1. EVENT-BASED REAL-TIME DECOMPOSED CONFORMANCE ANALYSIS Seppe vanden Broucke, Jorge Munoz-Gama, Josep Carmona, Bart Baesens, and Jan Vanthienen CoopIS 2014

2. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 2 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

3. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 3 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

4. Process Models, Process Mining and Conformance Checking Conformance Checking Process Mining Process Models 4

5. A process is a series of actions taken in order to achieve a particular end. e.g., construction permit application, patient path in a hospital, … A process model is a description of a process in a certain level of formality. Process models are used to gain insight of the processes, simulate forthcoming future, take educated decisions, … Several notations for processes: BPMN, EPC, UML, Petri nets, … 5 Processes and Process Models

6. Petri Net Petri nets: formal, wide extended, mathematical foundation, several approaches, … Transition PlaceToken 6

7. Petri Net Petri nets: formal, wide extended, mathematical foundation, several approaches, … 7

8. Process Modeling based on Experts MODELREALITY PROCESS DOMAIN EXPERTS 8

9. 9 Biased Vision

10. The basic idea of Process Mining is to extract unbiased knowledge from event logs as an exact representation of the reality. Conformance Checking is a sub-discipline of Process Mining where a process model is compared with the reality reflected in the log to assess its quality. 10 Process Mining

11. Conformance Checking MODELREALITY PROCESS LOGS 11 How good is the model describing the reality?

12. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 12 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

13. Detect possible conformance anomalies between the model and the reality on the fly, before it is too late. Challenges: Low Computation Time Analysis on the regular basis Localize Deviation and Understand Causes Specially in large models Event-based Not complete case necessary to report a mismatch 13 Event-based Real-time

14. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 14 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

15. Addressing the Challenges Challenges: Fast Event-based Mismatches localization and understanding. Solution: 15 Decomposition + Event-based Heuristical Replay

16. Approach 16

17. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 17 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

18. Benefits of Decomposition in Conformance Decomposition of models has been proven to improve the computation time in conformance checking. Munoz-Gama et al. 2014, van der Aalst 2013, … Meaningful decompositions improve the comprehension of the conformance violations. Munoz-Gama et al. 2013, … 18 Single-Entry Single-Exist (SESE) Decomposition

19. Why SESE? Single-Entry Single-Exit Components Represent subprocesses within the process Intuitive for conformance diagnosis Well-studied problem in the literature, with linear time algorithms. Hopcroft and Tarjan 1973, Polyvyanyy 2012, … 19 ExitEntry

20. SESE Decomposition SESE: set of edges which graph has a Single Entry node and a Single Exit node Refined Process Structure Tree (RPST) containing non overlapping SESEs Unique Modular Linear Time 20

21. Cut on RPST Partitioning over the RPST Any cut is a partitioning Algorithm to partitioning by size (k) Details in Munoz-Gama et al. 2014. 21

22. What are the guarantees? What are the guarantees in conformance? Valid decomposition: only sharing transitions (not places or arcs) van der Aalst 2013 proves that: 22 Theorem: If valid decomposition then no conformance violations are lost in the decomposition process.

23. SESE and Valid Decomposition SESE decomposition may produce not valid decompositions Exit place of one component is the entry place of another. But it can be a valid decomposition if we apply bridging. 23

24. What are the guarantees? Munoz-Gama et al. 2013 proves that: Combine SESEs to obtain more understanding subprocesses 24 Theorem: SESE + bridging is a valid decomposition and therefore, no conformance violations are lost in the decomposition process.

25. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 25 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

26. Event Dispatching 26

27. Event Dispatching Central dispatcher serves each event to its corresponding submodel(s) to be replayed on it. Distributed worker threads, each one in charge of one or more submodels in a concurrently way. 27

28. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 28 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

29. Replay 29

30. Replay vs Alignments 30 GLOBAL ALIGNMENT-BASED CONFORMANCE VS HEURISTIC REPLAY-BASED CONFORMANCE

31. Align-based Conformance Log Model C D E A B B C Alignment E Conformance mismatch on the Log Conformance mismatch on the Model 31 A B C D E A C D D B C E … A B A C C D D A B B C E

32. 32 Replay-based Conformance A A A B A B B A B C A B B C A B Forward replay based on heuristic decisions

33. Align-based Optimal from global point of view High Computational Cost Trace oriented Replay-based Event oriented Low Computational Cost Heuristic and optimality not guaranteed 33 Align vs Replay Conformance

34. Heuristic Event-based Replay Heuristic Event-based replay based on vanden Broucke et al. 2013. For each submodel and each case id the state of the submodel is maintained and evolved. Given a new event we check if it is enabled in the current state. Order: transition mapped to activity, silent transitions, and non-enabled transitions mapped to activity. 34

35. Heuristic Event-based Replay If several candidates, one-step look-ahead. Sufficient to resolve most ambiguities. However, in real-time no knowledge about future events. Three alternatives: Assume determinism Full replay of the trace each time a new event is added, reconsidering decisions. Combination of both: a part of the trace is “frozen”. Decomposition limit the effects of the heuristic decisions. 35

36. Algorithm 36 Details in the paper

37. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 37 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

38. Reporting and Visualization 38

39. Reporting and Visualization Actions while system is running Two types of actions Logging of statistics e.g., be polled regularly by dashboards or persistent data stores Triggers fired once certain criteria is met e.g., error threshold, violation of high-risk task Actions: warnings, halting running services, … 39

40. Proof-of-concept Implementation 40 Monitoring Subprocesses Events Streamed Global View General Statistics

41. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 41 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

42. Bank Transfer: High Level 42

43. Bank Transfer: Petri Net 43

44. Scenario 1: Serial Number Check 44 Pay in cash subprocess requires 3 concurrent checks before to proceed: CASN (external), CBSN (bank), CIBSN (consortium) External check is suddenly skipped (malfunction or attack)

45. Scenario 2: Preliminary Profiling 45 First Receiver Pre-Profiling and then Evaluate Pre-Profiling to take a decision of its risk and requirements. Evaluation before proper finishing of profiling (malfunction or attack)

46. Experimental Comparison 46 Approaches adapted to event-based for comparison Not designed nor optimized for that (e.g., grouping, etc)

47. APPROACH DECOMPOSITION CONFORMANCE CHECKING CONCLUSIONS 47 EVENT-BASED REAL-TIME CONFORMANCE EXAMPLE CASE AND EXPERIMENTS EVENT DISPATCHING REPLAY REPORTING AND VISUALIZATION

48. Conclusions Novel process conformance checking to support real-time monitoring of event- based data. Phases: 1) Decomposition, 2) Event Dispatching, 3) Replay, and 4) Reporting and Visualization. Event-based, Fast, and better comprehension. Future work: Other decompositions and real case studies. 48

49. EVENT-BASED REAL-TIME DECOMPOSED CONFORMANCE ANALYSIS Seppe vanden Broucke, Jorge Munoz-Gama, Josep Carmona, Bart Baesens, and Jan Vanthienen CoopIS 2014