The majority of process mining techniques focuses on control ow. Decision Point Analysis (DPA) exploits additional data attachments within log les to determine attributes decisive for branching of process paths within discovered process models. DPA considers only single attribute values. However, in many applications, the process environment provides additional data in form of consecutive measurement values such as blood pressure or container temperature. We introduce the DPAT imeSeries method as an iterative process for exploiting time series data by combining process mining and data mining techniques. The method also o ers di erent approaches for incorporating time series data into log les in order to enable existing process mining techniques to be applied. Finally, we provide the simulation environment DPATSiimmeSeries to produce log les and time series data. The DPAT imeSeries method is evaluated based on an application scenario from the logistics domain.
Process mining aims at discovery and analysis of process models based on event
logs. So far, process mining methodology emphasized the control ow, that is,
restricting analysis to time-stamped event data (so-called log les) gathered from,
or produced by, executed process instances. An extension towards the
branching logic of processes is provided by Decision Point Analysis (DPA) [
Fig. 1 depicts a container transportation example [
Single Value T=37.2
Move to Destination [T>37°C
Time Series T1=37.1,T2=36.9, T3=36.4,T4=36.9, T5=37.0,T6=37.2 [tTw>i3ce7°iCn a row Move to Destination
As the above characteristics show, DPA cannot adequately deal with realworld scenarios in which time series data are collected, e.g., in health care or container transportation. Based on time series data, more complex decision rules are conceivable, for example, \temperature exceeds a certain threshold for a time frame" (cf. right side in Fig. 1).
Hence, it would be desirable to process and analyze time series data by an extension of DPA. In this paper, we will present such an extension by means of method DPAT imeSeries that enables (a) a joint consideration of event log data and time series data, (b) iterative application of process and data/visual mining techniques, and (c) derivation of complex decision rules.
To do so, we distinguish two pertinent perspectives of this enhanced approach to process mining, viz. a method and a data perspective (Section 2). The ensuing process mining method is evaluated based on a real-world example of process analysis (Section 3). After re ecting our contribution against the state of the art in process and decision mining (Section 4), some concluding remarks (Section 5) nish this presentation. 2
The DPAT imeSeries method is illustrated in Fig. 2. As a rst step it has to be decided how time series data is considered in connection with the event log data. For o ering data structures within or outside the event logs that enable the application of DPAT imeSeries, we identify the following options (cf. Fig. 2): 1. Separation of Data: We can prepare an analytical data set consisting of recurring measurements with su cient temporally information to enable a matching with event data and provide this data separated from the log les.
Log Extension
Log Enrichment
Process Model
Decision
Rule
Candidate X
(MPrioncinegs)s Mining
data
[data setup must be changed Aggregated variables AVDgaegrciraeisbgiloaentse EvalDuPaAte by [rule not confirmed by DPA
X 2. Log Enrichment: This analytical data set can also be incorporated into the log by adding an attribute to the corresponding event within the log (e.g., a XES extension that allows such recurring measurement data structures). 3. Log Extension: Another approach is to dissemble the recurring measurement data and interlacing it into the log le as recurring events with single-valued attributes.
In the following, we discuss the pros and cons of these di erent options.
Separation of data does not modify the original event log data and therefore contributes to the maintenance of both data sets, an advantage if the event log data is used by other applications as well. The obvious disadvantage is that the connection between the event log data and the time series data is not explicitly stored and every analysis tool has to load and match the data by itself. Log enrichment and extension leads to an explication of this relation with the disadvantage of an additional preprocessing step to do so. Log enrichment does not change the number or kind of log entries as log extension does. Thus, process mining algorithms are not e ected and, in turn, the resulting process models do not become more complex. Hence, the integration is in principle easier than for log extension. Log extension practically pushes the time series data into the event log what might be intended depending on the application and can therefore be an advantage as well as a disadvantage. This approach sure changes the log e ectively but makes format extensions and extra les dispensable.
In summary, the choice of the approach is strongly dependent on the application. The case study presented in Sect. 3 features all three approaches.
As second step in the DPAT imeSeries method, process mining is used for classifying process execution paths along decisions made at runtime re ected by decision points in the resulting process models. In a third step we use data mining techniques such as CART, AdaBoost, Support Vector Machines as well as exploratory data mining including visual mining to explain the classi cation, i.e., derive the underlying decision rule. This more experimental mode of analysis, utilizing continuously improved understanding of (perhaps not yet) available process and environment data is more appropriate at this stage of the method than a mechanical brute-force exploration.
Candidates for decision rules are transformed into aggregated variables in a
fourth step. These variables can then be used to employ DPA [
Process Mining uses event logs that consist of a minimal data set of case ids, activity names and timestamps. It is also possible to store data values that were produced during process execution, e.g., the age of a patient. These singlevalued attributes are exploited by, for example, DPA. However, existing event log formats do not o er straightforward means to store time series data. 3
We start our evaluation by simulating the process of a container transport
example adapted from [
For the generation of process log data as well as time series data produced
by recurring events within the iterations we implemented the simulation
environment DPATSiimmeSeries. Using a programming language like Java instead of a
model interpreting tool like CPN-Tools [
The basic idea of the container transport example is that some temperaturesensitive cargo is moved, implying that there is some temperature threshold not to be exceeded during the handling; otherwise, if this threshold is violated for a certain duration, the carriage is interrupted, and the transporting vehicle returns to its home base. Apparently, the decision whether to continue or interrupt the carriage depends on the monitored cargo temperature, measured by some sensor, for instance every 10 minutes as long as the vehicle moves towards its destination.
