In this work we present an approach to extract the business logic of an application based on its generated logs. To do so we use process mining techniques to extract the model from the logs of an industrial application which are often large and hence di cult to analyze. We propose here a methodology to group the log according to similar elements, so that it can be presented to the user in separate fragments. We enrich this view of the model with semantic information based on the ontology we built.
One of the biggest challenges of information systems concerns the modernization of applications by introducing new technologies and functionalities. Modernizing an application can be a costly and time consuming task, especially when applications are developed using obsolete technologies and they lack a clear description of the underlying business logic.
The business logic of a system is described in the conceptual model which is a composition of the di erent entities and the relations between them. The conceptual model supports developers to understand di erent aspects of the application, independently of any implementation issues. Unfortunately, many of the modern systems lack of this conceptual model or are based on models which are neither maintained nor documented.
One of the most common approaches for extracting the di erent models of an application is based on the analysis of the source code using reverse engineering technologies. The extracted models can then be used to reconstruct di erent view points of the system. However analyzing the source code can be very expensive especially when the system is developed with an emphasis on perspectives di erent than the business process (e.g. COBOL). The business logic is spread out across the entire system which can encompass millions of lines of source code. As a result analyzing the integrality of the source code is necessary in order to create the model describing the business logic of the application.
In this work we use the events logs that are generated during the execution of an application in order to discover a model that describes the business logic. An event log is a recorded event that is related to an activity, at a particular timestamp, from a particular user. Existing techniques from the domain of process mining can extract the process of a system. However, this model, especially when it comes from large logs is di cult to analyze and to extract information due to its big size. Our goal is to improve the quality of the extracted data and facilitate their interpretation. The proposed approach, extracts an abstract representation of the initial model enriching it with semantic knowledge. To achieve that, we use clustering analysis and ontologies.
The work presented in this paper is part of the ITM factory3 collaborative project. The project solutions to the industries for the rapid maintenance of information systems and for software modernisation. The goal is to improve or create new business value from existing applications, especially when the software becomes outdated and incompatible with new technologies. The solutions are based on reverse engineering methodologies. That is, the model of the application is extracted, analysing the source code. Based on the extracted application model, we can derive di erent view points such as the architecture, the process and the business logic. The extracted models can then be enriched or modi ed to meet the objectives of the given project. The logic of the system can be enhanced with new business rules making use of the old ones, that is avoiding rewriting existing parts of the application. Similarly, new technologies and techniques can be applied to the corresponding model. This project joins together French specialists of the domain, Sodifrance (http://www.sodifrance.fr/ ) and Mia-Software (www.mia-software.com), leaders in the project of modernisation, o ering methodologies and tools as well as the public research laboratory InriaAtlanMod (http://www.inria.fr/en/teams/atlanmod), expert in the domain of model driven engineering. The project uses data from the French insurance company MMA4 which is the industrial partner of this project. MMA is an insurance company proposing home, auto and business insurances.
Recent work has shown that one can rely on clustering techniques for
extracting a model from user behavior. More speci cally, Song et al. [
The rest of the paper is structured as follows. The background to this work is described in Section 2. Section 3 describes the case study. The methodology we follow is detailed in Section 4. Finally, Section 5 concludes this work and discusses directions for future work. 3 http://www.viseo.com/fr/o re/le-projet-itm-factory 4 http://www.mma.fr/
Logging is a means of tracking actions that took place during the execution
of a system from a user at a speci c timestamp. Information such as actions,
originators of this action, used resources and timestamp are some of the
information that can be stored in an event log when executing an information system.
Process Mining [
A fundamental goal of process mining is the discovery and extraction of the
model describing the system process. The reconstruction of the model is the aim
itself but process mining it is not limited to that. Conformance checking [
The next section illustrates an example of an event log and how process mining can be used to extract the corresponding process model. 3
In this section, we present a case study that will be used throughout the paper to demonstrate our methodology. The event log chosen for the purpose of this case study is an extract of logs from an insurance company application. It describes a process of rescinding an insurance contract. The application is written in french language, so some of the terms in the rest of the paper will be presented in French.
The log contains several traces, each of which corresponds to a process instance. Each trace is a sequence of events represented by an action, the action originator, its timestamp, the resources, the classes etc. Some examples of identi ed actions are \register invoice", \denounce contract", \register new case", etc.
