MLA: A Tool for Multi-Perspective Conformance Checking of Business Processes (Extended Abstract)

Abstract

-Existing conformance checking techniques focus more on the control-flow perspective rather than other aspects in a business process. This may induce misleading diagnostics. In this paper, we introduce MLA tool for multi-perspective conformance checking. In addition to control-flow, MLA brings data and privacy perspectives' impact into conformance analysis to identify all intra- and inter-layer violations. Moreover, the tool can visualize the context in which data is processed and identify where data have been processed for unclear or secondary purposes by an authorised role. The tool has been implemented in the ProM framework. The provided user interface and graphical outputs make interpreting the conformance result simple. Index Terms-Process Mining, Multi-layer Alignment, Data privacy, Conformance Checking, Multi-perspective Analysis

I. INTRODUCTION

Process mining supports the analysis of business processes by extracting knowledge from event logs that are available in today’s information systems. Process mining techniques and algorithms are categorized as three main types including discovery, conformance checking, and enhancement. The work presented in this paper belongs to the conformance checking domain as it computes to what extent the executed behavior conforms to the expected/modeled one. All conformance checking techniques currently available in the literature [ 1 ]– [ 4 ] are control-flow based approaches which give the priority to this aspect while ignoring (or giving less priority to) other important perspectives of the process like data and privacy policies. Consequently, some important deviations may remain undetected or diagnosed incorrectly [ 2 ], [ 5 ]. Therefore, efficient and fully integrated multi-perspective conformance checking techniques are still missing. Recently, this lack was highlighted when data privacy regulations like GDPR1 and HIPAA2 were introduced. According to these regulations, organizations are required to take the data and privacy perspectives into account while analysing their processes.

The tool presented in this paper is developed in order to fill the aforementioned gap by applying the novel multiperspective conformance checking technique discussed in [ 5 ]. Such technique brings data and privacy policy aspects into conformance analysis as well as the control-flow point of view without giving priority to one perspective.

1https://gdpr-info.eu/ 2https://www.hhs.gov/hipaa/

The main functionalities of the tool will be discussed in Section 2. Section 3 outlines the maturity and availability of the tool, and Section 4 concludes the paper.

II. DESCRIPTION OF MAIN FUNCTIONALITIES

The MLA tool is the result of our novel approach for multiperspective conformance checking [ 5 ]. It takes as inputs: a process model with role information, a data model, an organisational model, a process log, and a data log. Then, it computes multi-layer alignments between the process, data, and privacy policy aspects and provides operational insights by reporting the deviations of each layer as well as hidden violations between these three aspects.Figures 1 and 2 illustrate the user interface of MLA tool applied to an example process and data event logs extracted from a healthcare treatment process.

A. Multi-perspective conformance checking

The multi-perspective conformance checking results is presented by “Projection to Process Log” visualization depicted in Fig.1. It facilitates observing the violations of each perspective in an overall view per trace as well as providing detailed information on each trace event. As shown in Fig.1, by linking the privacy, data and process layers, it allows analysts to detect missing behaviors (highlighted red/white shapes) and unexpected behaviors (red shapes) related to each perspective in addition to fully conformed activities and data operations executed by legitimate roles (green shapes) during the process. Moreover, the tool provides high-level behavioral patterns of hidden deviations where non-conformity relates to either a combination of two or all three aspects of a business process. For instance, in the health care treatment process, during each visit, doctors are expected to add a prescription or treatment plan to the patient’s medical history. A doctor may negligently forget to update it. This missing data operation may cause other doctors to prescribe an incompatible drug to the patient. Such missing data operations could impact care quality or cause serious health problems to the patient. This scenario implies that it is important to check executed behavior in both process and data layer. Since MLA considers both aspects in the conformance analysis, in this case, from control-flow perspective it reports no violation while in the data perspective the tool is able to report missing data operation violations.

