5 >t 7 ,t 7 >t 8 ,t 4 >t 6 ,t 5 >t 6 ,t 6 >t 8 , t 2 >t 4 ,t 2 >t 5 ,t 5 >t 4 ,t 5 >t 8 ,t 4 >t 8 。
(2) The intersection relationship is as follows: t is t 4 |t 5 ,t 5 |t 4 ,t 2 |t 3 ,t 3 |t 2 ,t 7 |t 5 ,t 5 |t 7 。
step 2-1, corresponding set S of event log co Detecting abnormal values by Tukey's scenes to obtain an event t 6 And t 7 Corresponding toIn the set S co Is an abnormal value, therefore, the。
Step 2-2, according to heuristic rule 1 and heuristic rule 2, solving the relation of the log layer, such as for event t 4 And t 8 ,Then t 4 And t 8 The relationship between is t 4 #t 8 Finally, the relationship of all log layer events can be found as follows:
cause and effect relationship: t is t 1 →t 2 ,t 2 →t 3 ,t 2 →t 7 ,t 7 →t 8 ,t 3 →t 4 ,t 3 →t 5 ,t 4 →t 6 ,t 5 →t 6 ,t 6 →t 8 ;
The interweaving relation is as follows: t is t 4 ||t 5 ,t 5 ||t 4 ;
The independent relationship: t is t 1 #t 1 ,t 1 #t 6 ,t 6 #t 1 ,t 1 #t 8 ,t 8 #t 1 ,t 1 #t 3 ,t 3 #t 1 ,t 1 #t 4 ,t 4 #t 1 ,t 1 #t 5 ,t 5 #t 1 ,t 1 #t 7 ,t 7 #t 1 ,t 2 #t 2 , t 2 #t 8 ,t 8 #t 2 ,t 2 #t 4 ,t 4 #t 2 ,t 2 #t 5 ,t 5 #t 2 ,t 2 #t 7 ,t 7 #t 2 ,t 6 #t 6 ,t 6 #t 3 ,t 3 #t 6 ,t 6 #t 4 ,t 4 #t 6 ,t 6 #t 5 ,t 5 #t 6 ,t 6 #t 7 ,t 7 #t 6 , t 8 #t 8 ,t 8 #t 3 ,t 3 #t 8 ,t 8 #t 4 ,t 4 #t 8 ,t 8 #t 5 ,t 5 #t 8 ,t 3 #t 3 ,t 3 #t 7 ,t 7 #t 3 ,t 4 #t 4 ,t 5 #t 5 ,t 7 #t 7 。
And 3, calling a model generation algorithm based on the event relation of the log layer in the alpha algorithm according to the event relation of the log layer obtained in the step 2, and generating a process model corresponding to the instance as shown in FIG. 4.
Claims (2)
1. A noise-tolerant process mining method based on a mixed type event log is characterized in that the method is used for mining a process model corresponding to the mixed type event log, the mixed type event log which possibly contains noise and has point events and interval events is used as an input, and a process model obtained by mining is used as an output result, and the method comprises the following steps:
step 1, mining a sequence level event relation based on an event sequence, scanning each event sequence of a mixed type event log, and acquiring the sequence level event relation based on the event sequence, wherein the sequence level event relation comprises a direct prior relation, an intersecting relation, a separating relation and a co-existing relation;
hybrid event sequence σ = e 1 e 2 e 3 …e n Containing n events, e 1 …e n Represents n events, wherein e i = x represents event e i Is a point event x, e j =y s Represents an event e j Is the start event of the interval event y, e j =y e Denotes e j The end event of the interval event y, and the specific process of solving the sequence level event relationship is as follows:
step 1-1, analyzing a mixed event log to obtain a set of all event sequences in the log, wherein the set of the event sequences refers to a sequencing combination of sequences of possible events in the log;
step 1-2, scanning each sequence in the set to obtain the relationship between events in each sequence; σ = e for any mixed event sequence 1 e 2 e 3 …e n Containing two events x 1 And y 1 Solving for x according to the sequence of occurrence of events 1 And y 1 The relationship between the two specifically includes:
(1) Directly preceding the relationship, the symbols are represented as>: when two events e in the sequence i And e j The following four conditions are simultaneously satisfied: (1) e.g. of the type i = x or e i =x e ;②e j = y or e j =y s (ii) a (3) Absence of p, i < p < j, e p = z; (4) absence of k, l, i < k < l < j, e k =z s ,e l =z e (ii) a X is then 1 >y 1 ;