For the purpose of this work, we keep information about the action, the originator and the timestamp. Table 1 shows a fragment of this log. It illustrates three traces, denoted as \case id". For each trace, di erent activities are executed by di erent originators at given timestamps. For example, in case 1, the originator \A6926A04" executes an instance of the activity \RegisterModifyPerson" at the timestamp \2013-12-19 13:59:33".
Case id Originator Timestamp
Activity
We use a fragment of the log that contains 670 traces (case id or process instances) and a total of 24 activities executed by 459 originators.
To extract the model from this event log we use ProM [
In this section we describe a methodology for extracting the process of an application based on its execution logs.
The process model of the application is obtained by analyzing the event logs and applying process mining algorithms. For event logs coming from real-life applications, like the insurance company application we are working on, the discovered model is large and di cult to explore and analyze. The end user, in order to understand the process of the application, needs to read the process model which is very complex, containing millions of activities. And still, the information he obtains cannot help him explore the application and detect problems or propose modi cations.
Giving an abstract view of the extracted model and assigning a meaning to each element of this abstract view is a big challenge.
Techniques for solving the abstraction problem have already been proposed.
Most of these approaches are based on structural properties such as identifying
patterns [
To overcome this challenge, we propose a methodology that incorporates clustering and semantic analysis. We cluster users (originators) based on their behavior, aiming to give a meaning to each of these clusters.
To achieve our goal we follow the methodology described below:
1. Extract the process model using the Fuzzy Miner algorithm [
P where P refers to any partitioning of the data.
One of the most popular clustering algorithm is k-means which groups the data in order to minimise the inter-class distance:
K arg min X
P
X jjv
kjj22 k=1 v2Pk where k = jP1kj Pv2Pk v is the mean of the vectors belonging to class k and jj jj22 is the squared Euclidean distance which is calculated as follows for two vectors v and v0:
D X(vi i=1 v0)2 i where D refers to the dimensionality of the vectors.
In our case we seek to cluster users based on their behavior. To do so, we need to represent the data to a vector space model starting from the event log which consists of tuples of the form < u; a; t > where: { u is the user (or originator of an action) { a is the executed action { t is the timestamp of the action
To create the vectors we identify all di erent actions ak, k 2 N of the log. Then for each user uj , j 2 N we create a vector vj , such that: vj =< na1 ; :::; nak >, for k 2 N and nai is the number of actions executed by the user uj . 4.2
Ontologies In this section we describe how we build the ontology of our application. The goal is to incorporate knowledge extracted from ontologies into the clusters produced from the analysis of the event logs.
An ontology can express semantically the system concepts and provide a
formal representation of the relations between them [
In our case, we aim to facilitate the task of experts by building an ontology semi-automatically. Analyzing the model extracted from the log analysis, we de ne rules that faciliate the extraction of the basic concepts of the ontology.
We start by giving some formal de nitions about the ontology and the process model.
An ontology is a tuple fC; R; Hg where: { C is the set of concepts { R is the set of relations de ned over concepts { H is a directed acyclic graph over concepts de ned by the subsumption relation r between concepts, such that for concepts C1; C2 2 C; C2 C1, the concept C1 subsumes the concept C2 with the property r.
The process model we obtain analyzing the even logs is a transition system S such that S = ( ; ; !) where: { is a non-empty set of states { is the set of labels, one for each state of the system { ! is a transition relation !
The ontology we build consists of a tuple as described above.
We de ne C the set of concepts of our ontology such that C = c0[C1[C2[Cr where: { c0 is de ned as the root concept of the ontology. It correspond to the label 0 2 of the state s such that @s0 2 S; s0 ! s where s 2 Sg. The root is de ned by the Business Process concept. { C1 is the set of concepts that corresponds to 'independent' edges of the process model, i.e. edges that have no incoming or outgoing transitions. The set of concepts C1 is de ned as C1 = fci 2 Cg, i 2 N such that ci correspond to the labels i 2 of the set of states fsi 2 Sg for which @s0; s00 2 S s
j i ! s0; s00 ! sig. Each concept ci of C1 is named after the label i of the edge si. { C2 is the set of concepts that corresponds to 'popular' edges of the process model, i.e. edges broadly interconnected with other edges through incoming and outgoing transitions. The set of concepts C2 is de ned as C2 = fcj 2 Cg; j 2 N such that cj correspond to the labels j 2 of the set of states fsj 2 Sg where for s0; s00 2 S and for the set of transitions ffting; ftoutg jtout : sj ! s0; tin : s00 ! sjg it holds jtinj + jtoutj > e for a given threshold e. Each concept cj of C2 is named after the label j of the edge sj. { Cr, for r 2 N, is the set of concepts that corresponds to all remaining edges.