B. Monitoring the purpose of data processing

Fig.2 shows another visualization which is available in the MLA tool as “Projection to Data Log”. This visualization was implemented to indicate the violations related to the data layer specifically. MLA is able to detect four kinds of important data layer deviations such as executed data operation by an illegitimate role, unexpected, ignored and missing data operations. Furthermore, this visualisation provides the answer to the important privacy rule, “who performed which data operation for which purpose?” by indicating the context of each data operation executed during a business process. By leveraging the reconciled view of the three data, process and privacy perspectives, it can detect and mark which data operations were executed with unclear or secondary purposes. Moreover, MLA can detect violations of data privacy where data was accessed by an authorised user in the system but with an illegitimate role in the process. As an example, in the treatment process several roles like doctors, nurses, and lab experts are allowed to access sensitive data of the patients, such as medical history and test results. A curious actor may exploit his/her privilege in order to use the information of patients for personal or financial gain. MLA can detect such scenarios that violate individual’s data privacy.

III. AVAILABILITY AND MATURITY

MLA is developed in JAVA and implemented in the open source ProM framework (available in ProM 6.11 release3). Sample of inputs, tool manual including description of all functionalities and inputs, a screen cast, and the source code are available in a GitHub repository: https://github.com/AzadehMozafariMehr/MLATool.

The MLA tool was developed to support the concepts provided by the approach disscussed in [ 5 ] for multi-perspective conformance checking. The approach in [ 5 ] was evaluated through controlled experiments. Using CPN tools4, we simulated a healthcare treatment process and generated process and data logs with real-life complexity (e.g. loops and considerable trace length). The approach was evaluated through 8 experiments as described in [ 5 ]. Overall, the experiments show high precision and recall. The results implied that the tool can deal with the real-life complexity and is able to detect all deviations that happened in one, two, or all three process perspectives combined (control-flow, data and privacy policy). It has been also applied for multi-perspective conformance analysis of a real-life lead management process in the industry.

IV. CONCLUSION

In this paper, we introduced MLA tool to support multiperspective conformance checking of business processes. Using MLA, the user can investigate the process from three aspects of process control-flow, data and privacy policy (role allocation). The provided user interface and the graphical outputs make it simple to interpret the conformance results. MLA allows the user to identify the violations that cannot be detected by taking into consideration only one or two perspectives of a business process. Thus, it can provide more accurate diagnostics of deviations than control-flow based conformance checking tools. Moreover, by reconciling the process, data and privacy aspects, MLA can detect spurious data access and identify privacy infringements where data have been processed for unclear or secondary purposes by an authorised role. As a future plan, for improving the usability of the tool, we are considering adding some features that allow users to filter the process instances with specific deviations.

ACKNOWLEDGMENT

The author has received funding within the BPR4GDPR project from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 787149.

References

[1] Adriansyah , A ., van Dongen , B.F. , van der Aalst , W.M.P. : Towards robust conformance checking . In: zur Muehlen, M. , Su , J . (eds.) Business Process Management Workshops. pp. 122 - 133 . Springer Berlin Heidelberg, Berlin, Heidelberg ( 2011 )

[2] Alizadeh , M. , Lu , X. , Fahland , D. , Zannone , N., van der Aalst , W.: Linking data and process perspectives for conformance analysis . Computers and Security 73 , 172 - 193 ( Mar 2018 )

[3] de Leoni , M., van der Aalst , W.M.P. : Aligning event logs and process models for multi-perspective conformance checking: An approach based on integer linear programming . In: Business Process Management . pp. 113 - 129 . Springer Berlin Heidelberg, Berlin, Heidelberg ( 2013 )

[4] Mannhardt , F. , Leoni, de, M., Reijers , H. , Aalst, van der, W.: Balanced multi-perspective checking of process conformance . BPMcenter . org ( 2014 )

[5] Mozafari Mehr , A.S. , de Carvalho, R.M., van Dongen , B. : Detecting privacy, data and control-flow deviations in business processes . In: Nurcan, S. , Korthaus , A . (eds.) Intelligent Information Systems . pp. 82 - 91 . Springer International Publishing, Cham ( 2021 )