event-based real-time decomposed conformance analysis seppe vanden broucke, jorge munoz-gama, josep...

EVENT-BASED REAL-TIME

DECOMPOSED CONFORMANCE ANALYSIS

Seppe vanden Broucke, Jorge Munoz-Gama, Josep Carmona, Bart Baesens, and Jan Vanthienen

CoopIS2014

2

APPROACH

DECOMPOSITION

CONFORMANCE CHECKING

CONCLUSIONS

EVENT-BASED REAL-TIME CONFORMANCE

EXAMPLE CASE AND EXPERIMENTS

EVENT DISPATCHING

REPLAYREPORTING AND VISUALIZATION

3

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


4

Process Models, Process Mining and Conformance Checking

Conformance Checking

Process Mining

Process Models

5

• A process is a series of actions taken in order to achieve a particular end.• e.g., construction permit application, patient path in a hospital,

…

• A process model is a description of a process in a certain level of formality.

• Process models are used to gain insight of the processes, simulate forthcoming future, take educated decisions, …

• Several notations for processes: BPMN, EPC, UML, Petri nets, …

Processes and Process Models

6

Petri Net

• Petri nets: formal, wide extended, mathematical foundation, several approaches, …

Transition

PlaceToken

7

Petri Net

• Petri nets: formal, wide extended, mathematical foundation, several approaches, …

8

Process Modeling based on Experts

MODEL REALITY

PROCESS

DOMAINEXPERTS

?

9

Biased Vision

10

• The basic idea of Process Mining is to extract unbiased knowledge from event logs as an exact representation of the reality.

• Conformance Checking is a sub-discipline of Process Mining where a process model is compared with the reality reflected in the log to assess its quality.

Process Mining

11

Conformance Checking

MODEL REALITY

PROCESS

?

LOGS

How good is the model describing

the reality?

12

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


13

• Detect possible conformance anomalies between the model and the reality on the fly, before it is too late.

• Challenges:• Low Computation Time

• Analysis on the regular basis

• Localize Deviation and Understand Causes• Specially in large models

• Event-based• Not complete case necessary to report a mismatch

Event-based Real-time

14

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


15

Addressing the Challenges

• Challenges: • Fast• Event-based• Mismatches localization and understanding.

• Solution:

Decomposition + Event-based Heuristical Replay

Approach

16

17

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


18

Benefits of Decomposition in Conformance

• Decomposition of models has been proven to improve the computation time in conformance checking. • Munoz-Gama et al. 2014, van der Aalst 2013, …

• Meaningful decompositions improve the comprehension of the conformance violations.• Munoz-Gama et al. 2013, …

Single-Entry Single-Exist (SESE) Decomposition

19

Why SESE?

• Single-Entry Single-Exit Components

• Represent subprocesses within the process• Intuitive for conformance diagnosis• Well-studied problem in the literature, with

linear time algorithms.• Hopcroft and Tarjan 1973, Polyvyanyy 2012, …

ExitEntry

20

SESE Decomposition

SESE: set of edges which graph has a Single Entry node and a Single Exit

node

Refined Process Structure Tree (RPST) containing non overlapping SESEs

• Unique• Modular• Linear Time

21

Cut on RPST

• Partitioning over the RPST• Any cut is a partitioning• Algorithm to partitioning by size (k)

• Details in Munoz-Gama et al. 2014.

22

What are the guarantees?

• What are the guarantees in conformance?

• Valid decomposition: only sharing transitions (not places or arcs)

• van der Aalst 2013 proves that:Theorem: If valid decomposition then no

conformance violations are lost in the decomposition process.

23

SESE and Valid Decomposition• SESE decomposition may produce not valid

decompositions• Exit place of one component is the entry place of

another.

• But it can be a valid decomposition if we apply bridging.

24

What are the guarantees?

