Process Mining: Discovery and Analysis of process-aware environments using event logs Eindhoven University of Technology Department of Computer Science P.O. Box 513, 5600 MB Eindhoven The Netherlands

Process Mining Control flow perspective: - What is the average flow time of orders? - What is the procedure followed for orders above 10k? Case perspective: - Was invoice 1203 paid on time? - What is the difference in the execution flow between regular and rush orders? Organizational perspective: - Does the employee address match the vendor’s address? - Which people -not in the same organizational unit- appear to be working together closely?

Event Logs An event log contains information about specific events executed for specific process instances (cases, event-lists, audit trails). We do not assume any knowledge of the underlying process.

1) basic performance metrics 2) Control flow discovery3) organizational model4) social network 5) performance characteristics If …then … 6) auditing/security Overview

1) Basic Performance Metrics If …then …

The concepts Process/control-flow perspective: flow-, waiting-, processing- and sync-times. Questions: What is the average flow time of orders? What percentage of requests is handled within 10 days? What is the average time between scheduling an activity and starting it? Resource perspective: frequencies, time, utilization, and variability. Questions: How many times did John withdraw activity go shopping? How many times did Clare suspend some running activity? How much time did people with role Manager work on this process? What is the average utilization of people with role Manager?

External tools

2) Control flow rediscovery If …then …

The concepts Try to discover a process model using nothing but the events in an event-log. An event log contains information about specific events executed for specific process instances (cases, event-lists, audit trails).

Example Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Verleng kortingen :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Verleng kortingen :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1245 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 6534 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Stuur beëind. brief :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle :02 09:00 10:00 11:15 Marie Willem Controlenummer: 1289 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Verleng kortingen :02 09:00 10:00 11:15 Kees Jan Karel Controlenummer: 1234 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Stuur beëind. brief :02 09:00 09:15 Peter Karel Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem Controlenummer: 1334 ActiviteitDatumTijdUitvoering Stuur aanvraag Controleer ontvangst Ontvang antwoord Verleng kortingen :02 09:00 10:00 11:15 Marie Willem

Result Controlenummer: 1330 ActiviteitDatumTijdUitvoering Stuur aanvraag Ontvang antwoord Beëindig controle :02 10:00 11:15 Marie Willem

3) Organizational model If …then …

Case Study Dutch national works department (1000 workers) Responsible for construction and maintenance of infrastructure in province. Process: Processing of invoices from the various subcontractors and suppliers Log: 5000 cases and events. Focus on 43 key players

The Concepts Discover the organizational model (i.e., roles, departments,etc.) without prior knowledge about the structure of the organization.

4) Social network If …then …

Social Network: joint activities

Social Network: hand-over of work between groups

Relating tasks and performers (using correspondence analysis)

5) Performance Characteristics If …then …

The concepts Performance characteristics can often be formulated as “if… then…” statements. If the “check amount” activity is delayed in the start of the process, then “pay customer” will be delayed at the end of the process. Strongly related is the work on “case prediction”. However, this concerns real-time behaviour.

Recommendations John: “Hmm, is a difficult insurance claim, I will ask my supervisor what to do.” Clair: “I am busy, ask Bob.” Bob: “This too complex for me to handle, let’s call Mary.” Mary: “I cannot find the claim in the system, just give me a minute.” Mary: “I see, I have seen such a claim before and we should just send a rejection letter, because form 230a has not been filled out completely.” John:“Thanks, I didn’t see that, since we rarely need form 230a.”

External tools Eudaptics Viscovery® Eudaptics Viscovery is the visual analysis platform for customer data which allows IT, business intelligence and marketing people to carry out CBM projects in an integrated and business-oriented workflow – from preprocessing and behavior modeling via the definition of marketing actions up to the checking of results. SPSS ® Is your organization a Predictive Enterprise? A Predictive Enterprise incorporates predictive analytics into its daily operations to improve business processes. By directing, optimizing, and automating decisions, a Predictive Enterprise meets its defined business goals and gains a measurable competitive advantage. SPSS predictive analytics gives you consistent control over daily decisions made within your organization.

6) Auditing / Security If …then …

The concepts Detecting process instances that do not fit some given process model, i.e. Checking Process Conformance. Determining how well a process model fits a log (over-fitting / under-fitting). Checking auditing principles such as the “four eyes principle”: Two tasks A and B within one case should never be performed by the same user.

Example Example of an instance: Enter, Select Product, Add to Basket, Proceed to Checkout, Fill in Delivery Info, Fill in Payment Info, Process Order, Finish Checkout 

ProM framework The ProM Framework is: 1)a pluggable proof of concept tooling framework for fast implementation of process mining techniques, 2)a toolkit for the, information system independent, analysis of processes, 3)open source, 4)used by researchers all over the world, resulting in 230 plugins so-far, 5)Downloadable from:

1) basic performance metrics 2) Control flow discovery3) organizational model4) social network 5) performance characteristics If …then … 6) auditing/security Added value of Process Mining

Conclusion Process mining provides many interesting challenges for scientists, customers, users, managers, consultants, and tool developers. In the short term, established process mining techniques such as LTL-checking, are extremely useful for integration in a production environment. Process mining techniques add value to the complex web of information systems and monitoring tools by: 1)Integrating techniques in one state-of-the-art platform ProM, 2)Combining results of different techniques from different perspectives to gain insights into complex operational procedures, 3)Allowing for interaction between tools otherwise providing static results.