This document discusses mining additional perspectives from event logs beyond the initial process model. It describes how event logs contain attributes relating to various perspectives like resources, time, cases, and costs. These additional attributes can be analyzed and visualized using techniques like social network analysis, resource behavior analysis, and decision mining to gain additional insights into the process. Classification techniques can also be applied to the event data to understand reasons for decisions, delays, or non-conformance in the process.

1. Chapter 8
Mining Additional Perspectives
prof.dr.ir. Wil van der Aalst
www.processmining.org

2. Overview
Chapter 1
Introduction
Part I: Preliminaries
Chapter 2 Chapter 3
Process Modeling and Data Mining
Analysis
Part II: From Event Logs to Process Models
Chapter 4 Chapter 5 Chapter 6
Getting the Data Process Discovery: An Advanced Process
Introduction Discovery Techniques
Part III: Beyond Process Discovery
Chapter 7 Chapter 8 Chapter 9
Conformance Mining Additional Operational Support
Checking Perspectives
Part IV: Putting Process Mining to Work
Chapter 10 Chapter 11 Chapter 12
Tool Support Analyzing “Lasagna Analyzing “Spaghetti
Processes” Processes”
Part V: Reflection
Chapter 13 Chapter 14
Cartography and Epilogue
Navigation
PAGE 1

3. Mining additional perspectives
(one type of enhancement, cf. repair in context of conformance checking)
supports/
“world” business
controls
processes software
people machines system
components
organizations records
events, e.g.,
messages,
specifies transactions,
models
configures etc.
analyzes
implements
analyzes
discovery
(process) event
conformance
model logs
enhancement
PAGE 2

4. Replay: Connecting events to model
elements is essential for process mining
Play-In
event log process model
Play-Out
process model event log
Replay
• extended model
showing times,
frequencies, etc.
• diagnostics
• predictions
• recommendations
event log process model PAGE 3

5. Remember: Replay!
ABC D
B
A p1 E p3 D
start end
p2 C p4
PAGE 4

6. Replay can detect problems
AC D
Problem! Problem!
token left behind B missing token
A p1 E p3 D
start end
p2 C p4
PAGE 5

7. Replay can extract timing information
A5 B8 C9 D13
8
5 6
4 7
3 B 2 5
8
A p1 E p3 D
start end
5 13
4 p2
3 C p4 4
37 4 7
6
9 PAGE 6

8. Decision mining: “Red” cases
ABC D
B
A p1 E p3 D
start end
p2 C p4
PAGE 7

9. Decision mining: “Blue” cases
If red then B+C;
AE D If blue then E;
B
A p1 E p3 D
start end
p2 C p4
PAGE 8

10. Starting point: connected event log
and model
1 1
process b
* case e
* event timestamp
h
1 1 * 1
a d f g resource
i
* 1
*
activity
* j
activity c * instance 1 attribute costs
k ...
model instance event
level level level trans-
action
PAGE 9

11. Process
supports/
“world” business
controls
the initial processes software
process model people machines system
is made by components
hand or organizations records
discovered from events, e.g.,
the event log messages, events have
specifies transactions,
models attributes
configures etc.
analyzes relating to
implements
various
analyzes
integrated model perspectives
showing multiple 2
perspectives discovery
(process) 3 event
conformance
5 model 4
logs 1
enhancement
conformance checking is the model is extended using the
used to relate the initial additional information in the
model and event log event log
PAGE 10

12. Attributes in event logs
PAGE 11

13. Cases may also have attributes
PAGE 12

14. Helicopter view: Dotted charts
activity : decide
each dot corresponds to an event type : start
time : 06-01-2011:11.18
resource : Sara
cost : -
custid : 9911 the color and
name : Smith
type : gold shape of a dot
region : south may depend on
amount : 989.50
attributes of the
class event
each line corresponds to
a class, e.g., a case, a
time resource, a customer, or
an activity
time can be absolute or relative and real or logical
PAGE 13

15. Dotted chart for a process of a housing
agency using absolute time
PAGE 14

16. Zooming in
PAGE 15

17. Same log, relative time
PAGE 16

18. Organizational mining
PAGE 17

19. Resource-activity matrix
mean number of times a resource
performs an activity per case
Activity a is executed exactly once for each case (take the sum of the first
column). Pete, Mike, and Ellen are the only ones executing this activity. In
30% of the cases, a is executed by Pete, 50% is executed by Pete, and 20%
is executed by Ellen. Activities e and f are always executed by Sara.
Activity e is executed, on average, 2.3 times per case. Etc.
PAGE 18

20. Social network analysis
the thickness of the arc indicates
organizational entity (resource, the weight of the relationship
person, role, department, etc.)
w=0.98
relationship
y the size of the oval indicates
the weight of the entity
w=0.80
w=0.90
w=0.15
x z
w=0.30 w=0.35
w=0.08
PAGE 19

21. Handover of work matrix
Count the number of times The causal dependencies in
work is handed over from one the process model are used
resource to another (on to count handovers in the
average per case). event log.
PAGE 20

22. Social network based on handover of
work (threshold of 0.1)
Pete Sue
Sean
Mike
Sara
Ellen
In this figure only
the thickness of
the arcs is based
PAGE 21
on frequencies.

23. Handover of work at role level
w=1.5
Assistant
w=5.45
w=0.5
w=3.45
w=2,95
Expert
w=1.3 w=1.15
w=0.65
In this figure also
Manager w=1.15
w=3.6
the size of each
node is based on
PAGE 22
frequencies.