• Munoz-Gama et al. 2013 proves that:

• Combine SESEs to obtain more understanding subprocesses

Theorem: SESE + bridging is a valid decomposition and therefore, no conformance violations are lost in

the decomposition process.

25

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


Event Dispatching

26

27

Event Dispatching

• Central dispatcher serves each event to its corresponding submodel(s) to be replayed on it.

• Distributed worker threads, each one in charge of one or more submodels in a concurrently way.

28

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


Replay

29

30

Replay vs Alignments

GLOBAL ALIGNMENT-BASED CONFORMANCE

VS

HEURISTIC REPLAY-BASED CONFORMANCE

31

Align-based Conformance

Log Model

C D E

A B B C

Alignment

E

• Conformance mismatch on the Log

• Conformance mismatch on the Model

A B C D EA C D DB C E

…

A B

A C C D DA B B C E

32

Replay-based Conformance

AA

A BA B

A B BA B

CA B B CA B

• Forward replay based on heuristic decisions

33

• Align-based• Optimal from global point of view• High Computational Cost• Trace oriented

• Replay-based• Event oriented• Low Computational Cost• Heuristic and optimality not guaranteed

Align vs Replay Conformance

34

Heuristic Event-based Replay

• Heuristic Event-based replay based on vanden Broucke et al. 2013.• For each submodel and each case id the

state of the submodel is maintained and evolved.• Given a new event we check if it is

enabled in the current state.• Order: transition mapped to activity,

silent transitions, and non-enabled transitions mapped to activity.

35

Heuristic Event-based Replay

• If several candidates, one-step look-ahead.• Sufficient to resolve most ambiguities.

• However, in real-time no knowledge about future events.• Three alternatives:

• Assume determinism• Full replay of the trace each time a new event is

added, reconsidering decisions. • Combination of both: a part of the trace is “frozen”.

• Decomposition limit the effects of the heuristic decisions.

Algorithm

36

• Details in the paper

37

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


Reporting and Visualization

38

39

Reporting and Visualization

• Actions while system is running

• Two types of actions• Logging of statistics

• e.g., be polled regularly by dashboards or persistent data stores

• Triggers fired once certain criteria is met• e.g., error threshold, violation of high-risk task• Actions: warnings, halting running services, …

Proof-of-concept Implementation

40

MonitoringSubprocesses

EventsStreamed

GlobalView

GeneralStatistics

41

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


Bank Transfer: High Level

42

43

Bank Transfer: Petri Net

Scenario 1: Serial Number Check

44

• Pay in cash subprocess requires 3 concurrent checks before to proceed: • CASN (external), CBSN (bank), CIBSN (consortium)

• External check is suddenly skipped (malfunction or attack)

Scenario 2: Preliminary Profiling

45

• First Receiver Pre-Profiling and then Evaluate Pre-Profiling to take a decision of its risk and requirements.

• Evaluation before proper finishing of profiling (malfunction or attack)

Experimental Comparison

46

• Approaches adapted to event-based for comparison• Not designed nor optimized for that (e.g., grouping,

etc)

47

APPROACH

DECOMPOSITION


CONCLUSIONS



EVENT DISPATCHING


48

Conclusions

• Novel process conformance checking to support real-time monitoring of event-based data.• Phases: 1) Decomposition, 2) Event

Dispatching, 3) Replay, and 4) Reporting and Visualization. • Event-based, Fast, and better

comprehension. • Future work: Other decompositions and

real case studies.

EVENT-BASED REAL-TIME

DECOMPOSED CONFORMANCE ANALYSIS

Seppe vanden Broucke, Jorge Munoz-Gama, Josep Carmona, Bart Baesens, and Jan Vanthienen

CoopIS2014

event-based real-time decomposed conformance analysis seppe vanden broucke, jorge munoz-gama, josep...

Documents

process mining conformance

conformance checking4a

process modeling

basic idea of process

conformance diagnosiswell

conformance violations

sese decomposition

event logs