We perform lexical analysis on the labels of the edges such that for a label r we split it in two parts, rA and rB . The rst part rA corresponds to the rst word of the label. For the set of concepts Cr we use the labels rB .
We de ne R the set of relations of our ontology such that R = r0 [ ri where: { r0 is de ned as the property 'is based on'. The root concept c0 is connected using this concept with the concepts of the sets C1 and C2 such that for c 2 C1; C2, c r0 c0. { The set of properties ri corresponds to iA . Concepts of the set C2 are connected to concepts of the set Cr using properties ri such that for cj 2 C2 and cr 2 Cr, for j; r 2 Nit holds that cr iA cj. Which concepts of C2 will be connected with concepts of Ci is a manual and random process.
For the example we are studying, we extract the ontology depicted in Figure 3. To construct this ontology, we analyze the process model shown in Figure 1. We identify seven 'independent' and 'popular' edges shown at the second level from the top of the ontology graph. These edges are transformed to concepts and connected to the root 'BusinessProcess' with the property 'is based on'. The concepts of the third level are created based on the lexical analysis of the edges of process model. For example, the edge 'EnregisterAvenant' leads to the 'EnregistrerChargementPayeurContrat'. The edge 'EnregistrerChargementPayeurContrat' is transformed to the concept 'ChargementPayeurContrat' and connected to the concept 'EnregistrerAvenant' with the property 'enregistrer'. In this section we describe the results of our methodology as applied to the MMA case. The event log we used contains 670 process instances and a total of 24 activities and 459 users.
The vector of each instance is standarized in the range [0; 1] feature-wised and
it is normalized to unit norm. The k-means algorithm was applied using di erent
values of the number of classes k = f2; 3; 4g. The minimum inter-class distance
was achieved for k = 4 which was also evaluated with the mean Sihlouette
Coe cient [
Figure 4 shows the four di erent clusters that we obtain for the process model of Figure 1. The next step consists of enriching these clusters with semantic information, such that each cluster is identi ed by those actions that describe its process. Using the ontology of Figure3 we extract the events that are illustrated in Figure 5. Each of these events characterize semantically the clusters and give su cient information for understanding their meaning.
In this work we introduced a methodology for clustering the event logs and identifying the most important activities of each cluster. The goal is to present an understandable and easy to manipulate model to the end user. We used process mining algorithms to extract the process model from the event logs, clustering algorithms to divide the logs to subgroups based on common behavior of users and nally built ontologies to identify the most important activities and the relations between them.
The ontology we built can be used to identify the most important activities of each cluster. The second level of the constructed ontology contains the most signi cant activities of the process. These activities can be identi ed in the clusters and give the semantics of each of them. More details for each cluster can be obtained from the lowest levels of the ontology.
This methodology can be used to deal with incompleteness. The generated logs provide information about only a fraction of the process. By clustering users, we can complete the behavior of one user with actions identi ed at the behavior of other users of the same cluster. Similarly, we can identify erroneous behaviors, analyzing the actions of users of the same clusters and observing unusual sequence of actions. Another possibility is to predict the behavior of users based on the action followed by other users of its cluster.
Future work includes de ning other parameters for clustering the log, di erent than the user behavior as well as incorporating multi-view clustering algorithms. For each cluster of logs, we can generate the corresponding process model and associate models between them by merging common elements. Improving the built ontology and expanding it with existing ontologies can improve the semantic interpretation of the clusters. Finally, we plan to apply the proposed methodology to larger experimental sets and validate the results by experts of the domain.
The authors would like to thank Dr. Josep Carmona for his valuable comments and suggestions for improving this work and the anonymous reviewer for his useful comments.