We now start the rst iteration of the DPAT imeSeries method { based on this description of the process { with a simple simulation to obtain a rst data set. 100 process instances are generated synthetically with up to 12 temperature measurements, such that in 30% of the cases the preset temperature threshold of 38 C is exceeded at least twice consecutively { in which case the carriage has to interrupt { whereas in 20% of the cases the threshold value is exceeded once at a time only, and in the remaining 50% of the process instances the threshold value is not overshot at all; that is, in 70% of the process instances the haulage continues until the destination is reached.
Using this data and the alpha algorithm of ProM 5.21 we develop the model shown in Fig. 3 ( rst model). We de ne a new analysis path for a better understanding of the decision of interrupting the carriage or not and identify that the temperature monitoring may be a useful candidate for a decision mining activity. Using the monitoring data as additional attribute and the approach of Log Enrichment (cf. Sect. 2) we attach the sequence of temperature observations to an \On the Way" event, after which the activities \Unload at Destination" (successful carriage) or \Return to Parking Lot" (interruption) commence.
A straight-forward application of the ProM 5.2 plug-in for DPA uses decision trees to identify attribute-value clauses underlying the branching of the process as shown in Fig. 3 ( rst model, shaded area). In order to apply this automatic procedure a data-preparing step is in place as the added time series in one attribute cannot be interpreted by the DPA. As the procedure would always refer to the latest (temperature) measurement available, an attribute indicating the most recent temperature observation at the time of branching was de ned. In the following new iteration of the DPAT imeSeries method, DPA is able to classify all of the \Return to Parking Lot" instances correctly. However, due to the fact that the event of overshot temperature occurs at di ering times DPA cannot infer a correct decision rule, because, for 20% of the instances taking the \Unload at Destination" branch, the overshot temperature condition is also met.
When starting a new iteration of the DPAT imeSeries method by adding all 12 (possible) measurements as individual process environment attributes (thus, however, losing the temporal ordering of the temperature information), DPA generates a fairly complex classi cation of cases able to classify 99 of the instances correctly anyway, but the tree is over- tted to the data and fails to detect the proper decision criterion. The decision tree does not take into account the temporal ordering of the observations and is only applicable if all measurements are available. But even in that case it has only poor predictive power.
For the next iteration of the DPAT imeSeries method, we replaced the singular \On the Way" event of the process model, with all the temperature data attached, by a couple of recurrent activities, viz. \Check Transport" and \Continue Transport". This time, \Check Transport" events carry one temperature observation at a time, generating a recurrent measurement of the temperature attributes as de ned above. This way we changed from Log Enrichment to Log Extension. As apparent from Fig. 3 (second model, shaded area), the entailed activity loop has been process-mined correctly.
Running DPA this time, for each of the attributes, the very same classi
cation is obtained, but with entirely di erent evaluation output. First of all,
amazingly, the number of process instances increases erroneously to 130; this
happens because, within a process instance, only the rst of recurring events is
used for subsequent decision analysis [
We conclude, modeling the process in either approach cannot resolve the
shortcoming of representing recurrent measurements (generated through process
loops; [
We now develop a new process view for the next iteration of the DPAT imeSeries method, which concentrates on the process instances and their decisions whether to return or not. For this view we use the monitoring data now as main source. This leads to an analysis model for classi cation of time series data. Because of regular structure of monitoring time we stick to Separation of Data and keep all 12 measurements as vector of attributes, but understand it as regular time series. Accordingly to the time series understanding we start with an analysis of the trend behavior and use parallel coordinate plots in R for the visualization of the groups. The results are shown in Fig. 4. While the critical plot (left side) only shows sharp single tops we can see clearly that the return plot (right side) has high plateaus leading immediately to the conjecture that the decision about return to parking lot depends on the duration of temperature above a threshold. From a more detailed investigation with visual data mining tools we can determine the rule: the critical event is that the temperature remain above threshold for two consecutive events. critical
One alternative now would be { using Log Extension again { to de ne a new event for the process which is de ned as: \First occurrence of two consecutive measurements above the threshold". DPA would { that way { be able to identify this attribute as decisive.
We also applied di erent other classi cation methods for the data. It turned out that with Boosting and Support Vector Machines we obtained better results for the error rates in case of cross validation than with decision trees. But the results are not easy to interpret in application.
With that data understanding we now produce two aggregated data attributes: (i) a boolean attribute temperatureThresholdViolation indicating that the threshold we found using data mining was violated in two consecutive measurements; (ii) a numeric attribute temperatureThresholdViolationCount counting the number of these violations, bypassing the problem of loosing the temporal information. This way there is no need for the recurring events with single measurements and therefore we can again make use of the DPA by means of Log Enrichment using the two new aggregated attributes.
We start a new iteration of the DPAT imeSeries method with the augmented attribute set in the ProM environment and nd with standard DPA 100% of cases are correctly classi ed. 4
An integrated analysis of processes and data is provided by DPA [
Log preparation tools cover the extraction and integration of data from
different sources as well as data quality improvement, e.g., [
In this paper, we proposed the DPAT imeSeries method for analyzing time series data and process logs by a combined and iterative application of process and data mining techniques. For equipping and analyzing the logs with time series data, we discussed the possibilities of log enrichment and extension as well as of keeping log and time series data in a separated way. The DPAT imeSeries method is implemented and evaluated based on use case from the logistics domain.