(2) Intersection, the symbol represents as an agent: when several events e in the sequence i ,e j ,e p ,e q Either of the following two conditions is satisfied: (1) e.g. of the type i =x s ,e j =x e ,e p =y s ,e q =y e And p < i < q or i < p < j; (2) e.g. of a cylinder i =y s ,e j =y e ,e k =x 1 And i < k < j; x is then 1 ︱y 1 ,y 1 ︱x 1 ;
(3) In a spaced relationship, symbolically represented asIf two events x in the log 1 And y 1 Satisfy x 1 ≯y 1 ,y 1 ≯x 1 And is andthen
(4) Co-existing relationships, symbolized asIf two events x 1 And y 1 Occur in the same event sequence, then
Step 2, deducing a log layer event relation based on an event log, combining Tukey's functions by utilizing a sequence level event relation and occurrence frequency and creating a heuristic rule, thereby deducing the event relation of the log layer, wherein the event relation comprises a causal relation, an interleaving relation and an independent relation; the method specifically comprises the following steps:
step 2-1, using | L | to represent the number of event sequences contained in the event log L, and using |, to represent the number of event sequences contained in the event log LDenotes x 2 And y 2 Co-existence frequency of (1), to the setDetecting the set S by using Tukey' S scenes co The abnormal value in (1), two events x corresponding to the abnormal value 2 And y 2 Is/are as followsWherein, the abnormal value detection mode of Tukey's scenes is as follows:
for a set of data constructs, Q 1 Represents the lower quartile, Q, in the set 3 Denotes the upper quartile in the set, IOR = (Q) 3 -Q 1 ) Representing a quarter-bit distance of the set, less than Q in the set 1 -1.5IQR and > Q 3 The value of +1.5IQR is identified as an abnormal value;
step 2-2, event relations of the log layer comprise a causal relation, an interleaving relation and an independent relation; by | x 2 >y 2 |、|x 2 |y 2 I andrespectively represent the relation x 2 >y 2 、x 2 ︱y 2 Andthe frequency of occurrence, and the heuristic rule adopted for deducing the event relation at the log level are as follows:
heuristic rule 1: let x be 2 ,y 2 E.g. T, if Then call x 2 And y 2 Is a causal relationship, symbolized by x 2 →y 2 (ii) a If it isAnd is provided with Then call x 2 And y 2 Is an interleaved relationship, the symbol is denoted x 2 ||y 2 (ii) a If it isThen call x 2 And y 2 Is an independent relationship, symbolized by x 2 #y 2 ;
Heuristic rule 2: according to the rule of 'all activities are connected', each activity which is not the starting node should have other activities as its predecessor activity, and each activity which is not the ending node should have other activities as its successor activity; suppose activity y of a non-initiating node 2 Absent predecessor activity, then slave and y 2 All activities x constituting direct precedence relationships 2 In (1), select | x 2 >y 2 The value of | is largest, andas y 2 Is a precursor of (i.e. x) 2 And y 2 The relationship is x 2 →y 2 (ii) a Assuming that the activity a of the non-end node lacks subsequent activities, then the value of | a > b | is selected to be the largest among all the activities b which form the immediately preceding relationship with a, andas a successor to a, i.e., the relationship a and b is a → b;
and 3, acquiring a process model, and calling a model generation algorithm based on the event relation of the log layer in the alpha algorithm to obtain a final process model.
