The document discusses using process mining techniques to analyze service-based application (SBA) event logs to extract knowledge that can improve SBA analysis. It describes applying sequential pattern mining algorithms PrefixSpan and MiSTA to a real-world SBA event log from VRESCo to find frequently occurring sequences of invoked services. The extracted patterns showed services that are often invoked together and this inferred knowledge could be used to enhance SBAs through tools like service recommendation.

1. Exploiting Knowledge on Past Process
Execution to Improve SBA Analysis
Mining Lifecycle Event Logs for
Enhancing SBAs
ISTI-CNR (CNR), TU Wien (TUW)
Franco Maria Nardini, Gabriele Tolomei, CNR

2. Learning Package Categorization
S-Cube
Monitoring and Analysis of SBA
Process Mining
Exploiting Knowledge on Past Process
Execution to Improve SBA Analysis

3. Connections to the S-Cube IRF
 Conceptual Research Framework:
– Service Composition and Coordination
– Service Infrastructure
– Adaptation and Monitoring
 Logical Run-Time Architecture:
– Monitoring Engine
– Adaptation Engine
– Negotiation Engine
– Runtime QA Engine
– Resource Broker
3

4. Overview
 Introduction
 Goal
 Methodology
 Experiments
 Conclusions

5. SBA Event Logs
 Most complex software systems collect their lifecycle
usage data in event log files
 SBA event logs contain several information about service
components exchanging messages
– e.g., service invocation, service failure, registry querying, etc.
 Event logs represent a huge source of “hidden” information
(i.e., knowledge)
5

6. Mining SBA Event Logs
 Data Mining algorithms and techniques allow extracting
valuable knowledge from event logs
 Extracted knowledge may refer to several aspects:
– e.g., service usage patterns, service failure patterns, etc.
 If properly exploited, such knowledge might help
improving the overall quality of the system:
– recommending frequent invoked services;
– avoiding/handling anomalous situations, etc.
6

7. Process Mining (PM)
 Process Mining (PM) is an application of data mining
techniques to SBA event logs
 PM aims at discovering structured process models
derived from patterns that are present in actual traces
of service executions
 Each process is usually represented by a digraph and
the problem of PM has been modeled as:
– finite state machine [CW96]
– sequential pattern mining (SPM) [AGL98]
– Petri-net [vdAWM04]
7

8. Another Example: Web Search Engines
 Web Search Engines (WSEs) are another example of
systems that benefit from mining their event log data (i.e.,
Query Logs)
 Query Log Mining (QLM) has proven to be effective for
enhancing the overall performances of WSEs
 We propose a QLM technique for identifying search
patterns (tasks) from the stream of queries recorded in
query logs [LOPST11]
8

9. Overview
 Introduction
 Goal
 Methodology
 Experiments
 Conclusions

10. Goal
 Treat PM as an instance of the SPM problem
 Detect frequent sequential patterns of service
invocation, i.e., services that are frequently co-invoked
within the same sequence
– e.g., service Y is usually invoked afterwards service X
 Find which/how services are actually used
– service recommendation
– avoiding/handling anomalous situations
10

11. Overview
 Introduction
 Goal
 Methodology
 Experiments
 Conclusions

12. Sequential Pattern Mining
 Event log might be viewed as sequences of events that
change with time (time-series)
 We are interested in finding sequences of services that are
frequently invoked in a specific order, i.e., sequential patterns
 Sequential Pattern Mining (SPM) is the process of extracting
sequential patterns whose support exceeds a predefined
minimal support threshold min_supp
12

13. PrefixSpan
 One of the most efficient algorithm for finding sequential
patterns [PHMP01]
 Mines the complete set of patterns but greatly reduces the
efforts of candidate subsequence generation
 Takes only into account the chronological order between
events
- i.e., it only cares if X comes before Y without worrying about the
actual time interval
13

14. MiSTA
 Hint: observing that two services are invoked really
close rather than far away to each other in a sequence
could lead to distinct conclusions
 MiSTA [GNPP06] is able to deal with the actual time
interval between any two consecutive service
invocations
 It needs a time threshold tau for specifying the
maximum time interval of events in a frequent
sequence
14

15. Overview
 Introduction
 Goal
 Methodology
 Experiments
 Conclusions

16. Data Set: VRESCo
 VRESCo is the runtime environment for Service-oriented
Computing developed by VITALab@TUW
 It collects usage data (i.e., events) in the form of XML log
file
 VRESCo event log file contains information about: invoked
services, service rebinding, service failure, etc.
 We only focus on service invocation events
16

17. PrefixSpan: min_supp=25%
17

18. PrefixSpan: min_supp=50%
18

19. PrefixSpan: min_supp=66%
19

20. MiSTA: min_supp=32%, tau=5sec.
20

21. MiSTA: min_supp=32%, tau=60sec.
21

22. MiSTA: min_supp=32%, tau=300sec.
22

23. Results
 The service logs coming from the VRESCo runtime
environment contain frequent patterns of services;
 Those patters contains information about: invoked services,
service rebinding, service failure, etc;
 Those patterns could be collected by considering co-
occurring sequences and also by considering the time;
 Such inferred knowledge can be used to enhance SBAs:
e.g., by means of novel design tools like service
recommendation.
23

24. Overview
 Introduction
 Goal
 Methodology
 Experiments
 Conclusions

25. Conclusions
 Event logs collected by complex software systems
represent a huge source of information (knowledge)
 Find sequences of frequently co-invoked services from
SBA event logs using Sequential Pattern Mining (SPM)
 2 SPM algorithms run on top of a real-world SBA event log
(VRESCo): PrefixSpan, MiSTA
 Experimental results show that some services are often
invoked together in a frequent sequence
 Exploit such inferred knowledge to enhance SBAs: e.g., by
means of novel design tools like service recommendation

26. References
– [CW96] J. E. Cook and A. L. Wolf, “Discovering models of software processes
from event-based data”. Research Report Technical Report CUCS-819-96,
Computer Science Dept., Univ. of Colorado, 1996.
– [AGL98] R. Agrawal, D. Gunopulos, and F. Leymann, “Mining Process Models
from Workflow Logs”. In Sixth International Conference on Extending Database
Technology, pp. 469–483, 1998
– [vdAWM04] W. van der Aalst, T. Weijters, and L. Maruster, “Workflow Mining:
Discovering Process Models from Event Logs”. IEEE Transactions on
Knowledge and Data Engineering, vol. 16, no. 9, pp. 1128–1142, Sep. 2004.
– [LOPST11] C. Lucchese, S. Orlando, R. Perego, F. Silvestri, and G. Tolomei,
“Identifying task-based sessions in search engine query logs”, in WSDM ’11.
ACM, 2011, pp. 277–286.
– [PHMP01] J. Pei, J. Han, B. Mortazavi-Asl, and H. Pinto, “Prefixspan: Mining
sequential patterns efficiently by prefix-projected pattern growth,” in ICDE ’01.
IEEE, 2001
– [GNPP06] F. Giannotti, M. Nanni, D. Pedreschi, and F. Pinelli, “Mining
sequences with temporal annotations,” in SAC ’06. ACM, 2006, pp. 593–597.