24. Profile
PAGE 23

25. Social network based on similarity of
profiles
Sean Sue
Pete
Mike Ellen Sara
Resources that execute similar collections of activities are
related. Sara is the only resource executing e and f . Therefore,
she is not connected to other resources. Self-loops are
suppressed as they contain no information (self-similarity)
PAGE 24

26. Discovering organizational structures
Expert
Manager
Sue Sean
Sara
b
examine
thoroughly
g
p1 p3 pay
c compensation
a examine e
start register casually decide p5 end
request
h
p2 d p4 reject
check ticket request
f
reinitiate
request
Assistant
Mike Ellen Pete
PAGE 25

27. Another example
process model organizational model resources
oe1 r1
r2
a1
oe2 oe3
r3
a2 a3
r4
oe4 oe5
a4 r5
oe6 oe7 oe8 r6
r7
a5
r8
r9
PAGE 26

28. Analyzing resource behavior, e.g.,
Yerkes-Dodson law of arousal
PAGE 27

29. Learning time and probabilities
• Replay, as before, but now considering timestamps.
• Let us replay the first three cases in the event log:
− case 1 starts at time 12 and ends at time 54,
− case 2 starts at time 17 and ends at time 73,
− case 3 starts at time 25 and ends at time 98.
PAGE 28

30. 5
1,s:35 1,c:40
9
2,s:50 2,c:59
1,s:25 7 1,c:32 2,s:30 8 2,c:38 5
3,s:45 3,c:50
5 3 7
3,s:60 3,c:65 3,s:32 3,c:35 3,s:80 3,c:87
2,s:70 3 2,c:73
7 8
1,s:12 1,c:19 3,s:90 3,c:98
1:10
6 1:3
2,s:17 2,c:23 2:11
1:6 2:12
5
3,s:25 3,c:30 2:7 b 3:10
3:0
3:3
3:2 3:15
examine
3:5
thoroughly
1:12
g 1:54
2:73
p1 p3 pay
2:17
c compensation 3:98
3:25
a examine e
start register casually decide p5 end
request
h
1:7
p2 d p4
reject
2:5 check ticket request
3:5 f 1,s:50
4
1,c:54
3:7
reinitiate
1:2
request
2:18 5
3,s:50 3,c:55
7 3:5
1,s:26 1,c:33
3:13
4
2,s:28 2,c:32
5
3,s:35 3,c:40
5
3,s:62 3,c:67
PAGE 29

31. Another view on the timed replay of
the first three cases
0 10 20 30 40 50 60 70 80 90 time
a
b
case 1 d
e
h
a
c
case 2 d
e
g
a
b
c
case 3 d d
e e
f
g
PAGE 30

32. Timed replay projected onto resources
0 10 20 30 40 50 60 70 80 90 time
a a h
Pete c d
d
Mike a d
c
Ellen d g g
Sue b
Sean b
e
Sara e
e f e
PAGE 31

33. Decision mining
decision b
point #1 examine
thoroughly decision
g
point #2
c1 c3 pay
c compensation
a examine
e
start register casually decide c5 end
request
h
c2 d c4 reject
check ticket request
f
reinitiate
request
PAGE 32

34. Example: XOR-split
type region amount activity type=gold and y
amount<500
What are the “features”
gold south 987.30 z (predictor variables)
silver north 178.70 z x influencing the
gold south 211.50 y
type=silver or decision?
silver west 587.70 z amount≥500 z
silver east 224.70 z
silver south 278.50 z y
gold north 488.50 y
type=gold and
silver west 443.20 z amount<500
x
silver south 673.70 z type=silver or
amount≥500
gold west 413.50 y
A classification technique
silver south 687.70 z z
like decision tree learning
gold south 987.30 z can be used to find such
silver north 378.80 z rules: :explain response
type=gold and y
gold south 314.50 y
amount<500
variable (dependent
silver north 537.70 z variable) in terms of
x predictor variables
silver west 158.70 z
type=silver or
(independent variables).
gold east 344.50 y
amount≥500 z
... ... ... ...
PAGE 33

35. Example: OR-split
type=gold or y
type region amount activity amount<500
gold south 987.30 y and z
x
silver north 178.70 y and z
gold south 211.50 just y type=silver or
amount≥500 z
silver west 587.70 just z
silver east 224.70 y and z
y
silver south 278.50 y and z
gold north 488.50 just y type=gold or
amount<500
silver west 443.20 y and z x
type=silver or
silver south 673.70 just z amount≥500
... ... ... ...
z
PAGE 34

36. Classification in process mining
• The application of classification techniques like
decision tree learning is not limited to decision
mining based on event/case data only.
• Additional predictor variables may be used:
− behavioral information (count number of loops)
− performance information (processing times)
− contextual information (weather, queues, etc.)
• Alternative response variables can be analyzed:
− uncover reasons for non-conformance (split
instances in two groups)
− uncover reasons for delays
PAGE 35

37. Bringing it all together
Step 1: obtain an event log event
log
b
examine
Step 2: create or discover thoroughly
A
g
A M
a process model c1
c
c3 pay
compensation
a examine
e
start register casually
A decide c5 end
request
h
Step 3: connect events in c2 d c4 reject
the log to activities in the check ticket request
f
model reinitiate
request
Step 4: extend the model Role A: Role E: Role M:
Assistant Expert Manager
Pete Sue Sara
add organizational
Mike Sean
perspective
perspectives
add other
perspective
perspective
Ellen E
add case
add time
b
A
examine
thoroughly
A
g
A M
c1 c3 pay
c compensation
a examine
e
A
start register casually
A decide c5 end
request
h
c2 d M
Step 5: return c4 reject
request
check ticket
integrated model f
reinitiate
request
PAGE 36