Process Mining:
Discovery and Analysis of process-aware environments using
event logs
Eindhoven University of TechnologyDepartment of Computer ScienceP.O. Box 513, 5600 MB EindhovenThe Netherlandswww.processmining.org
http://www.processmining.org
Process Mining
Control flow perspective:- What is the average flow time of orders?- What is the procedure followed for orders above 10k?
Case perspective:- Was invoice 1203 paid on time?- What is the difference in the execution flow between regular and rush orders?
Organizational perspective:- Does the employee address match the vendor’s address?- Which people -not in the same organizational unit- appear to be working together closely?
information system
(process)model
eventlogs
modelsanalyzes
discovery
records events, e.g., messages,
transactions, etc.
specifies configures implements
analyzes
supports/controls
conformance
“world”
people machines
organizationscomponents
business processes
http://www.processmining.org
Event Logs
An event log contains information about specific events executed for
specific process instances (cases, event-lists, audit trails). We do not
assume any knowledge of the underlying process.
http://www.processmining.org
1) basic performance metrics
2) Control flow discoveryStart
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
3) organizational model 4) social network
5) performance characteristics
If …then …
6) auditing/security
Overview
1) Basic Performance Metrics
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
If …then …
http://www.processmining.org
The concepts
Process/control-flow perspective: flow-, waiting-, processing- and sync-times.Questions:
What is the average flow time of orders?
What percentage of requests is handled within 10 days?
What is the average time between scheduling an activity and starting
it?
Resource perspective: frequencies, time, utilization, and variability.Questions:
How many times did John withdraw activity go shopping?
How many times did Clare suspend some running activity?
How much time did people with role Manager work on this process?
What is the average utilization of people with role Manager?
http://www.processmining.org
External tools
2) Control flow rediscovery
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
If …then …
http://www.processmining.org
The concepts
Try to discover a process model using nothing
but the events in an event-log.
An event log contains information about specific events executed for
specific process instances (cases, event-lists, audit trails).
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
http://www.processmining.org
Example
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Verleng kortingen
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Verleng kortingen
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1245
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 6534
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Stuur beëind. brief
14-01-200614-04-200615-04-200715-04-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Beëindig controle
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
Controlenummer: 1289
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Verleng kortingen
14-01-200514-02-200515-02-200515-02-2005
12:0209:0010:00 11:15
KeesJanKarelKarel
Controlenummer: 1234
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Stuur beëind. brief
13-01-2005 17-01-200517-01-2005
12:0209:00 09:15
PeterKarelKarel
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
Controlenummer: 1334
Activiteit Datum TijdUitvoering
Stuur aanvraag Controleer ontvangst Ontvang antwoord Verleng kortingen
14-01-200614-02-200615-02-200715-02-2007
12:0209:0010:00 11:15
MarieMarieWillemWillem
http://www.processmining.org
Result
Start controle kortingsrecht
Stuur vraag werkgever
Beëindig controle
Stuur beëindigings-
brief
Wacht op antwoord
Controlebeëindigd OF OF
Controleer ontvangstwerkgever
OF Ontvang antwoord
Positief antwoordwerkgever
Negatief antwoord werkgever
OF
OFGeen
antwoord ontvangen
Controlenummer: 1330
Activiteit Datum TijdUitvoering
Stuur aanvraag Ontvang antwoord Beëindig controle
14-01-2005 15-01-200516-01-2005
12:0210:00 11:15
MarieWillemWillem
3) Organizational model
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
If …then …
http://www.processmining.org
Case Study
Dutch national works department (1000 workers)
Responsible for construction and maintenance of infrastructure in
province.
Process: Processing of invoices from the various subcontractors and
suppliers
Log: 5000 cases and 33.000 events.
Focus on 43 key players
http://www.processmining.org
The Concepts
Discover the organizational model (i.e., roles, departments,etc.) without
prior knowledge about the structure of the organization.
4) Social network
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
If …then …
http://www.processmining.org
Social Network: joint activities
http://www.processmining.org
Social Network: hand-over of work between groups
http://www.processmining.org
Relating tasks and performers (using correspondence analysis)
5) Performance Characteristics
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
If …then …
http://www.processmining.org
The concepts
Performance characteristics can often be formulated as “if… then…”
statements.
If the “check amount” activity is delayed in the start of the process, then
“pay customer” will be delayed at the end of the process.
Strongly related is the work on “case prediction”. However, this concerns
real-time behaviour.
http://www.processmining.org
Recommendations
John: “Hmm, 897880 is a difficult insurance claim, I will ask my supervisor what to do.”
Clair: “I am busy, ask Bob.”
Bob: “This too complex for me to handle, let’s call Mary.”
Mary: “I cannot find the claim in the system, just give me a minute.”
Mary: “I see, I have seen such a claim before and we should just send a rejection letter, because form 230a has not been filled out completely.”
John: “Thanks, I didn’t see that, since we rarely need form 230a.”
http://www.processmining.org
External tools
Eudaptics Viscovery®
Eudaptics Viscovery is the visual analysis
platform for customer data which allows IT,
business intelligence and marketing people to
carry out CBM projects in an integrated and
business-oriented workflow – from
preprocessing and behavior modeling via the
definition of marketing actions up to the
checking of results.
http://www.eudaptics.de/
SPSS ®
Is your organization a Predictive Enterprise? A
Predictive Enterprise incorporates predictive
analytics into its daily operations to improve
business processes. By directing, optimizing,
and automating decisions, a Predictive
Enterprise meets its defined business goals
and gains a measurable competitive
advantage. SPSS predictive analytics gives
you consistent control over daily decisions
made within your organization.
www.spss.com
6) Auditing / Security
Start
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
If …then …
http://www.processmining.org
The concepts
Detecting process instances that do not fit some given process model,
i.e. Checking Process Conformance.
Determining how well a process model fits a log (over-fitting / under-
fitting).
Checking auditing principles such as the “four eyes principle”: Two tasks
A and B within one case should never be performed by the same user.
http://www.processmining.org
Example
Example of an instance:
Enter, Select Product, Add to Basket, Proceed to Checkout, Fill in Delivery Info, Fill in Payment Info, Process Order, Finish Checkout
http://www.processmining.org
ProM framework
The ProM Framework is:
1) a pluggable proof of concept tooling framework for fast
implementation of process mining techniques,
2) a toolkit for the, information system independent, analysis of
processes,
3) open source,
4) used by researchers all over the world, resulting in 230 plugins so-far,
5) Downloadable from: www.processmining.org
http://www.processmining.org
1) basic performance metrics
2) Control flow discoveryStart
Register order
Prepareshipment
Ship goods
(Re)send bill
Receive paymentContact
customer
Archive order
End
3) organizational model 4) social network
5) performance characteristics
If …then …
6) auditing/security
Added value of Process Mining
http://www.processmining.org
Conclusion
Process mining provides many interesting challenges for scientists, customers, users, managers, consultants, and tool developers.
In the short term, established process mining techniques such as LTL-checking, are extremely useful for integration in a production environment.
Process mining techniques add value to the complex web of information systems and monitoring tools by:
1) Integrating techniques in one state-of-the-art platform ProM,
2) Combining results of different techniques from different perspectives to gain insights into complex operational procedures,
3) Allowing for interaction between tools otherwise providing static results.