Feature extraction from event logs for predictive monitoring of business processes

Abstract

Many organizations record information about their IT-driven processes in some form of event logs, be it for auditing or debugging purposes or simply by accident. Obtaining knowledge from such event logs is the goal of process mining. Process mining techniques can be used to discover process models from event logs or relate existing process models and observed behaviour in various ways. While we usually envision process models to carry some executable semantics, like Petri net systems or BPMN models, we can also think of purely statistical models or a combination of both. Statistical models are particularly suited for predictive tasks such as early classification of a running case or anomaly detection. In the context of business process management, these activities are denoted as predictive monitoring.However, most standard machine learning and data mining algorithms cannot be directly applied to complex event logs. Some of the most widespread algorithms, like Support Vector Machines or decision tree learners, require the data to be mapped into a vector space first. To this end, meaningful features need to be extracted from event logs. Now, it is not obvious what good features in the domain of business processes are: events describe observed behaviour and are typically equipped with information about execution times and quite often also resources and other attributes. Business processes usually show a certain degree of structure in terms of subprocesses and workflow patterns, which is reflected in the logs. Furthermore, processes may allow for a parallel execution of activities, so that the order in which events are recorded can have different interpretations. Treating the traces in an event log simply as symbolic sequences of activities neglects all of these potentially useful perspectives.In this master's thesis, we investigate feature extraction techniques for event log traces. We provide an overview over the field of predictive monitoring and analyze existing trace profiles proposed in the literature. Based on this, we apply the results obtained in recent research on process discovery to find meaningful abstractions over related subsequences of events.We assess different feature sets by evaluating their predictive power in a supervised classification setting as well as a semi-supervised outlier detection setting. For this purpose, we use two datasets from public administration, describing complex processes in EU agricultural subsidy management. Our particular goal in this domain is to predict negative outcomes, for instance, additional work due to legal claims or corrections necessary after initial payment decisions. iv