2. The hybrid event log-based noise-tolerant process mining method of claim 1, wherein: and 3, calling an alpha algorithm based on a model generation algorithm of the log layer event relation according to the log layer event relation obtained in the step 2, obtaining the relation between transitions in the final model, adding libraries among the transitions, and generating the final Petri network model.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201910761362.5A CN110597686B (en) | 2019-08-18 | 2019-08-18 | Noise-tolerant process mining method based on mixed event log |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201910761362.5A CN110597686B (en) | 2019-08-18 | 2019-08-18 | Noise-tolerant process mining method based on mixed event log |
Publications (2)
Publication Number | Publication Date |
---|---|
CN110597686A CN110597686A (en) | 2019-12-20 |
CN110597686B true CN110597686B (en) | 2022-10-18 |
Family
ID=68854653
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201910761362.5A Active CN110597686B (en) | 2019-08-18 | 2019-08-18 | Noise-tolerant process mining method based on mixed event log |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN110597686B (en) |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102332125A (en) * | 2011-11-08 | 2012-01-25 | 南京大学 | Workflow mining method based on subsequent tasks |
US9516052B1 (en) * | 2015-08-01 | 2016-12-06 | Splunk Inc. | Timeline displays of network security investigation events |
CN108647253A (en) * | 2018-04-23 | 2018-10-12 | 南京理工大学 | A kind of mining algorithm of the workflow containing time-constrain |
CN108647220A (en) * | 2018-03-19 | 2018-10-12 | 南京理工大学 | Based on event indirectly prior to the scientific workflow method for digging of relationship |
CN108710645A (en) * | 2018-04-23 | 2018-10-26 | 南京理工大学 | Process model mining method based on mixed type event log |
CN110032494A (en) * | 2019-03-21 | 2019-07-19 | 杭州电子科技大学 | A kind of double grains degree noise log filter method based on incidence relation |
-
2019
- 2019-08-18 CN CN201910761362.5A patent/CN110597686B/en active Active
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102332125A (en) * | 2011-11-08 | 2012-01-25 | 南京大学 | Workflow mining method based on subsequent tasks |
US9516052B1 (en) * | 2015-08-01 | 2016-12-06 | Splunk Inc. | Timeline displays of network security investigation events |
CN108647220A (en) * | 2018-03-19 | 2018-10-12 | 南京理工大学 | Based on event indirectly prior to the scientific workflow method for digging of relationship |
CN108647253A (en) * | 2018-04-23 | 2018-10-12 | 南京理工大学 | A kind of mining algorithm of the workflow containing time-constrain |
CN108710645A (en) * | 2018-04-23 | 2018-10-26 | 南京理工大学 | Process model mining method based on mixed type event log |
CN110032494A (en) * | 2019-03-21 | 2019-07-19 | 杭州电子科技大学 | A kind of double grains degree noise log filter method based on incidence relation |
Also Published As
Publication number | Publication date |
---|---|
CN110597686A (en) | 2019-12-20 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Weijters et al. | Process mining: discovering workflow models from event-based data | |
De Medeiros et al. | Process mining for ubiquitous mobile systems: an overview and a concrete algorithm | |
US20090049428A1 (en) | Error tracing with context history | |
van der Aalst | On the representational bias in process mining | |
US10891178B2 (en) | Method and device for identifying problematic component in storage system | |
CN111240940B (en) | Real-time service monitoring method and device, electronic equipment and storage medium | |
Dumez et al. | Model-driven approach supporting formal verification for web service composition protocols | |
CN104835015B (en) | Workflow mining method based on predecessor task | |
US11165664B2 (en) | Enforcing electronic service contracts between compu'iing devices | |
CN110597686B (en) | Noise-tolerant process mining method based on mixed event log | |
US10956458B2 (en) | Consolidating text conversations from collaboration channels | |
CN111522617B (en) | Method and device for maintaining system and electronic equipment | |
CN108647220A (en) | Based on event indirectly prior to the scientific workflow method for digging of relationship | |
CN112069136A (en) | Outsourcing model mining method for emergency handling process of emergency event | |
CN111105210A (en) | Approval task processing method and device, electronic equipment and storage medium | |
Al-Karaghouli et al. | Negotiating and understanding information systems requirements: The use of set diagrams | |
Vázquez-Barreiros et al. | Enhancing discovered processes with duplicate tasks | |
CN108710645B (en) | Process mining method based on mixed event log | |
CN108647253B (en) | Mining algorithm containing time constraint workflow | |
KR20220016933A (en) | Method and apparatus for ingesting data, device, storage medium and computer program stored in the medium | |
Wang et al. | A new process mining algorithm based on event type | |
EP4081911A1 (en) | Edge table representation of processes | |
CN111461641A (en) | Approval flow processing method, system, equipment and readable storage medium | |
CN111178014A (en) | Method and device for processing business process | |
Kouhestani et al. | Towards level 3 BIM process maps with IFC & XES process mining |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |