Event Logs Research Articles

A Framework for the Generation of Monitor and Plant Model From Event Logs Using Process Mining for Formal Verification of Event-Driven Systems

A Framework for the Generation of Monitor and Plant Model From Event Logs Using Process Mining for Formal Verification of Event-Driven Systems

Context-aware early warning method for monitoring business flow anomalies in transmission grid construction based on context-awareness

Abstract Based on context-aware theory, this paper proposes an online anomaly detection and warning method for multi-angle transmission grid construction business processes. The business process model for transmission grid construction is constructed using a Petri net, and the data is preprocessed. The context in the business event log is initially refined, and the data in the model training is labeled using the supervised learning method. The sliding window Euclidean distance model is applied to build an anomaly detection model for the transmission grid construction business process, and the data is filtered by mean value aggregation to obtain the threshold value for anomaly monitoring and to realize anomaly detection and warning. This paper’s anomaly detection and early warning model is applied to carry out transmission grid construction business flow optimization practice in the G Power Supply Bureau of Yunnan Province, China. Since the optimization in June, the timeliness and accuracy of material matching of G Power Supply Bureau have been stable at more than 90%, and the execution rate of the operation plan and on-time completion rate of billing have also been maintained at a high level of about 95%. The number of cancellations and adjustments to transmission network construction operations has decreased from 20% to 30% to less than 7%, and the overall satisfaction score of transmission network construction business processes has reached 4.15.

Advancing verification of process mining models with quantitative model checking in stochastic environment

The study of business process analysis and optimization has attracted significant scholarly interest in the recent past, due to its integral role in boosting organizational performance. A specific area of focus within this broader research field is Process Mining (PM). Its purpose is to extract knowledge and insights from event logs maintained by information systems, thereby discovering process models and identify process-related issues. The goal of the current study is to examine how Quantitative Model Checking (QMC) approaches might be applied in the context of PM. Model checking is a well-known verification approach that provides thorough analysis and validation of a system’s properties in comparison to a predetermined model. The adoption of QMC is aimed at improving the accuracy, reliability, and comprehensiveness of PM models in stochastic environment. We propose a novel methodology in this research direction, which integrates QMC with PM by formally modelling discovered and replayed process models and applying QMC methods to verify PM models. The potential of QMC to overcome significant drawbacks of the existing methodologies is the main driver for its use in PM. By including probabilistic model verification, it is possible to take into account the uncertainties and stochastic behaviour that are frequently present in systems that are used in real world; while statistical model checking methods utilized where probabilistic methods fails/not suitable, such as, to handle complex models and/or models with large state-spaces.

Merging Directly-Follows Graphs and Sankey Diagrams for Visualizing Acyclic Processes

This paper proposes a method to visualize models of acyclic processes based on merging Directly-Follows Graphs (DFG) and Sankey diagrams. DFG is a popular graphical model to visualize discrete process models, while Sankey diagrams are used to represent flows of any kind. Our approach, based on flow diagrams, allows us to highlight individual cases or groups of cases in the overall model. The approach is implemented as a web-based tool that allows us, given an event log of an acyclic process, to construct and analyze the process behavior. We illustrate and evaluate the applicability of the proposed approach using learning processes as examples.

Data Preprocessing for Cross-System Analysis: The DaProXSA Approach

The domain of Social Collaboration Analytics (SCA) is gathering momentum due to the increasing importance of Enterprise Collaboration Systems (ECS) that are used to build performant digital workplaces. ECS collect and store large amounts of digital trace data, which reflect the collaborative work of employees. Collaborative work activity is usually supported by multiple systems, which complicates the analysis of the digital traces. The cross-system analysis of collaborative work is challenging because of the nature of the log files that are stored in heterogeneous formats and at different levels of log granularity. These challenges cannot easily be overcome with the help of existing approaches for data preprocessing. In this paper, approaches and frameworks for data mining, data preprocessing and SCA are adapted to design a special method for Social Process Mining (SPM). The DaProXSA approach was developed to obtain interpretable, high-quality event logs of multiple ECS and builds on existing literature as well as on findings from an analysis of leading ECS. DaProXSA contributes to the aim of discovering and interpreting patterns and processes that occur in computer-mediated collaborative work.

Merging Directly-Follows Graphs and Sankey Diagrams for Visualizing Acyclic Processes

This paper proposes a method to visualize models of acyclic processes based on merging Directly-Follows Graphs (DFG) and Sankey diagrams. DFG is a popular graphical model to visualize discrete process models, while Sankey diagrams are used to represent flows of any kind. Our approach, based on flow diagrams, allows us to highlight individual cases or groups of cases in the overall model. The approach is implemented as a web-based tool that allows us, given an event log of an acyclic process, to construct and analyze the process behavior. We illustrate and evaluate the applicability of the proposed approach using learning processes as examples.

WebQuorumChain: A web framework for quorum-based health care model learning

BackgroundInstitutions interested in collaborative machine learning to enhance healthcare may be deterred by privacy concerns. Decentralized federated learning is a privacy-preserving and security-robust tool to promote cross-institutional learning, however, such frameworks require complex setups and advanced technical expertise. Here, we aim to improve their utilization by offering an intuitive, user-friendly, and secure system that integrates both front-end and back-end functionalities. MethodWe develop WebQuorumChain, an integrated system built upon the QuorumChain schema. We test the system on a 2-site network using two publicly available health datasets and measure the average vertical and horizontal-ensemble AUCs per dataset across 30 trials, as well as the average execution time of the system. ResultsOur system achieved consistently high AUCs for each dataset (0.94–0.96), with reasonable total execution times ranging from 5 to 20 min, inclusive of modeling and all other system overheads. The front-end displays event logs generated from back-end layers in real time, in sync with the progress of the underlying algorithm. ConclusionsWe develop a web-based system that supplies users with visual tools to configure the federated learning network, manage training sessions, and inspect the learning process. WebQuorumChain helps schedule and monitor low-level processes without violating the fundamental security promises of cross-institutional decentralized machine learning. The system also maintains predictive accuracy and runtime efficiency in the presence of additional layers. WebQuorumChain will help promote meaningful collaboration among healthcare institutions, who can retain full control of their data privacy while contributing to data-driven discoveries.

Power System Fault Detection and Analysis Using Numerical Relay in Power grid Corporation Limited, Shoolagiri

The faults in a power system may be of various nature and they may affect the stability of the power system by causing outage of the line, there by overloading other connected lines and also causing cascading effect in the system. In order to access the nature of fault and analyze the impact of the same in a power system, fault analysis is required to be carried out as the same will be useful for the system operation and to take quick decisions in securing the system. In this paper we discuss the various types of faults in EHV system that may occur in line or substation. These faults are identified by Numerical relays which use IEDs [Intelligent Electronic Device]. The faults identified includes symmetrical and unsymmetrical faults in power system. Further in this project, we have taken into consideration the theoretical and practical study of the fault analysis through Numerical relays. In case of occurrence of Transient faults, Auto re-closure works with dead time of 1 sec. Current, voltage, Breaker status (open, close) are graphically represented by Disturbance Recorder. Events are recorded by Event logger. The above mentioned project for faults and analysis of faults in line or substation were carried out at Power grid Corporation Limited, 400 / 230kv Sub-Station Shoolagiri.

МЕТОД ТА ЗАСІБ МОНІТОРИНГУ БЕЗПЕКИ В КОМП'ЮТЕРНІЙ МЕРЕЖІ ЗАСОБАМИ SIEM

This work focuses on researching, analyzing, and enhancing methods and tools for security monitoring in computer networks. The study develops security monitoring tools and methods based on SIEM agents, improving the data normalization process from security logs. The research explores SIEM's role in the SIEM-EDR-NDR triad perspective to accelerate responses to network security threats. The investigation is grounded in the experiences of foreign companies and domestic banking networks. The interaction of SIEM-EDR-NDR components, forming a SOC triad, is examined. SIEM is utilized for centralized data analysis, including EDR and NDR, providing a comprehensive security overview. EDR detects and responds to threats on endpoints, complemented by NDR, extending SIEM analysis. This combination ensures effective response to cyberattacks, reducing "dwell time" until detection. The formulation of tasks for EDR components in the SIEM-EDR-NDR triad is discussed. Emphasis is placed on the importance of protecting endpoints at all stages of an attack, and effective strategies, such as traffic analysis, application control, and centralized cybersecurity management, are identified. Integration of EDR with existing security tools to create a comprehensive system is highlighted. Within the SIEM context, data processing stages, from log collection and normalization to event classification and correlation, are illuminated. The role of correlation in incident formation and investigation is underscored. An enhanced normalization scheme with an expanded agent deployment and key data processing stages within the SIEM system is proposed. The work addresses the improvement of event log processing in SIEM for effective network security monitoring and timely threat mitigation. The achieved goal accelerates threat response processes through SIEM agent integration, facilitating the organization and classification of information flows for prompt threat mitigation.

Analysis of adversarial attacks on the machine learning models of cyberprotection systems.

Modern trends in the development of cyber protection systems are associated with the widespread use of machine learning technologies to detect and prevent cyber threats. At the same time, attackers are looking for ways to evade detection by such systems, using both traditional attack methods and new ones aimed exclusively at countering artificial intelligence - adversarial attacks. Therefore, finding ways to counteract adversarial attacks is an urgent scientific and technical task. Adversarial Machine Learning (AML) is used to study them, which consists in simulating such attacks. The purpose of research is to determine ways to increase the resilience of cyber defense systems operating with the use of machine learning technologies to the impact of attacks based on AML models. The article provides examples of the application of machine learning methods in cyber protection systems. The models of adversarial attacks are described, namely: models of evasion, poisoning, functional extraction, inversion, and models of membership inference attack. Possible scenarios of their implementation are considered. Examples of adversarial attacks on machine learning models for recognizing images and text messages, detecting domain name generation algorithms, HTTP traffic malware, malicious content in e-mails, bypassing antivirus software are analyzed. Studies have shown that even without access to the algorithms of machine learning models, it is possible to bypass the cyber protection system. Therefore, to ensure the security of networks and services by means of cyber protection with artificial intelligence, it is necessary to take into account the need to counter adversarial attacks. For this purpose, it is proposed to: collect and aggregate training data for each machine learning model individually, instead of obtaining them from publicly available sources; optimize the content of event logs, taking into account the possibility of using the information contained in them to create adversarial attacks; to ensure the protection of training data and algorithms of the functioning of models; in the case of deploying cyber protection systems on critical infrastructure objects, use specially developed machine learning models that are not publicly available, which will complicate the possibility of creating a functional extraction attack.

Classification and quantification of timestamp data quality issues and its impact on data quality outcome

Abstract Timestamps play a key role in process mining because it determines the chronology of which events occurred and subsequently how they are ordered in process modelling. The timestamp in process mining gives an insight on process performance, conformance, and modelling. This therefore means problems with the timestamp will result in misrepresentations of the mined process. A few articles have been published on the quantification of data quality problems but just one of the articles at the time of this paper is based on the quantification of timestamp quality problems. This article evaluates the quality of timestamps in event log across two axes using eleven quality dimensions and four levels of potential data quality problems. The eleven data quality dimensions were obtained by doing a thorough literature review of more than fifty process mining articles which focus on quality dimensions. This evaluation resulted in twelve data quality quantification metrics and the metrics were applied to the MIMIC-III dataset as an illustration. The outcome of the timestamp quality quantification using the proposed typology enabled the user to appreciate the quality of the event log and thus makes it possible to evaluate the risk of carrying out specific data cleaning measures to improve the process mining outcome.

Lift Engineering Equipment Event Log Data Analysis

This paper is devoted to the collection and analysis of log files of lift engineering equipment, considering their technical complexity and significant impact on the safety of their use. The usage of log analysis can quickly identify and resolve problems, keeping elevators functional, extending service life, and increasing passenger safety. Using a log file of a real IoT monitoring system, the study provides baseline statistics, revealing information about event distribution and hardware status. The analysis focuses on the "Elevator Power On/Off" event type, focusing on the average time for the equipment to transition from an emergency state to a normal state, as well as calculating the probability of remaining in an operating state for 1, 12, or 24 hours. The results highlight the different transition times between the equipment under consideration, providing valuable information for maintenance planning and resource optimization

Application of Process Mining in the Process of IT Incidents Management by Utilizing Kaggle’s Dataset

The application of process mining in Information Technology (IT) incident management has been carried out. In the face of the increasing complexity of IT systems and a surge of incidents, traditional incident management is no longer effective. This study uses Kaggle's dataset on IT incident management to analyze event logs, identify process bottlenecks, and compare process flows seen in event logs with expected flows. Process mining techniques, such as process discovery and conformance, are applied using PM4PY and Celonis tools. The analysis results with process mining produce a new model process that can be applied in practice with a conformance rate of 81%.

Simulation and process mining in a cross-docking system: a case study

The increasing development of the competitive market has forced organisations to make great efforts in the processes of supply, production, and distribution to meet customer demand in the shortest time and at the lowest cost. A cross-docking (CD) system is one of the successful and practical strategies in this field considered by researchers in various fields. Also, business process management plays a key role in continuous improvement and increased productivity. In today’s digital age, due to the ability to record all activities, process mining is an important method to identify the current situation and improve productivity. In this research, a newly established CD belonging to a chain store is studied to improve the current situation, in which different goods enter and then exit after different processes. The purpose of this study is to obtain the optimal number of doors and loaders as sources. First, helping an RFID system, all activities are recorded, and the current situation of the processes is monitored, and then, the real process model is identified using heuristic and inductive miner algorithms. After adapting to the event log by using the simulation process in Arena software, different scenarios are examined, and the best possible case is presented.

Validation set sampling strategies for predictive process monitoring

Previous studies investigating the efficacy of long short-term memory (LSTM) recurrent neural networks in predictive process monitoring and their ability to capture the underlying process structure have raised concerns about their limited ability to generalize to unseen behavior. Event logs often fail to capture the full spectrum of behavior permitted by the underlying processes. To overcome these challenges, this study introduces innovative validation set sampling strategies based on control-flow variant-based resampling. These strategies have undergone extensive evaluation to assess their impact on hyperparameter selection and early stopping, resulting in notable enhancements to the generalization capabilities of trained LSTM models. In addition, this study expands the experimental framework to enable accurate interpretation of underlying process models and provide valuable insights. By conducting experiments with event logs representing process models of varying complexities, this research elucidates the effectiveness of the proposed validation strategies. Furthermore, the extended framework facilitates investigations into the influence of event log completeness on the learning quality of predictive process models. The novel validation set sampling strategies proposed in this study facilitate the development of more effective and reliable predictive process models, ultimately bolstering generalization capabilities and improving the understanding of underlying process dynamics.

Alarm correlation analysis with applications to industrial alarm management

Alarm systems are essential for the safe and efficient operation of process industries. However, complex plant connectivity and process interactions could cause many correlated alarms in practice and thus compromise alarm system performance. To address correlated alarms, it is desired that alarm correlations are discovered from historical Alarm and Event (A&E) logs, so the obtained results could help improve alarm configurations or design suppression strategies. Motivated by this problem, a systematic method to extract alarm correlation is proposed in this work and the contributions are: (1) Correlated alarms and their occurrence orders are captured as correlation patterns through pattern mining, and such patterns are characterized by statistical features. (2) Alarm correlations and their statistical features are visualized as network graphs to indicate process interactions and identify alarms for prioritized analysis. To demonstrate the effectiveness of the proposed method, case studies are provided using an industrial simulation benchmark Vinyl Acetate Monomer (VAM) plant model.

Integrated detection and localization of concept drifts in process mining with batch and stream trace clustering support

Process mining can help organizations by extracting knowledge from event logs. However, process mining techniques often assume business processes are stationary, while actual business processes are constantly subject to change because of the complexity of organizations and their external environment. Thus, addressing process changes over time – known as concept drifts – allows for a better understanding of process behavior and can provide a competitive edge for organizations, especially in an online data stream scenario. Current approaches to handling process concept drift focus primarily on detecting and locating concept drifts, often through an integrated, albeit offline, approach. However, part of these integrated approaches rely on complex data structures related to tree-based process models, usually discovered through algorithms whose results are influenced by specific heuristic rules. Moreover, most of the proposed approaches have not been tested on public true concept drift-labeled event logs commonly used as benchmark, making comparative analysis difficult. In this article, we propose an online approach to detect and localize concept drifts in an integrated way using batch and stream trace clustering support. In our approach, cluster models provide input information for both concept drift detection and localization methods. Each cluster abstracts a behavior profile underlying the process and reveals descriptive information about the discovered concept drifts. Experiments with benchmark synthetic event logs with different control-flow changes, as well as with real-world event logs, showed that our approach, when relying on the same clustering model, is competitive in relation to baselines concept drift detection method. In addition, the experiment showed our approach is able to correctly locate the concept drifts detected and allows the analysis of such concept drifts through different process behavior profiles.

Blockchain Based Wireless Sensor Networks for Detecting Nodes

Abstract The versatility of Wireless Sensor Networks (WSNs) and other unique qualities inspired by real-time collaboration between the sensor nodes make them widely used for a range of applications in monitoring and surveillance. As solutions for malicious node identification involve a single, centralized decision-making process, security in WSNs is becoming more and more important. Errors are difficult to prevent with this paradigm, and repeatability and traceability are problems. Therefore, the detecting ability and integrity of the developed detection method cannot be guaranteed by malicious node identification technology in ordinary WSNs. This article provides insights into this innovative idea as well as a thorough investigation of the use of blockchain technology to WSNs (Blockchain-Based WSN), including a full analysis of a blockchain-based method for identifying rogue nodes. The Blockchain-Based WSN architecture, business-specific applications, and use are all included in this study. The Blockchain-Based WSN architecture model for tracking malicious nodes and the smart contract features of malicious node detection is both included in the explanation of harmful node identification based on Blockchain-Based WSN in this paper. The second part of this study investigates the use of blockchain technology to the management of WSN data, which necessitates online information aggregation and may also require auditing, event logging, and storage for information analysis and offline query processing. The traditional WSN data management approaches are discussed first in this study, followed by the blockchain-based WSN data management choices. The benefaction of blockchain to WSN security management is also included in this survey. Before discussing blockchain-based WSN security management solutions, such as those that provide access control, protect data integrity, ensure anonymity, and prolong the life of WSN nodes, it first looks at the security vulnerabilities of centralized WSN models.

Examining change in students’ self-regulated learning patterns after a formative assessment using process mining techniques

The growing popularity of e-learning platforms, such as learning management systems, has foregrounded the role of self-regulated learning (SRL) in student success. In many e-learning environments, students typically complete learning assignments outside of school hours with little or no instructor support, which requires students to be highly self-regulated. The current study used trace data from a Moodle platform to examine both the temporal pattern of students' SRL behaviors and changes in high- and low-performing students' SRL behaviors following a formative in-course exam. This study employed repeated-measures ANOVA, multivariate ANOVA, Fuzzy miner, and pMineR on 122,167 event logs from 527 undergraduate students. Findings revealed that students engaged in a loosely sequenced recursive SRL cycle. Following the formative assessment, each group made different adjustments to their SRL processes. High-performing students exhibited more SRL behaviors and developed more structured and interconnected SRL patterns. Low-performing students displayed a smaller increase in SRL behaviors while maintaining their established SRL patterns. Findings from this study could provide a more in-depth theoretical understanding of the nature of SRL cycles. Furthermore, students’ adjustment of SRL patterns in response to assessment may be informative for practitioners to assist students in enhancing their SRL through formative feedback.

Monitoring Patient Reported Outcomes in PNH: Interim Results of a Market Research with florio ® PNH

Background: Patients withparoxysmal nocturnal hemoglobinuria (PNH), an ultra-rare, acquired disorder, report various cardiovascular, gastrointestinal, neurological or hematological symptoms that can severely impact their physical functioning and health-related quality of life. Patients may require long term treatment with anti-complement therapies to alleviate PNH symptoms or complications. Whilst blood biomarkers can aid the monitoring of disease progression, patient reported outcomes (PRO) and related symptoms are also of value in assessing response to therapy, but they are not always continuously tracked by patients. Hence florio PNH, a software medical device (smartphone app), was designed to allow easy monitoring of PRO and tracking of medication by patients. It allows documentation of therapy and common symptoms as well as hemoglobin and LDH levels. florio PNH can send treatment reminders and compiles the entered data into a patient report. Patients were invited to participate in market research of florio PNH to better understand monitoring habits and expectations towards an app in this area. Methods: Twenty patients were invited to participate in market research sponsored by Florio GmbH. The participants came from the UK PNH service centre in Leeds and were selected by the coordinating clinical team at routine clinic visits. The research was submitted for ethics approval and written informed consent was provided. The market research consisted of a one hour entry interview assessing current behavior and expectations towards monitoring of outcomes, followed by an eight-week period of field-testing florio PNH app. The subsequent one hour exit interview explored the user experience with the app, and which app features were seen of value, of less value or were missing. A total of 20 patients are to be enrolled in the research, of which 17 had completed the initial interview at the time of this report. Results: The majority of participants were 50 years of age or older (59%) and described themselves as “not tech savvy”. Six participants rated the impact of PNH on their life as significant, 6 as somewhat and 5 as little to none. Fatigue was named by 10 patients unprompted as the prominent symptom affecting their social and work life. Before the research, three participants neither tracked symptoms nor reported medication, five tracked both, seven only tracked their anti-complement infusions and two only major events when they happened. Forty seven percent of participants (8 of 17) did not prepare information at all for clinical consultations in advance, as they either experienced few events or relied on their memory. All users managed to install the app, set up their account and log events without problem. The app was described as easy to use, straightforward and participants appreciated that all data was in one location and possible to summarize into a report. Sixteen (94%) patients said that they believe the app will help them track events and that they would be enthused to use it in the future. Conclusions: Monitoring applications are employed in several rare bleeding disorders and have been shown to be valuable assets for collecting patient reported outcomes, especially in the outpatient setting. Participants of this research had no experience with using disease specific apps for collecting outcomes, and usually rely on the calendar functions provided by their smartphones or paper diaries. 94% concluded that the app will help them organize their PNH data, share data with their treating clinical team, better plan their future activities and be reminded when the next treatments are due.